Secret delivery controls, unified connectors, and flat credit plans
New
17- Imported legacy Suna chats are now first-class: migrated sessions show up in the session list with a restore state (instead of a misleading "Done"), and opening one restores its full conversation history into the session. Files from every imported chat live in the project repo under
legacy/. (#6235, #6241, #6251) - Admin: an activity-analytics dashboard, a projects console, clearer tier labels, and admin-issued trials with per-account entitlement overrides. (#6244, #6249, #6250)
- Apps: serverless app deployments are provider-neutral — any Dockerfile runtime builds and serves (including non-root images), and the first request after idle reliably wakes the app. (#6253)
- Reloading a busy session asks before stopping the running turn, and says clearly when a turn was stopped.
- Secret delivery controls. Decide exactly which secrets each agent session can use. Policies are managed from the web app and CLI, secrets reach sandboxes through an audited HTTPS broker with session-scoped handles, revoked secrets disappear from running agents, and LLM, connector, git, and subscription credentials are isolated from each other. A new
kortix auditCLI command reads the account audit trail. - Unified connectors. One connector model across web, CLI, SDK, and API: consistent Connector and Connection terminology, a single data plane in
@kortix/sdk, and connector credentials that bind to project secrets. The connector catalogue now pages through the full ~2,700-app list instead of stopping at 192. - Flat credit plans. Plans are priced as flat monthly credits instead of per-seat pricing. Billing also gained idempotent compute debits and accurate spend reporting.
- Rebuilt project onboarding. A single-column, seven-step flow with a clearer Slack setup and plan selection.
- Capability pages. Connectors, skills, and agents are browsable pages instead of a configuration overlay.
- Use-case packs. Marketplace runbooks are grouped into installable packs, with real loading and error states and inline project creation.
- Document conversion by default. Every new sandbox includes a convert-documents-to-markdown skill backed by a baked-in converter.
- Serverless app deployments. Provider-neutral serverless deployments for apps, served behind a managed edge with wildcard TLS and signed public hosts.
- Kimi K3 is available as a managed model.
- One-shot approval links: approve or reject an agent's pending request straight from the notification link, without opening the app.
- Sandboxes now ship with a baked-in Python package floor — Pillow, pypdfium2, pytesseract, and 13 more pinned packages — so document and image skills run immediately, with no install step.
- The session header warns when an agent's configuration changed on disk after the session started, with a one-click reload that updates the files the agent actually reads.
- Terms of Service are linked from /legal/terms.
Improvements
13- Setup links: secret links now last 7 days, an expired link says it expired instead of "invalid", and completing one notifies the waiting session immediately. (#6240)
- Faster navigation between projects and sessions: one cache entry per entity, and route segments are no longer discarded on the way. (#6231)
- Browser tabs are named after the session you have open. (#6236)
- Sessions survive interruptions. A pending agent question is parked when its sandbox dies and restored on the next boot, and a stored answer is delivered as a follow-up turn. Runtime updates boot and verify the new runtime before retiring the old one.
- Chat UX. Instant session rename, a truthful header title, idempotent provisioning, preview verdicts, and grouped activity. In-flight sends survive navigation, and tool failures are reported honestly.
- Session list. Rebuilt with status states, collapsible sections, and a nested filter menu.
- Faster, calmer navigation. Project pages load faster (Next.js 16.3), and passively opening a project no longer wakes idle sandboxes.
- Clearer errors. The LLM gateway surfaces real upstream provider errors instead of a generic Bad Gateway, and large repository branch listings are bounded.
- Project page navigation is noticeably faster, and the web app moved to Next.js 16.2.0.
- Messages queued while the agent is working now stay queued until the turn actually ends — no more mid-turn releases or duplicate sends.
- One keyboard shortcut (⌘I / Ctrl+I) now toggles the whole right side of a session: the action panel, a detail panel, or both.
- Session error states are clearer: tool failures are reported truthfully, retry states show what is happening, and a stale agent config no longer needs a page reload to surface.
- The CLI is quieter and more honest:
--quietis honoured on every path, and it no longer claims an invite email was sent when none was.
Fixes
19- Billing: subscriptions activate only after the first invoice is paid; compute metering opens and closes windows atomically with precise start times; sandbox resume reconciliation is fenced so a wake race can't double-bill; a ledger row can no longer be both usage and an admin debit. (#6247, #6248)
- The terminal stays attached when the session runtime restarts during a reload.
- Removed noisy request-timeout toasts.
- Firefox no longer shows a crash message from the background shader when WebGL is unavailable. (#6254)
- The local Docker sandbox provider. Sessions run on cloud sandboxes.
- Billing: the same compute window can no longer be charged twice, "spend this period" reports the correct window, the paid seat is released when SCIM deprovisions a member, BYOK failover respects the managed-model entitlement, and the UI shows the concurrency limit the server actually enforces.
- Agent workspaces are strictly enforced across repository, git, and clone APIs.
- Approvals require a full review of each call, and the daemon no longer auto-answers questions outside a channel session.
- The Terms of Service link opens the document directly.
- Desktop: the title bar aligns with the OS window controls.
- Production API recovery is hardened: migration-safe restarts and better behavior under memory pressure.
- Transactional email — team invites, project access requests, and demo-request notifications — now goes through a chain of email providers. If one provider fails or is unavailable, the next one takes over automatically. This removes the single point of failure that delayed some emails on August 5.
- The Terms of Service link now opens the document directly instead of its containing folder.
- End-to-end cost tests compute gap-fill counts from their own time window, fixing a flaky check.
- Hardened the sandbox: closed a proxy hole that could leak the sandbox service key to an attacker-named host, closed a DNS-rebind window by connecting only to the address that was vetted, resolved symlinks before authorizing file paths, and stopped one session's credentials from being served to other members of the account.
- Secrets: setup links now expire on time, re-scoped secrets validate against the session owner rather than the caller, and secret identifiers are no longer disclosed through the narrowing report.
- Session reliability: removed two paths that could silently destroy a session's commits, a planned restart now finishes the turn it interrupts, a failed agent spawn schedules a respawn instead of killing the session, and reloading an agent never hard-resets the session branch.
- A transient git failure can no longer compile an agent with an empty prompt.
- Queued API errors: address-validation failures now return a proper 400 instead of a server error.