September 21 – 27, 2026

Your own keys in Slack, Teams and the CLI, and sessions that open instantly

New

Share connector accounts with specific groups, specific people, or everyone in the project. Anything can also be granted to everyone in a project.
Mobile push notifications when a turn completes, fails, asks a question, or needs a permission, even while the app is closed. Transcripts can also be shared as a public link from mobile.
pi.dev packages. pi sessions can load any extension from pi.dev, per project, per agent, or for every session.
Claude Code on the gateway. Claude Code works fully against /v1/messages, and ChatGPT models work from a gateway key.
Grouped outputs. When the agent shows several results in a row, such as two screenshots, the session renders one tabbed card instead of a card per result.
Managed model routes. Each Kortix-managed model routes through its own provider route, and the model picker shows the price for each route.
Wake failures are explained. When a sandbox fails to wake, the session page shows the failure and when it retries.
Your own keys and ChatGPT everywhere. Models you reach through your own API keys, keys shared with you, project keys, and ChatGPT subscriptions are available in Teams, Slack and the CLI, not only the web picker.
Members bring their own ChatGPT subscription, without needing permission to manage project secrets.
Saved sessions open on their conversation. Opening an existing session shows skeleton rows shaped like that session while it loads, instead of the full-screen boot screen.
Command palette. ⌘K opens instantly at a fixed position, and search can copy your account, project and session IDs.
Connect cards name the app they connect, and render as cards even when an agent writes them in a table.
Mobile: dictation in the composer, labelled queue controls with undo, and + only attaches.
SSO domain verification. An enterprise account verifies its email domain with a DNS TXT record before SSO is enforced for it. Existing SSO setups keep working.
An audit log you can read. Every entry shows a readable title instead of a raw route, in all nine languages. Every API route and event now has a label, and kortix audit ls prints the same titles in the terminal.
More outcomes are audited: sandbox-provider transitions, App deployments, branch cleanup (one entry per deleted remote branch), and an expired tunnel permission. Background jobs run each tick as a named worker, so their work is attributable.
Agents act as their own principal by default. An agent has its own identity and permissions rather than borrowing the person who started it.
Apps are a per-agent resource in both the editor and the CLI.
Reply to several passages at once with inline quote blocks.
GPT-6 Sol and GPT-6 Luna are available through a connected ChatGPT subscription.
Agents act as their own principal. An agent session now acts as the agent, on behalf of the person who started it, and every audit event records both. The kortix_cli permission scope is now kortix_permissions.
Microsoft Teams is complete. Agent questions, images, and the remaining Teams flows now work like Slack.
Saved history works while the sandbox is off. Session transcripts and their attachments load on web, SDK, and CLI without waking the sandbox.
Mermaid previews. .mmd and .mermaid files render as diagrams in the file viewer.
Mobile app revamp. New primitives, a project stack, and session chat parity with web. Session logic is now shared through @kortix/sdk.
Let owners and admins open every session. An owner can turn on an account policy that gives owners and admins access to every session in the account. It is off by default, only an owner can change it, and every session opened this way is recorded in the audit log.
See who owns each session. The Sessions page shows each session's owner and filters by owner and by access.
Pick a project from a Slack-style selector. /projects lists your projects and opens them in place.
Stop a run from Slack or Teams. The live card has a Stop button, and Teams also gets /stop. /status in Teams shows the current run and links to it.
Bring your own Teams bot with a three-step setup wizard.
Review decisions carry a reason. Request changes in Slack or Teams and say what should change.
Answer questions in Teams directly. The question card answers what was actually asked, and a tapped answer keeps the question it answered.
Edit a person's account role from a group's member list. You no longer have to leave the group to change what someone is.
A turn tells you how it ended. Every turn carries one typed outcome, so a failed turn reports the recorded cause instead of a blank row — and a turn you stopped yourself is recorded as stopped, not as a failure. GET /turn lists failed turns with the reason each one ended.
A workspace chooser on the way in. Signing in shows your workspaces and any pending invites rather than silently creating a project for you. With no workspaces yet, the chooser is the create form.
Every account member can mint and revoke their own personal access token. It no longer takes an owner.
Teams asks with a card. The question tool renders a real card with inputs, dropdowns and toggles behind one Submit, and replies in a group chat continue the session without a mention.
Kortix in the terminal (experimental). kortix tui opens a full terminal client: sidebar with accounts, projects and grouped sessions; session transcript with tool cards and interactive prompts; a composer with a command palette and model, effort and agent pickers; Files, Review, Apps and Customize screens; an embedded terminal; and opencode attach mode. It installs its own binary on first run, so the CLI stays small.
Microsoft Teams. Run an agent from a channel, a group chat, or a direct message. Thread replies continue the same session without a new mention. Files work both ways: inline images reach the agent, and results upload to the team drive with a link back. Join policies (open, owner-approval, owner-only) match Slack, with an Approve/Deny card and /policy. When a tenant has several projects and nothing is bound yet, Teams asks which project to use and replays the message you already sent. The agent's markdown renders as card elements — headings, tables, bold, monospace code — with step source citations.
Split a kortix.yaml across files. An imports: list pulls agents, connectors and triggers in from other files, and every connector and agent records which file declared it. The CLI, the manifest reference and the scheduling docs all understand it.
Replace a project's repository. Point an existing project at a different repository, authorized per repository rather than per account.
Every managed Kortix model now accepts images. The lineup moved to the Morph catalog with Kimi K3 and GLM Flash, plus text-only DeepSeek V4 Pro. Text-only models are hidden rather than offered and then refused.
Model pricing and data handling are visible before you pick. The model manager shows each managed model's modalities, its zero-retention status, and which connected account pays. Regional options cover US-only and EU inference, with the retention terms stated.

Improvements

Opening a session shows its saved history immediately from cache while the live transcript loads, in one request instead of several.
Turns start faster: configuration, model catalog and ingress checks run in parallel.
Sessions retry transient model errors inside the turn and continue through short provider outages instead of stopping.
A session whose runtime was lost resumes automatically when it was running unattended.
The sandbox model catalog stays current across boot, wake, restart and every turn.
Streaming responses never forward a partial event line; a stream cut before the first byte is retried, and a later cut ends with an explicit error.
The kortixt terminal desk adds cloud sessions, port forwarding, a Links panel and a self-updating launcher.
Managed models route through their OpenRouter pools by default; direct Morph routing is off unless an operator enables it.
Gateway request logs break admission time down by step: preparation, admission, routing, resolution and billing.
Gateway request logs split latency into admission time and upstream wait.
The Settings panel and icon pickers load on demand, so the app opens faster.
The connector catalog resolves connectors concurrently.
Avatars render from generated paths instead of loading the full icon set.
Branch listings for views are faster, and Composio auth configuration is served from cache while it refreshes.
Sessions resolve their connectors in one batched lookup, and Composio discovery serves cached results while it refreshes.
Faster page loads and API responses: cached git reads, fewer browser preflight requests, fewer repeated queries, and smaller payloads.
The marketing pages are static and ship about 80% less JavaScript, and opening a session is faster.
Mobile: onboarding, drafts, a reworked drawer header, connectors, a "Needs you" view, session chrome, the browser toolbar, plan rings and sheet contrast.
Desktop: native window controls, sidebar and settings alignment, the collapsed sidebar accepts clicks again, and the Customize sidebar toggle stays clickable.
File attachments now go through OpenAPI and HTTP connectors.
Kortix-managed models route through Morph first, with a confirmed-US, zero-retention failover when it is unavailable.
Mobile: attachments upload through the shared SDK, a session starts optimistically, and there is a Members page.
Download is a visible primary action in the file viewers.
Session layout: a centered session column, sub-agent tree lines, neutral queued-message bubbles, tighter connector intake spacing, and a working send from project home.
Sandbox memory guard: a turn stops only on real memory pressure, and every stop says why.
Sending from the project home sends the message instead of freezing the input, and the composer stays in one place through the send.
A session that wakes fills in its saved history.
The waiting indicator stops while a turn is waiting on you.
When a session cannot start, the reason is shown instead of a generic error.
Long sessions finish a turn and stop faster: ending a turn and pressing Stop no longer re-read or re-write the whole conversation.
Saved history keeps loading older messages while the sandbox is down.
Members see only what they can change: session settings, the model picker and the sandbox notice no longer show account-level controls they cannot use.
Members can open the Sessions page.
The notice about a project's previous repository is a dismissible card with one clear update action, in plain language.
A new API key or ChatGPT account is private by default. The Add dialog opens with "Specific members" selected and you already on the list, so sharing a key with everyone in the project is an explicit choice rather than the default.
One place to pick provider keys for a session, and the choice saves.
The model picker collapses every provider group, and the zero-retention and US-inference facts sit on one line instead of a banner.
An image sent to a channel never runs on a model the agent is not allowed to use; the pin is checked per message rather than trusted from the catalog.
Deleting a project from Settings redirects instead of leaving you on a dead page.
Resuming a session keeps the repository workspaces it had before.
Session transcripts stay complete. A session accepts messages while its transcript history starts the runtime, so you are not waiting on a sandbox to type.
Attachments are stored before the sandbox starts, so a file sent with the first message is still there when the agent reads it. Older sessions recover attachments that previous versions could not read back.
Teams replies post faster: the live card goes up before identity resolution, and the webhook acknowledges before dispatch.
Provider keys keep your draft while saving, and the provider list collapses to a count so the managed set stays in view.
Group and member pages stay current after a directory update, and attaching a group to a project now grants its agents.
Deployments report why a rollout failed instead of only that it timed out, and a container starts faster.

Fixes

99+

Turns were sometimes marked abandoned while still running.
Transcript requests could return 401 during a session.
Stopped sandboxes could stay running after their session ended.
Orphan cleanup only stops sandboxes that this deployment's database owns.
Snapshot cleanup now removes images left behind by deleted App deployments, so new sandbox images keep building instead of hitting the provider quota.
Turning off session oversight takes effect immediately on every server. Admins can no longer open a member's private session for a few seconds afterwards.
A production deploy no longer briefly runs the database out of connections. Session start, stop and model listing stay available while a new version rolls out.
The admin console's account list uses an index and no longer times out. A slow query now returns a clear error instead of raw database text.
Audit events that hit database lock contention are retried with backoff instead of being dropped.
A session start whose repository clone fails now stops after its retry limit instead of retrying forever.
A long run whose first prompt has not loaded yet still reads in order.
A sandbox's binaries update at a turn boundary instead of waiting for a restart.
A restart failure is no longer reported as a lost computer before the provider is asked, and a removed parked box is recovered first.
A parked session stays stopped under passive traffic, and the app stops polling a parked or unreachable sandbox.
Unconfigured sessions use the project's shared ChatGPT accounts.
Bring-your-own Anthropic-compatible providers respect their configured base URL.
A session name set at creation is kept.
The session audit view loads without 25-second timeouts.
Interleaved text in streamed Anthropic responses opens its own content block.
An invalid Composio toolkit returns a clear error instead of a server error.
Tool output is parsed in linear time on web, mobile and the SDK.
Several browser errors no longer surface as app errors.
Project routes always run authentication before the route handler.
Mobile Review merges work and feel instant, with change-request cards in sessions.
Historical session dates and activity ordering are restored for migrated sessions.
The web app no longer hits React error #467 while loading translations.
A live session's transcript recovers when a turn ends even if the working signal was missed.
A session idle for more than a day wakes again, and a failed start is recovered instead of reported lost.
A config update never interrupts the turn it finds running.
Kortix owns the kortix and opencode binaries inside a managed sandbox, so a box cannot end up on a version Kortix cannot heal.
The file viewer reloads when the explorer switches between the live workspace and the saved copy.
X and other Composio toolkits with their own OAuth connect again, and the Connected tab stays current.
Git pushes on branch commits retry a transient failure.
Audit writes for one session no longer queue behind each other.
A requested Stop keeps its reason in the turn history.
Several browser errors from extensions, GPU drivers, closed parent windows and tab discards no longer surface as app errors.
One Stop during a session's first turn no longer makes every later turn end immediately, and a Stop during start-up releases the held prompt.
A healthy Slack run is no longer closed as idle after 30 minutes of quiet work.
A saved secret that is not granted to the session's agent is now reported as "not granted to this agent" instead of silently missing, and an agent session can sync its own secrets.
In web terminals on custom Debian templates, Kortix tools stay on PATH and secrets load in login shells.
An open file viewer refreshes when the agent edits the file.
A turn that fails mid-stream shows one readable line naming the model, with details folded away.
Streaming from OpenAI-compatible models that omit event separators no longer fails to parse.
The web app detects the end of a turn reliably.
Creating a session no longer fails with a server error when a transient git-mirror fetch fails; it retries instead.
A trigger or channel prompt no longer freezes the mobile app.
A request that changes nothing no longer records a change in the audit log, and a rate-limited request no longer stores the path it was refused on.
A git push no longer shares its upstream connection with another push.
OpenAI and Anthropic models are never presented as Kortix-managed.
Quote splitting trims newlines in one pass.
A git request that cannot get its repository credential now fails with a clear, retryable error instead of a misleading "repository not found", and a brief credential failure is retried before anyone sees it.
Session turns no longer render out of order after prompts sent from the CLI.
On the desktop app, Back is clickable again on sign-in, /projects, /new and onboarding, and the window can still be dragged from those pages.
The shader wallpaper compiles again; its uniform names used a form GPUs reject.
When memory runs out because of files held in RAM, the memory guard now names them instead of reporting only that the turn stopped.
An agent merging its own change request no longer gets a false "changes agents or triggers" refusal right after a push; the check reads the current branches.
An App's Access list shows an agent grant right after it is saved.
Slack: in a workspace with more than one Kortix Slack app, an app no longer answers replies in another project's thread, so the right bot replies again.
BYOK billing: sessions on your own provider key are never charged Kortix credits, and usage is attributed correctly.
CLI: kortix sessions rm retries a stalled delete instead of hanging.
Git: shallow pushes are accepted.
Usage descriptions are fully localized.
Internal: the Pi raw event envelope carries its own id; commit hooks block customer data and work in older worktrees; release-gate test fixes.
Creating a project during a GitHub rate limit now tells you to retry and when, instead of failing.
Rebuilding a sandbox image that is still in use explains why it cannot proceed.
Restarting or starting a session no longer erases what another in-flight request recorded about it.
Session-access audit entries are translated.
A turn that ends by asking you something is no longer reported as "Task complete" in Slack or Teams, and neither is a review still waiting on you.
A run you stopped on purpose no longer shows as "Run failed" in Teams.
A failed start is reported as a failure rather than going quiet.
A Teams review decision requires access to the project.
The Teams agent picker offers only agents you may run.
Teams cards no longer show Slack-style formatting.
A Teams conversation always shows its name, never a raw id.
kortix sessions reads a stopped session's saved transcript.
Sessions stay usable after the project's repository changes.
Every role assignment is checked against the owner ceiling, so an assignment cannot grant more than the person making it holds.
A failed turn with no named cause now says it stopped, rather than showing nothing.
The stale-turn sweep aborts the runtime turn, not just its card.
An unresolvable agent grant now fails closed for codex models instead of quietly picking a model the agent may not use.
An unowned conversation returns "not found" rather than "forbidden", so it cannot be used to probe what exists.
A form field id containing a comma is rejected.
An audit entry for the new account-invites route renders with a readable label.
Release publishing no longer depends on the npm registry: a registry failure can no longer cost a release its tag, its downloads or its changelog entry, and the release refuses to publish with missing downloads.
Sandbox compute is metered on free and trial accounts. It was not, so usage on those accounts went unbilled.
Starting a session, sending a prompt and waking an App no longer debit a cent each. Those actions placed a charge they should never have placed.
Adding a tool authorizes the project's account, not the clicker's. The connection was being created as a private one owned by whoever clicked, so nobody else — and no scheduled run — could use it, while the UI reported it connected.
A prompt sent before the model catalog finished loading was dropped. It is now held and sent.
The model picker spun forever for every project member, and for a project with no id.
A sent message came back as the project-home draft.
The session sidebar reordered itself while you were reading it.
An idle session's Files panel showed a permanent spinner instead of its files.
The Teams source filter crashed the project page.
Removing an attachment whose upload was still starting left it behind for a day and counted against the attachment limit.
Sessions resumed after a pause no longer fail on stale provider credentials.
Repository controls stay visible and readable at the minimum window size, and the replacement flow is fully translated.
Teams session titles, sidebar entries and channel cards no longer show raw <at> mention markup.
A Teams turn that died mid-flight no longer wedges the conversation.
Bot tokens are sent only to Bot Framework attachment hosts, and a team-drive upload is authorized against the conversation it belongs to.
An out-of-range attachment part now reports "not found" instead of "not active", so a caller can tell a permanent error from a temporary one.
An emptied imported collection stays an empty list rather than becoming an empty object.
projects upgrade in the CLI now prompts with the same wording as the dashboard.

Run your whole company from one repo you own.

Run your whole company from one repo you own.

Your own keys in Slack, Teams and the CLI, and sessions that open instantly

New

Improvements

Fixes