OtoDock

Added

• Agent Skills. Skills now follow the industry-standard Agent Skills format
  (SKILL.md, agentskills.io) and load two ways: always (inlined into the
  system prompt) or on_demand (loaded only when a task matches — most skills
  moved there, slimming every system prompt). Standalone skill packages install
  from the new community-skills catalog — seeded with curated Anthropic and
  OpenAI skills — with the same admin approval flow as MCPs, managed from a new
  Skills tab in Agent Settings and a Skills page in admin settings. Docker
  installs gain a named volume (otodock-skills), created automatically by
  docker compose up.
• Real equations in documents. Agents write LaTeX math into Word (native,
  Word-editable), PDF (vector-rendered), PowerPoint and Excel (high-resolution
  images that persist across later edits), and read it back out as LaTeX.
  sympy now ships in the baseline agent toolchain — existing hosts pick it up
  on the next installer run or image rebuild.
• Previous-version document previews. When an agent delivers a new version
  of a document it already previewed, the old preview stays on screen as a
  view-only "previous version" you can scroll back to and compare; only the
  newest preview is editable, and a file keeps at most two full previews.

Changed

• Spreadsheet reads return a coordinate-labeled grid and every write reports
  back the cells it touched — fixing a class of answers-one-column-off errors.
  Fresh formulas show as formulas, and malformed operations are reported
  instead of silently skipped.
• Skill context exclusions now actually apply: scheduled tasks and phone calls
  no longer load skills whose manifest excludes those contexts.
• Repeated reads of the same remote-machine file are now instant: the platform
  first asks the machine whether the file changed (satellite 0.5.95 —
  connected machines self-update) and serves its cached copy when it hasn't.
  Any doubt still transfers the full file.

Fixed

• A connected account revoked at the vendor no longer retries its token
  refresh every minute forever — refreshes back off, and a definitively
  revoked account waits until you reconnect it.
• Document preview: now works on bare-metal installs served over plain HTTP or
  a non-default port ("refused to connect"), survives Collabora stalling on
  heavy spreadsheets, keeps an idle document loaded for 2 hours (was 1), and a
  view-only viewer can no longer place an editing lock that blocked other
  users' saves.
• The shared local browser no longer opens by itself: the window now appears
  only when an agent actually runs a browser action, and stays closed once you
  close it.
• Interactive terminal: content no longer goes missing after sitting idle, no
  keypress is needed to revive scrolling, switching chats no longer leaks a
  GPU context, and a prompt sent while the terminal was still starting is
  delivered once it's ready instead of silently dropped.
• Task runs opened from the sidebar now show the run's real model and
  permission posture instead of the viewer's own selections — and a task's
  "Don't Ask" mode no longer leaks into the next new chat you open.
• A scheduled task whose agent left a background command running forever no
  longer loops endlessly re-reviewing it — the task waits a bounded time and
  completes, noting anything still running.
• Remote machines: a newly created, deleted, or catalog-installed agent shows
  up in Remote Machines without a page reload; uploads to remote agents no
  longer stall for the length of the transfer (the copy continues in the
  background and a prompt referencing the file waits for it to land); and
  document reads over slow connections get the platform's full 150 s transfer
  window instead of failing at 5 s.
• Community MCP containers self-heal after the install's identity changes
  (stale container names are re-stamped and the start retried); containers
  from a different OtoDock install are named in a boot warning, never
  touched.
• Silent failures now fail loud at boot: one ERROR names the cause and fix
  when stored credentials can no longer be decrypted (changed JWT_SECRET /
  config.env), another lists the exact columns when the database schema is
  missing ones the code expects.
• Docker installs on Ubuntu 24.04+ no longer fail at boot with a namespace
  error. OtoDock ships a scoped AppArmor profile (otodock_userns) that
  grants the needed capability to the OtoDock container only — instead of the
  widely-circulated workaround that disables that kernel hardening
  system-wide. scripts/compose.sh installs it automatically (one-time sudo);
  pull-only installs run scripts/setup-apparmor-userns.sh once and set
  OTODOCK_APPARMOR_PROFILE=otodock_userns in .env.