Changelog

Accept webhook requests without a User-Agent at the Cloudflare edge. Mint OpenCode-compatible initial message IDs so webhook-triggered turns complete once instead of replaying.

What's Changed

• chore(release): VERSION → 0.13.2 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6660
• fix(turns): box-initiated turns get authority; busy roots are never read as terminal by @markokraemer in https://github.com/kortix-ai/suna/pull/6657
• learnings: three rules from the v0.13.1 release-gate campaign by @markokraemer in https://github.com/kortix-ai/suna/pull/6661
• fix(session): polish the session UX end to end by @markokraemer in https://github.com/kortix-ai/suna/pull/6663
• refactor: stop inferring chronology from OpenCode message ids by @markokraemer in https://github.com/kortix-ai/suna/pull/6665
• fix(turns): turn-begin relay must authenticate as the sandbox, not a PAT by @markokraemer in https://github.com/kortix-ai/suna/pull/6664
• fix(billing): resolve entitlement from the subscription, not the stored tier by @markokraemer in https://github.com/kortix-ai/suna/pull/6662
• perf(boot): shrink OpenCode config runtime by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6656
• chore(billing): backfill the renewal credits zero-grant legacy tiers never gave by @markokraemer in https://github.com/kortix-ai/suna/pull/6666
• perf(boot): bake the generic scaffold checkout by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6668
• fix(billing): teach the entitlement invariant what a renewal now grants by @markokraemer in https://github.com/kortix-ai/suna/pull/6671
• perf(boot): make starter Git bundles provider-portable by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6672
• chore(billing): reconcile stripe_subscription_status drift before #6662 promotes by @markokraemer in https://github.com/kortix-ai/suna/pull/6669
• feat(runtime): converge every sandbox onto the API it talks to by @markokraemer in https://github.com/kortix-ai/suna/pull/6673
• fix(boot): invalidate stale scaffold images by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6674
• fix(runtime-assets): hash the sandbox binaries at startup, not on the request by @markokraemer in https://github.com/kortix-ai/suna/pull/6676
• docs(boot): record scaffold benchmark by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6678
• feat(secrets): gate egress-enforced delivery behind experimental secrets_egress flag; default to environment by @markokraemer in https://github.com/kortix-ai/suna/pull/6677
• fix(sdk): sub-agent panels stop throwing 'Invalid session id' + quieter landing hero by @markokraemer in https://github.com/kortix-ai/suna/pull/6680
• gateway: remove the AI-SDK-native transport — OpenAI-compat only (reliability) by @markokraemer in https://github.com/kortix-ai/suna/pull/6679
• fix(secrets): relay substitutes handles in Authorization/Cookie (egress works for Bearer auth) by @markokraemer in https://github.com/kortix-ai/suna/pull/6683
• Serve every sandbox preview on its own origin by @markokraemer in https://github.com/kortix-ai/suna/pull/6681
• fix(web): sub-agent row hierarchy — one rail per level, agent rows that open by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6682
• enh(web): landing page hero scenes and marketing rebuild by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6658
• feat(secrets): stream the relay — no body caps, SSE, truncation sentinel by @markokraemer in https://github.com/kortix-ai/suna/pull/6685
• fix(boot): the managed-skill overlay no longer counts as the user's changes by @markokraemer in https://github.com/kortix-ai/suna/pull/6684
• refactor(session): one source of truth for what a session changed + the tracked package.json by @markokraemer in https://github.com/kortix-ai/suna/pull/6687
• fix(session): a finished turn stays finished by @markokraemer in https://github.com/kortix-ai/suna/pull/6688
• perf(web): verify the session JWT in-process instead of calling GoTrue on every navigation by @markokraemer in https://github.com/kortix-ai/suna/pull/6690
• fix(session): a retry is not the end of a turn by @markokraemer in https://github.com/kortix-ai/suna/pull/6691
• fix(queue): the inbox owns the queue by @markokraemer in https://github.com/kortix-ai/suna/pull/6692
• perf(sandbox): reduce cold OpenCode startup latency by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6694
• perf(snapshots): materialize Platinum templates before activation by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6695
• Prepare active Platinum images before cold boots by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6696
• fix(slack): an app_mention was answered by whichever project got the callback, not the bot that was mentioned by @kubet in https://github.com/kortix-ai/suna/pull/6689
• fix(sessions): list and lifecycle answer manager standing from one predicate by @kubet in https://github.com/kortix-ai/suna/pull/6697
• fix(api): an algorithm the local verifier cannot check is not a bad token by @markokraemer in https://github.com/kortix-ai/suna/pull/6698
• perf(sandbox): add guarded project-image cold boot by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6700
• fix(api): fail closed on unsafe FAST activation by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6703
• fix(api,selfhost): isolate audit writes + Caddy retry so a slow audit write can't 502 the gateway by @markokraemer in https://github.com/kortix-ai/suna/pull/6702
• revert(queue): put the queue back the way it was by @markokraemer in https://github.com/kortix-ai/suna/pull/6699
• fix(web): stop the session boot shell vanishing at handover by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6701
• fix(edge): accept webhooks without User-Agent by @markokraemer in https://github.com/kortix-ai/suna/pull/6709
• fix(gateway): bound per-request memory so the LLM path can actually autoscale by @markokraemer in https://github.com/kortix-ai/suna/pull/6708
• fix(web): restore voice input and subordinate menu styling — main was red by @markokraemer in https://github.com/kortix-ai/suna/pull/6711
• docs(learnings): a 'tried and reverted' comment is a decision record by @markokraemer in https://github.com/kortix-ai/suna/pull/6704
• docs(gateway): state the in-flight budget's unit, and pin it with a test by @markokraemer in https://github.com/kortix-ai/suna/pull/6710
• fix(dev): stop OOM-killing the dev API — 1024 MiB was a quarter of every other environment by @markokraemer in https://github.com/kortix-ai/suna/pull/6705
• fix(gateway): size the in-flight budget from the container, not from a constant by @markokraemer in https://github.com/kortix-ai/suna/pull/6712
• docs(learnings): a limit larger than the thing it protects is not a limit by @markokraemer in https://github.com/kortix-ai/suna/pull/6713
• fix(triggers): stop initial prompt replay loops by @markokraemer in https://github.com/kortix-ai/suna/pull/6716

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.1...v0.13.2

New

• One URL configures every email Kortix sends. Signup confirmations, magic links, invites and alerts all flow through the same EMAIL_URL transport with the same sender identity and templates — self-hosted installs configure email once. Supabase auth mail now goes through the same path instead of GoTrue's own SMTP.
• One-click OAuth for MCP connectors. Connecting an MCP server that requires OAuth 2.1 now works end-to-end from the UI or via kortix connectors authorize — discovery, dynamic client registration and token exchange included.
• Secrets get an exposure and usage model. Each secret declares how it may be exposed and which usages are assigned to it, enforced by one mechanism across every sandbox provider.
• Session sharing is now the owner's call: managers keep lifecycle control (stop, restart), but only the session's owner can share it or mint public links.

Fixed

• Revoked API tokens now actually stop working. A personal access token that had been revoked could still authenticate on every surface (REST, the LLM gateway, git proxy, preview proxy, connectors) because the validation query never checked the revocation timestamp. Revoked tokens are now rejected everywhere.
• Deleting an account now stops and removes every one of its sandboxes — across every account the user owns and every non-terminal state — instead of only stopping the ones under the earliest-joined account.
• A runaway agent turn can no longer take the API down. Each session's audit-event stream is bounded (900 events per minute); past that ceiling only the high-volume streaming-delta class is dropped while lifecycle, usage and billing events keep flowing.
• API writes are much faster under load. Audit events are written asynchronously in batches off the request path (they were a synchronous insert into a 14-index table on every request), and the account list no longer makes one admin-API call per member to resolve owner emails. Audit reads flush the queue first, so the audit log stays read-your-writes.
• A waking sandbox no longer looks like an error. Every surface (web, CLI, SDK) now treats the sandbox-starting state as "waking" with retry, instead of surfacing a 503. Resuming a stopped box also dropped two provider round trips.
• Gateway reliability: long streaming turns are no longer killed at 255 seconds by a runtime idle timeout; Bedrock requests with trailing prefill or redacted reasoning no longer fail; the gateway's provider shaping now runs on the new AI-SDK-native transport path, which is the default everywhere.
• Slack: another bot @-mentioning Kortix now works; linking the bot no longer demands owner/admin (it delegates only your own authority); user lookups were sent in a form Slack silently ignored — fixed.
• Prompt queue and composer: forwarded prompts can no longer strand, Stop can no longer leak into the next turn, fresh sessions paint instantly in one ordered batch, and the boot-time composer shows the session's real agent.
• Deleted sessions are no longer readable by id. Listing a project's group grants is manager-only, matching the write routes.
• Sandboxes learn the managed model set from the API on every boot, so a model the picker offers is one the runtime knows.
• Keyboard scrolling in a session is treated as scroll intent: Cmd+Up no longer snaps back to the end. A session.error is now attributed to the turn that failed.
• Starter reflector and reviewer agents run without approval prompts. Self-hosted boxes get a daily Docker prune timer.
• Session titles and conversation counts are recorded again. The per-session metadata mirror was silently never written (the internal call carried no user identity, so the sandbox rejected it) — session names and conversation counts now populate for new sessions.

Security

• The sandbox egress pin trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope; trigger-session manager visibility no longer extends to session-bound agent tokens.
• The browser test suite was broadcasting a deployment-protection bypass secret to third-party hosts on every run; it now authenticates once via a scoped cookie and the secret reaches no third party.
• nodemailer upgraded across two majors to clear open advisories, including one high.

Internal

• Roles have one store. The RBAC cutover made role_assignments the only authorization store — legacy tables became views, mirror triggers were dropped, and 3,100 lines of parallel code were deleted.
• The production release gate is now reliable and fast. It runs as 6 API shards + 3 browser shards, cleans up its own test debris, tolerates a traffic-degraded-but-serving gateway, can be rehearsed against staging without opening a release PR, and the test client never replays a non-idempotent request through an edge-laundered error. Staging was right-sized for it, and a workflow-gating bug that had silently frozen the staging frontend for a week is fixed.
• Container image builds are ~7× faster. Staging and dev images build natively per architecture with a registry layer cache (API image: ~3 minutes, was ~20), and the arm64 frontend image is now genuinely arm64.
• CREATE INDEX CONCURRENTLY migrations ship with a lock_timeout that can land on a live database, and CI blocks any new one that sets it too low.

What's Changed

• chore(release): VERSION → 0.13.1 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6569
• docs(learnings): CIC under a 5s lock_timeout cannot land on live prod (v0.13.0 deploy incident) by @markokraemer in https://github.com/kortix-ai/suna/pull/6570
• perf(sandbox): warm OpenCode instance in fast image by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6571
• perf(sandbox): precompile fast OpenCode tools by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6572
• infra(selfhost): bake a daily docker-prune timer into the box by @markokraemer in https://github.com/kortix-ai/suna/pull/6573
• infra(selfhost): drop a deployment name from the prune comment by @markokraemer in https://github.com/kortix-ai/suna/pull/6574
• perf(sandbox): align fast runtime base with Ubuntu by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6575
• fix(slack): let another bot @-mention Kortix — the gate blocked every bot, not just us by @kubet in https://github.com/kortix-ai/suna/pull/6577
• fix: every managed model works in every sandbox + session.error renders in place + keyboard scroll intent by @markokraemer in https://github.com/kortix-ai/suna/pull/6576
• fix(sandbox): disable slower fast boot experiment by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6578
• ci(release-gate): 6 api shards + serial-tail shard, 60-min cap, dry-run dispatch against staging by @markokraemer in https://github.com/kortix-ai/suna/pull/6580
• test(ke2e): fix tests typecheck break from #6554 (iam.flow.ts:1739) by @markokraemer in https://github.com/kortix-ai/suna/pull/6581
• test(ke2e): preflight tolerates traffic-degraded gateway, 180s deployed flow budget, no cross-shard shared-state collisions by @markokraemer in https://github.com/kortix-ai/suna/pull/6582
• test(e2e): harden the recurring deployed-target browser specs; quarantine the non-deterministic ones into a nightly lane by @markokraemer in https://github.com/kortix-ai/suna/pull/6584
• ci(release-gate): E2E_EXCLUDE_TAGS='@quarantine' on the browser shards (companion to #6584) by @markokraemer in https://github.com/kortix-ai/suna/pull/6587
• Bound the per-session audit event rate so one runaway turn cannot take the API down by @markokraemer in https://github.com/kortix-ai/suna/pull/6583
• fix(starter): reflector + reviewer agents run without approval prompts by @markokraemer in https://github.com/kortix-ai/suna/pull/6589
• fix(api,ke2e): account deletion stops+removes every sandbox, revoked tokens stop authenticating, gc reclaims sessions+tokens by @markokraemer in https://github.com/kortix-ai/suna/pull/6586
• Give CONCURRENTLY migrations a lock_timeout that can actually land on live prod by @markokraemer in https://github.com/kortix-ai/suna/pull/6588
• fix(slack): a bot @-mention still did nothing — the identity gate refuses it, silently by @kubet in https://github.com/kortix-ai/suna/pull/6590
• feat(connectors): one-click OAuth 2.1 for MCP servers (RFC 9728 + 8414 + 7591 + 8707) by @markokraemer in https://github.com/kortix-ai/suna/pull/6579
• Canonical RBAC cutover: role_assignments is the only store — legacy tables → views, old engine + parity harnesses deleted by @markokraemer in https://github.com/kortix-ai/suna/pull/6594
• fix(daemon): managed-model overlay never blocks the spawn; reconcile once before readiness by @markokraemer in https://github.com/kortix-ai/suna/pull/6592
• fix(sessions): session sharing is the owner's call, not a manager's by @markokraemer in https://github.com/kortix-ai/suna/pull/6593
• perf(sandbox): arm Platinum secrets during create by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6596
• feat(email): one EMAIL_URL configures every email Kortix sends by @markokraemer in https://github.com/kortix-ai/suna/pull/6585
• perf(sessions): stop paying two provider round trips to resume a stopped box by @markokraemer in https://github.com/kortix-ai/suna/pull/6595
• fix(gateway): disable Bun idleTimeout stream-kill + Bedrock request/response fixes by @markokraemer in https://github.com/kortix-ai/suna/pull/6599
• fix(email): nodemailer 7.0.13 -> 9.0.5 (open advisories, incl. one high) by @markokraemer in https://github.com/kortix-ai/suna/pull/6597
• test(ke2e): GW-1 tolerates a traffic-degraded gateway (aligns with #6582 preflight) by @markokraemer in https://github.com/kortix-ai/suna/pull/6603
• docs(runbook): switching dev/staging/prod auth email onto the send-email hook by @markokraemer in https://github.com/kortix-ai/suna/pull/6601
• fix(db): unblock dev deploys — reconcile retired role_permissions actions before the cutover's catalog-FK VALIDATE (runtime override) by @markokraemer in https://github.com/kortix-ai/suna/pull/6602
• fix(slack): link-bot documented the one input form Slack cannot send by @kubet in https://github.com/kortix-ai/suna/pull/6606
• docs(learnings): reconcile a retired constraint value by remapping, never deleting by @markokraemer in https://github.com/kortix-ai/suna/pull/6605
• docs(runbook): hook-enable PATCH clears custom SMTP; promote-safety proof by @markokraemer in https://github.com/kortix-ai/suna/pull/6608
• Never render sandbox readiness 503s as errors — waking state + retry across all surfaces by @markokraemer in https://github.com/kortix-ai/suna/pull/6610
• refactor(gateway): AI-SDK-native /language-model path for lossless opencode passthrough (flag-gated, dormant) by @markokraemer in https://github.com/kortix-ai/suna/pull/6609
• fix(slack): link-bot should not require owner/admin — it delegates only your own authority by @kubet in https://github.com/kortix-ai/suna/pull/6612
• infra(staging): API 3×2vCPU/4GiB — the release gate saturates 2×1vCPU tasks by @markokraemer in https://github.com/kortix-ai/suna/pull/6613
• feat(secrets): exposure/usage model — one enforcement mechanism on all providers by @markokraemer in https://github.com/kortix-ai/suna/pull/6611
• refactor(gateway): wire API in-process gateway + session env to enable the native path (flag off) by @markokraemer in https://github.com/kortix-ai/suna/pull/6615
• fix(slack): users.info was sent as JSON, so Slack never saw the user param by @kubet in https://github.com/kortix-ai/suna/pull/6616
• fix(queue): forwarded prompts cannot strand, Stop cannot leak, bubbles keep one identity by @markokraemer in https://github.com/kortix-ai/suna/pull/6598
• perf(api): take audit writes and the owner-email fan-out off the request path by @markokraemer in https://github.com/kortix-ai/suna/pull/6618
• perf(ci): dev single-arch + layer cache + fix the frontend-skip by @markokraemer in https://github.com/kortix-ai/suna/pull/6619
• perf(ci): build staging images natively per arch, with a layer cache by @markokraemer in https://github.com/kortix-ai/suna/pull/6622
• fix(gateway): re-apply gateway-side provider shaping (codex store:false + 3 more) on the native path by @markokraemer in https://github.com/kortix-ai/suna/pull/6623
• ci(dev): explicit Deploy Dev action instead of per-push storm by @markokraemer in https://github.com/kortix-ai/suna/pull/6621
• fix(web): boot-time composer shows the session's real agent; panels survive boot→ready by @markokraemer in https://github.com/kortix-ai/suna/pull/6625
• deploy-staging: Cloudflare auth failure must not freeze the staging frontend by @markokraemer in https://github.com/kortix-ai/suna/pull/6626
• ci(dev): auto-deploy latest + cancel-stale (builds are fast now) by @markokraemer in https://github.com/kortix-ai/suna/pull/6627
• ke2e: never replay a create through an edge-laundered 5xx (fixes all 22 release-gate failures) by @markokraemer in https://github.com/kortix-ai/suna/pull/6628
• fix(web): boot composer reads the stashed agent pick before /start answers by @markokraemer in https://github.com/kortix-ai/suna/pull/6629
• fix(gateway): upgrade @ai-sdk/amazon-bedrock 5.0.24→5.0.59 (parse redacted reasoning; fixes GPT-on-Bedrock 502) by @markokraemer in https://github.com/kortix-ai/suna/pull/6630
• refactor(gateway): make the AI-SDK-native path the default everywhere (verified across all providers) by @markokraemer in https://github.com/kortix-ai/suna/pull/6631
• Unblock the release browser gate, and stop leaking the Vercel bypass secret by @markokraemer in https://github.com/kortix-ai/suna/pull/6632
• gate: 1 api worker per shard — 19 concurrent collapsed the staging write path by @markokraemer in https://github.com/kortix-ai/suna/pull/6634
• gate: survive a transient 503 at world bootstrap; staging API floor 6 tasks by @markokraemer in https://github.com/kortix-ai/suna/pull/6636
• gate: fix the four session residuals, and stop reruns colliding with themselves by @markokraemer in https://github.com/kortix-ai/suna/pull/6638
• edge: laundered 503 parses as an AI-SDK error; Worker deploy survives a dead credential by @markokraemer in https://github.com/kortix-ai/suna/pull/6639
• staging: raise the request deadline to 55s (cross-region DB) by @markokraemer in https://github.com/kortix-ai/suna/pull/6641
• gate: boundary-asserting skips and named quarantines are legitimate --require-all outcomes by @markokraemer in https://github.com/kortix-ai/suna/pull/6643
• gate: a one-step assert-then-skip flow counts as asserted by @markokraemer in https://github.com/kortix-ai/suna/pull/6645
• IAM-12: poll effective-permission probes through the cross-task IAM cache window by @markokraemer in https://github.com/kortix-ai/suna/pull/6648
• perf(boot): remove fresh-session Git network round trips by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6647
• perf(boot): deliver exact Git delta during sandbox creation by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6650
• docs(boot): record deployed Git timing by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6651
• perf(boot): make Git bundle reuse durable by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6652
• docs(boot): record durable Git cache benchmark by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6653
• chore(runtime): bump OpenCode 1.17.11 -> 1.18.19 everywhere by @markokraemer in https://github.com/kortix-ai/suna/pull/6655

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.0...v0.13.1

New

• Apps is now a stable feature — it moved out of experimental status and sits in the sidebar under Customize. Apps open instantly (no more loading flash), show their desktop layout on the preview card instead of mobile, and get their own IAM permissions and per-team scoping. Non-public Apps are now usable and honest about who can access them; self-host installs can serve Apps even though they can't publish to kortix.com.
• Invite-time project grants — inviting someone to a project now grants both the account role and project access in one step, instead of two separate actions.
• Settings unified into one tabbed panel, and the Billing pane was rebuilt with fewer boxes and a single credits card.
• Chat input rebuilt to stop duplicate and lost sends; triple-tapping Escape now stops the agent even while you're typing.
• Easy panel overhaul (the non-technical-user view): memory updates are now visible and plainly labelled, skill and task calls expand with live sub-agent activity, and a connect-apps strip and context-card actions were added.
• Session usage modal reworked for clarity and speed; the model switcher and session usage view now show the real upstream provider instead of "Kortix".
• Monitors (experimental): a new trigger type that runs on its own provisioned box, with its own CLI command group and MCP surface.
• Network-boundary secrets on Daytona: an in-guest egress shim scopes a secret to the sandbox it was issued to, replacing the old operator-wide env var.
• Presentations framework at /presentations, including a diagram-led security deck.
• Added managed models: DeepSeek V4 Pro 0813 and Grok 4.6.
• The CLI now shows the identity behind a minted agent token instead of reporting "not logged in".

Fixed

• A cluster of stuck-session bugs: sessions could get wedged on boot with no retry, get stuck in a runaway self-repeating turn, show phantom interrupts, or strand mid-workspace-switch. A failed direct send now lands in the failed lane instead of disappearing, and prompts no longer get lost around session hand-off.
• Session truth now reads from a durable server-side turn ledger over HTTP, replacing several client-side guesses about whether a session is still working.
• Self-host: Storage now hands out public URLs instead of an internal Docker host address, and updates auto-heal from unlogged-table fork corruption that used to block them.
• The gateway reports what an LLM request actually cost, not what Kortix billed; it no longer kills slow reasoning turns at a hard 90-second timeout, drops the trailing-assistant prefill that made strict backends fail, and its body size ceiling is raised to 1 GiB (was rejecting large multimodal requests).
• MCP catalog discovery is now authenticated, and private sessions are no longer discoverable by other connectors.
• Creating a duplicate App slug now returns 409 instead of 500.
• The Vercel production frontend build now pins its runtime version so it can't get stranded on a stale one.
• Cleaned up frontend error noise from bot/automation scripts and third-party scripts on Safari.
• The reasoning-effort icon for Auto is now visually distinct, and agent names are capitalized consistently.

Notes

This release also includes a large internal hardening pass: an in-guest network-boundary/egress-secrets system, a warm-session simplification (session pooling now reuses ordinary sessions instead of a separate warm-session concept), a large API route-file split for maintainability, and expanded test coverage across sessions, monitors, and the deployed staging gate.

Also in this release

• Security hardening — the sandbox egress pin now trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope when authorizing App access; trigger-session manager visibility no longer extends to session-bound agent tokens; a deleted session is no longer readable by id.
• Release-pipeline reliability — the release gate is sharded into parallel jobs, cleans up its own test debris, and runs against a right-sized staging; several long-standing test-suite defects that kept the gate red were fixed.

What's Changed

• chore(release): VERSION → 0.12.9 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6399
• test(deployed): make the staging release gate resilient to origin load + dead email key by @markokraemer in https://github.com/kortix-ai/suna/pull/6397
• fix(deploy-prod): pin the Vercel RUNTIME version env so the prod FE isn't stranded by @markokraemer in https://github.com/kortix-ai/suna/pull/6401
• fix(web): de-noise three Better Stack frontend prod error classes (OneTrust JSON parse, Firefox DOM mutation, WebSocket Failed to send message) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6398
• test(deployed): serialize staging lanes + self-heal AgentMail quota (gate stabilization r2) by @markokraemer in https://github.com/kortix-ai/suna/pull/6404
• feat: tell the agent what the network boundary is doing by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6406
• fix: the connectors MCP server never started; add a broker tool to it by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6407
• feat: turn the connectors MCP face on for every session by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6408
• test(deployed): retry transient gateway errors in ALL clients (fixture clients too) by @markokraemer in https://github.com/kortix-ai/suna/pull/6411
• fix(web): suppress bot/automation webdriver redefine + transient signal timed out noise (BS ee14e84d…, 73e683c3…) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6410
• feat: Monitors — 24/7 watchers as a third trigger type (experimental flag) by @markokraemer in https://github.com/kortix-ai/suna/pull/6413
• test(deployed): send Vercel SSO bypass header in the browser lane (+ weak-ETag tolerance) by @markokraemer in https://github.com/kortix-ai/suna/pull/6415
• feat(web): unify settings into one tabbed panel by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6396
• test(deployed): 90m timeout + cap sandbox concurrency (final gate stabilization) by @markokraemer in https://github.com/kortix-ai/suna/pull/6418
• fix(monitors): monitor-box git-proxy access + stale-agent recycle by @markokraemer in https://github.com/kortix-ai/suna/pull/6417
• feat(web): show when each user message was sent by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6420
• fix(monitors): stale-agent probe uses resolveEndpoint (authed edge) by @markokraemer in https://github.com/kortix-ai/suna/pull/6421
• test(deployed): serialize the two staging lanes (Daytona provisioning throughput) by @markokraemer in https://github.com/kortix-ai/suna/pull/6422
• enh(web): send all queued messages on the next turn by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6423
• docs: broker end-to-end result, and the premise it disproved by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6409
• fix: mint the session handle row for network-boundary secrets by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6425
• feat(web): dot-matrix busy glyphs and conversation density by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6426
• feat(models): add managed Grok 4.6 by @markokraemer in https://github.com/kortix-ai/suna/pull/6427
• feat(secrets): boundary delivery is a project flag, not an operator env var by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6428
• fix(secrets): close the audit findings against the boundary-shim flag by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6430
• feat(models): add managed DeepSeek V4 Pro 0813 by @markokraemer in https://github.com/kortix-ai/suna/pull/6432
• test(deployed): revert serialize — RUN-* timeouts were a transient staging outage by @markokraemer in https://github.com/kortix-ai/suna/pull/6434
• fix(self-host): auto-heal unlogged-table fork corruption that blocks updates by @markokraemer in https://github.com/kortix-ai/suna/pull/6433
• fix(agent-tunnel): re-authorize when a saved token is rejected by @markokraemer in https://github.com/kortix-ai/suna/pull/6431
• fix(compliance): resolve Drata IaC critical/high findings by @markokraemer in https://github.com/kortix-ai/suna/pull/6392
• feat: keep a warm session ready while a user is present on a project by @markokraemer in https://github.com/kortix-ai/suna/pull/6437
• fix(runtime): detect, report and survive a provider losing a session's sandbox by @markokraemer in https://github.com/kortix-ai/suna/pull/6438
• fix(web): de-noise Safari frameless third-party 'Can't find variable' ReferenceError by @agent-kortix in https://github.com/kortix-ai/suna/pull/6429
• fix(api): never warm into the last concurrent-session slot by @markokraemer in https://github.com/kortix-ai/suna/pull/6439
• feat(web): presentations framework at /presentations + diagram-led security deck by @markokraemer in https://github.com/kortix-ai/suna/pull/6440
• fix(web): end a workspace switch instead of stranding it by @markokraemer in https://github.com/kortix-ai/suna/pull/6441
• test(e2e): cover repeated workspace switching in the browser lane by @markokraemer in https://github.com/kortix-ai/suna/pull/6442
• fix(iam): report the constraint that actually denied a project request by @markokraemer in https://github.com/kortix-ai/suna/pull/6443
• fix(meta): stop the per-prompt re-mint from destroying the coordinator's grant by @markokraemer in https://github.com/kortix-ai/suna/pull/6444
• refactor(sessions): a warm session is an ordinary session (-1,446 lines) by @markokraemer in https://github.com/kortix-ai/suna/pull/6445
• refactor(api): split r7.ts (3,499 lines) into nine focused route modules by @markokraemer in https://github.com/kortix-ai/suna/pull/6446
• feat(sandbox): the in-guest egress shim — network boundary without Platinum by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6447
• fix(secrets): the boundary echo guidance was lying to shim-backed agents by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6448
• fix(sandbox): the shim CA was unusable by python — missing key identifiers by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6449
• docs: network-boundary secrets work on Daytona — measured, not argued by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6450
• feat(secrets): bind a session credential to the sandbox it was issued to by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6451
• docs: the session credential is bound to its sandbox — verified on dev by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6452
• enh: rebuild the chat input, end duplicate and lost sends by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6314
• fix(api): never render a boot failure as a provider-side loss by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6456
• Remove the agent-switch 409, and fix file upload end to end by @markokraemer in https://github.com/kortix-ai/suna/pull/6457
• feat(apps): real permissions, resource controls, E2B parity and self-host hosting by @markokraemer in https://github.com/kortix-ai/suna/pull/6453
• fix(self-host): hand out public Storage URLs, not the internal Docker host by @markokraemer in https://github.com/kortix-ai/suna/pull/6461
• Apps: show only what you can open, and open it in place by @markokraemer in https://github.com/kortix-ai/suna/pull/6462
• fix(apps): return 409 (not 500) on duplicate App slug by @markokraemer in https://github.com/kortix-ai/suna/pull/6465
• fix(api): don't gate turn-stream lifecycle reports on connector.write by @markokraemer in https://github.com/kortix-ai/suna/pull/6464
• enh(web): rework session usage modal for clarity and speed by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6459
• fix(web): align the Apps sidebar row with the group it moved into by @markokraemer in https://github.com/kortix-ai/suna/pull/6463
• fix(web): never land existing users on "No workspace yet" by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6460
• feat: personalize project-home starter prompts by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6467
• fix(cli): show the minted agent token's identity, not "not logged in" by @markokraemer in https://github.com/kortix-ai/suna/pull/6470
• fix(apps): frame self-host App previews from the operator frontend origin by @markokraemer in https://github.com/kortix-ai/suna/pull/6471
• enh(web): overhaul the easy panel for non-technical users by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6472
• fix(apps): don't 500 App teardown when a runtime's provider is disabled/retired by @markokraemer in https://github.com/kortix-ai/suna/pull/6474
• fix(gateway): stop killing slow reasoning turns at 90,000ms by @markokraemer in https://github.com/kortix-ai/suna/pull/6473
• docs(learnings): a resource-scaled timeout moves the cliff, never removes it by @markokraemer in https://github.com/kortix-ai/suna/pull/6476
• fix: end phantom interrupts, stop replays, slow switches by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6468
• feat(triggers): control created session access by @markokraemer in https://github.com/kortix-ai/suna/pull/6477
• fix(triggers): enforce private session discovery by @markokraemer in https://github.com/kortix-ai/suna/pull/6479
• fix(sandbox): renew lifecycle from active OpenCode turns by @markokraemer in https://github.com/kortix-ai/suna/pull/6480
• fix(sandbox): harden provider lifecycle renewal by @markokraemer in https://github.com/kortix-ai/suna/pull/6481
• fix(sandbox): revoke turn authority on stop by @markokraemer in https://github.com/kortix-ai/suna/pull/6482
• fix(sandbox): renew active turns on fast cadence by @markokraemer in https://github.com/kortix-ai/suna/pull/6484
• fix: close three prompt-loss holes around session hand-off by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6486
• fix: stop home sends landing in used warm sessions by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6485
• fix(web): resolve react-doctor bug, security, perf findings by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6487
• Use a minimal icon for shared sessions by @markokraemer in https://github.com/kortix-ai/suna/pull/6488
• fix(llm-gateway): drop trailing assistant prefill so strict backends stop failing by @markokraemer in https://github.com/kortix-ai/suna/pull/6489
• enh(web): overhaul the easy panel for non-technical users by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6475
• fix(llm-gateway): stop 413-ing large multimodal requests; raise body ceiling to 1 GiB by @markokraemer in https://github.com/kortix-ai/suna/pull/6490
• Apps: open an App instantly, and stop hiding Apps inside the SDK docs by @markokraemer in https://github.com/kortix-ai/suna/pull/6492
• fix(sdk): bound the prompt busy override and un-park status reconciliation by @markokraemer in https://github.com/kortix-ai/suna/pull/6494
• fix(gateway): report what an LLM request actually cost you, not what Kortix billed by @markokraemer in https://github.com/kortix-ai/suna/pull/6491
• fix(web): make triple-ESC stop the agent from inside the composer by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6493
• fix(sdk): stop pinning content-length when forwarding a request by @markokraemer in https://github.com/kortix-ai/suna/pull/6495
• fix(manifest): refuse reserved App env names in validate, not only at deploy by @markokraemer in https://github.com/kortix-ai/suna/pull/6496
• Connectors: no Pipedream on this deployment, no Discovery tab by @markokraemer in https://github.com/kortix-ai/suna/pull/6498
• fix(web): drop the Apps subtitle and stop Learn more pressing the edge by @markokraemer in https://github.com/kortix-ai/suna/pull/6499
• Apps: show the App's desktop layout on a card, not its mobile one by @markokraemer in https://github.com/kortix-ai/suna/pull/6500
• fix(web): bring the permission-approval card onto the design system by @markokraemer in https://github.com/kortix-ai/suna/pull/6501
• fix: adversarial-audit hardening of the stuck-session fixes by @markokraemer in https://github.com/kortix-ai/suna/pull/6497
• fix(web): show real upstream provider, not "Kortix", in session usage + model switcher by @markokraemer in https://github.com/kortix-ai/suna/pull/6504
• Revamp Customize IA, permissions, and shared page shells by @markokraemer in https://github.com/kortix-ai/suna/pull/6503
• fix(members): repair Groups/Roles links + multi-select grant dialogs by @markokraemer in https://github.com/kortix-ai/suna/pull/6505
• fix(web): distinct Auto reasoning-effort icon + capitalize agent names by @markokraemer in https://github.com/kortix-ai/suna/pull/6508
• fix(connectors): authenticate MCP catalog discovery by @markokraemer in https://github.com/kortix-ai/suna/pull/6507
• feat(iam): remove duplicate Access cards, fix Customize discoverability by @markokraemer in https://github.com/kortix-ai/suna/pull/6506
• fix: bound two stuck-runtime states — a wedged boot with no retry, and a runaway self-repeating turn by @markokraemer in https://github.com/kortix-ai/suna/pull/6509
• feat(iam): invite-time project grants — one invite, account role + project access by @markokraemer in https://github.com/kortix-ai/suna/pull/6510
• feat(secrets): make network-boundary parity across sandbox providers contractual by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6511
• Server-truth M1: turn lifecycle moves to the control plane; the client stops guessing by @markokraemer in https://github.com/kortix-ai/suna/pull/6512
• fix(web): unify "No second factor enrolled" alert tone + icon by @markokraemer in https://github.com/kortix-ai/suna/pull/6513
• docs: the egress pin survives a stop/resume — measured on both shim providers by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6514
• fix(web): stop the animated logo splash on account/group navigation by @markokraemer in https://github.com/kortix-ai/suna/pull/6515
• feat(web): assign a custom role from inside a group, clarify Agent copy by @markokraemer in https://github.com/kortix-ai/suna/pull/6516
• fix(daemon): do not arm the in-guest shim where a provider edge owns the destination by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6517
• docs(runbook): enabling a sandbox provider is one atomic secret edit by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6518
• enh(web): rework the public share page chrome by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6519
• fix(api): a spawned sub-session inherits its parent's sharing, not private by @markokraemer in https://github.com/kortix-ai/suna/pull/6521
• iam: strip Agents/Connectors/Skills/Customize from the member floor role by @markokraemer in https://github.com/kortix-ai/suna/pull/6522
• fix(gateway): log the full request/response body, never a capped preview by @markokraemer in https://github.com/kortix-ai/suna/pull/6523
• feat(web): unify secret Delivery + "Used by" into one Access picker by @markokraemer in https://github.com/kortix-ai/suna/pull/6525
• Session truth M1.5: queue forwards between turns, first prompt is a durable row, dead-code sweep, sub-session integrity by @markokraemer in https://github.com/kortix-ai/suna/pull/6527
• refactor(github): prove account-linking identity via the App's own OAuth, not Supabase by @markokraemer in https://github.com/kortix-ai/suna/pull/6526
• Access control: one hub, one dialog, one row, one picker — agents deny-by-default, Editor removed, tokens IA by @markokraemer in https://github.com/kortix-ai/suna/pull/6531
• feat(worktree): nuke --all with time rules for bulk teardown by @markokraemer in https://github.com/kortix-ai/suna/pull/6529
• enh(web): bake a 110% UI scale into the default by @markokraemer in https://github.com/kortix-ai/suna/pull/6524
• fix(desktop): answer HTTP Basic challenges instead of rendering a dead 401 by @markokraemer in https://github.com/kortix-ai/suna/pull/6455
• chore(deps): bump pnpm/action-setup from 4 to 6 by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6343
• chore(deps): bump bridgecrewio/checkov-action from 12.3114.0 to 12.3117.0 by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6342
• chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6341
• chore(deps): bump github/codeql-action from 4.37.4 to 4.37.7 by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6340
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.7 by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6339
• chore(deps): bump golang from 1.25-bookworm to 1.26-bookworm in /apps/api by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6338
• docs(monitors): internal shipping/verification/ops/removal record by @markokraemer in https://github.com/kortix-ai/suna/pull/6436
• fix(billing): one grant idempotency key per subscription activation by @markokraemer in https://github.com/kortix-ai/suna/pull/6534
• test(ke2e): GW-13 exhausts /v1/usage group_by enum, row shapes, malformed timestamps, empty window by @agent-kortix in https://github.com/kortix-ai/suna/pull/5254
• fix: image/video show tool now wraps in ViewerFrame with toolbar actions by @agent-kortix in https://github.com/kortix-ai/suna/pull/6033
• feat(selfhost): serve deployed Apps through the bundled Caddy ingress by @markokraemer in https://github.com/kortix-ai/suna/pull/6469
• chore(deps): bump pypdf from 6.14.2 to 6.15.0 in /packages/starter/templates/general-knowledge-worker/.kortix/opencode/skills/presentations/scripts by @dependabot[bot] in https://github.com/kortix-ai/suna/pull/6262
• feat(platinum-provider): idempotent create dedup + decoupled build-size knob by @allenabraham999 in https://github.com/kortix-ai/suna/pull/5411
• docs(learnings): correct the tests-release entry; add the half-deployed-staging rule by @markokraemer in https://github.com/kortix-ai/suna/pull/6537
• fix(web): keep capability-tab-routes server-safe — unblocks Deploy Dev frontend build by @markokraemer in https://github.com/kortix-ai/suna/pull/6533
• fix(worktree): create --branch checks out a remote-only branch instead of forking HEAD by @markokraemer in https://github.com/kortix-ai/suna/pull/6536
• feat(gateway): per-project OTLP trace export + Observability tab by @markokraemer in https://github.com/kortix-ai/suna/pull/4987
• Revert "feat(gateway): per-project OTLP trace export + Observability tab (#4987)" by @markokraemer in https://github.com/kortix-ai/suna/pull/6538
• test(apps): APP-4 teammate is a project member (editor role removed) by @markokraemer in https://github.com/kortix-ai/suna/pull/6532
• fix(iam): don't cache empty agent-grant maps — grants visible on all replicas immediately by @markokraemer in https://github.com/kortix-ai/suna/pull/6535
• Queue: one prompt per turn, chained on turn end, <1s delivery, instant Enter by @markokraemer in https://github.com/kortix-ai/suna/pull/6530
• Revert "enh(web): bake a 110% UI scale into the default (#6524)" by @markokraemer in https://github.com/kortix-ai/suna/pull/6539
• test(release-gate): make the gate passable — drop 5 permanent todo stubs, fix 7 stale/over-strict deployed-target flows by @markokraemer in https://github.com/kortix-ai/suna/pull/6542
• perf(ke2e): overlap the serial lane, stop retrying timeouts, fail fast on funding, backoff+breaker in the client by @markokraemer in https://github.com/kortix-ai/suna/pull/6543
• ci(release-gate): shard into parallel api/browser jobs, sweep test debris pre/post-run, assert browser env up front by @markokraemer in https://github.com/kortix-ai/suna/pull/6545
• infra(staging): right-size for the release gate (2 tasks, on-demand base, bigger box), record DB tier, let CI see real origin status at the edge by @markokraemer in https://github.com/kortix-ai/suna/pull/6544
• fix(security): close 3 Strix findings — egress-pin spoofing, trigger-session manager override, App proxy token scope by @markokraemer in https://github.com/kortix-ai/suna/pull/6541
• test(ke2e): declare daytona on 3 flows that boot a real sandbox (P1.6) by @markokraemer in https://github.com/kortix-ai/suna/pull/6546
• test(ke2e): send the edge CI-passthrough header so the release gate sees real origin status by @markokraemer in https://github.com/kortix-ai/suna/pull/6547
• infra(ecs-api): force_new_deployment when the capacity-provider strategy changes (fixes staging TF apply) by @markokraemer in https://github.com/kortix-ai/suna/pull/6549
• test(ke2e): fix the two runtime defects that failed the first sharded release-gate run by @markokraemer in https://github.com/kortix-ai/suna/pull/6552
• Canonical RBAC: one model (role_assignments), one engine (authorize), one write path (assignRole) — dual-read window by @markokraemer in https://github.com/kortix-ai/suna/pull/6554
• ci(release-gate): the pre-run sweep can never skip the shards by @markokraemer in https://github.com/kortix-ai/suna/pull/6556
• fix(iam): don't cache empty agent object-grant maps (canonical engine) — grants take effect on all replicas immediately by @markokraemer in https://github.com/kortix-ai/suna/pull/6558
• fix(iam): GET /projects/:id/group-grants requires project.members.manage (Strix MEDIUM) by @markokraemer in https://github.com/kortix-ai/suna/pull/6560
• ci(release-gate): halve the shard fleet (26→15 workers) and retry a timed-out flow once by @markokraemer in https://github.com/kortix-ai/suna/pull/6561
• feat(sandbox): add flagged fast cold boot runtime by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6562
• fix(sandbox): harden lazy tool dispatch by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6565
• fix(dev): apply fast cold boot flag to ECS tasks by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6566
• fix(api): ship fast runtime build artifacts by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6567

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.8...v0.13.0

New

• Act-as for support — platform admins can open a customer account for up to one hour, with a visible banner and full auditing. Anything that would outlive the hour — tokens, memberships, invites, SSO providers, public shares, tunnels, agent scope changes — is refused during the session.
• Per-account entitlement overrides — operators grant or extend individual entitlements per account, each with an optional expiry, from a new admin override console. Expired overrides stop applying on their own.
• One plan catalog — plans now resolve through a single catalog and resolver across API, SDK and web. The duplicate frontend tier catalogs and the "· legacy" plan label are gone.
• Grant a secret to an agent in one call — a new API route grants an agent access to a secret, and the web app offers that grant directly from the warning that reports the missing access.
• Session overrides in one place — the Scope panel is replaced by a single overrides popover: agent, model, sandbox and connector overrides together, labels grounded in the agent's real defaults, and a reset that is always reachable.
• Managed model lineup refresh — Muse Spark 1.2, MiniMax M3 and GPT-5.6 Luna join GLM 5.2, and DeepSeek V4 Flash becomes the platform default.
• Sandboxes stay current — every deploy serves its CLI and managed skills at /v1/runtime-assets, and sandboxes reconcile against it on start, restart and resume.

Improved

• Project sessions are grouped by last activity instead of creation date.
• Account settings are reachable from the user menu.
• Model errors keep their upstream cause through gateway fallbacks, and context overflow is reported consistently — including after a fallback.
• Managed-model capabilities reported by the gateway now come from real pricing data.
• An outdated CLI now gets a clear "update your CLI" warning on the connector routes instead of a raw 404.

Fixed

• Two ways the session message queue could stall.
• Saving session scope without touching connectors no longer writes a connector override, and a saved agent secret selection is retained.
• Secret delivery on Platinum sandboxes resolves replicas reliably and arms the secrecy boundary within the provider's real timing budget, without re-arming on every turn.

Security and compliance

• The impersonation deny-list also covers agent-governance writes (agents/:name/scope, secrets/:id/grant), connector and channel management, and setup-link minting — all closed during review, before release.
• MFA enforcement for IAM users, WAF attached to the web load balancers, load-balancer log bucket versioning, and a tightly scoped CI Terraform role.

Internal

• Terraform for dev and prod now applies from CI behind per-environment OIDC roles, with drift detection re-registered.
• Production deploys stamp the frontend with the release version and no longer allow mixed frontend/API states; migrations with blocking backfills are rejected at lint time.
• Full-stack PR previews run in warm sandboxes, and the local test gates were stabilized.

What's Changed

• chore(release): VERSION → 0.12.8 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6350
• feat(llm-catalog): add Muse Spark 1.2, MiniMax M3, GPT-5.6 Luna; DeepSeek V4 Flash default by @markokraemer in https://github.com/kortix-ai/suna/pull/6352
• test: run full-stack PR previews in warm sandboxes by @markokraemer in https://github.com/kortix-ai/suna/pull/6347
• fix(ci): install Bun for preview controller by @markokraemer in https://github.com/kortix-ai/suna/pull/6354
• fix(llm-gateway): serve real managed-model capabilities via pricingRef by @markokraemer in https://github.com/kortix-ai/suna/pull/6355
• fix(web): remove two ways the message queue can stall by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6349
• fix(test): separate Platinum cold and restore budgets by @markokraemer in https://github.com/kortix-ai/suna/pull/6356
• fix(tests): scope preview idempotency to workflow run by @markokraemer in https://github.com/kortix-ai/suna/pull/6360
• fix(web,api): session scope defaults to Project default + unified overrides popover by @markokraemer in https://github.com/kortix-ai/suna/pull/6361
• fix(sandbox): always-latest kortix CLI + managed skills on every session start/restart by @markokraemer in https://github.com/kortix-ai/suna/pull/6359
• feat(infra): CI-applied Terraform — reusable guarded apply, per-env OIDC roles, drift coverage by @markokraemer in https://github.com/kortix-ai/suna/pull/6358
• fix(tests): bake Docker Compose into preview workers by @markokraemer in https://github.com/kortix-ai/suna/pull/6363
• fix(web): group sessions by last activity, not creation by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6357
• fix(llm): preserve upstream failure chains by @markokraemer in https://github.com/kortix-ai/suna/pull/6362
• fix(web): ground session-override labels in system truth + quiet trigger by @markokraemer in https://github.com/kortix-ai/suna/pull/6364
• fix(ci): force gateway in full dev deploys by @markokraemer in https://github.com/kortix-ai/suna/pull/6365
• test(infra): align the preview runtime contract test with the sandbox-preview architecture by @markokraemer in https://github.com/kortix-ai/suna/pull/6366
• billing: fix admin primitives — enterprise flag, expiring trial grants, monthly re-grant, member-role control by @markokraemer in https://github.com/kortix-ai/suna/pull/6367
• fix(gateway): normalize message-only context overflow by @markokraemer in https://github.com/kortix-ai/suna/pull/6368
• Stabilize preview and full local test gates by @markokraemer in https://github.com/kortix-ai/suna/pull/6369
• fix(cli): suppress browser launches in CI by @markokraemer in https://github.com/kortix-ai/suna/pull/6370
• fix(deploy-prod): gate the dead us-east-2 shadow lane behind ENABLE_US_SHADOW_DEPLOY by @markokraemer in https://github.com/kortix-ai/suna/pull/6372
• ci(terraform): auto-apply environments/dev and environments/prod by @markokraemer in https://github.com/kortix-ai/suna/pull/6373
• fix(web): overrides trigger icon-only, save closes panel, agent-default labels, sandbox chooser in panel by @markokraemer in https://github.com/kortix-ai/suna/pull/6371
• billing: plan catalog + pure resolver (PR2 — zero consumers switched) by @markokraemer in https://github.com/kortix-ai/suna/pull/6375
• fix(web): suppress Paper Shaders library-guard 'this.gl is null' noise (BS f0c8c422) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6374
• billing: one resolved plan view everywhere — kill the '· legacy' label (PR3) by @markokraemer in https://github.com/kortix-ai/suna/pull/6376
• fix(ci): stop the dev deploy cancelling its own API build by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6377
• feat: grant a secret to an agent from the warning that reports it by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6378
• Keep saved agent secret selection in sync by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6379
• billing: provider-vs-admin write ownership for credit_accounts (PR4) by @markokraemer in https://github.com/kortix-ai/suna/pull/6380
• fix: a network-boundary secret made every agent turn fail by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6381
• fix(secrets): give the boundary arm a budget the provider can meet by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6384
• billing: per-account overrides with expiry + compute pricing + admin override console (PR5) by @markokraemer in https://github.com/kortix-ai/suna/pull/6383
• fix(compliance): enforce ALB log bucket versioning (DCF-78) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6382
• billing: kill the duplicate frontend tier catalogs (PR7) by @markokraemer in https://github.com/kortix-ai/suna/pull/6385
• billing: act-as impersonation for platform admins (PR6) by @markokraemer in https://github.com/kortix-ai/suna/pull/6386
• fix(api): deny agent-scope and secret-grant writes during impersonation by @markokraemer in https://github.com/kortix-ai/suna/pull/6388
• fix(api): deny connector, channel-connect and setup-link writes during impersonation by @markokraemer in https://github.com/kortix-ai/suna/pull/6390
• fix(ci): raise tests-release timeout to 45m so the full suite can finish by @markokraemer in https://github.com/kortix-ai/suna/pull/6393
• fix(ci): raise tests-release timeout to 60m (measured ~47m real runtime) by @markokraemer in https://github.com/kortix-ai/suna/pull/6394

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.7...v0.12.8

New

• Your terminal is now a first-class way to work with an agent: kortix connect opens a session picker and attaches a full terminal UI to any running session, and can create a session and connect in one step. Bare kortix shows the landing screen again.
• Feature flags: one gating primitive across API, web, and CLI. Disabled features answer with a clear feature_disabled error everywhere, and each project gets a dedicated Feature flags section under Customize.
• Network-boundary secrets: secrets can now be marked for delivery only inside the sandbox network boundary, enforced per provider, configurable from web and CLI. Protected Platinum credentials sync automatically, misconfigurations are caught at save time instead of at boot, and the UI only offers delivery modes the project can honour.
• A workspace switcher and a /new create page: switch workspaces from anywhere, reach account settings from the switcher, and create projects from one place.
• Connector approvals are reviewed inline in the session, and connector setup finishes through one atomic path — no more half-finished connections when a webhook and a redirect race each other.
• The starter ships a continual-harness skill: agent scaffolding that reviews its own sessions and refines itself over time.
• Live session reload: when a session restarts, the UI now streams the reload progress instead of going quiet.

Improved

• Sandbox lifetime is now bound to the agent. Active turns keep compute alive; finished or inactive sessions contract to a short retrieval window; every stop records why it happened. Wake billing starts only after the provider confirms the machine is actually running — concurrent and failed wakes no longer bill.
• Session turns read in plain language, and rendering them costs far less.
• Connector search covers the whole Pipedream catalogue, with categories filtered server-side. New sessions pick up server-resolved connector defaults.
• Computer profiles are bound per machine, personal machines are allowed in project profiles, and the Computer Tunnel is hardened with computer-use restored.
• Session titles converge on the runtime title everywhere — no more three names for one session.
• Workspace file and spreadsheet reads retry during sandbox startup instead of failing on the first try.
• Audit trails reconstruct complete session integrity chains, and runtime state survives provider restarts.

Fixed

• A turn that is still being written can no longer be aborted mid-write, and "Interrupted" is only shown when a turn was actually interrupted.
• The session error card no longer blinks after giving up, no longer appears while the runtime is intentionally parked, and a temporary 503 during startup is no longer treated as a failure.
• The thinking shimmer only animates the thought the model is still writing.
• Starter agent templates fetch managed skills through the CLI instead of assuming they are on disk.
• A building sandbox shows a Details action instead of a broken Retry.
• Inline content previews render again.
• The public unauthenticated /review prototype page is gone, a connector URL parsing denial-of-service is eliminated, SES mail now runs on a task role instead of an IAM user, and production deploys refuse a mismatched Supabase auth configuration.

What's Changed

• chore(release): VERSION → 0.12.7 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6268
• fix(audit): make OpenCode relay spool writable by @markokraemer in https://github.com/kortix-ai/suna/pull/6270
• fix(web): hide Apps discovery until the project enables the apps experiment by @markokraemer in https://github.com/kortix-ai/suna/pull/6271
• fix(audit): persist runtime state outside provider tmpfs by @markokraemer in https://github.com/kortix-ai/suna/pull/6272
• fix(runtime): parse CRLF OpenCode event frames by @markokraemer in https://github.com/kortix-ai/suna/pull/6274
• fix(web): remove public unauthenticated /review prototype page by @markokraemer in https://github.com/kortix-ai/suna/pull/6275
• feat(api): feature-flag core — declared enforcement + standard feature_disabled gate by @markokraemer in https://github.com/kortix-ai/suna/pull/6277
• fix(audit): return complete session integrity chains by @markokraemer in https://github.com/kortix-ai/suna/pull/6278
• feat(web,sdk): feature-flag surface — one gating primitive, dedicated Customize section by @markokraemer in https://github.com/kortix-ai/suna/pull/6279
• feat(cli,tests,docs): feature_disabled everywhere — CLI message, drift pin, flags UI spec by @markokraemer in https://github.com/kortix-ai/suna/pull/6280
• fix(sandbox): bind lifecycle and billing to agent activity by @markokraemer in https://github.com/kortix-ai/suna/pull/6281
• feat(starter): continual harness — self-refining agent scaffolding (arXiv 2605.09998) by @markokraemer in https://github.com/kortix-ai/suna/pull/6282
• fix(sdk): eliminate connector URL regex denial of service by @markokraemer in https://github.com/kortix-ai/suna/pull/6284
• fix(web): select connector defaults for new sessions by @markokraemer in https://github.com/kortix-ai/suna/pull/6286
• Refactor computers into per-machine connector profiles by @markokraemer in https://github.com/kortix-ai/suna/pull/6287
• fix(web): keep connector defaults server-resolved by @markokraemer in https://github.com/kortix-ai/suna/pull/6288
• fix(compliance): add MFA enforcement denial policy for IAM users (DCF-67) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6289
• fix(web): de-noise CAPTCHA interceptor widgetId race from extension by @agent-kortix in https://github.com/kortix-ai/suna/pull/6290
• refactor(connectors): group assigned computers in profiles by @markokraemer in https://github.com/kortix-ai/suna/pull/6292
• fix(connectors): isolate legacy computer aggregate by @markokraemer in https://github.com/kortix-ai/suna/pull/6293
• feat(secrets): enforce network-boundary delivery by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6297
• feat(web,api,sdk): workspace switcher and /new create page by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6276
• fix(computers): allow personal machines in project profiles by @markokraemer in https://github.com/kortix-ai/suna/pull/6299
• Publish agent tunnel with platform releases by @markokraemer in https://github.com/kortix-ai/suna/pull/6301
• fix(api,sdk,web): converge session titles on the runtime title everywhere by @markokraemer in https://github.com/kortix-ai/suna/pull/6302
• Remove agent tunnel keep-awake mode by @markokraemer in https://github.com/kortix-ai/suna/pull/6304
• fix(web): restore preview for inline content artifacts by @agent-kortix in https://github.com/kortix-ai/suna/pull/6300
• fix(web): building sandbox alert shows Details action instead of Retry build by @markokraemer in https://github.com/kortix-ai/suna/pull/6306
• fix(connectors): search the whole Pipedream catalogue, filter categories server-side by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6307
• feat(web): review connector approvals inline in the session by @markokraemer in https://github.com/kortix-ai/suna/pull/6311
• fix(api,sdk,web): unify connector finalize into one atomic path; webhook auxiliary by @markokraemer in https://github.com/kortix-ai/suna/pull/6312
• fix(agent-tunnel): harden Computer Tunnel and restore CUA by @markokraemer in https://github.com/kortix-ai/suna/pull/6313
• feat(web,sdk): plain-language turn UI and a large render-cost cut by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6309
• fix(tunnel): record signed heartbeat pongs by @markokraemer in https://github.com/kortix-ai/suna/pull/6315
• feat(cli): bare kortix attaches the OpenCode TUI to a session (managed binary + picker) by @markokraemer in https://github.com/kortix-ai/suna/pull/6317
• fix(web): retry all workspace file reads during sandbox startup by @agent-kortix in https://github.com/kortix-ai/suna/pull/6310
• feat(cli): connect picker under connect (bare kortix = landing again) + create-and-connect by @markokraemer in https://github.com/kortix-ai/suna/pull/6318
• feat(web): deploy frontend and PR previews on ECS by @markokraemer in https://github.com/kortix-ai/suna/pull/6319
• test(ke2e): add fast local flow runner by @markokraemer in https://github.com/kortix-ai/suna/pull/6260
• fix(compliance): replace SES IAM user with ECS task role (DCF-71) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6295
• feat(web): expose session restart actions in command palette by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6321
• fix(daemon): never abort a turn that is still being written by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6322
• feat: let agents reconcile branch conflicts before reload by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6323
• ci: run each test suite once by @markokraemer in https://github.com/kortix-ai/suna/pull/6324
• fix(web): "Interrupted" must mean interrupted, not "the word abort appeared" by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6325
• Show live session config reload progress by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6326
• infra: retire unused QA report portal by @markokraemer in https://github.com/kortix-ai/suna/pull/6328
• ci: remove completed QA teardown workflow by @markokraemer in https://github.com/kortix-ai/suna/pull/6333
• infra: cut dev and previews over to ECS web by @markokraemer in https://github.com/kortix-ai/suna/pull/6332
• fix(starter): route managed-skill references through kortix-cli + live kortix skills get by @markokraemer in https://github.com/kortix-ai/suna/pull/6330
• fix: network-boundary secrets fail loudly instead of silently by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6334
• fix(web): the session header shows the session name, not opencode's title by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6327
• fix(infra): preserve canonical dev DNS metadata by @markokraemer in https://github.com/kortix-ai/suna/pull/6336
• fix(compliance): associate ECS web ALBs with WAF (DCF-88) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6344
• test: sample full-stack test report artifacts by @markokraemer in https://github.com/kortix-ai/suna/pull/6337
• fix(release): gate prod frontend on live API; forbid blocking backfills in migrations by @markokraemer in https://github.com/kortix-ai/suna/pull/6346
• feat(llm-catalog): slim managed lineup to GLM 5.2 + DeepSeek V4 Flash by @markokraemer in https://github.com/kortix-ai/suna/pull/6348

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.6...v0.12.7

Secret delivery is now a managed control plane, connectors speak one language across the whole platform, and billing moves to flat credit plans.

New

• Secret delivery controls. Decide exactly which secrets each agent session can use. Policies are managed from the web app and CLI, secrets reach sandboxes through an audited HTTPS broker with session-scoped handles, revoked secrets disappear from running agents, and LLM, connector, git, and subscription credentials are isolated from each other. A new kortix audit CLI command reads the account audit trail.
• Unified connectors. One connector model across web, CLI, SDK, and API: consistent Connector and Connection terminology, a single data plane in @kortix/sdk, and connector credentials that bind to project secrets. The connector catalogue now pages through the full ~2,700-app list instead of stopping at 192.
• Flat credit plans. Plans are priced as flat monthly credits instead of per-seat pricing. Billing also gained idempotent compute debits and accurate spend reporting.
• Rebuilt project onboarding. A single-column, seven-step flow with a clearer Slack setup and plan selection.
• Capability pages. Connectors, skills, and agents are browsable pages instead of a configuration overlay.
• Use-case packs. Marketplace runbooks are grouped into installable packs, with real loading and error states and inline project creation.
• Document conversion by default. Every new sandbox includes a convert-documents-to-markdown skill backed by a baked-in converter.
• Serverless app deployments. Provider-neutral serverless deployments for apps, served behind a managed edge with wildcard TLS and signed public hosts.
• Kimi K3 is available as a managed model.

Improved

• Sessions survive interruptions. A pending agent question is parked when its sandbox dies and restored on the next boot, and a stored answer is delivered as a follow-up turn. Runtime updates boot and verify the new runtime before retiring the old one.
• Chat UX. Instant session rename, a truthful header title, idempotent provisioning, preview verdicts, and grouped activity. In-flight sends survive navigation, and tool failures are reported honestly.
• Session list. Rebuilt with status states, collapsible sections, and a nested filter menu.
• Faster, calmer navigation. Project pages load faster (Next.js 16.3), and passively opening a project no longer wakes idle sandboxes.
• Clearer errors. The LLM gateway surfaces real upstream provider errors instead of a generic Bad Gateway, and large repository branch listings are bounded.

Fixed

• Billing: the same compute window can no longer be charged twice, "spend this period" reports the correct window, the paid seat is released when SCIM deprovisions a member, BYOK failover respects the managed-model entitlement, and the UI shows the concurrency limit the server actually enforces.
• Agent workspaces are strictly enforced across repository, git, and clone APIs.
• Approvals require a full review of each call, and the daemon no longer auto-answers questions outside a channel session.
• The Terms of Service link opens the document directly.
• Desktop: the title bar aligns with the OS window controls.
• Production API recovery is hardened: migration-safe restarts and better behavior under memory pressure.

What's Changed

• chore(release): VERSION → 0.12.5 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6148
• Billing correctness + park-and-restore for blocked turns by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6145
• fix(db): generated migrations get the safety header, unblock the squawk gate by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6150
• chore(web): upgrade Next.js to 16.3.0 by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6151
• Rework connectors, skills and commands into browsable capability pages by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6054
• fix(daemon): stop auto-answering questions outside a channel session by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6153
• feat(secrets): complete secure delivery controls by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6134
• feat(web): session list — status states, collapsible sections, and a nested filter menu by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6142
• fix(approvals): require full one-call review by @markokraemer in https://github.com/kortix-ai/suna/pull/6154
• fix(web): keep standalone output off Vercel by @markokraemer in https://github.com/kortix-ai/suna/pull/6155
• fix: attribute CLI actions in centralized audit logs by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6156
• fix(billing): stop quoting the wrong seat grant and seat price by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6157
• feat(secrets): bind project secrets to connectors by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6158
• fix(web): align approval indicator with design system by @markokraemer in https://github.com/kortix-ai/suna/pull/6159
• fix(web,api,sdk): chat UX — header title, instant rename, provision idempotency, preview verdicts, activity grouping by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6136
• feat(billing): flat credit plans replace seats, no included managed LLM by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6160
• feat(web): update secrets optimistically by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6164
• fix(api): support pinned secret broker requests on Bun 1.2 by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6167
• fix(web): guard tool-outcome parsing against null JSON output (session page crash) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6163
• fix(web): de-noise old-browser DOM null-deref on marketing homepage (scrollLeft / appendChild) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6161
• fix(web): de-noise model_not_servable unhandled rejection (BS 9784f440) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6162
• fix(web): hide the regressed capability pages behind a flag by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6168
• refactor: unify CLI connector and connection terminology by @markokraemer in https://github.com/kortix-ai/suna/pull/6165
• feat(sandbox): bake @firecrawl/anydoc + default convert-documents-to-markdown skill by @markokraemer in https://github.com/kortix-ai/suna/pull/6170
• fix(marketplace): stop listing use-case pack skills as Kortix Starter contents by @markokraemer in https://github.com/kortix-ai/suna/pull/6171
• Remove standalone Commands capability page by @agent-kortix in https://github.com/kortix-ai/suna/pull/6169
• test(marketplace): add convert-documents-to-markdown to the pinned starter floor by @markokraemer in https://github.com/kortix-ai/suna/pull/6172
• refactor(db): cut over connector physical identifiers by @markokraemer in https://github.com/kortix-ai/suna/pull/6173
• feat(marketplace): group use-case runbooks under a browsable Use-case pack project by @markokraemer in https://github.com/kortix-ai/suna/pull/6174
• fix(web): use-case install dialog — real load/error states + inline project creation by @markokraemer in https://github.com/kortix-ai/suna/pull/6175
• refactor(connectors): remove executor and profile compatibility by @markokraemer in https://github.com/kortix-ai/suna/pull/6176
• fix(desktop): pin the title-bar band to the OS window controls by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6178
• feat(web): adopt smooth shadow system by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6179
• refactor(sdk): unify Connector data plane by @markokraemer in https://github.com/kortix-ai/suna/pull/6180
• feat(web): add standalone Agents capability page by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6177
• feat(worktree): multi-name nuke with per-worktree confirmation by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6181
• feat(web,api,sdk): a calmer, more personal onboarding experience by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6111
• fix(prod): harden API recovery after OOM incident by @markokraemer in https://github.com/kortix-ai/suna/pull/6182
• fix(prod): enforce migration-safe ECS recovery by @markokraemer in https://github.com/kortix-ai/suna/pull/6183
• fix(secrets): verify sandbox env delivery end to end by @markokraemer in https://github.com/kortix-ai/suna/pull/6184
• fix(web): filter Supabase gotrue OTP-expired Object-Not-Found rejection noise by @agent-kortix in https://github.com/kortix-ai/suna/pull/6189
• fix(ke2e): align release flows with current contracts by @markokraemer in https://github.com/kortix-ai/suna/pull/6190
• fix(release): retry transient flow and trigger conflicts by @markokraemer in https://github.com/kortix-ai/suna/pull/6192
• fix(release): bound and expose full gate progress by @markokraemer in https://github.com/kortix-ai/suna/pull/6194
• feat: teach agents how to use scoped secrets safely by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6195
• fix: clear revoked secrets from new sandbox processes by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6198
• feat(apps): add provider-neutral serverless deployments by @markokraemer in https://github.com/kortix-ai/suna/pull/6197
• fix(ci): clear v0.12.5 security findings by @markokraemer in https://github.com/kortix-ai/suna/pull/6199
• fix: keep agent config freshness safe and unobtrusive by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6202
• ci(apps): provision wildcard edge DNS by @markokraemer in https://github.com/kortix-ai/suna/pull/6201
• fix(ci): use supported Wrangler secret-list format by @markokraemer in https://github.com/kortix-ai/suna/pull/6204
• fix(apps): honor managed storage upload limit by @markokraemer in https://github.com/kortix-ai/suna/pull/6205
• fix(apps,connectors): repair edge routing and long sync calls by @markokraemer in https://github.com/kortix-ai/suna/pull/6206
• fix(apps): update Caddy security release by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6208
• fix(apps): build patched Caddy in API image by @markokraemer in https://github.com/kortix-ai/suna/pull/6209
• fix(apps): build static Caddy runtime by @markokraemer in https://github.com/kortix-ai/suna/pull/6212
• fix(apps): make Caddy cross-build reproducible by @markokraemer in https://github.com/kortix-ai/suna/pull/6214
• feat(daemon): verified opencode reload — boot the new one, then retire the old by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6213
• feat(api): materialize restricted agent environments by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6126
• fix(ci): resolve staging scanner findings by @markokraemer in https://github.com/kortix-ai/suna/pull/6218
• test(daemon): make the reload decline path provable on a real box by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6219
• fix(apps): preserve runtime billing through idle lifecycle by @markokraemer in https://github.com/kortix-ai/suna/pull/6220
• ci(apps): provision nested wildcard certificate by @markokraemer in https://github.com/kortix-ai/suna/pull/6207
• fix(ci): make Rekor signing retries idempotent by @markokraemer in https://github.com/kortix-ai/suna/pull/6221
• fix: promote verified agent config replacements by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6223
• fix(ci): checkout signing helper in supply-chain job by @markokraemer in https://github.com/kortix-ai/suna/pull/6224
• fix(ci): scope Apps edge certificate token by @markokraemer in https://github.com/kortix-ai/suna/pull/6222
• fix(web): de-noise Canvas getImageData OOM on marketing homepage (BS b4b43847) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6225
• fix(apps): gate projects and bootstrap Platinum runtime by @markokraemer in https://github.com/kortix-ai/suna/pull/6226
• fix(web): connector catalogue stops at 192 of ~2,700 apps — restore paging, add infinite scroll by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6228
• feat(reload): say the turn was stopped, and ask before stopping it by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6230
• fix(proxy): the opencode PTY must follow opencode across a reload swap by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6233
• perf(web,sdk): one cache entry per entity, and stop discarding route segments by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6231
• fix: suppress request deadline toasts by @markokraemer in https://github.com/kortix-ai/suna/pull/6234
• fix(projects): re-land legacy-migration chat rehydrate on session open by @markokraemer in https://github.com/kortix-ai/suna/pull/6235
• fix(apps): make cold wake and Dockerfile runtimes reliable by @markokraemer in https://github.com/kortix-ai/suna/pull/6227
• fix(web): name the session browser tab, owned by route metadata by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6236

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.4...v0.12.5

New

• One-shot approval links: approve or reject an agent's pending request straight from the notification link, without opening the app.
• Sandboxes now ship with a baked-in Python package floor — Pillow, pypdfium2, pytesseract, and 13 more pinned packages — so document and image skills run immediately, with no install step.
• The session header warns when an agent's configuration changed on disk after the session started, with a one-click reload that updates the files the agent actually reads.
• Terms of Service are linked from /legal/terms.

Improved

• Project page navigation is noticeably faster, and the web app moved to Next.js 16.2.0.
• Messages queued while the agent is working now stay queued until the turn actually ends — no more mid-turn releases or duplicate sends.
• One keyboard shortcut (⌘I / Ctrl+I) now toggles the whole right side of a session: the action panel, a detail panel, or both.
• Session error states are clearer: tool failures are reported truthfully, retry states show what is happening, and a stale agent config no longer needs a page reload to surface.
• The CLI is quieter and more honest: --quiet is honoured on every path, and it no longer claims an invite email was sent when none was.

Fixed

• Hardened the sandbox: closed a proxy hole that could leak the sandbox service key to an attacker-named host, closed a DNS-rebind window by connecting only to the address that was vetted, resolved symlinks before authorizing file paths, and stopped one session's credentials from being served to other members of the account.
• Secrets: setup links now expire on time, re-scoped secrets validate against the session owner rather than the caller, and secret identifiers are no longer disclosed through the narrowing report.
• Session reliability: removed two paths that could silently destroy a session's commits, a planned restart now finishes the turn it interrupts, a failed agent spawn schedules a respawn instead of killing the session, and reloading an agent never hard-resets the session branch.
• A transient git failure can no longer compile an agent with an empty prompt.
• Queued API errors: address-validation failures now return a proper 400 instead of a server error.

What's Changed

• CLI: stop reporting failure while a cross-account fallback is still pending by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6069
• chore(release): VERSION → 0.12.3 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6072
• Executor: one-shot human approval links by @markokraemer in https://github.com/kortix-ai/suna/pull/6078
• Render the connector refusal, fix the reload, and surface stale config in the UI by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6074
• feat(sandbox): bake the starter Python package floor, run skills bare by @markokraemer in https://github.com/kortix-ai/suna/pull/6080
• fix(sandbox): target the managed interpreter by path in the floor install by @markokraemer in https://github.com/kortix-ai/suna/pull/6081
• fix(sdk): classify model_not_servable 409 as silent to Sentry (BS ed07f6c5…) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6082
• Fix local Supabase and test runner dependencies by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6084
• Make session reload update the agent files opencode actually reads by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6083
• Keep content timestamp generation deterministic by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6085
• Set a safe default frontend build heap by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6087
• Warn on the first secrets narrowing; don't compile an agent with no prompt by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6086
• Guarantee accessible public MDX images by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6088
• A failed spawn must schedule a respawn, not kill the session by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6089
• CLI: stop claiming an invite email was sent when none was by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6090
• Validate re-scoped secrets for the session owner, not the caller by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6091
• docs: record the connector 'Connected' badge gap and its tradeoff by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6092
• Finalize the turn a planned restart kills by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6093
• Two paths that silently destroy a session's commits by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6094
• mock.module stubs silently delete the exports they omit by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6095
• Surface a stale agent config without a page reload by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6097
• Port 3211 served another session's credentials to any account member by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6098
• Reload 500'd on every session that hadn't pushed its branch by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6099
• /web-proxy mailed the sandbox service key to any host you named by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6096
• feat(experimental): add meta_agent feature flag by @agent-kortix in https://github.com/kortix-ai/suna/pull/6101
• fix(secrets): setup-link TTL, session callback, secrets sync, diagnostic logging by @agent-kortix in https://github.com/kortix-ai/suna/pull/6100
• fix(web,sdk): keep in-flight sends, tell the truth about tool failures, one code palette by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6058
• fix(web): stop auth cache and markdown prefetch storms by @markokraemer in https://github.com/kortix-ai/suna/pull/6106
• fix: slow project page navigation, and upgrade to Next.js 16.2.0 by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6102
• fix(web,sdk): queued messages stay queued until the turn actually ends by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6110
• fix(executor): align catalog with session connector scope by @markokraemer in https://github.com/kortix-ai/suna/pull/6113
• fix(api): convert assertAllowedSourceAddress throw to typed 400 (BS f5c0ce61) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6112
• feat(legal): publish simplified Terms of Service at /legal/terms by @agent-kortix in https://github.com/kortix-ai/suna/pull/6103
• fix(web): redirect Terms to public Drive folder, drop stale terms body by @agent-kortix in https://github.com/kortix-ai/suna/pull/6114

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.2...v0.12.3

Promotes the full candidate verified on staging. Prevents passive session reads and project navigation from waking stopped sandboxes; corrects session activity timestamps; adds session access, reload, cost, and guarded secret-delivery controls; improves channel, email, executor, chat, download, PPTX, and account-usage behavior; and completes the ECS-focused infrastructure and deployment updates. Fast-track note: staging image build and deployment passed. One unrelated landing-page accessibility assertion for a scrollable pre element failed; the four browser interaction tests, login accessibility, and migration tests passed.

What's Changed

• chore(release): VERSION → 0.12.2 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6011
• fix(web): show recoverable session failure payload by @markokraemer in https://github.com/kortix-ai/suna/pull/6013
• fix(api): execute email sender regex with RE2 by @markokraemer in https://github.com/kortix-ai/suna/pull/6014
• chore(dev-eks): deploy gateway dev-0d116c01 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6015
• chore(dev-eks): deploy dev-0d116c01 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6016
• fix(markdown): make table headers and cells stop wrapping mid-word, restore GFM alignment by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6017
• fix(web): rebuild the project access gate UX by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6019
• seo(web): full on-page/technical SEO pass over the public site by @markokraemer in https://github.com/kortix-ai/suna/pull/6020
• fix: propagate managed model vision capability to frontend by @agent-kortix in https://github.com/kortix-ai/suna/pull/6021
• chore(dev-eks): deploy gateway dev-62dccb48 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6023
• chore(dev-eks): deploy dev-62dccb48 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6024
• chore(dev-eks): deploy dev-847b9689 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6025
• blog: the only moat that matters — data flywheels, not static software by @agent-kortix in https://github.com/kortix-ai/suna/pull/6022
• feat(web): rebuild the session chat thread for a calmer, more readable conversation by @sutharjay1 in https://github.com/kortix-ai/suna/pull/5940
• blog: six adjacent articles on the data-flywheel thesis by @agent-kortix in https://github.com/kortix-ai/suna/pull/6026
• fix: process Slack audio messages (file_share subtype) through webhook by @agent-kortix in https://github.com/kortix-ai/suna/pull/6028
• fix: also allow me_message subtype through Slack webhook gate by @agent-kortix in https://github.com/kortix-ai/suna/pull/6029
• fix: also allow bot_message subtype through Slack webhook gate by @agent-kortix in https://github.com/kortix-ai/suna/pull/6030
• Fix Executor email attachments from local artifacts by @markokraemer in https://github.com/kortix-ai/suna/pull/6031
• chore(dev-eks): deploy dev-13d27c8e [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/6032
• fix(agentmail): isolate inbox provisioning per email profile by @markokraemer in https://github.com/kortix-ai/suna/pull/6034
• fix(ci): update tests after EKS removal by @markokraemer in https://github.com/kortix-ai/suna/pull/6038
• fix(session): prevent passive project navigation from waking sandboxes by @markokraemer in https://github.com/kortix-ai/suna/pull/6039
• fix(email): accept standard webhook signature headers by @markokraemer in https://github.com/kortix-ai/suna/pull/6040
• Fix Executor email attachments with binary uploads by @markokraemer in https://github.com/kortix-ai/suna/pull/6036
• docs(web): compare Kortix with QM by @markokraemer in https://github.com/kortix-ai/suna/pull/6042
• fix(ci): provide AWS role to staging secret sync by @markokraemer in https://github.com/kortix-ai/suna/pull/6043
• fix(ci): allow staging secret synchronization by @markokraemer in https://github.com/kortix-ai/suna/pull/6044
• fix(sessions): recognize Veyris title placeholder by @markokraemer in https://github.com/kortix-ai/suna/pull/6046
• fix(web): remove client warm sessions by @markokraemer in https://github.com/kortix-ai/suna/pull/6047
• fix(sessions): retry title generation with fallback model by @markokraemer in https://github.com/kortix-ai/suna/pull/6048
• fix(sessions): bound title generation fallback by @markokraemer in https://github.com/kortix-ai/suna/pull/6049
• fix(web): guard members-view query arrays with toArray before .filter/.map (BS f9603a43) by @agent-kortix in https://github.com/kortix-ai/suna/pull/6051
• Session config freshness: end orphaned turns, compile from the session's ref, refresh config on restart by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6053
• feat(secrets): add delivery policy control plane by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6055
• feat(web): add a cost explorer to account usage by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6018
• The documented session reload, and a way to see when a session is stale by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6056
• Add CLI session access controls by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6059
• feat(web): /download close button, and mobile marked coming soon by @sutharjay1 in https://github.com/kortix-ai/suna/pull/6060
• fix(executor): stop hiding the whole connector catalog on bound sessions by @agent-kortix in https://github.com/kortix-ai/suna/pull/6052
• Apply session config via dispose (~51ms) instead of a respawn (~8s) by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6062
• fix(compliance): reconcile regional ALB alarms by @markokraemer in https://github.com/kortix-ai/suna/pull/6065
• Point systemReload at endpoints that exist by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/6067

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.1...v0.12.2