Changelog

Every release, straight from the source. New features, fixes, and improvements — versioned and dated. View on GitHub.

v0.13.14

Latest

Fixed

  • Sandboxes cannot outlive their work. A session turn now has an absolute ceiling as well as a renewable one. Renewal asks whether a turn is still running, and a wedged turn answers "yes" forever, so a turn record past the ceiling is now settled instead of being renewed indefinitely and its sandbox is reclaimed. This one cause sat behind several classes of server error.
  • Fewer server errors when the database is busy. Connection-class and contention failures are now recognised as the temporary conditions they are and retried, instead of being reported as server faults.
  • Errors say what actually went wrong. A failure now carries its real cause rather than the message of whatever wrapped it, and how serious it is follows that cause. Ordinary customer state no longer looks like a platform failure, so real failures stop being buried.
  • A large unused database index is gone, removing its write cost from every audit record. It was 8.6 GB and had served no read in two and a half months.
  • One subscription dialog, in the right place. The upgrade dialog now renders above the deepest panel that opened it, so its controls stay reachable and screen readers can see it. Escape closes it and leaves account settings open.
  • Ordered lists size their gutter to the widest marker, so long lists no longer clip their numbers.
  • Desktop: the Back control sits correctly on sign-in screens.

New

  • Desktop asks which Kortix instance to use on first launch.

Internal

  • The test harness no longer loses a whole browser shard when a dev-server cache restore fails, and a finished test run now exits instead of hanging when something leaves a connection open. Both had turned passing runs into failed ones.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.13...v0.13.14

Release on GitHub →

v0.13.13

Fixed

  • Billing opens one subscription dialog from the account hub. Its controls remain accessible, and Escape closes the subscription dialog while keeping account settings open.
  • Session Git pushes honor explicit ref grants within the effective IAM role. Manager-authorized sessions can update shared branches; agent grants cannot elevate a member to manager ref authority.
  • Connectors keep working after a bad manifest read. A session no longer loses every connector when one read of kortix.yaml answers wrong. Each grant now records the manifest revision it came from; a grant read from the same revision or an older commit never replaces it, and an unreadable manifest keeps the last known grant. The channel that started a session (Slack, Teams, email) stays callable under any grant, so the agent can always report in its own thread.
  • Connector denials say why. connector_not_assigned now names the agent, its granted list, the manifest revision, and what to change. A declared connector with no credential answers connector_not_connected and lists as needs_auth. Composio connectors no longer show needs_auth while they are connected.
  • Slack progress is never silently dropped. slack step and slack send fail with a reason when a checkpoint or an answer does not reach the thread, instead of reporting success. A replayed idle event no longer closes a turn that just started. Button clicks carry the full turn instructions and never vanish without a trace.
  • Sessions: the waiting row and the Stop button stay accurate while a prompt is in flight.
  • Triggers: the manager override for reuse-mode prompt delivery works again.
  • Web: auth tokens are preserved during hydration and fenced before cross-user adoption, and project access waits for auth, so cold loads no longer show "This project didn't load".
  • Web: 18 toasts no longer render their own translation key; the template OG image route runs on Node and stops bundling every translation.
  • Desktop: navigation layout restored, with parity checks in the package gate.

Improved

  • Self-host operators can set KORTIX_FRONTEND_MEMORY_LIMIT to give the frontend more memory. The setting persists through CLI updates and affects only the frontend.
  • Account hub as a modal. Organization settings, members, groups, roles, identity, billing, and audit open over the page you are on instead of a separate route tree. The /accounts routes are gone; links resolve to ?accountId= on the current page, and Back, reload, and pasted links keep working.
  • Signing in paints one brand mark across the whole path to the project instead of four different loading frames.
  • Command palette: file search is offered only where it can run; the Open URL row and the Jump to message page are removed; the empty state no longer names a row that is not there.

Internal

  • Release fixtures follow the current connector tab and use a normal cancellation request. Test artifacts mask diagnostic credentials and upload only after the secret guard passes.
  • End-to-end flow GH-17 verifies member branch isolation and owner ref authority through real Git HTTP.
  • New end-to-end flow (CONN-27) covers session grant provenance, the channel guarantee, and honest denials, with preview harness support. Browser specs follow the account hub to its new URLs; spec 23 ignores CORS preflights.
  • Connector authorization tests mint credentials through the token API and close database connections after each run.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.12...v0.13.13

Read the full release on GitHub →

v0.13.12

New

  • Every supported language now has complete translations across settings, onboarding, project home and sidebar, sessions, password recovery, sign-in, and workspace administration. Serbian is a new locale. 241 entries that rendered as placeholders now show real text.
  • Headless auth: multi-factor enrolment, enterprise SSO, and profile updates are available through the API and the SDK (PATCH /v1/auth/user, KortixSession.subscribe as the replacement for onAuthStateChange).
  • Kortix Apps: one identity guard for every App (createKortixAppGuard, groups always populated), and an embedded App can complete its own sign-in (cookieSameSite).
  • Session brief: hover a session to see its summary.

Improved

  • Connector catalogue: one-letter searches work, cache entries are compared by identity, and panel padding and search were corrected.
  • Markdown code blocks inside lists are inset correctly.
  • Slack and Teams: a live run keeps its thread after 15 quiet minutes.
  • Triggers: a billing-rejected fire is terminal and keeps its reason code; a reuse, keyed, or pinned delivery handoff is recorded as fired.

Fixed

  • Project creation: a failure while creating the managed repository is now logged with its cause. The edge router in front of the API is deployed with every release, so an origin error is never shown as a maintenance page. The managed-git token is verified by creating and deleting a probe repository before it is stored, and the status endpoint reports which credential is in use.
  • Connector endpoints must be https on a public host. An invalid endpoint answers 400 instead of failing as a server error.
  • Session attachments are reliable again.
  • Kortix Apps: the App guard's trailing-slash handling could take seconds on one config string; the viewer secret is resolved per request; the access picker no longer promises options the code does not offer.
  • MFA unenrol route typechecks (gotrue() accepts DELETE).

Internal

  • Template preview images (/api/og/template) render on the Node runtime with their strings inlined; as an Edge Function the route had grown past Vercel's size limit.
  • Preview environments: Node repaired in persistent sandboxes, failed Platinum templates recover, an explicit Daytona fallback, all runtime secrets forwarded, Node engine floor raised, translations kept out of the edge middleware bundle.
  • Release gate: follows the deployed test contracts, installs with engine-strict relaxed, verifies the host-only access cookie.
  • Route manifest and audit route registry regenerated; the headless auth routes are registered and allowlisted with reasons.
  • pi-js-router: open_access is the operator's override and the workflow honours it.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.11...v0.13.12

Release on GitHub →

v0.13.11

Billing

  • No account runs on an empty wallet. Paid per-seat and credit-plan accounts used to keep spending past $0 with no floor; one six-seat account settled $588.81 against a $150 monthly grant with the wallet at $0.00. Every account now stops at the same floor before new work starts.
  • Work that already ran is always recorded. A settlement that the wallet could not cover used to be refused, which deleted the record of the spend and left "Spent this period" frozen while compute kept running. The ledger now records the overdraft, and the account stays blocked until it is topped up.
  • Wallet alerts agree with the server. Every wallet alert and billing string in the app now reads the account's billing state, so the sidebar and the project page no longer disagree about whether you are out of credits.
  • Credits have their own tab in account settings, with the available balance and where it comes from. Plan keeps its own card.

Git and access

  • Push authority is scoped to who is pushing. A session credential can push only to its own branch. Pushing other refs and deleting refs are two new permissions, project.gitops.ref.any and project.gitops.ref.delete, held by the project manager role and grantable to agents from the agent editor, the CLI scope validator and the docs. Before this, any credential that could push at all could rewrite or delete any branch.
  • Deleting a branch checks the person's role, so a plain push right no longer deletes a colleague's branch.
  • GitHub reconnect is named, not failed. When a stored GitHub App installation stops minting tokens, the app tells you to reconnect instead of throwing an opaque error.
  • A project always has a manifest. Provisioning through the API seeds kortix.yaml by default, and kortix ship refuses to push a project that has none.
  • Signed-in identity is your own. The app no longer shows an account owner's email as the signed-in identity, and account lookups stay inside the account you are in.

Customize, agents and settings

  • Customize is built around the agent. Agents lead the Customize bar, and each agent is a full-page editor with a topic rail: People, Access pages for Skills, Connectors, Secrets and Project actions that reuse the catalog cards and modals, grant editing in place, and a Share button showing who has the agent.
  • Capability tabs live under /customize/<tab>. Old URLs redirect. Review is its own tab on the bar. The per-project config page is retired; its sections live in the settings overlay.
  • Settings is a full-screen shell with Workspace, Personal and Account groups. Security, Appearance, Notifications and Plan are separate tabs. Personal settings are called Preferences, the account Tokens tab is called API keys, and Mod+, opens the panel.
  • Review center is a full-width inbox with an inline review page, no modals.
  • A change request is a card in the turn that produced it, with a status that updates and a URL to share.
  • Admin console rebuilt on the app shell and the design system.
  • Project home and account hub extracted and tidied: hero column centred, composer band on the base surface, the workspace name throws confetti for every project and the icon only when you choose one.
  • Smaller fixes: sidebar active row paints again, info and warning banners are legible, managed repositories no longer read as unmanaged, triggers open in place, the Git repository section is its own settings section, and connector proposals get an <app>-<random> slug.

Docs and support

  • Docs moved to Blume. /docs is rebuilt on a new docs engine with a working favicon, a canonical origin, and no stray files in the published site. The credits guide lives at /docs/credits.
  • One support hub. /help merged into /support: contact channels, guides, FAQ, account deletion and legal in one place.

Sessions and runtime

  • Stop stays visible while a response streams, and the session reports busy for the whole turn.
  • Queued prompts keep their order and sync after a turn completes. Prompts sent during a live turn are forwarded instead of waiting.
  • Turn failures show the real message instead of a raw JSON body.
  • File tool rows use the right tense (wrote, edited, listed) instead of the tool's registry name.
  • The terminal no longer reconnects every 60 seconds. The PTY connection between the API and the sandbox was cut after a minute of silence; both legs are now kept alive.
  • Connecting a provider refreshes the model picker without a page reload.
  • Older sandboxes catch up. Boxes provisioned before the self-updating runtime receive the current daemon, OpenCode and CLI from the control plane, and the daemon re-detects the OpenCode binary after a restart. This revives sessions that went silent after the 2026-08-14 OpenCode message-id rollover.
  • Trigger status is truthful. Reuse, keyed and pinned trigger fires record fired on delivery instead of sitting at queued forever, dead-letters are visible, and a re-prompted session runs on the trigger's model.

CLI and desktop

  • kortix login works against dev and staging again. The web firewall was rejecting the localhost callback.
  • Desktop shows a sign-in dialog for the dev and staging HTTP Basic gate, with an option to remember the credential on the device.
  • pnpm worktree nuke stops on a failed removal instead of reporting success and orphaning the worktree.

Reliability

  • Audit reconciliation writes use the isolated audit pool, so an audit lock convoy cannot starve the gateway's auth queries.
  • Preview environments heal themselves. Disk is pruned, a failed deploy keeps the last good stack, and the environment is named in words rather than by hostname. The JS pi agent has a stable name on Platinum dev.

Under the hood

  • @kortix/sdk root entry is canonical. The root, ./react and ./server are the real entries; the 20 legacy subpaths remain as shims until the next major.
  • One resolved next version across the workspace (16.3.3), with a test that fails the build if the lockfile ever resolves two. Three consecutive dev deploys had died at boot on Cannot find module 'next'.
  • Web tests run isolated, so a partial module mock cannot leak across files.
  • Production has its own managed-git token, separate from staging, and the secrets exception list was cleaned.
  • Two database migrations: the two git ref permissions (4 catalog rows) and a settlement function that records overdrafts. Neither touches user data at volume.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.10...v0.13.11

Read the full release on GitHub →

v0.13.10

Fixed

  • "Kortix is temporarily unavailable" when nothing was wrong. A single failed read of the maintenance flag was treated as a decision to lock the platform down. The API then rejected every write and showed that message to everyone using Kortix, with no one having touched the maintenance setting. An unreadable flag now means normal operation. Maintenance mode is only ever an explicit action, and a real one still holds while the flag store is briefly unreachable.

  • Being sent to the maintenance page after one failed status check. A momentary network problem in the browser was enough to navigate you out of a working session. It no longer is.

Security

  • Updated the SSH library bundled in our app runtime past CVE-2026-56854, an authentication bypass caused by source-address restrictions not being enforced (golang.org/x/crypto 0.53.0 to 0.55.0).

Internal

  • Two browser errors that were never Kortix defects — one thrown by a browser extension, one by the graphics library behind our background visuals — no longer report as product errors in our monitoring.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.9...v0.13.10

Release on GitHub →

v0.13.9

Fix the @kortix/sdk React entry point in fresh npm consumers. Declare the llm-catalog publish tool directly so isolated npm publishing succeeds. Refresh a stale trigger manifest once on a cache miss, with a per-project cooldown, so trigger fire converges across API replicas.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.7...v0.13.9

Release on GitHub →

v0.13.7

Highlights

  • Add Sign in with Kortix OAuth 2.1 flows, headless authentication, and app viewer tokens.
  • Add enterprise organization branding for logos, icons, favicons, and product names.
  • Improve session startup, auto-resume, streaming, queue state, transcript mirrors, terminal cards, and stopped-session recovery.
  • Restore GitHub repository sources on workspace creation and correct People with access visibility.
  • Add GLM 5.3 Flash and remove retired AsterLab and GLM 5.2 routes.
  • Improve secrets, connectors, Slack routing, sandbox lifecycle, preview durability, and provider failover.
  • Allow registered OAuth loopback redirects through the WAF while preserving API redirect validation.

Release validation

  • Staging SHA: 309e0afe1ce19a5674d137e749d8a6511576f2f5
  • Build Staging Artifacts: 33258635866
  • Deploy Staging: 33258801944
  • Full release QA: 33259390663

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.6...v0.13.7

Read the full release on GitHub →

v0.13.6

Sessions start, resume, and stay honest

  • The session loading screen no longer shows a false "Couldn't start session" card. A wake that stalls now escalates on its own — retry, then restart — with a cooldown ladder instead of a terminal state you had to clear by hand.
  • The transcript loads instead of rendering empty while the sandbox boots, and it stays readable for stopped sessions. Transcripts are now mirrored server-side, so a session that is not running can still be read.
  • The frontend no longer falls behind the agent or shows "stopped" while a turn is running. A running session no longer flips to stopped mid-turn.
  • The prompt queue reflects delivery truth: a message is queued until the runtime accepts it, and a message the runtime cannot run is surfaced instead of silently dropped.
  • Long turns no longer stop at random. Fixes cover provider deadline read-back, the request body cap, the OpenCode auto-updater (now off), a progress-aware boot budget, a bounded turn probe, and Bun's 300 s fetch idle timeout.
  • Long sessions no longer run the sandbox out of memory: attachments are offloaded out of the transcript, a memory guard runs before the kernel does, and the reaper backs off its probes. Each sandbox exposes a daemon log and a /kortix/diag endpoint.
  • Audit writes use a single upsert and a dedicated pool, so a lock convoy on the audit table can no longer surface as a "Bad Gateway" during a session.
  • /summarize (compaction) no longer times out through the proxy; the compaction marker is minimal and the summary opens in the panel.
  • A deleted session refuses /start and /restart with 404. Quota and provider races on project creation are gone. Rotated E2B ingress tokens refresh instead of failing.
  • An untouched send skips a no-op scope round-trip, and the approval audit read drops to 100 rows — faster first send.
  • OpenCode is bumped to 1.18.23 everywhere (fixes Bedrock redacted-content streams).

Connect apps from the session (Composio)

  • A new Connect Link flow replaces the connector overlay. Composio is the managed default provider; the agent selects it on its own.
  • You can connect an app from inside the session without typing "done". A connect the human walked away from is finished later, and a stopped session is told when its connector landed.
  • Gmail managed OAuth ships with the minimum scopes. The CLI and the intake link mint a Kortix connect link, never the provider's raw URL.
  • The connector catalogue is sectioned and filterable at the source. A newly created connector keeps its detail view open.

Models and the LLM gateway

  • The LLM gateway is a per-project setting with a first-class native path when it is off: keys go to the sandbox environment and the native provider/model is used. It stays on by default.
  • Native projects get a model picker before the sandbox runtime exists. The picker defaults to the latest flagship set; search reveals all. Deprecated models are hidden; models.dev status passes through.
  • One capability source and one thinking knob for every model. The sandbox learns the project's servable model set at boot, so the picker never offers a model the runtime cannot run. The seed refreshes weekly.
  • Bedrock: inference-profile ids are preferred, a refused bare id is retried with global./us., bare pins are healed, and no bare Bedrock id is used as a default. OpenAI-on-Bedrock reasoning effort now reaches the model. Summarized Bedrock reasoning streams. A rejected reasoning parameter gets one retry with per-model memory.
  • Inline images are windowed inside the sandbox: every gateway session routes through the daemon LLM proxy.

Approvals and permissions

  • Approval and permission notices fill the composer strip. An approval you cannot decide is never rendered as decidable, an unreviewable card says what is true, an unauthorised reviewer is told so, and Approve is not offered on a row the server will reject.
  • A truncated arguments preview no longer blocks approval.

Web

  • Inline "edit from here" editor with an honest Restore control.
  • bash, write, and edit tool rows: zone layout, live counts, and a diff stat.
  • Code blocks always show a copy button. The carousel tab no longer shifts the page sideways. One sidebar opener on every headerless session surface.
  • Session previews stay loaded and both preview frames preload. An HTML file is served, never injected.
  • Triggers keep access across stale reads. The setup-links modal finalizes when it closes.

Change surfaces

  • One vocabulary and one file list for every change surface.

Under the hood

  • CI moved to Blacksmith runners with tiered sizes, a kill switch, sticky-disk Docker cache, and a portable image-digest recipe. PR test lanes run natively.
  • Secrets hygiene: prod dotenvx keys are owner-only, non-prod profiles carry no prod-reaching credential, and a separation tripwire enforces it.
  • The release pipeline refuses a version tag collision.
Release on GitHub →

v0.13.5

Sessions

  • Sessions start faster with OpenCode 1.18.19, leaner runtime assets, reusable Git bundles, and guarded image preparation.
  • Existing sessions recover after sleep, runtime loss, dropped streams, and interrupted connections.
  • Transcripts catch up after missed events, render long threads sooner, and load attachment bytes only when needed.
  • Unsent drafts persist per project and session. The composer can reference recent session files from the / menu.
  • Fixed duplicate prompts, stale status snapshots, malformed runtime responses, and inaccessible backend-origin sessions.

Product experience

  • Every sandbox preview port can use its own origin across cloud and self-hosted deployments.
  • ZIP archives can be browsed and extracted in the file viewer.
  • The CLI now covers models, sessions, agents, connectors, triggers, access, billing, reviews, and project settings.
  • Added ranked command-palette results, a resizable sidebar, clearer change indicators, a rebuilt Apps gallery, and a simpler Customize chooser.
  • Retired the experimental voice runtime and its unused product surfaces.

Security and reliability

  • Preview origins enforce trusted CORS, cross-site write protection, read-only shares, immediate revocation, and host-scoped cookies.
  • Sandbox credentials stay confined to their session. Connector-bound secrets receive tighter delivery boundaries.
  • Experimental network-enforced secrets support streaming bodies, Server-Sent Events, large payloads, and credential substitution in authorization and cookie headers.
  • Paid legacy subscriptions pass the wallet floor correctly and receive renewal credits based on actual payments.
  • The LLM gateway handles large image requests without repeated base64 copies and survives overload without process crashes.
  • Gateway and edge failures return structured retryable errors instead of intermediary HTML or invalid compressed bodies.
  • Audit writes no longer block API traffic. Audit reads use bounded barriers under continuous traffic.
  • Added database connection limits, secret-write coalescing, per-project session controls, safer live-turn reaping, and initial-prompt replay protection.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.0...v0.13.5

Read the full release on GitHub →

v0.13.4

Fixed

  • Bound API database pools against the maximum rolling deployment fleet. This prevents PostgreSQL 53300 connection exhaustion.
  • Isolated audit writes on a dedicated pool. Slow audit inserts cannot starve request handlers.
  • Coalesced project environment updates, bounded secret writes, and capped concurrent project sessions to contain request storms.
  • Bound public web version metadata to each Vercel deployment. Production web deploys now complete with the correct release version.
  • Strengthened release verification for warm-session adoption.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.2...v0.13.4

Release on GitHub →

v0.13.2

Accept webhook requests without a User-Agent at the Cloudflare edge. Mint OpenCode-compatible initial message IDs so webhook-triggered turns complete once instead of replaying.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.1...v0.13.2

Read the full release on GitHub →

v0.13.1

New

  • One URL configures every email Kortix sends. Signup confirmations, magic links, invites and alerts all flow through the same EMAIL_URL transport with the same sender identity and templates — self-hosted installs configure email once. Supabase auth mail now goes through the same path instead of GoTrue's own SMTP.
  • One-click OAuth for MCP connectors. Connecting an MCP server that requires OAuth 2.1 now works end-to-end from the UI or via kortix connectors authorize — discovery, dynamic client registration and token exchange included.
  • Secrets get an exposure and usage model. Each secret declares how it may be exposed and which usages are assigned to it, enforced by one mechanism across every sandbox provider.
  • Session sharing is now the owner's call: managers keep lifecycle control (stop, restart), but only the session's owner can share it or mint public links.

Fixed

  • Revoked API tokens now actually stop working. A personal access token that had been revoked could still authenticate on every surface (REST, the LLM gateway, git proxy, preview proxy, connectors) because the validation query never checked the revocation timestamp. Revoked tokens are now rejected everywhere.
  • Deleting an account now stops and removes every one of its sandboxes — across every account the user owns and every non-terminal state — instead of only stopping the ones under the earliest-joined account.
  • A runaway agent turn can no longer take the API down. Each session's audit-event stream is bounded (900 events per minute); past that ceiling only the high-volume streaming-delta class is dropped while lifecycle, usage and billing events keep flowing.
  • API writes are much faster under load. Audit events are written asynchronously in batches off the request path (they were a synchronous insert into a 14-index table on every request), and the account list no longer makes one admin-API call per member to resolve owner emails. Audit reads flush the queue first, so the audit log stays read-your-writes.
  • A waking sandbox no longer looks like an error. Every surface (web, CLI, SDK) now treats the sandbox-starting state as "waking" with retry, instead of surfacing a 503. Resuming a stopped box also dropped two provider round trips.
  • Gateway reliability: long streaming turns are no longer killed at 255 seconds by a runtime idle timeout; Bedrock requests with trailing prefill or redacted reasoning no longer fail; the gateway's provider shaping now runs on the new AI-SDK-native transport path, which is the default everywhere.
  • Slack: another bot @-mentioning Kortix now works; linking the bot no longer demands owner/admin (it delegates only your own authority); user lookups were sent in a form Slack silently ignored — fixed.
  • Prompt queue and composer: forwarded prompts can no longer strand, Stop can no longer leak into the next turn, fresh sessions paint instantly in one ordered batch, and the boot-time composer shows the session's real agent.
  • Deleted sessions are no longer readable by id. Listing a project's group grants is manager-only, matching the write routes.
  • Sandboxes learn the managed model set from the API on every boot, so a model the picker offers is one the runtime knows.
  • Keyboard scrolling in a session is treated as scroll intent: Cmd+Up no longer snaps back to the end. A session.error is now attributed to the turn that failed.
  • Starter reflector and reviewer agents run without approval prompts. Self-hosted boxes get a daily Docker prune timer.
  • Session titles and conversation counts are recorded again. The per-session metadata mirror was silently never written (the internal call carried no user identity, so the sandbox rejected it) — session names and conversation counts now populate for new sessions.

Security

  • The sandbox egress pin trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope; trigger-session manager visibility no longer extends to session-bound agent tokens.
  • The browser test suite was broadcasting a deployment-protection bypass secret to third-party hosts on every run; it now authenticates once via a scoped cookie and the secret reaches no third party.
  • nodemailer upgraded across two majors to clear open advisories, including one high.

Internal

  • Roles have one store. The RBAC cutover made role_assignments the only authorization store — legacy tables became views, mirror triggers were dropped, and 3,100 lines of parallel code were deleted.
  • The production release gate is now reliable and fast. It runs as 6 API shards + 3 browser shards, cleans up its own test debris, tolerates a traffic-degraded-but-serving gateway, can be rehearsed against staging without opening a release PR, and the test client never replays a non-idempotent request through an edge-laundered error. Staging was right-sized for it, and a workflow-gating bug that had silently frozen the staging frontend for a week is fixed.
  • Container image builds are ~7× faster. Staging and dev images build natively per architecture with a registry layer cache (API image: ~3 minutes, was ~20), and the arm64 frontend image is now genuinely arm64.
  • CREATE INDEX CONCURRENTLY migrations ship with a lock_timeout that can land on a live database, and CI blocks any new one that sets it too low.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.0...v0.13.1

Read the full release on GitHub →

v0.13.0

New

  • Apps is now a stable feature — it moved out of experimental status and sits in the sidebar under Customize. Apps open instantly (no more loading flash), show their desktop layout on the preview card instead of mobile, and get their own IAM permissions and per-team scoping. Non-public Apps are now usable and honest about who can access them; self-host installs can serve Apps even though they can't publish to kortix.com.
  • Invite-time project grants — inviting someone to a project now grants both the account role and project access in one step, instead of two separate actions.
  • Settings unified into one tabbed panel, and the Billing pane was rebuilt with fewer boxes and a single credits card.
  • Chat input rebuilt to stop duplicate and lost sends; triple-tapping Escape now stops the agent even while you're typing.
  • Easy panel overhaul (the non-technical-user view): memory updates are now visible and plainly labelled, skill and task calls expand with live sub-agent activity, and a connect-apps strip and context-card actions were added.
  • Session usage modal reworked for clarity and speed; the model switcher and session usage view now show the real upstream provider instead of "Kortix".
  • Monitors (experimental): a new trigger type that runs on its own provisioned box, with its own CLI command group and MCP surface.
  • Network-boundary secrets on Daytona: an in-guest egress shim scopes a secret to the sandbox it was issued to, replacing the old operator-wide env var.
  • Presentations framework at /presentations, including a diagram-led security deck.
  • Added managed models: DeepSeek V4 Pro 0813 and Grok 4.6.
  • The CLI now shows the identity behind a minted agent token instead of reporting "not logged in".

Fixed

  • A cluster of stuck-session bugs: sessions could get wedged on boot with no retry, get stuck in a runaway self-repeating turn, show phantom interrupts, or strand mid-workspace-switch. A failed direct send now lands in the failed lane instead of disappearing, and prompts no longer get lost around session hand-off.
  • Session truth now reads from a durable server-side turn ledger over HTTP, replacing several client-side guesses about whether a session is still working.
  • Self-host: Storage now hands out public URLs instead of an internal Docker host address, and updates auto-heal from unlogged-table fork corruption that used to block them.
  • The gateway reports what an LLM request actually cost, not what Kortix billed; it no longer kills slow reasoning turns at a hard 90-second timeout, drops the trailing-assistant prefill that made strict backends fail, and its body size ceiling is raised to 1 GiB (was rejecting large multimodal requests).
  • MCP catalog discovery is now authenticated, and private sessions are no longer discoverable by other connectors.
  • Creating a duplicate App slug now returns 409 instead of 500.
  • The Vercel production frontend build now pins its runtime version so it can't get stranded on a stale one.
  • Cleaned up frontend error noise from bot/automation scripts and third-party scripts on Safari.
  • The reasoning-effort icon for Auto is now visually distinct, and agent names are capitalized consistently.

Notes

This release also includes a large internal hardening pass: an in-guest network-boundary/egress-secrets system, a warm-session simplification (session pooling now reuses ordinary sessions instead of a separate warm-session concept), a large API route-file split for maintainability, and expanded test coverage across sessions, monitors, and the deployed staging gate.

Also in this release

  • Security hardening — the sandbox egress pin now trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope when authorizing App access; trigger-session manager visibility no longer extends to session-bound agent tokens; a deleted session is no longer readable by id.
  • Release-pipeline reliability — the release gate is sharded into parallel jobs, cleans up its own test debris, and runs against a right-sized staging; several long-standing test-suite defects that kept the gate red were fixed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.8...v0.13.0

Read the full release on GitHub →

v0.12.8

New

  • Act-as for support — platform admins can open a customer account for up to one hour, with a visible banner and full auditing. Anything that would outlive the hour — tokens, memberships, invites, SSO providers, public shares, tunnels, agent scope changes — is refused during the session.
  • Per-account entitlement overrides — operators grant or extend individual entitlements per account, each with an optional expiry, from a new admin override console. Expired overrides stop applying on their own.
  • One plan catalog — plans now resolve through a single catalog and resolver across API, SDK and web. The duplicate frontend tier catalogs and the "· legacy" plan label are gone.
  • Grant a secret to an agent in one call — a new API route grants an agent access to a secret, and the web app offers that grant directly from the warning that reports the missing access.
  • Session overrides in one place — the Scope panel is replaced by a single overrides popover: agent, model, sandbox and connector overrides together, labels grounded in the agent's real defaults, and a reset that is always reachable.
  • Managed model lineup refresh — Muse Spark 1.2, MiniMax M3 and GPT-5.6 Luna join GLM 5.2, and DeepSeek V4 Flash becomes the platform default.
  • Sandboxes stay current — every deploy serves its CLI and managed skills at /v1/runtime-assets, and sandboxes reconcile against it on start, restart and resume.

Improved

  • Project sessions are grouped by last activity instead of creation date.
  • Account settings are reachable from the user menu.
  • Model errors keep their upstream cause through gateway fallbacks, and context overflow is reported consistently — including after a fallback.
  • Managed-model capabilities reported by the gateway now come from real pricing data.
  • An outdated CLI now gets a clear "update your CLI" warning on the connector routes instead of a raw 404.

Fixed

  • Two ways the session message queue could stall.
  • Saving session scope without touching connectors no longer writes a connector override, and a saved agent secret selection is retained.
  • Secret delivery on Platinum sandboxes resolves replicas reliably and arms the secrecy boundary within the provider's real timing budget, without re-arming on every turn.

Security and compliance

  • The impersonation deny-list also covers agent-governance writes (agents/:name/scope, secrets/:id/grant), connector and channel management, and setup-link minting — all closed during review, before release.
  • MFA enforcement for IAM users, WAF attached to the web load balancers, load-balancer log bucket versioning, and a tightly scoped CI Terraform role.

Internal

  • Terraform for dev and prod now applies from CI behind per-environment OIDC roles, with drift detection re-registered.
  • Production deploys stamp the frontend with the release version and no longer allow mixed frontend/API states; migrations with blocking backfills are rejected at lint time.
  • Full-stack PR previews run in warm sandboxes, and the local test gates were stabilized.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.7...v0.12.8

Read the full release on GitHub →

v0.12.7

New

  • Your terminal is now a first-class way to work with an agent: kortix connect opens a session picker and attaches a full terminal UI to any running session, and can create a session and connect in one step. Bare kortix shows the landing screen again.
  • Feature flags: one gating primitive across API, web, and CLI. Disabled features answer with a clear feature_disabled error everywhere, and each project gets a dedicated Feature flags section under Customize.
  • Network-boundary secrets: secrets can now be marked for delivery only inside the sandbox network boundary, enforced per provider, configurable from web and CLI. Protected Platinum credentials sync automatically, misconfigurations are caught at save time instead of at boot, and the UI only offers delivery modes the project can honour.
  • A workspace switcher and a /new create page: switch workspaces from anywhere, reach account settings from the switcher, and create projects from one place.
  • Connector approvals are reviewed inline in the session, and connector setup finishes through one atomic path — no more half-finished connections when a webhook and a redirect race each other.
  • The starter ships a continual-harness skill: agent scaffolding that reviews its own sessions and refines itself over time.
  • Live session reload: when a session restarts, the UI now streams the reload progress instead of going quiet.

Improved

  • Sandbox lifetime is now bound to the agent. Active turns keep compute alive; finished or inactive sessions contract to a short retrieval window; every stop records why it happened. Wake billing starts only after the provider confirms the machine is actually running — concurrent and failed wakes no longer bill.
  • Session turns read in plain language, and rendering them costs far less.
  • Connector search covers the whole Pipedream catalogue, with categories filtered server-side. New sessions pick up server-resolved connector defaults.
  • Computer profiles are bound per machine, personal machines are allowed in project profiles, and the Computer Tunnel is hardened with computer-use restored.
  • Session titles converge on the runtime title everywhere — no more three names for one session.
  • Workspace file and spreadsheet reads retry during sandbox startup instead of failing on the first try.
  • Audit trails reconstruct complete session integrity chains, and runtime state survives provider restarts.

Fixed

  • A turn that is still being written can no longer be aborted mid-write, and "Interrupted" is only shown when a turn was actually interrupted.
  • The session error card no longer blinks after giving up, no longer appears while the runtime is intentionally parked, and a temporary 503 during startup is no longer treated as a failure.
  • The thinking shimmer only animates the thought the model is still writing.
  • Starter agent templates fetch managed skills through the CLI instead of assuming they are on disk.
  • A building sandbox shows a Details action instead of a broken Retry.
  • Inline content previews render again.
  • The public unauthenticated /review prototype page is gone, a connector URL parsing denial-of-service is eliminated, SES mail now runs on a task role instead of an IAM user, and production deploys refuse a mismatched Supabase auth configuration.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.6...v0.12.7

Read the full release on GitHub →

v0.12.6

New

  • Imported legacy Suna chats are now first-class: migrated sessions show up in the session list with a restore state (instead of a misleading "Done"), and opening one restores its full conversation history into the session. Files from every imported chat live in the project repo under legacy/. (#6235, #6241, #6251)
  • Admin: an activity-analytics dashboard, a projects console, clearer tier labels, and admin-issued trials with per-account entitlement overrides. (#6244, #6249, #6250)
  • Apps: serverless app deployments are provider-neutral — any Dockerfile runtime builds and serves (including non-root images), and the first request after idle reliably wakes the app. (#6253)
  • Reloading a busy session asks before stopping the running turn, and says clearly when a turn was stopped.

Improved

  • Setup links: secret links now last 7 days, an expired link says it expired instead of "invalid", and completing one notifies the waiting session immediately. (#6240)
  • Faster navigation between projects and sessions: one cache entry per entity, and route segments are no longer discarded on the way. (#6231)
  • Browser tabs are named after the session you have open. (#6236)

Fixed

  • Billing: subscriptions activate only after the first invoice is paid; compute metering opens and closes windows atomically with precise start times; sandbox resume reconciliation is fenced so a wake race can't double-bill; a ledger row can no longer be both usage and an admin debit. (#6247, #6248)
  • The terminal stays attached when the session runtime restarts during a reload.
  • Removed noisy request-timeout toasts.
  • Firefox no longer shows a crash message from the background shader when WebGL is unavailable. (#6254)

Removed

  • The local Docker sandbox provider. Sessions run on cloud sandboxes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.5...v0.12.6

Release on GitHub →

v0.12.5

Secret delivery is now a managed control plane, connectors speak one language across the whole platform, and billing moves to flat credit plans.

New

  • Secret delivery controls. Decide exactly which secrets each agent session can use. Policies are managed from the web app and CLI, secrets reach sandboxes through an audited HTTPS broker with session-scoped handles, revoked secrets disappear from running agents, and LLM, connector, git, and subscription credentials are isolated from each other. A new kortix audit CLI command reads the account audit trail.
  • Unified connectors. One connector model across web, CLI, SDK, and API: consistent Connector and Connection terminology, a single data plane in @kortix/sdk, and connector credentials that bind to project secrets. The connector catalogue now pages through the full ~2,700-app list instead of stopping at 192.
  • Flat credit plans. Plans are priced as flat monthly credits instead of per-seat pricing. Billing also gained idempotent compute debits and accurate spend reporting.
  • Rebuilt project onboarding. A single-column, seven-step flow with a clearer Slack setup and plan selection.
  • Capability pages. Connectors, skills, and agents are browsable pages instead of a configuration overlay.
  • Use-case packs. Marketplace runbooks are grouped into installable packs, with real loading and error states and inline project creation.
  • Document conversion by default. Every new sandbox includes a convert-documents-to-markdown skill backed by a baked-in converter.
  • Serverless app deployments. Provider-neutral serverless deployments for apps, served behind a managed edge with wildcard TLS and signed public hosts.
  • Kimi K3 is available as a managed model.

Improved

  • Sessions survive interruptions. A pending agent question is parked when its sandbox dies and restored on the next boot, and a stored answer is delivered as a follow-up turn. Runtime updates boot and verify the new runtime before retiring the old one.
  • Chat UX. Instant session rename, a truthful header title, idempotent provisioning, preview verdicts, and grouped activity. In-flight sends survive navigation, and tool failures are reported honestly.
  • Session list. Rebuilt with status states, collapsible sections, and a nested filter menu.
  • Faster, calmer navigation. Project pages load faster (Next.js 16.3), and passively opening a project no longer wakes idle sandboxes.
  • Clearer errors. The LLM gateway surfaces real upstream provider errors instead of a generic Bad Gateway, and large repository branch listings are bounded.

Fixed

  • Billing: the same compute window can no longer be charged twice, "spend this period" reports the correct window, the paid seat is released when SCIM deprovisions a member, BYOK failover respects the managed-model entitlement, and the UI shows the concurrency limit the server actually enforces.
  • Agent workspaces are strictly enforced across repository, git, and clone APIs.
  • Approvals require a full review of each call, and the daemon no longer auto-answers questions outside a channel session.
  • The Terms of Service link opens the document directly.
  • Desktop: the title bar aligns with the OS window controls.
  • Production API recovery is hardened: migration-safe restarts and better behavior under memory pressure.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.4...v0.12.5

Read the full release on GitHub →

v0.12.4

Fixed

  • Transactional email — team invites, project access requests, and demo-request notifications — now goes through a chain of email providers. If one provider fails or is unavailable, the next one takes over automatically. This removes the single point of failure that delayed some emails on August 5.
  • The Terms of Service link now opens the document directly instead of its containing folder.

Internal

  • End-to-end cost tests compute gap-fill counts from their own time window, fixing a flaky check.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.3...v0.12.4

Release on GitHub →

v0.12.3

New

  • One-shot approval links: approve or reject an agent's pending request straight from the notification link, without opening the app.
  • Sandboxes now ship with a baked-in Python package floor — Pillow, pypdfium2, pytesseract, and 13 more pinned packages — so document and image skills run immediately, with no install step.
  • The session header warns when an agent's configuration changed on disk after the session started, with a one-click reload that updates the files the agent actually reads.
  • Terms of Service are linked from /legal/terms.

Improved

  • Project page navigation is noticeably faster, and the web app moved to Next.js 16.2.0.
  • Messages queued while the agent is working now stay queued until the turn actually ends — no more mid-turn releases or duplicate sends.
  • One keyboard shortcut (⌘I / Ctrl+I) now toggles the whole right side of a session: the action panel, a detail panel, or both.
  • Session error states are clearer: tool failures are reported truthfully, retry states show what is happening, and a stale agent config no longer needs a page reload to surface.
  • The CLI is quieter and more honest: --quiet is honoured on every path, and it no longer claims an invite email was sent when none was.

Fixed

  • Hardened the sandbox: closed a proxy hole that could leak the sandbox service key to an attacker-named host, closed a DNS-rebind window by connecting only to the address that was vetted, resolved symlinks before authorizing file paths, and stopped one session's credentials from being served to other members of the account.
  • Secrets: setup links now expire on time, re-scoped secrets validate against the session owner rather than the caller, and secret identifiers are no longer disclosed through the narrowing report.
  • Session reliability: removed two paths that could silently destroy a session's commits, a planned restart now finishes the turn it interrupts, a failed agent spawn schedules a respawn instead of killing the session, and reloading an agent never hard-resets the session branch.
  • A transient git failure can no longer compile an agent with an empty prompt.
  • Queued API errors: address-validation failures now return a proper 400 instead of a server error.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.2...v0.12.3

Read the full release on GitHub →

v0.12.2

Promotes the full candidate verified on staging. Prevents passive session reads and project navigation from waking stopped sandboxes; corrects session activity timestamps; adds session access, reload, cost, and guarded secret-delivery controls; improves channel, email, executor, chat, download, PPTX, and account-usage behavior; and completes the ECS-focused infrastructure and deployment updates. Fast-track note: staging image build and deployment passed. One unrelated landing-page accessibility assertion for a scrollable pre element failed; the four browser interaction tests, login accessibility, and migration tests passed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.1...v0.12.2

Read the full release on GitHub →

v0.12.1

New

  • Sessions can require connectors up front: select a connector for a session before it is connected, and when a prompt needs a connector that is not connected yet, the session pauses with a connect card instead of failing.
  • Project icons: pick an emoji or a named glyph for each project.
  • When an app preview stops or fails to load, you can send it straight to the agent to fix.
  • Markdown files with frontmatter now render their metadata.

Improved

  • The project session list was rebuilt as a cleaner everyday list.
  • Model management shows which models are enabled for a project, and the Manage models tab counts them correctly.
  • Error screens include one-click copy so you can report exactly what went wrong.
  • The sidebar merges the Kortix mark and project switcher into one control, with layout and hover fixes.
  • Sandbox capacity problems surface clear retry diagnostics instead of failing silently.

Fixed

  • New signups land directly in their project instead of the project list.
  • E2B sandboxes: template builds route through the self-host domain, concurrent builds settle correctly, build uploads stream reliably, and permanent sandbox removal is bounded.
  • The file viewer no longer errors when a file is missing from the repo.
  • Self-hosted installs can configure the API memory ceiling.
  • Console noise from Android WebView is filtered out of session logs.
  • Release pipeline: a stalled dark-region replica can no longer hold back a release, which had left recent releases without their published notes.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.14...v0.12.1

Read the full release on GitHub →

v0.12.0

New

  • Audit log — every API request and agent action lands in one centralized audit trail. The app gets a project and session audit explorer; the SDK gets reconstruction filters and client attribution.
  • Session costs — one unified cost record per session, and a session cost explorer in billing that shows what each session spent.
  • Session scope controls — new sessions can start with an explicit, opt-in scope over connectors and secrets. Agents can require connector profiles, connector profiles carry an authorization strategy, and denied secrets never enter the sandbox. When a required connector is missing, the session prompts to connect it instead of failing.
  • Answerable approvals — approval prompts show the full tool arguments, and approval policies match on arguments, not just tool names.
  • Automatic session titles — sessions are titled from the first prompt, server-side, on every session-start path.
  • Signup lands in a project — new accounts go straight into a working project, with no blocking provisioning step.
  • Microsoft Teams (experimental) — Teams is available as a per-project experimental channel.
  • Embedding Kortix — per-end-user session caps enforced on create and resume, hardened sandbox isolation between end users, and mid-session re-scoping of secrets and connector bindings.
  • New website — kortix.com rebuilt: home page, Solutions, Security, Self-hosted, Integrations, Channels, Automations, About, Careers, and a public /download page. An accuracy sweep removed claims that were not true and corrected public pricing copy.

Improved

  • The project Files route opens instantly instead of after 5–6 seconds, session transcripts paint from cache instead of waiting on the sandbox VM, the sidebar no longer flickers on cold load, and older history loads by scrolling.
  • Sandboxes have a bounded lifetime that a wedged box cannot escape, and compute is billed against liveness evidence, never wall-clock.
  • Billing is one state machine: running out of credits reads as "out of credits", never "no plan"; one credit-debit function with no wallet-floor bypass; Stripe checkout returns work from any route.
  • Sessions order by last activity, connector profile creation is atomic, and the icon set moved to Phosphor.
  • Managed models group under Kortix in the model picker instead of being split across upstream provider names.

Fixed

  • Gateway: Bedrock adaptive thinking and region-prefix normalization, and the correct base path for standalone OpenAI keys.
  • A broken sandbox template no longer fails the whole template listing.
  • Public file-share links restored across the file and preview surfaces.
  • Signup and sign-in redirects can no longer land in a project the user cannot open.
  • Opening a session with history no longer shows an empty new-session shell, and triggers show as active when they are active.
  • CLI: private and self-hosted API hosts are no longer forced to https, and IPv6 hosts classify correctly.
  • Every /docs route returned 500 after an icon namespace crossed the RSC boundary.
  • Closed public SSH/RDP exposure on a network ACL and added an audit that keeps it closed.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.11.0...v0.12.0

Read the full release on GitHub →

v0.11.0

New

  • Realtime voice calls use LiveKit Cloud and preserve transcripts and worker tool calls in the session UI.
  • Session rewind restores REST and ACP sessions from a selected message.
  • Warm sessions keep one session available per project to reduce cold-start latency.
  • The Marketing Department template adds campaign, content, lifecycle, growth, and brand agents.
  • Connection policies canonicalize connector aliases and enforce the selected shared connection across grant gates.
  • KaaB isolation restricts session access, sharing, approvals, model changes, executor grants, connector use, and OpenCode proxy access.
  • KaaB spend controls enforce per-end-user limits.
  • Secret Delivery Strategy stage 1 adds the schema, policy layer, and shared egress-policy type.
  • White-label session scope controls add end-user session filtering, connector binding, scope visibility, and a testing guide.

Improved

  • Prompt delivery deduplication releases the claim after a final sandbox-down response. A later retry can recover without duplicating a completed prompt.
  • Session transcripts preserve reasoning and tool-step wire order.
  • Runtime-generated session titles synchronize with the canonical session and web UI.
  • Managed repository provisioning uses deterministic pacing and 13 reusable repositories in the release gate.
  • The release gate runs API lanes in parallel and cleans mutable staging fixtures concurrently.

Fixed

  • Session sharing preserves permission status during warm-session claim races.
  • Sandbox secret injection remains scoped to the active agent.
  • Strict model providers receive normalized message history.
  • readRepoFile returns 404 for a missing Git path.
  • Maintenance mode remains visible during an API outage.
  • Worktree shutdown stops the complete process tree.

Operations

  • US East 2 shadow deployment, database reconciliation, writer activation, and cutover tooling remain disabled.
  • This release does not freeze the EU database or switch production traffic.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.15...v0.11.0

Read the full release on GitHub →

v0.10.15

Bound scheduler fleet work, catalog trigger projects, refresh webhook manifests safely, and rate-limit forced manifest refreshes. Source is the targeted staging candidate from PR #5461.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.14...v0.10.15

Read the full release on GitHub →

v0.10.14

  • Use shared Daytona and Platinum runtime images for normal session boots.
  • Disable automatic per-project commit-specific warm image builds.
  • Fix snapshot collision recovery, warm archive handling, and repository Git metadata.
  • Preserve sandbox URLs and reset readiness clocks across session restarts.
  • Add responsive Cmd+J loading feedback and clearer runtime versus accelerator status.
  • Remove the missing MACHINE.md failure and legacy migration eligibility request noise.
  • Refactor release session fixtures to reuse managed repositories, bound SESS-2 to one session, and enforce teardown.
  • Retry transient runtime-readiness failures without leaving failed sessions.
  • Enforce account concurrent-session overrides consistently across API tasks.
  • Correct compute pricing calculations and billing copy.
  • Promote verified staging source d4f665abe258513bb1f48a6606f59c48dbfac835; staging RUN-8 and SESS-2 passed 2/2.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.13...v0.10.14

Read the full release on GitHub →

v0.10.13

LLM gateway

  • ChatGPT / Codex models work again. Fixed the ChatGPT-subscription (codex/*) 400s end to end: restored the required store: false, stopped sending the unsupported max_output_tokens, and started surfacing the real upstream error detail instead of a bare "Bad Request".
  • Anthropic extended thinking now uses adaptive + effort (not the deprecated enabled + budget tokens), so non-AUTO reasoning effort no longer 400s on newer Claude models.
  • Reworked provider mapping into per-provider adapters typed against each SDK's own option types, with models.dev-driven capability gating — wrong wire shapes are now compile errors.

Models & providers

  • Model picker labels BYOK groups by their real provider (e.g. Amazon Bedrock, not "Kortix").
  • Model show/hide visibility is now consistent across the picker and settings.

Projects & Git

  • Git-provider-first project creation and management; new projects default to managed repositories.
  • Removed an unbuilt "Repository synchronization" placeholder from Git settings.

Marketplace

  • Fixed marketplace item pages returning 500 (they now render correctly, and a missing item 404s).

Identity (SCIM/IAM)

  • Okta group-push renames (PUT /Groups) now work; protection for IdP-synced groups; status-first Identity tab with last-sync activity and per-provider cadence.

CLI & docs

  • Avoids 502s on long chat turns; clearer "vision fallback" model labeling; dev CLI installer surfaced in Git settings.
  • New "Developing with Kortix" guide covering local instances and the CLI workflow.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.12...v0.10.13

Read the full release on GitHub →

v0.10.12

This release fixes the session-start regression behind the v0.10.11 rollback and re-ships the rebuilt LLM gateway.

Fixed

  • New sessions could hang at "Starting the agent" and never become ready — the in-sandbox runtime was rejecting its own model configuration. Sessions now start reliably.
  • Sandbox images re-downloaded the browser engine on rebuilds, which slowed session startup under load; the browser layer is now cached deterministically.
  • Slack channels showing "Not connected" with no connector available.

Improved

  • The LLM gateway is rebuilt on the Vercel AI SDK with a live models.dev catalog (re-shipped from 0.10.11).
  • Broader end-to-end test coverage and infrastructure monitoring.

Internal

  • Groundwork for an alternate managed-git backend (off by default; deployments stay on GitHub).
  • Secrets-management hardening.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.11...v0.10.12

Release on GitHub →

v0.10.11

LLM Gateway

  • Rebuilt on the Vercel AI SDK + live models.dev. The gateway now runs a single AI-SDK transport for every provider (OpenAI, Anthropic, Bedrock, OpenRouter and more), with the model catalog served verbatim from models.dev. The old per-provider transports and the LiteLLM sidecar have been removed.
  • Per-model generation controls. Set reasoning effort, temperature, top_p, and max output tokens per model — each control only appears when the model actually supports it (driven by the live catalog), and applies to every client (chat, SDK, and direct API).
  • Reasoning-effort selector in the chat composer for models that expose it (including a thinking-effort control for Claude models).
  • Two drop-in API surfaces: OpenAI-compatible /v1/chat/completions and Anthropic-compatible /v1/messages, plus /v1/models — all now documented in the API reference.
  • Provider & model manager overhaul: connect providers (incl. Bedrock via bearer token), browse models with pricing, context windows, and capabilities, verify that a key actually works, and see everything grouped under its real provider.
  • Anthropic extended thinking and prompt caching are applied correctly, and cost/usage are recorded accurately per request.
  • A gen_ai.* OpenTelemetry span is emitted per gateway call for downstream observability.

Templates

  • Many new business use-case templates across finance, sales, customer support, marketing, data, and recruiting — each with its own cover art.

Fixes & hardening

  • Sandbox proxy no longer times out healthy long reasoning/tool turns.
  • Blank projects can start sessions immediately (no more "agent not declared").
  • Project-scoped API tokens can drive their own project's sessions.
  • Per-project agent model pins no longer collide across projects.
  • Faster session/gateway paths and clearer errors on upstream failures.
  • Security & compliance: GuardDuty runtime monitoring, IAM baseline, root-login and patch/detection alerting, and corrected SSO/SCIM setup guides.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.10...v0.10.11

Read the full release on GitHub →

v0.10.10

Fixed

  • The workspace could get stuck shifted sideways — chat and panel cards clipped at the left edge, dead space on the right — after opening the browser or terminal in the session panel. Opening those views no longer nudges the layout, and the layout can no longer be scrolled out of place.
  • When the agent shares files or images in the chat, the carousel and file previews render inline again instead of collapsing to a bare one-line row. Clicking the row still opens the full viewer in the side panel.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.9...v0.10.10

Release on GitHub →

v0.10.9

Improved

  • The session panel's terminal now connects reliably and recovers cleanly instead of failing with "pty not found".
  • Browser sessions in the panel now land on a proper starting page instead of a blank view.
  • Tool cards in the session panel now show exactly what each tool did — no more misleading summaries.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.8...v0.10.9

Release on GitHub →

v0.10.8

This release is a focused batch of fixes.

Fixed

  • OpenAI-compatible models now get the correct max_tokens handling based on the model itself rather than the upstream host, so sessions on newer OpenAI models (e.g. gpt-5.6) complete their turns reliably instead of erroring.
  • Bring-your-own-key provider credentials are now always shared across your team — the private "Only me" option has been removed end to end, matching how the gateway actually reads keys and avoiding silent "no upstream configured" failures.
  • The in-terminal experience is more robust: the sandbox terminal now looks up or creates its pty on demand, so a reconnect no longer closes with "pty not found".
  • Approving or denying a request that has already been resolved no longer double-fires a "not found" toast.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.7...v0.10.8

Release on GitHub →

v0.10.7

This release is a top-to-bottom overhaul of the LLM gateway — the layer that carries every model request — plus a round of security hardening and sandbox tooling work.

LLM gateway

The gateway now speaks each provider's API correctly instead of approximately.

  • OpenAI routing and parameters. Genuine-OpenAI reasoning models that also use tools now route to the /v1/responses API, where they belong. We translate max_tokens to max_completion_tokens, correct the gpt-5.5 fallback temperature flag, and pin the playground wire shape so what you test is what you ship.
  • Anthropic and Bedrock. When extended thinking is on, we stop forwarding temperature/top_p (they conflict with thinking), and Bedrock request/response frames are handled correctly. Bedrock is now available as a standalone bring-your-own-key provider, with its region read from the project's own secret.
  • Transport correctness. Safer tool_choice handling, per-provider parameter quirks, message-role normalization, and correct streaming frames across providers.
  • A LiteLLM translation sidecar now sits behind the control plane as a stateless translation layer, so provider-shape differences are handled in one place.
  • Streaming reliability. Aborts propagate end to end, mid-stream errors surface instead of hanging, buffers are bounded, and requests carry deadlines.
  • Error taxonomy. Failures now come back as honest, actionable errors rather than opaque ones.
  • Billing correctness. Accurate usage capture, cache-write pricing, and atomic budget holds, with tests to keep them honest.
  • A published capability matrix documents exactly what each model and provider supports.

Security

  • A DNS-resolving egress guard replaces the old hostname-string regex, closing SSRF gaps.
  • Teams bot connector tokens can no longer leak to a caller-supplied serviceUrl.
  • Sessions reject client attempts to forge deletedAt/deletedBy metadata.
  • Preview shares enforce a view-mode method gate; the Slack file proxy is narrowed to file subdomains; GET /files/history gets the resource denier; the MFA-required setting requires an explicit boolean; and malformed AgentMail webhook bodies are rejected before acknowledgement.

Sandbox and CLI

  • New pre-push sandbox gate: the CLI lints your Dockerfile in validate and can build sandboxes locally with sandboxes build --local.
  • The Python floor is venv-isolated, custom /workspace contents are preserved, and PTY terminals compile on a supported Bun and recover across providers.
  • A stopped sandbox now auto-resumes on active OpenCode access, flipping the session to ready.

Web and fixes

  • Rebuilt session panel with Easy/Advanced modes, new file viewers, and modular tool renderers.
  • The project no longer reveals the resolved sandbox provider when the project's provider is set to Automatic.
  • Clearer CLI install guidance, corrected OpenCode proxy targeting, and "Kortix Computer is starting" renamed to "Kortix Session is starting."
  • Infrastructure: HTTPS-only load-balancer listeners, durable WAF ownership, restored prod gateway origin TLS, and recovered prod migrations and session uploads.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.6...v0.10.7

Read the full release on GitHub →

v0.10.6

Stamp KORTIX_VERSION in the EKS gateway Helm chart and in staging/production GitOps bumps so the standby gateway reports the exact promoted release version. This completes the gateway origin TLS recovery and restores six-endpoint version parity across ECS, EKS, and the public router.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.4...v0.10.6

Release on GitHub →

v0.10.4

Refresh the authenticated managed-model catalog when adopting warm-fork sandboxes, restarting OpenCode only when the live catalog changes. Also preserve the staging Cloudflare Worker gateway bindings so managed inference reaches the configured gateway backend.

Verified on dev and staging with fresh real sandboxes: kortix/glm-5.2 returned exactly PONG. Staging proof used a real Stripe test-mode paid subscription and cleaned up all resources.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.3...v0.10.4

Release on GitHub →

v0.10.3

Self-host hardening wave from the production-readiness audit, an experimental local-docker sandbox provider, and an auth refresh fix.

New

  • Experimental local-docker sandbox provider for self-host — run agent sandboxes as plain Docker containers on the same machine as your Kortix instance, with no cloud sandbox account. All sandbox-facing URLs resolve over the Docker network. Listed last in the provider picker and not recommended for production: it builds sandbox images locally and is noticeably slower than Daytona or Platinum.
  • Moving dev / staging / prod image tags — self-host instances can now track a channel-style tag (kortix self-host init --tag dev|staging|prod); CI re-tags the deployed build by digest, no rebuild.
  • Smoother SSO/SCIM setup — mint the SCIM token and paste it into your IdP on one page, live SSO verification with a resume story, complete Directory Sync and Google guide screenshots, and a visible "Use single sign-on (SSO)" entry on the sign-in page.

Improved

  • Self-host updater — resilient update runs with visible outcomes (kortix self-host status now shows the last update result), rotated container logs, and per-service memory limits so one service can't starve the box.
  • Self-host EC2 (Terraform) — the data volume now survives instance replacement (AZ pinned to the subnet, not the instance), reboot-surviving bootstrap, containerd relocated to the data volume, and CloudWatch status/disk/memory alarms.
  • Zero-downtime migration policy — every new database migration is linted by squawk plus deterministic mixed-version and enum-value guards in CI, with a rewritten migrations runbook.

Fixed

  • Silent auth refresh — sessions renew in the background; an expired token no longer leaves a dead, blank page.
  • Git PAT import — a saved managed-git personal access token is now recognized as a connected GitHub account, so repo import works without reconnecting.
  • SCIM Tenant URL is now correct on same-origin and self-hosted deployments.
  • Removed the legacy SANDBOX_IMAGE configuration surface from self-host.
  • Scoped the ECS deploy role's describe/list IAM actions to Kortix ARNs.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.2...v0.10.3

Release on GitHub →

v0.10.2

New

  • Unified sign-in — login and registration are now one email-first flow: enter your email and Kortix routes you to sign-in, sign-up, or your company's SSO automatically (with closed-signup and enforce-SSO support).
  • SSO out of the box on self-host — SAML is enabled by default, each instance generates its own SAML signing key at init, and SSO/SCIM setup is fully documented.
  • Identity setup wizard overhaul — reworked Entra wizard, SAML-before-SCIM ordering guidance, a provisioning health panel, an enforce-SSO toggle with clear domain consequences, and illustrated guides for all four SSO/SCIM flows.
  • Admin-controlled account creation on self-host — creating additional accounts is now restricted to the server admin by default (signups, teams, and SSO provisioning are unaffected), and the UI hides account creation when restricted.
  • Simpler self-host CLI — one env command, an uninstall command, and a friendlier init: a missing sandbox key warns instead of refusing to boot.
  • Enterprise license availability is now exposed on account state (API + SDK).

Fixed

  • Managed model provider now follows billing configuration by default, fixing managed models being unavailable on some deployments.
  • Self-host updater no longer fails on Docker-in-Docker mounts; the provider menu is always visible; configure records the admin email.
  • Non-admins no longer see a spurious Git-status error.

Behind the scenes

  • Production deploys are now hard-gated end to end: the release only publishes after the API and gateway deploys verify the live version.
  • Demo requests notify the team directly with lead-domain classification, and new signups sync to the contact list that powers onboarding emails.
  • Repo cleanup: self-host layout consolidated, stale roots removed, self-host docs moved under Guides.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.1...v0.10.2

Release on GitHub →

v0.10.1

Self-host hardening — everything live-verified

  • Agent sessions work everywhere: fixed the LLM base URL handed to cloud sandboxes and the in-API gateway path shape — BYOK model keys now carry real agent turns on local machines (Cloudflare tunnel) and VPS (domain) alike, proven end-to-end.
  • Guided setup, VPS-first: kortix self-host init walks domain/reachability → admin email → deployment shape → sandbox provider (Daytona/E2B/Platinum) → optional connectors → update schedule. Help text cut to a page. Auto-update on by default.
  • GitHub connection hardening: personal-account installs route correctly, torn configs are detected, the Git settings tab never renders blank, and 'New project' takes you to Git settings when GitHub isn't connected yet.
  • CLI against your self-host: kortix login opens your deployment's dashboard and the full login → projects → ship flow is verified.
  • kortix-selfhost/: one-README distribution with an optional thin Terraform for AWS/EC2 — durable data volume, automatic EBS-snapshot backups (configurable cadence, keeps N), DNS via Route53 or your own provider.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.0...v0.10.1

Release on GitHub →

v0.10.0

Self-hosting, rebuilt

One generic Docker Compose self-host that runs the full Kortix platform on any VPS/server — kortix self-host init + start, VPS-first with a persistent domain (Caddy + automatic TLS), plus Cloudflare-tunnel and local modes for evaluation.

  • In-app GitHub setup — create an org-owned GitHub App from Settings → Git (manifest flow), paste an existing App, or use a scoped access token. No CLI gymnastics, no PATs required.
  • Self-host feature flags — single-account mode, marketing site off by default, enterprise license unlock, billing/connectors gracefully hidden when unconfigured.
  • Operations built in — nightly zero-downtime rolling updates on the curated stable channel (promoted via the new Promote Self-Host Stable workflow), kortix self-host secrets management, run-any-version + local-images modes, required-secret enforcement at init.
  • Kortix-managed models are cloud-only — self-host deployments use your own model keys (BYOK); the managed catalog is gated behind an explicit flag.
  • Reliability — SSE turn-stream no longer leaks connections on retry (fixes tab-wide request starvation); stale sessions self-heal instead of dead-ending on the auth screen.
  • New self-host e2e test suite (fast CLI-artifact tier + opt-in live tier) wired into CI.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.108...v0.10.0

Read the full release on GitHub →

v0.9.108

Fixed

  • Opening an idle-stopped session now wakes it on its own instead of dead-ending on "OpenCode failed to load / sandbox not ready." When a real user hits a stopped-but-resumable box, the runtime resumes in place, and the session's status flips to running without a manual refresh.
  • Invitation listing and acceptance no longer error — a database column the code relied on was missing and is now added.
  • Sessions keep their sandbox identity through recovery and reprovision cleanly after a daemon boot error.
  • Quieter, more reliable UI: the transient "runtime still starting" state is no longer reported as an error, and a couple of edge-case crashes (malformed links, a non-string command template) are guarded.

New

  • Executor connection profiles — group a connector's credentials under a named profile.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.107...v0.9.108

Release on GitHub →

v0.9.107

Fixed

  • Opening a session whose sandbox had gone idle no longer dead-ends on "OpenCode failed to load / sandbox not ready." The runtime now wakes on its own when you open the session — the same recovery a manual refresh used to do — so idle sessions just come back.
  • A session's status now flips to "running" in the sidebar as soon as it connects, instead of staying "stopped" until you refresh the page.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.106...v0.9.107

Release on GitHub →

v0.9.106

Fixed

  • Opening or switching sessions no longer flashes a blank screen. A brief "runtime still starting" moment during a switch is now treated as a loading state, not an error, so the session just renders in place.
  • A session whose sandbox had gone idle no longer dead-ends on "open a new session." It now resumes on its own, with an in-place Restart if it can't wake automatically.
  • Cleaned up the marketing site: removed dead Compare links from the footer, dropped Blog from the nav, and fixed the CLI footer link.

Improved

  • The deploy maintenance banner is clearer and on-brand, and is treated as a critical rollout signal.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.105...v0.9.106

Release on GitHub →

v0.9.105

Fixed

  • Switching between sessions no longer flashes a "Something went wrong" screen. A brief "runtime still starting" state during a session switch now shows a short loader and recovers on its own instead of surfacing as an error.
  • The review inbox (sidebar and Review Center) keeps loading even when one of its sources is temporarily unavailable — it now degrades gracefully instead of failing the whole panel.
  • Session file uploads are recoverable again after an interruption.
  • PDF previews now open at 100% zoom instead of 50%.
  • Sign-in polish on mobile: the mark is pinned top-left, gutters are wider, and the tagline is refreshed.

New and improved

  • Signing in now defaults to a one-time email code, with password kept as a secondary option.
  • Projects still on the older manifest now show a clear v1 → v2 upgrade prompt in the sidebar.
  • Maintenance mode: admins can bypass a full lockdown through a signed session, and deploys now raise a heads-up banner while a rollout is in progress and clear it automatically once the API is healthy.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.104...v0.9.105

Release on GitHub →

v0.9.104

  • Session uploads no longer fail at the generic 15-second proxy cutoff.\n- Failed sends preserve and restore the full prompt and attachments.\n- Legacy personal connector credentials migrate safely into member-owned profiles.\n- Restores missing runtime-context and executor-profile schema.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.103...v0.9.104

Release on GitHub →

v0.9.103

  • Promote the fully tested staging candidate to production.
  • Includes sandbox identity race protection and restored health deployment identity.
  • Includes staged authentication redesign and chat input model-state fixes.
  • Includes reliable Slack project default agent/model handling.
  • Staging artifact build and deploy passed; public staging ke2e passed 9/9.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.102...v0.9.103

Read the full release on GitHub →

v0.9.102

Adds slack bind-thread (bind a session to a Slack thread for approval-reply loops; #4385) plus all other pending main changes promoted through staging (v0.9.102-staging, commit 6275ff93). Enables the WRING funding-request APPROVE-in-thread flow.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.101...v0.9.102

Release on GitHub →

v0.9.101

This release fixes a timing bug that could make an agent miss the very first message of a session, tightens single sign-on for teams, makes gateway errors say what actually went wrong, and hardens how OAuth tokens are stored.

Fixed

  • Agents now reliably reply to your first message. On a fast cold start, the agent could fire your opening prompt before it had finished subscribing to its own event stream — so a quick first turn finished in that gap and the reply was lost (most visible as a silent first message in Slack). The agent now subscribes first, reconciles anything it missed on connect, and delivers each turn's end exactly once.
  • Clearer gateway errors instead of a generic failure. When an upstream model provider failed mid-response (for example, an overloaded or request-too-large error on an otherwise-started stream), the gateway used to bury it as a generic "empty completion" and retry the same failing provider until it gave up. It now surfaces the real upstream error and message, drops the failed provider immediately, and fails over to another one when available.
  • SSO group-to-role sync now works for SAML. SAML providers weren't registered with a group-claim mapping, so the group attribute never reached the token and group-driven role assignment silently did nothing (login still worked). Providers now register with the correct mapping, and the SSO setup card documents the common identity-provider gotchas.
  • SCIM group membership applies to pending invites. A user provisioned via SCIM but not yet signed in was silently dropped from pushed groups. Their group is now recorded on the invite and applied automatically when they accept, matching how project access already works.

Improved

  • Sandbox templates show which provider they use. Each template card and recent build now carries a small provider chip (Daytona, Platinum, Managed), and the templates section is tidier and less cluttered.
  • CLI secrets match the web app. kortix secrets set --identifier KEY=VALUE lets you store more than one value under the same key from the terminal, and kortix secrets ls now lists by identifier and flags any missing required keys — bringing the CLI in line with the web Add-secret experience.
  • CLI token context shows your environment grant. kortix token / whoami --token-only now include the env part of an agent grant (not just connectors and CLI access), and a bound default project points you at kortix projects use to switch.

Behind the scenes

  • OAuth server access and refresh tokens are now stored with peppered scrypt, matching every other credential (previously plain SHA-256). Existing tokens keep working until they expire.
  • All OpenRouter usage now attributes to one canonical app (www.kortix.com) instead of splitting across per-environment entries.
  • Removed an unused internal session-LLM route that no client called.
  • Trimmed frontend build spend by skipping builds that don't touch the frontend and gating preview builds.

Kortix is open and source-available.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.100...v0.9.101

Release on GitHub →

v0.9.100

New

  • Marketplace imports. Agents, commands and bundles install into a project in one click. The detail view now shows what a listing actually contains — bundle contents, capability badges, type-aware copy — before you add it.
  • Groups and custom roles on every plan. Previously limited by tier; now available to all accounts.
  • Answer permission prompts from the CLI. Sessions that pause for approval can be resolved without leaving the terminal.
  • One-click Slack connect via kortix channels connect — no manual app setup.
  • Review center approvals. Approve and deny executor requests for real, with change descriptions rendered as markdown.
  • OAuth1 connectors for OpenAPI and HTTP.
  • Always-bound project CLI. login binds a default project; unbound commands recover interactively instead of failing.

Improved

  • kortix.toml is now kortix.yaml (TOML stays supported as v1 legacy), with format-aware manifest errors and agent-scope/trigger-path parity.
  • Destructive actions are confirm-gated: deleting secrets, revoking gateway keys, deleting sandbox templates and sessions, archiving projects.
  • Loading states unified across the app; onboarding moves Skip into the footer per step.
  • Upgrades are surfaced with an accent card and a Recommended badge.
  • A complete IAM administrator's guide: SSO/SAML, SCIM, roles, groups, custom roles, agents, audit.

Fixed

  • Sessions on projects pinned to the Platinum sandbox provider could not start. Production's sandbox_provider type was missing the platinum value, so every session create failed at the database. The value is now added; a sandbox that fails to start also raises properly so provisioning retries.
  • Retry build / Fix with agent works again, snapshot quota cleanup can fire, and the prewarm cache is bounded with an alarm when cleanup falls behind.
  • Permission leaks closed. Project detail sections are filtered by read capability, previously ungated project endpoints now check their capability leaf, member management gates on the leaf rather than a broad write floor, and viewers no longer see error toasts for surfaces they cannot read. Read-only users get a degraded view instead of a broken one, and the floor member role can fire triggers again.
  • Service-account bearer tokens are accepted wherever user tokens are.
  • Unknown CLI commands now error with a suggestion instead of silently scaffolding a project named after the typo.
  • The model picker updates immediately after connecting a provider, and setup links render as clean CTA chips rather than raw token URLs.
  • Resolved high-severity CodeQL findings (ReDoS, temp-file handling, TOCTOU, CLI opener).
  • Rename dialogs no longer close mid-save; sessions and projects show honest error, empty and retry states.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.99...v0.9.100

Read the full release on GitHub →

v0.9.99

Fixed

  • Connecting an LLM provider with "Only me" access made the key invisible to the model gateway — sessions failed with "No upstream configured" while the provider still looked connected, and flipping an existing key to "Only me" silently left the shared key active for every member. Provider API keys are now always project-wide: the per-user option is gone from the connect flow and the API rejects per-user provider keys outright.
  • The marketplace now paginates and virtualizes its listings, and installs no longer fail against a 25-second timeout.
  • The detach-role dialog no longer shows a raw translation key and now spaces the role name correctly.
  • Removed a distracting fade animation on the sidebar toggle.

New

  • File and secret access can now be restricted per role: file and secret reads moved to the editor tier, and new groups default to the member grant.
  • A warning now appears when a group's built-in grant overrides its assigned custom role.
  • The New Project modal has an account picker, so you can choose which workspace a new project lands in.

Improved

  • A smoother session-starting loader.
  • A full accuracy pass over the docs (SDK, CLI, reference, and concepts) against the current code.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.98...v0.9.99

Release on GitHub →

v0.9.98

New

  • Marketplace is on by default. Every project can now browse and install marketplace skills without a feature flag. Kortix Meet, Kortix Computer, and People Search are opt-in installs rather than part of the default set.
  • People Search. A new starter tool that searches LinkedIn profiles (backed by Apify), runs to completion without timeouts, and is billed per call.
  • Expanded skill library. A much larger set of default skills ships with every new project, and the auto-created "My First Project" now gets the full starter pack.
  • SCIM provisioning that just works. Error-free user provisioning from your IdP: invited users arrive active, PUT updates are supported, email lookups are dedup-safe, and Azure AD connector setup gets /ResourceTypes + /Schemas discovery. The SCIM setup dialog now shows the paste-ready absolute base URL.
  • SSO group auto-provisioning. An opt-in toggle creates groups (and their mappings) automatically from IdP claims on login, so directory structure flows into Kortix without manual setup. SSO and SCIM settings cards got status pills and visual group mappings.
  • Upgrades section. Projects have an Upgrades registry with a one-off prompt runner, so platform-side improvements (like a baseline refresh) can be applied to existing projects on demand.
  • Files is a standalone page with Google Drive-style colored folder tiles, out of the Customize overlay. Customize itself moves to a master-detail sidebar for agents, skills, and commands.
  • Warm prebake on push. Sandbox images warm when a commit lands — for every provider a session can use — so sessions on recently-active projects boot faster.
  • CLI: attach to a session. kortix can now attach directly to a running session's agent from the terminal.
  • Per-account concurrent-session limits. Accounts can carry a custom concurrent-session override, and hitting the limit now explains exactly what happened.
  • SDKs on npm. @kortix/sdk and @kortix/llm-catalog now publish to npm with every release, in lockstep with the platform version, joining @kortix/executor-sdk.

Improved

  • Sandboxes no longer idle for hours. An observe-idle reaper with 15-minute/5-minute TTLs, a busy probe, and a provider backstop stop stopped-but-billing dead time.
  • Agents automatically resume work when a turn is killed by a transient model-provider error, instead of stopping silently.
  • The LLM gateway no longer forwards empty completions: it retries the same model once, then fails over to the next candidate. Upstream provider errors now surface in the stream instead of hanging it.
  • The full member directory is visible to all account members (sensitive columns stay manager-only), and member counts reflect what the viewer can see. "Departments" are now "groups" throughout.
  • The PDF viewer opens at a comfortable zoom with the sidebar closed, and presentation viewers drop redundant download buttons.

Fixed

  • Change requests can no longer be empty. An agent that committed but never pushed used to produce a silent "No changes detected" change request; the push step is now enforced and empty CRs are rejected at open time.
  • Session lifecycle races. Starting a brand-new session no longer trips over its own creation (the create-vs-start race), deleting a session mid-provision can no longer resurrect it, the first prompt of a new session is no longer dropped while the agent restarts, a session page open on a stopped sandbox no longer hammers it with requests, and the create-first flow no longer bounces back to the project index.
  • The project-home composer keeps its text while navigating into the new session, and the sidebar flyout stays open while one of its menus is open.
  • Legacy daytona provider names are normalized at session create, so older projects keep working after the provider rename.
  • Suna migration pushes are now idempotent across pods and strip oversized blobs instead of failing.
  • Snapshot cache keys are scoped to in-sandbox inputs, so unrelated source changes no longer invalidate sandbox snapshots.
  • AgentMail inbox limits are handled gracefully instead of erroring the channel.
  • API and gateway origin load balancers only accept traffic from Cloudflare, closing a WAF-bypass path.
  • Gateway request logs strip NUL bytes before persisting, fixing a recurring database write error.

Internal

  • CI hardening: staging keeps its VERSION in sync on release, a duplicate migration was deduped before it could break deploys, staging QA runs behind Vercel SSO with a bypass token, the direct prod hotfix workflow is retired, and dependency/action versions are bumped across the board.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.97...v0.9.98

Read the full release on GitHub →

v0.9.97

This release ships two changes:

1. Per-account concurrent-session override (f162d38289) Concurrent-session caps were tier-only. Adds an operator-set per-account override (credit_accounts.max_concurrent_sessions; NULL = tier decides, a positive integer wins over the tier in both directions) and a clearer 429 message that includes the account's actual limit. Wired through session-create enforcement, trigger backpressure, and the billing account-state response.

2. Session-delete-mid-provision resurrection race fix (this promotion's second change) A session deleted while its sandbox was still provisioning could come back to life: the fire-and-forget provisioner had no status guards on its finish-of-provisioning writes, so a session deleted mid-provision could be flipped back to 'running' (and billed) after the user had already deleted it. Both finish-of-provisioning writes are now conditional on the session not having been deleted/archived in the meantime; two related hardening fixes close the same class of gap in continueSession's revival path and the stuck-session reaper sweep.

Migration: 20260706034600000_account_session_limit_override.sql

  • Adds nullable kortix.credit_accounts.max_concurrent_sessions (int)
  • Idempotent upsert seeding the internal Kortix dogfood account (3b1fc472-a90e-404f-823f-ca42f6b32e4d) with an effectively-uncapped override of 100000 This is the only migration pending between prod and staging.

Rollback: additive-only migration (ADD COLUMN IF NOT EXISTS + idempotent upsert), safe to leave in place. A bad release rolls back via Path 1 in docs/runbooks/rollback-procedure.md: revert the merge commit on prod (PR, reviewed, same gate as forward deploys) — Argo CD self-heals to the prior image tag. No down-migration is needed or defined (matches this repo's node-pg-migrate convention).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.96...v0.9.97

Read the full release on GitHub →

v0.9.96

Stops the infinite refresh/reconnect storm on the session page when a sandbox is stopped. A stopped box answers /kortix/health with 503; the frontend misread that as connected+booting and fast-polled every 150ms forever, which re-fired all health-gated file/SSE queries (walls of /global/event 503s, auth0 CORS redirects, /file/content?path=.opencode 400s). Now the 503 boot window is bounded (120s -> mark unreachable, 5s poll), and .opencode/.kortix/.git are never read as file content.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.95...v0.9.96

Release on GitHub →

v0.9.95

Agent sessions now automatically resume a turn killed by a transient provider failure (e.g. a model host stall ending in "Upstream idle timeout exceeded", connection resets, 5xx after retries) instead of surfacing a dead error turn. Root sessions only, max 3 resumes per 15 minutes with backoff, never for user aborts or auth/credit errors, kill switch KORTIX_TURN_AUTO_RESUME=0. Completes the v0.9.94 GLM routing fix.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.94...v0.9.95

Release on GitHub →

v0.9.94

Fixes the production "Upstream idle timeout exceeded" turn failures on GLM 5.2.

  • Managed glm-5.2 requests now carry OpenRouter provider routing preferences (order: [z-ai], fallbacks allowed) so they land on Z.AI's first-party endpoint (99.9% uptime, native fp8) instead of being load-balanced across ~20 hosts including low-uptime fp4 requantizations that stall mid-generation until OpenRouter kills the stream.
  • The LLM gateway now detects in-stream upstream error frames (a 200 stream carrying {"error": ...}) and settles the request as upstream_stream_error with a warn log, instead of tracing a dead turn as a success — this failure class is now visible and alertable.
  • Pre-content error frames keep flowing into the existing empty-completion retry/failover path (now regression-tested).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.93...v0.9.94

Release on GitHub →

v0.9.93

Fixed

  • The LLM gateway no longer returns a blank, empty reply when a model provider silently produces nothing (a rare but real upstream failure mode). It now retries the same provider a few times, then fails over to another configured provider if one is available, before ever giving up — so a transient provider hiccup resolves invisibly instead of showing up as an empty response.
  • The gateway strips stray NUL bytes from request/response logs before saving them, avoiding an occasional database error that could drop a log entry.
  • Fixed a case where the first message of a new session could fail right after an environment restart, instead of waiting for the runtime to come back up.
  • Made the internal migration step idempotent so it no longer depends on which pod happens to run it.
  • Narrowed an account-membership repair path to be safer and more precise.

Improved

  • Platform admins get read-only access to the project access gate for support/investigation, without full write access.
  • Projects can now override which sandbox provider they use on a per-project basis.
  • Slack identity verification is now enabled on staging, matching production.
  • Handle AgentMail inbox-limit errors gracefully instead of surfacing a raw failure.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.92...v0.9.93

Release on GitHub →

v0.9.92

New

  • Per-project sandbox provider override — pin a project to a specific sandbox provider (e.g. Platinum) from Customize → Settings, instead of always following the platform's weighted default.

Fixed

  • Sandboxes could fail on literally the first message in a silent retry loop, caused by a broken dependency bundle baked into the sandbox image. Sandbox image builds now verify the bundle actually works before shipping.
  • A new session's first prompt could be silently dropped right after sandbox startup, requiring a resend. The app now waits for the sandbox to finish restarting before sending the prompt.
  • Fixed a Postgres error that could interrupt request logging when an LLM request or response contained certain binary characters.
  • Fixed a migration bug that could strand a retry in a failed state instead of resuming cleanly.
  • Fixed an edge case in account membership repair.
  • Improved error handling when an AgentMail inbox hits its limit.

Internal

  • Restored the full staging release-verification pipeline (Vercel authentication bypass) after a temporary gate exclusion.
  • Removed the manual prod-hotfix workflow — all production changes now go through the standard promotion flow.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.91...v0.9.92

Read the full release on GitHub →

v0.9.91

Promote the staging hotfix that strips NUL bytes before persisting gateway request/response traces to gateway_request_logs, preventing Postgres 22P05 unsupported Unicode escape sequence alerts from recurring in production.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.90...v0.9.91

Release on GitHub →

v0.9.90

Fixed

  • The first message in a new session now runs reliably. Previously the very first prompt in a brand-new project could silently do nothing, leaving you to send it again. A new session briefly restarts the agent runtime to load its configuration, and the first message was being sent into that restart window and dropped. The first message now waits for the runtime to be ready before it's sent, so it lands on the first try.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.89...v0.9.90

Release on GitHub →

v0.9.89

Improved

  • Refreshed marketing site: a new Company-OS landing page with a Web / Slack / Teams / Mobile / CLI / SDK surface switcher and an interactive "your company, as files" explorer, a revamped enterprise hero, and a single "Request demo" flow across the site.
  • New blog: rebuilt as data-driven React pages (replacing MDX) with branded post covers, plus comparison write-ups (Claude Cowork; OpenClaw + Hermes; ChatGPT / Claude / Grok) covering bring-your-own-model cost and shared-vs-siloed work.
  • The mobile app download preview now shows real app screenshots instead of a placeholder mockup.
  • Cleaned up page titles and metadata so the title bar no longer repeats "Kortix".

Fixed

  • Default-agent sessions now see their connectors. Sessions running as the default agent were getting an empty connector grant, which hid shared Slack channel and computer connectors — they now resolve correctly.
  • Install-based connectors (Slack channel, computer) no longer show "connector not found" in the dashboard connector settings; they fall back to the live connector record.
  • The Agent Computer Tunnel is now a regular connector: a connected machine shows up as a connector automatically, without needing an experimental flag.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.88...v0.9.89

Release on GitHub →

v0.9.88

New

  • Guided project onboarding — new projects now open into a full-screen, step-by-step setup that walks you through connecting your tools and getting to your first run.
  • One /kortix Slack panel — a single Slack command opens a unified panel with a real model picker and per-project default models.
  • Desktop auto-update — the desktop app now updates itself, with a steadier always-on-top window.

Fixed

  • Dead show tool cards no longer render a confusing "File not found" card — they're hidden when the artifact is gone.
  • Stuck tool results now resolve themselves when a run finishes, instead of needing a page refresh.
  • The in-sandbox terminal correctly replays your prompt again.
  • AgentMail inbox-limit errors are handled gracefully instead of failing hard.
  • Tighter, safer account-membership repair.

Behind the scenes

  • Staging runs the full release gate behind Vercel SSO with the Slack identity gate enabled, and releases now go through promote only (the direct prod-hotfix path was removed).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.87...v0.9.88

Release on GitHub →

v0.9.87

Fixes

  • Deactivate session agent-lock (KORTIX_ENFORCE_SESSION_AGENT_LOCK, default off): no more AGENT_SWITCH_REQUIRES_NEW_SESSION 409, in-session agent switching works, and the first prompt of a new session no longer fails. Agent picker unlocked in the UI.
  • Send-retry: any sandbox 503 now rides the full boot/wake window (~29s) so a prompt to a waking box lands instead of reverting a message that actually ran.
  • deploy-prod self-heal: assert the Argo app tracks 'prod' and repoint a stranded break-glass rollback before the rollout wait.
  • Drata IaC CRITICAL fixed (scoped staging deploy secretsmanager perms); opt-in RELEASE_FAST_TRACK release lane.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.86...v0.9.87

Release on GitHub →

v0.9.86

Fixes

  • Stop the false AGENT_SWITCH_REQUIRES_NEW_SESSION 409 that blocked new sessions on the second message. The proxy now treats the default agent sentinel as non-binding and only blocks a genuine switch between two distinct concrete agents; for default sessions the echoed agent is stripped so OpenCode runs its booted default_agent.
  • Agent picker: clearer hover tooltip explaining a session's agent is fixed at start (start a new session to switch); switcher behavior unchanged.
  • Includes billing duplicate-suppression and Platinum snapshot upload fixes already on main.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.85...v0.9.86

Release on GitHub →

v0.9.85

Promotes the staged Slack identity and session access hardening plus the fresh-account /accounts/me bootstrap repair. Includes the live staging candidate at 79d43a7f with staging API health verified before production promotion.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.84...v0.9.85

Release on GitHub →

v0.9.84

  • Keep the Slack identity/session authorization release active in production.\n- Repair explicit legacy account memberships during project provisioning so fresh production users can create projects after /accounts returns a legacy account_id.\n- Preserve the normal account_members authorization gate after the repair and cover it with a managed-project provisioning regression test.\n- Verified staging API health for 0.9.84-staging.10fccfe9 and staging deploy live verification.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.83...v0.9.84

Release on GitHub →

v0.9.83

Promotes the Slack identity gate and access/authentication hardening with SLACK_REQUIRE_USER_IDENTITY enabled, plus the project-session agent binding fixes that prevent invalid agent switches and preserve default OpenCode agent behavior. Also includes the current main release candidate already validated on staging.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.82...v0.9.83

Release on GitHub →

v0.9.82

New

  • GLM 5.2 is now selectable directly in the model picker; the "Auto" model sits behind a flag.
  • Slack connect and request-access are separate steps now — connect right in a thread, and request access without being pushed through a connect flow first.
  • Slack access nudges arrive as a DM and an in-thread notice so they're harder to miss.
  • Agents no longer stop while they still have open to-dos — an always-on continuation check keeps a run going until its to-do list is actually finished.

Fixed

  • The file viewer now opens dot-directories like .opencode.
  • Free-tier and native Zen free-model availability resolve correctly in the model picker.
  • OAuth and other backend redirects pass straight through to the browser instead of being swallowed — no more blank page on some connect flows.
  • AgentMail inbox-limit errors are handled gracefully instead of failing the request.

Behind the scenes

  • Release and staging CI plumbing: Vercel SSO bypass so the staging release gate runs end-to-end, and removal of the direct prod-hotfix workflow in favor of the staging-only promotion path.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.81...v0.9.82

Release on GitHub →

v0.9.81

  • Return a CORS-safe 409 agentmail_inbox_limit response when AgentMail refuses inbox creation because the inbox quota is reached.
  • Remove the direct-to-prod hotfix workflow so urgent production fixes use the normal staging -> production promotion path.
  • Staging deployed and verified at 0.9.81-staging.74daf84b before promotion.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.80...v0.9.81

Release on GitHub →

v0.9.80

New

  • Connect Slack and email channels directly from the project view — set them up in place without leaving the page.
  • "Fix with agent" on a change request: when a merge is blocked by a manifest conflict, hand it to the agent to resolve it.

Fixed

  • Inbound email now reaches your agent. The AgentMail webhook endpoint had been dropped from the API, so replies to your agent's emails never started a session — restored it, along with the Slack identity-bind endpoint that was dropped with it.
  • Live preview proxy now caps its retry budget under the load-balancer idle timeout, so slow previews fail fast instead of hanging.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.79...v0.9.80

Release on GitHub →

v0.9.79

Promote the current staging candidate to production. Includes latest dev/staging changes through aab6ea55: maintenance/admin fixes, account filtering, project 404 UX, LLM provider UI/free-tier picker fixes, and Vercel prod branch deployment config.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.78...v0.9.79

Release on GitHub →

v0.9.78

New

  • Added the native Kortix marketplace runtime floor so new projects can start with curated skills, starter defaults, and marketplace install/update flows built into the project experience.
  • Expanded the Marketplace UI, CLI commands, registry handling, and project creation defaults so skills can be browsed, installed, updated, and carried into starter projects consistently.
  • Moved the managed LLM gateway into the default routing path behind the production master switch, with OpenRouter and Bedrock-backed managed model routing, AUTO model handling, and server-owned model configuration.
  • Added no-restart warm-fork and sandbox runtime improvements, including build-time catalog baking and credential hot-swap paths for faster agent startup without restarting OpenCode.
  • Added agent email channel support, Slack per-user identity controls, and improved channel/session selection behavior.

Improved

  • Hardened the dev, staging, and production release topology: staging is the release-candidate branch, production promotion retags tested staging images, prod rollback is image-aware, and staging/prod deploy workflows apply database migrations in the right environment.
  • Improved staging environment correctness, including staging database isolation, staging auth/runtime configuration, Daytona as the staging sandbox provider, and staging Cloudflare/API worker deployment.
  • Improved session reliability across browser, terminal, PTY, tunnel, file upload, PDF rendering, and first-prompt retry paths.
  • Improved frontend onboarding and project creation flows with marketplace starter selection, first-project bootstrap fixes, chat input polish, session sidebar persistence, and model picker stability.
  • Improved gateway observability and runtime behavior with structured run-path logging, managed catalog support, session cost display fixes, and live env handling for router tools.

Fixed

  • Fixed staging deploy dispatch, build, and promotion edge cases so staging image pins and release-source SHAs are preserved correctly for production retags.
  • Fixed multiple auth and environment regressions in staging, including server auth env alignment and runtime config validation.
  • Fixed CI and security scan issues around marketplace code, frontend build memory, Drata visibility gating, and staging QA/report publishing.
  • Fixed channel and connector bugs for AgentMail, Slack, email inbox binding, profile inbox defaults, and executor call routing.
  • Fixed warm snapshot and warm pool toggles so disabled settings remain disabled and stale build contexts self-heal.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.77...v0.9.78

Read the full release on GitHub →

v0.9.77

Improved

  • Faster, cheaper model calls: the LLM gateway now applies prefix prompt caching on the Bedrock and Anthropic transports, so shared context (system prompt, tools, history) isn't reprocessed on every request.

Fixed

  • Blocked previews no longer break: when a site refuses to be embedded, the agent shows a link to open the preview URL instead of an empty frame.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.76...v0.9.77

Release on GitHub →

v0.9.74

Gateway streaming improvement, reliability & more bedrock models

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.73...v0.9.74

Release on GitHub →

v0.9.73

Promotes latest main to production.

Highlights:

  • Slack native channel connector consolidation and CLI parity fixes.
  • DB migration backfills executor_connector_provider=channel on faked-baseline prod databases so Slack channel connector materialization works.
  • Live-schema deploy gate now checks enum values, preventing this drift class from recurring.
  • Includes latest main stability/dependency updates already green on main.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.72...v0.9.73

Release on GitHub →

v0.9.72

Redeploy stack

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.71...v0.9.72

Release on GitHub →

v0.9.71

LLM Gateway → production

Promotes the full LLM gateway to production — a per-project router with native cost & usage observability, served at gateway.kortix.com.

Highlights

  • Router — resolve → route → bill across OpenAI-compatible, Anthropic, Bedrock and Codex transports, with fallback chains and a circuit breaker.
  • Managed models — Kortix Power (Claude Sonnet) and Kortix Basic (Claude Haiku) on AWS Bedrock.
  • Per-project BYOK — bring your own provider keys, injected per session.
  • Live pricing — every LLM call priced from the live models.dev feed (24h refresh) with a 20% margin; no hardcoded price tables.
  • Observability — Overview, Cost (per-session LLM + sandbox compute), Usage (requests / tokens / latency / errors), Logs, Budgets, API keys, and a Playground.
  • Per-session cost — LLM + sandbox compute attributed per session.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.70...v0.9.71

Release on GitHub →

v0.9.70

Follow-up reliability fix: removes a too-aggressive internal sweep timeout that could under-cover scheduled triggers at scale, and corrects a false scheduler-stalled health signal. More consistent on-time trigger firing; no other user-facing change.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.69...v0.9.70

Release on GitHub →

v0.9.69

Scheduled triggers (crons) are now resilient — no single trigger can hold up the rest.

  • A slow or stuck trigger fire (e.g. resuming a sandbox) no longer blocks the scheduler: each fire is time-bounded and isolated, so one trigger can fail and retry while every other trigger keeps firing on schedule.
  • The scheduler self-heals — a stalled sweep is automatically reclaimed, so automations can't silently stop.
  • Hardened background-worker leadership so an API-only node can never sit on the scheduler lease without running it.
  • Added a stall watchdog + health signal so a frozen scheduler is surfaced immediately instead of going unnoticed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.68...v0.9.69

Release on GitHub →

v0.9.68

Fixes the production incident where sessions stuck in an active status with no live box ate the per-account concurrent-session cap — wedging Slack ("queued behind other project work") and 429'ing new sessions. Adds a DB-only reconcileStuckActiveSessions maintenance pass (immune to Daytona throttling) with a real-DB e2e, plus the already-merged /sessions list resilience (#3567) and the provider-agnostic Daytona billing reaper + orphan-box reaper. Also: honest, reason-aware Slack status messages (out-of-credits / at-cap / not-found).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.67...v0.9.68

Read the full release on GitHub →

v0.9.67

  • Stage scaffold.git for Daytona snapshot build contexts so template builds no longer fail before user Dockerfile steps.
  • Reuse the shared snapshot build-context path across providers to keep required files consistent.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.66...v0.9.67

Release on GitHub →

v0.9.66

Sandbox lifecycle + compute billing (headline)

  • Idle sandboxes now reliably auto-stop after 15 min of no real activity on every provider, and compute billing closes deterministically the moment a box stops — fixes sandboxes that kept running (and billing) for hours/days after work finished.
  • Provider-agnostic reaper (real provider state = source of truth; idleness keyed off real turns), quiesce so an open tab can't resurrect a finished box, Platinum reprovision-on-open, gateway per-session usage attribution, provider lifecycle webhooks (/v1/webhooks/sandbox/*) with the reaper as a zero-config backstop, and a billing-invariant monitor.

Also in this release

  • Executor unified into one CLI/MCP/SDK (#3541, #3549); OpenCode title sync (#3544); compact session digests (#3534); preview env-sync retries (#3538, #3539); revert Bedrock (#3545); credits never render as -0 (#3415); dep bumps.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.65...v0.9.66

Release on GitHub →

v0.9.65

Fixes an intermittent production session provisioning failure for private GitHub repos. The shared per-project git mirror now resolves stored project credentials before clone/fetch even when a tokenless background caller wins the refresh lock, preventing unauthenticated cold-cache clones. Git repository authentication failures are also categorized as git-auth instead of being misreported as a Daytona provider failure.

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.64...v0.9.65

Release on GitHub →

v0.9.64

  • Fix warm-pool claimed sessions so their sandbox token is re-scoped to the real session before the spare row is removed.
  • Restart/reconfigure OpenCode after claim so Executor MCP, LLM gateway, and project config are available for manual and cron trigger sessions.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.63...v0.9.64

Release on GitHub →

v0.9.63

New

  • Per-agent authorization — scope exactly what each agent can touch with [[agents]] in kortix.toml.
  • Instant session shell — sessions open immediately with an optimistic create and a shared composer, so there's no wait to start working.

Improved

  • Project home, configure, and composers now route through the instant shell for a snappier first interaction; workspace top bar refresh and background restored.
  • Warm pool is now per-template opt-in (no global cap) — templates that benefit from pre-warmed sandboxes get them without tying up capacity for those that don't.
  • The production backend now runs colocated with the database (London), cutting cross-region latency on every request.

Fixed

  • Slack: exactly-once turn dispatch and durable, atomic credit deduction — no more double answers or missed credits.
  • Terminal: fixed a PTY WebSocket reconnect loop when a JWT expired.
  • Warm pool: send the Daytona preview token on the park health probe.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.62...v0.9.63

Release on GitHub →

v0.9.62

Sandbox boot time improvements, UI improvements

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.60...v0.9.62

Release on GitHub →

v0.9.59

Redeploy

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.57...v0.9.59

Release on GitHub →

v0.9.57

Slack — fixed the dev/prod stuck-hourglass path by shipping the Slack schema/runtime hotfix and preserving canonical + bring-your-own webhook parity.

Invocation lifecycle — reapplied the unified session invocation engine so Slack, manual triggers, cron, webhooks, CLI, mobile, and web session creation share the same durable lifecycle path.

Triggers — webhook/manual/cron trigger fires now use durable queued invocation semantics under backpressure and record accepted queued fires in trigger runtime state.

Verification — dev API is serving 0.9.57-dev.845b5eda; /v1/health sampled cleanly; Slack canonical route rejects unsigned requests with 401; BYO manifest emits production/dev API webhook URLs correctly; trigger E2E and API typecheck passed before merge.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.56...v0.9.57

Release on GitHub →

v0.9.56

Sessions — more reliable runtime recovery and a refactored session lifecycle; terminal PTYs are now isolated per session; session branches are local-first and publish to origin lazily; the show tool fills the Actions panel height; the welcome wallpaper stays full-width when the side panel is open.

Browser & sharing — the browser preview stays mounted across panel switches; added public preview and file share links; Chromium for agent-browser is now baked into every session image.

Slack — clearer channel intro and App Home copy; unified canonical + bring-your-own into one manifest builder with per-project parity; the question tool no longer auto-answers outside Slack and is disabled in-thread.

Web — restored social avatar downloads and the full logo; added a /game-of-life page seeded from the Kortix logo.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.55...v0.9.56

Release on GitHub →

v0.9.55

This release focuses entirely on making sessions start faster and more reliably.

Improved

  • Sessions open faster. The computer behind a session now warms up earlier and is prefetched as you navigate, so there's less waiting before you can start typing. Under the hood we also trimmed cold-start time (lighter tool loading, a pre-warmed runtime baked into the image).
  • A single, clearer loading screen. Starting a session now shows one consistent loader with clear steps, instead of overlapping or flickering states.
  • Titles appear right away. A session picks up its title as soon as the agent names it, rather than staying unnamed until your next message.

Fixed

  • Sessions no longer get stuck on the loading screen — start-up now retries on its own when a transient hiccup (like a momentarily missing sandbox id) would previously leave it stranded.
  • Your first message stays visible while the session connects, instead of briefly disappearing.
  • Warm sandboxes are now prepared for the person actually opening the session, not always the project owner.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.54...v0.9.55

Release on GitHub →

v0.9.54

Session loading is now clean end-to-end:

  • The chat input no longer jumps to the top of the page while a session connects.
  • No more brandmark 'arcs' bleeding through behind the loader on a fresh session.
  • The loader and the session shell never show at the same time — connecting shows just the loader, ready shows the full session, never both at once.
  • More reliable Slack session handling (session lifecycle now goes through the unified openSession path).

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.52...v0.9.54

Release on GitHub →

v0.9.52

Sessions — unified, more reliable startup. Opening a session now runs through one server-driven endpoint that provisions, resumes, and connects the workspace in a single call, with a clean staged "Kortix Computer is starting" loader. Fixes the intermittent "stuck spinner until a hard refresh," removes a stale git-lock failure that could block session creation, and makes the connect flow predictable. Verified end-to-end on dev (project + session CRUD, repeatable cold starts ~17s).

Files. File reads now go through the sandbox daemon; the PDF and PPTX viewers were rebuilt.

Security. Session visibility is now enforced on the sandbox proxy daemon port, not just account membership.

Reliability. Warm-pool boxes that errored are swept automatically; pool boxes boot on the reliable region.

Integrations. Slack app expanded to 57 bot scopes with the AI Assistant enabled.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.51...v0.9.52

Release on GitHub →

v0.9.49

New

  • Connect your ChatGPT Plus/Pro subscription. Sign in once from a project's provider settings — or from the CLI with kortix providers login openai — and every session reuses it, no API key needed. It uses OpenAI's device login and stores the resulting credential encrypted, per project.
  • Skills tab is now a real file tree. Browse a project's skills as a navigable, recursive tree.

Improved

  • Slack is steadier. Agent questions no longer block a turn, so threads don't get stuck; a Slack thread now maps permanently to a single session that brings its own sandbox back as needed; and the flaky streaming widget was retired.
  • Executor accepts YAML OpenAPI specs, with hardened spec parsing.
  • CLI agents reach full programmatic parity, including parallel sub-agent orchestration.

Under the hood

  • More API memory headroom (dev + prod) so the new ChatGPT device login can't exhaust a pod.
  • Dev cluster tuning for low traffic (autoscaling and pod-disruption-budget adjustments).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.48...v0.9.49

Release on GitHub →

v0.9.48

ArgoCD bug in HPAs

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.45...v0.9.48

Release on GitHub →

v0.9.45

Health endpoint now shows memory of a pod

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.44...v0.9.45

Release on GitHub →