September 28 – October 4, 2026

Session labels, a redesigned approval flow, and long sessions that compact instead of failing.

New

Fork a conversation. A session's conversation offers a Fork action, so you can branch from any point.
Cancel a subscription from the billing pane.
One permission per topic. The broad project.customize.* permissions are replaced by project.settings.write, project.sandbox.write, and project.model.read/.write. Agent changes use project.agent.write. Every role keeps exactly what it had. Project members can now open Agents and Triggers read-only.
Permissions decide, for agents as for people. An agent that holds a permission can do the work end to end. kortix_permissions: all, "*", and any list that contains "*" mean the same thing. With all, an agent can also manage project members and delete the project. Creating credentials stays with people.
An agent can grant only what it holds. When an agent edits an agent's permissions, connectors, secrets, or Apps, it can add only what it holds itself. This applies through every route, change request, and push. An agent that does not hold every grant opens a change request instead of pushing the default branch directly.
One authorization path. Every agent with a kortix_permissions grant acts as itself, in every project. The per-project switch back to the authority of the person who started it is gone.
One bad permission entry no longer empties an agent. An entry Kortix cannot grant is skipped, and the rest of the agent's grant stays. kortix validate still reports it.
The Meta agent is platform-owned. It runs read-only and appears first in the agent picker.
No more active-session limits. Billing is the only limit on how many sessions run at once.
The blog is served from its own app at /blog.
Your computer, on the web. Each physical computer appears once, even after you re-pair it. Computer Use runs inside the Kortix desktop app, and it asks for every macOS permission right after you connect. Pairings with no hardware id that stay silent for 30 days are removed.
Edit a queued prompt in place. The prompt queue sits in its own card above the composer.
Review Center has its own page. You approve requests in a modal on the approve page.
Channel bindings live in one dialog, with one tab per platform and a settings dialog for each binding. Teams bindings read "Team › Channel" and include the thread title.
Shared sessions show who sent each message, with an avatar per sender.
Marketplace redesign: one card per item, a file tree in the sidebar, and related skills.
A new /developers page. Its "copy prompt command" output now pastes safely into any POSIX shell.
One-day personal API keys. You can create a key that expires after one day.
Apps on mobile: a new Apps tab in the project drawer.
Show files name the file in a hover card.
Microsoft Teams is on for every project. There is no feature flag to turn on: connect Teams from the project's Connectors → Channels page. A tenant admin consents once, or the project brings its own bot. A project that connected Teams while it was a flag keeps its install. @kortix/sdk keeps teams as a deprecated flag key that always reports enabled. (#8601, #8603)
What Kortix says to one person in Teams stays with that person. In a channel or group chat, only that person sees: - the prompt to connect an account or request access, with the connect button right in the thread; - command replies; - why a message did not run; - approval requests and decisions. Teams marks these "Only you can see this message", as Slack does. The shared "Working on it…" card appears only when the message can run. (#8609)
Kortix shows when your Teams app is out of date. When your organization's Teams catalog has an older Kortix app, the Channels page and kortix channels status say so and name the two steps: a Teams admin publishes the update, then a team owner updates the app in each team where Teams offers it. A Teams thread that the agent may not read now comes back with who fixes it, instead of Microsoft's error alone. The Teams app moves to version 1.6.1. (#8624)
A failing trigger is no longer silent. When a trigger's run fails, the Schedule page shows the trigger as failed with the reason, and the account owner gets one push when a failure streak starts, not one per fire. The next run that finishes clears it. A reused session that grew too large to compact is retired, so the next fire starts a fresh one. (#8586, #8588)
Human Messaging reaches every agent surface (projects with the Human Messaging feature on). Agents in sessions, Slack, Teams and the hosted MCP server know how to ask a person and answer back, and the mobile app groups what people asked you under "Asked you". An ask from a session runs the asking session's own agent. (#8622, #8623)
Share a secret or a connector account with an agent. "Who can use it" now offers agents next to people and groups. A value shared with an agent reaches every session of that agent, triggers and schedules included; running the agent stays gated by its own access. A secret link can keep the value to the person who asked. kortix secrets share --agent <name> does the same from the CLI. (#8635, #8638)
Approve or deny a connector call from the Review Center header, next to Back, as for a change request. Deny takes an optional note that reaches the agent. Long parameter values collapse behind Show more. (#8641)
An agent's ask names the agent, not the session title, in "Asked you" (Human Messaging projects). With the Human Messaging feature off, it no longer appears anywhere. (#8626, #8637)
Every prompt records who wrote it, and the transcript shows the author.
Agents can ask a person a question or start a group conversation with people, behind the human_messaging project flag (off by default).
Sessions carry writable labels and metadata across the API, SDK, CLI, MCP and web, and the session list filters by label.
Redesigned approval, preview and install consent screens.
A split "Connect your computer" dialog with one-click CLI copy.
Recent session views stay open across project navigation; the command palette finds sessions by ID.
The desktop app copies the current session URL from the Go menu and reports sanitized crash telemetry.
Push notifications route by browser presence: a session open in a tab does not also push.
Project-bound agents get their own cost rollups.
kortix apps access --viewer, and the CLI lints manifest wiring references.
The pi harness loads repository-native Pi configuration and supports config releases.
Each agent's OpenCode plugins load in isolation.
Sign in to OpenCode Go with your OpenCode account from a sign-in card, instead of pasting a key; each provider now has its own key name.
Connector discovery is on by default for every project.
Choose who can use a secret's value: only you, everyone, or chosen people and groups.
Manifest v3: agents boot from kortix.yaml.
Computers are connector accounts like any other: the same row, the same Share dialog (people, groups or everyone), and one registration per machine.
The audit trail shows Via for each event: the credential the API authenticated (browser session, personal access token, connected app, session token, API key, service account or SCIM token), never a self-reported client label.
The hosted MCP server reaches full kortix CLI parity through a sandboxed kortix tool, and serves project skills.
Connectors are first-class MCP tools.
Projects can run their sessions in the US East region.
A GDPR-complete privacy policy and a public subprocessors page at /legal/subprocessors.
Local mode: connect your computer from the desktop app. Each computer is a connector account with access approval, and the tunnel keeps running in the background while the app is closed.
Microsoft Teams reaches Slack parity: direct messages, a connected note, a home tab, message actions, edit and delete, /unbind, /status buttons, /sessions, the full agent picker, review cards, and call-to-action links as buttons.
Saved session history is always on, and a reload shows the newer saved copy.
Mobile: an empty session opens on its composer, messages queue while the computer wakes, and sub-agents show their saved steps.
A redesigned Create a project page. New accounts get their name during onboarding, not from the email address.
Sessions list as a tree that shows who started each run, with server-side search.
Copy a session ID or link from the session menu.
One account-level MCP server at /v1/mcp, bound to your token like the CLI. It exposes sandbox shell and files, skills, and the session list; long commands run as jobs, and connected apps can be listed and revoked. kortix mcp runs the whole CLI as an MCP server, and a Connect MCP menu sets it up.
The LLM gateway accepts the OpenAI Responses API, so the Codex CLI works against Kortix.
Reminders: schedule prompts into a session, with a Reminders view and a per-project flag.
Approvals: the agent describes each gated call, the approver can reply, and approval cards reach Slack and Teams.
New projects get a three-step onboarding and a first chat.
GitHub projects can be created under personal GitHub accounts, and their sessions start.
Sandbox templates can run Docker inside the sandbox.
Agents can store secrets they already have, and long setup links load.
ChatGPT accounts show when they need reconnection, and a failed ChatGPT turn offers Reconnect or Connect ChatGPT.
Saved session history is 1:1 with the live session and on by default, including sub-agents.
The mobile app signs in to self-hosted Kortix instances.
Slack: a session's Slack thread is bound automatically so replies come back to it, and the agent can remove its own reactions.
The CLI saves large connector results as JSON (--out, and MCP results above 16 KB).

Improvements

Sign-in: an existing account opens on the password form, and the email link is one click away. After you enroll in two-factor authentication, sign-in asks for the code. A magic link still completes when its verifier cookie is lost. A failed server sign-out is reported on the sign-in page.
Security settings list the devices that are signed in.
Account deletion: "Delete immediately" deletes the account, and the dialog reads as a choice.
Creating a project lands you on the project page.
The session key panel says whose keys a session reaches, and why a key is not available.
Connectors: Computers appear under Connected only after a machine is paired, and connector notes display the same way on every surface.
The audit log: reconciliation catches up on accounts with very large histories.
The API returns 400 for a malformed account id, and a marketplace install fails clearly when no model can serve its import.
Database health: more RLS policies evaluate the signed-in user once per query, and legacy tables gain primary keys and missing indexes.
A change-request merge that edits agents, triggers, or default_agent needs the same permission as the direct route.
The download links (/download/macos, /windows, /linux) fall back to the releases page after 3 seconds if GitHub does not answer.
Deleting a sign-in removes the accounts that only that person belonged to, and revokes all of that person's credentials.
The manager's session inventory no longer lists deleted warm drafts.
Audit log, rebuilt. Events are written to weekly partitions with time-ordered ids, without the per-session lock that slowed ingestion. Noise rows (missing-secret probes, a login event per request) are gone. Weeks older than 90 days move to S3 under Object Lock, and exports read archived weeks too.
The agent harness: Kortix tools run on both supported harnesses, and the web, CLI, and mobile clients render from the Kortix session contract.
Slack: messages name people and channels instead of showing ids, and plan steps render channels natively. Agent history and thread reads name each author. Slack shows its own logo everywhere.
Connectors: discovery tries managed connectors first, with explicit API and MCP sources. Discovery still works when a spec source cannot load.
Sandbox file uploads send 8 MiB requests, so a 1 MiB file uploads in about 2 s instead of 20 s.
Sessions honor US compute placement and reuse warm sessions. Warm sessions you are billed for stay visible in the session list. You can switch agents in a started session, and the locked agent picker explains why it is locked.
Each sandbox sends its calls to its own regional control plane.
Database health: RLS policies evaluate the signed-in user once per query, duplicate indexes are dropped, foreign keys are indexed, and unused legacy tables are removed.
Apps: deleting an App deletes its deployment images, and you can delete a single deployment.
Invite emails name the invited address.
Managed models can write up to 65,536 output tokens; the ChatGPT lineup and provider defaults come from live data.
A session whose sandbox lacks the model a turn asks for is repaired, for any provider.
Audit reconciliation is incremental, which cuts database load.
Session pages prefetch on intent, and a revived stream rehydrates the transcript.
Long managed sessions compact instead of failing at the model's context window; new sessions boot with the current managed context limit.
The session scope view reads the cached repository instead of waiting for a git fetch.
Stop answers within the request deadline and reports stopping while the sandbox finishes shutting down.
Creating a project retries the first push while GitHub finishes creating the repository, instead of rolling back.
Agent config from the base branch reaches a session on reload, even without config releases.
A session restored from an archived sandbox gets up to 12 minutes to wake instead of failing at 8.
Mobile queues prompts in the server inbox, and a turn that ended while the stream was down goes idle.
New users land on the project selector.
Neutral runtime names across the API, SDK and CLI (OpenCode decoupling).
GLM 5.3 Flash is served from OpenCode Zen first, with the OpenRouter pool as fallback.
Slack channels have defaults, and Teams and Slack permissions cover roles, identity links, join policies, and the bot's own scope.
MCP OAuth refresh tokens get a grace period, a sweeper, and code-reuse revocation. Reads after a push return fresh data.
The desktop app reopens your last project on launch, the same as the web.
Connect-computer approval is a dialog you can close.
A ChatGPT login the provider refuses is refreshed, and the message says who can reconnect it.
Session overrides open while their catalog loads; Save commits what is ready.
An agent-created session saves its transcript at every turn end.
Audit ingest answers within the request deadline.
Transcript reads and gateway resolution do less work per request.
MCP list_projects returns the caller's project role.
A project's fallback model chain runs when a model is unavailable, when a ChatGPT plan or BYOK model fails, and when every pooled account is paused or needs reconnection.
The LLM gateway bounds requests per credential.
DeepSeek and GLM accept images and a thinking control; model hosting is named accurately.
Session connection and run status are accurate across web, mobile and the SDK, without flapping.
A session is never parked while its runtime repair is still running, and its model converges when it opens.
Sessions move off retired managed models automatically, and the error names the cause.
Sharing a session switches it to the project's keys instead of stranding it.
Sandbox images carry every runtime asset, and updates move only the chunks that changed.
Audit events are ingested and reconciled without blocking requests or scanning whole tables.
Sandbox health polls and connector listings answer faster.

Fixes

The CLI: - sessions log and chat show the real stop or failure reason. - Trigger schedule updates keep their time zone. - Policy conditions keep their operators. - --json output and session listings stay stable. - projects rm --purge reports "Purged". - Project-scoped commands reach projects that have no session. - The empty models state points to providers.
Mobile: - Question answers can be retried until they are accepted. - Mermaid diagrams render. - Teams mentions are stripped from session titles. - Diff stats keep literal escapes. - App previews refresh their credentials when opened.
Desktop: "Allow all" adds Kortix to the macOS Screen Recording list.
A warm session that has not been prompted reads as starting, not running.
The sandbox agent's dependencies are patched against two undici vulnerabilities.
Customize tabs appear immediately, and only the page body waits for permissions.
kortix validate rejects invalid arguments.
The sandbox's /turn request is read correctly before streaming starts.
The mobile stop icon honors its size.
The infrastructure audit checks network ACL admin ports separately for IPv4 and IPv6.
A session whose turn ends with a terminal error now parks, instead of staying busy.
The CLI: --host and named-host project context route to the right host, browser login uses the target host, and --json output carries no human notices. accounts current --json exits 1 when no account is active, projects use reports errors instead of crashing, and tokens rm with a malformed id returns 400.
Credit balances read the same on the CLI and the web, and a free account sees its balance on Plan.
Sign-in keeps the details of an email sign-in failure. Rate-limit errors show guidance instead of raw text, and account deletion ends active sessions at once.
The web: the command palette finds active projects, the selected language persists, the account hub opens from deep links, connected-account settings open again, and settings rows stack on narrow screens. The Apps card shows its live preview again.
Video: unsupported fullscreen and blocked autoplay no longer raise errors.
Mobile: the composer detects mention and command triggers at the caret, not only at the end of the text.
Marketplace installs report failures instead of exiting silently.
Slack and Teams sign-in links open again. Since 2026-09-24 the link to connect a chat account answered "page not found". (#8611)
Accounts that require MFA work after the code is verified. Linking Slack or Teams, and some API routes such as connectors, asked for the second factor again even after it passed. Connecting a chat account now continues by itself after the code. (#8611) Members' sessions in such an account now reach shared provider keys, including a ChatGPT login shared with the project, and changing a shared key still needs the second factor. (#8618, #8620)
A Slack or Teams conversation runs the model it shows. A message without a /model change could run on the model of an earlier message instead of the conversation's model. (#8618)
Signup asks you to open the emailed link. The confirmation screen no longer asks for a six-digit code that the email does not contain. (#8608)
Signing out takes effect on every route at once. A logged-out, banned or revoked access token is rejected everywhere. Before, it stayed valid until it expired, up to an hour, on routes outside the account session check. (#8594)
Migrated sessions start again. A session moved from the previous platform could hold a sign-in token that the move had revoked, and never finished starting. Opening it now restores that one token, only for the session's own box. (#8636)
Audit ingestion wastes fewer retries. After a database timeout, a retry sends half the rows instead of the same statement again, and a small batch gives up after one try. (#8599)
Email connections survive a failed inbox listing. When the inbox listing failed, Kortix treated it as an empty list and removed the project's email connections. It now keeps them and reports the error. (#8607)
The bring-your-own Teams webhook answers 404, not 503, for a project that has no bot of its own. (#8603)
The Kortix icon is the same everywhere again. The favicon, app icons and home-screen icon all show the light tile with the dark mark, in light and dark mode. (#8647)
Translated pages are translated again. Blog titles and descriptions, SEO descriptions, the site description and the open-source headline show in all eight non-English languages. The brand kit had left them in English. (#8587)
Chat stays available while a connector waits for approval.
The advanced panel preference keeps the panels you open.
The cost explorer shows a loading state until usage arrives.
Mobile renders model reasoning as a thinking row.
Deleting an account no longer reports its sandboxes as lost work.
A conversation with people is named at a word boundary.
A malformed access request answers 400 instead of 500.
Reminder trigger sessions open themselves, with atomic caps.
App viewer tokens no longer fail with 401 after an access-policy save, and no longer appear in App logs.
Account API keys are refused before session daemon access; the session token acts as the person who starts each turn.
Slack replies to a bound session return to the thread they came from; Slack writes stay inside the calling project's channels and threads; an unavailable model stops before a Slack thread starts.
Listing or sharing connectors, or disconnecting a computer, no longer fails with 500 on a database deadlock.
An agent cannot be switched while its session is running; overlapping turns keep the running state.
A failed secret save keeps the form's contents.
Sessions on a sandbox owned by another API instance refuse prompts instead of racing it.
Agent .md model references resolve through the Kortix provider in gateway mode.
Slack and Teams connector reads stay inside the calling project's own conversations.
Stopping a session no longer fails with a database deadlock when a wake runs at the same moment.
A malformed member id returns 400 instead of 500.
A stopped session box stays stopped: auto-resume is turned off before the stop, not after.
A transient git failure while saving a project's manifest returns a retryable 503 and no longer exposes the repository URL.
A session that was open across a deploy keeps accepting prompts. A runtime restart no longer ends a turn it already accepted, and every turn end reaches the API.
A live session no longer goes to sleep after a short network interruption.
A session whose sandbox lost its OpenCode root pin resumes the right conversation.
A pi model that stops responding ends with a visible timeout.
Deleting a user revokes their API tokens, OAuth tokens, and pending authorization codes.
Prompt attachment imports keep the sender's access.
Computer access and machine states return 4xx errors, not 500.
Repository previews in channels show only public repositories.
The Composio Microsoft Teams app is hidden; Teams is a native channel.
The public health endpoint no longer exposes internal deployment details.
A malformed preview cookie is refused, and playground budget denials are typed.
Every prompt file reaches the computer.
Every agent picker lists the project's own agent roster.
Connector toolkit search returns the same page shape as the unsearched list.
A dead credential gets a typed 401, so retrying clients stop.
The Firecrawl proxy rejects private and metadata URLs.
Values can be copied out of the XLSX and CSV viewers.
A pinned runtime that still serves no longer refuses its session.
Old saved tool calls show what they kept; an empty session opens on its composer.
A stopped session wakes without needing a message.
GET /kortix/part in the sandbox requires the same credential as its sibling routes.
Teams: the bot token is sent only to stored service URLs, and the sign-in link appears only in one-to-one chats.
A session whose sandbox name was still held by an old archived sandbox could never get a new sandbox. It now provisions under a fresh name.
Opening a session repairs a stale runtime immediately instead of waiting for the background check.
A prompt parked while the sandbox restarts keeps its sandbox deadline through every retry.
A Firefox browser-extension error no longer reaches error reporting.

Run your whole company from one repo you own.

Run your whole company from one repo you own.

Session labels, a redesigned approval flow, and long sessions that compact instead of failing.

New

Improvements

Fixes