Changelog

Self-hosting, rebuilt

One generic Docker Compose self-host that runs the full Kortix platform on any VPS/server — kortix self-host init + start, VPS-first with a persistent domain (Caddy + automatic TLS), plus Cloudflare-tunnel and local modes for evaluation.

• In-app GitHub setup — create an org-owned GitHub App from Settings → Git (manifest flow), paste an existing App, or use a scoped access token. No CLI gymnastics, no PATs required.
• Self-host feature flags — single-account mode, marketing site off by default, enterprise license unlock, billing/connectors gracefully hidden when unconfigured.
• Operations built in — nightly zero-downtime rolling updates on the curated stable channel (promoted via the new Promote Self-Host Stable workflow), kortix self-host secrets management, run-any-version + local-images modes, required-secret enforcement at init.
• Kortix-managed models are cloud-only — self-host deployments use your own model keys (BYOK); the managed catalog is gated behind an explicit flag.
• Reliability — SSE turn-stream no longer leaks connections on retry (fixes tab-wide request starvation); stale sessions self-heal instead of dead-ending on the auth screen.
• New self-host e2e test suite (fast CLI-artifact tier + opt-in live tier) wired into CI.

What's Changed

• chore(release): VERSION → 0.9.109 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4521
• fix(web): guard non-string error message to prevent TypeError crash (t.message.includes is not a function) by @markokraemer in https://github.com/kortix-ai/suna/pull/4523
• fix(web): drop expected billing-gate 402 from Sentry noise by @markokraemer in https://github.com/kortix-ai/suna/pull/4522
• fix(api): stop Sentry-capturing the expected request-deadline 503 (BS 29af03…) by @markokraemer in https://github.com/kortix-ai/suna/pull/4524
• chore(dev-eks): deploy dev-0022fc90 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4525
• fix(web): show deterministic session switching state by @markokraemer in https://github.com/kortix-ai/suna/pull/4526
• fix(api): retry transient socket-close on git proxy ref discovery (Better Stack df7a31d4) by @markokraemer in https://github.com/kortix-ai/suna/pull/4530
• fix(web): survive storage-disabled in-app WebViews (null localStorage/sessionStorage) by @markokraemer in https://github.com/kortix-ai/suna/pull/4529
• fix(web): suppress stale-deploy webpack-runtime 'call' TypeError noise by @markokraemer in https://github.com/kortix-ai/suna/pull/4528
• fix(web): stop Sentry-capturing the expected client-side request timeout (BS b1db01e5…) by @markokraemer in https://github.com/kortix-ai/suna/pull/4531
• fix(web): suppress old-WebKit lookbehind parse noise (Safari < 16.4) by @markokraemer in https://github.com/kortix-ai/suna/pull/4532
• fix(desktop): restore clickable native window chrome by @markokraemer in https://github.com/kortix-ai/suna/pull/4534
• feat(gateway): default to Codex GPT-5.6 with bounded GLM fallback by @markokraemer in https://github.com/kortix-ai/suna/pull/4535
• chore(dev-eks): deploy gateway dev-f9887b23 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4536
• chore(dev-eks): deploy dev-f9887b23 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4537
• feat(channels): revive Microsoft Teams + Slack-parity feature set by @lillyboga in https://github.com/kortix-ai/suna/pull/4527
• chore(dev-eks): deploy gateway dev-6456a34f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4539
• fix(web): suppress old-browser minified-chunk SyntaxError parse noise by @markokraemer in https://github.com/kortix-ai/suna/pull/4538
• fix(api): isolate effective:batch probe failures so a transient authorize blip degrades instead of 500-ing (BS c0e40278…) by @markokraemer in https://github.com/kortix-ai/suna/pull/4541
• chore(dev-eks): deploy dev-60a70f65 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4543
• fix(web): guard undefined/non-array before .filter/.map in customize agents/skills by @markokraemer in https://github.com/kortix-ai/suna/pull/4542
• fix(web): suppress unactionable No-error-message chunk events by @markokraemer in https://github.com/kortix-ai/suna/pull/4540
• fix(web): guard Paper Shaders null-context getSupportedExtensions crash by @markokraemer in https://github.com/kortix-ai/suna/pull/4544
• fix(teams): harden tenant binding and login tokens by @markokraemer in https://github.com/kortix-ai/suna/pull/4548
• chore(dev-eks): deploy dev-7a90fd7d [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4549
• fix(teams): loading card, /whoami, beautiful commands, widen ids by @lillyboga in https://github.com/kortix-ai/suna/pull/4547
• chore(dev-eks): deploy dev-a0a26619 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4550
• feat(web/teams): render Microsoft Teams as a channel table row like Slack by @lillyboga in https://github.com/kortix-ai/suna/pull/4551
• fix(api/teams): Teams install never shows connected (connector-scoped secret read) by @lillyboga in https://github.com/kortix-ai/suna/pull/4552
• chore(dev-eks): deploy dev-a8a49d4f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4553
• feat(api/teams): true one-click org install via delegated auth-code publish by @lillyboga in https://github.com/kortix-ai/suna/pull/4554
• chore(api/teams): log org-install outcome in the oauth callback by @lillyboga in https://github.com/kortix-ai/suna/pull/4556
• fix(scim): group member adds stranded when the person joined via SSO JIT by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4555
• chore(dev-eks): deploy dev-b2f52c75 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4557
• chore(dev-eks): deploy dev-0689722b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4559
• fix(scim): close the shadowed-invite holes (offboarding, group remove/replace/create) by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4558
• chore(dev-eks): deploy dev-4a852b0a [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4560
• feat(projects): add session branch environments by @markokraemer in https://github.com/kortix-ai/suna/pull/4566
• chore(dev-eks): deploy dev-0a38bd7c [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4567
• fix(web/channels): stop the channels table overflowing its card by @lillyboga in https://github.com/kortix-ai/suna/pull/4568
• feat(self-host): add target-aware enterprise foundation by @markokraemer in https://github.com/kortix-ai/suna/pull/4569
• chore(dev-eks): deploy dev-6e5f07eb [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4571
• content: publish secure agent tool access by @agent-kortix in https://github.com/kortix-ai/suna/pull/4293
• fix(ci): isolate self-host schema bootstrap services by @markokraemer in https://github.com/kortix-ai/suna/pull/4570
• chore(dev-eks): deploy dev-a0182392 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4573
• refactor: remove hosted app deployment capability by @markokraemer in https://github.com/kortix-ai/suna/pull/4572
• chore(dev-eks): deploy dev-0a4e9c10 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4575
• content: publish Kortix vs Glean comparison by @markokraemer in https://github.com/kortix-ai/suna/pull/4574
• refactor(db): drop retired hosted deployments schema by @markokraemer in https://github.com/kortix-ai/suna/pull/4576
• chore(dev-eks): deploy dev-80b9e6fb [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4578
• refactor(llm-gateway): move catalog and fallback policy to control plane by @markokraemer in https://github.com/kortix-ai/suna/pull/4577
• chore(dev-eks): deploy gateway dev-b0768610 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4579
• chore(dev-eks): deploy dev-b0768610 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4580
• refactor: finish hosted app deployment stripout by @markokraemer in https://github.com/kortix-ai/suna/pull/4587
• chore(dev-eks): deploy dev-efcb5ded [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4589
• refactor: remove final hosted app guidance residues by @markokraemer in https://github.com/kortix-ai/suna/pull/4590
• feat(infra): add enterprise VPC deployment plane by @markokraemer in https://github.com/kortix-ai/suna/pull/4586
• chore(dev-eks): deploy dev-6eb580d6 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4591
• feat(llm-gateway): add project routing policy UI by @markokraemer in https://github.com/kortix-ai/suna/pull/4594
• fix(cli): use projects route for repository linking by @markokraemer in https://github.com/kortix-ai/suna/pull/4593
• chore(dev-eks): deploy dev-db83252d [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4595
• feat(sandboxes): add unified E2B cloud provider by @markokraemer in https://github.com/kortix-ai/suna/pull/4592
• chore(dev-eks): deploy gateway dev-0d8c2cbe [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4597
• feat(cli): manage enterprise AWS VPC installs by @markokraemer in https://github.com/kortix-ai/suna/pull/4596
• fix(db): unblock E2B provider migration on historical managed sandboxes by @markokraemer in https://github.com/kortix-ai/suna/pull/4599
• feat(projects): treat repository branches as isolated projects by @markokraemer in https://github.com/kortix-ai/suna/pull/4598
• chore(dev-eks): deploy dev-034b5229 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4600
• feat(projects): enable branch-isolated repository projects by @markokraemer in https://github.com/kortix-ai/suna/pull/4602
• chore(dev-eks): deploy dev-d784efd5 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4603
• chore(dev): add E2B key to encrypted env by @markokraemer in https://github.com/kortix-ai/suna/pull/4606
• fix(web): restore flat projects list by @markokraemer in https://github.com/kortix-ai/suna/pull/4608
• chore(dev-eks): deploy gateway dev-42803b64 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4611
• chore(dev-eks): deploy dev-42803b64 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4612
• fix(platinum): classify 409 sandbox_not_running as controlled 503, not Sentry by @agent-kortix in https://github.com/kortix-ai/suna/pull/4601
• fix(sessions): guard Daytona 429 on transcript + public-share reads (post-#3567) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4605
• fix(sdk): retry transient 502/503/504 on idempotent reads (BS 994987…) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4609
• fix(web): drop TronLink extension proxy-trap noise from Sentry by @agent-kortix in https://github.com/kortix-ai/suna/pull/4607
• fix(web): filter Android WebView native-bridge postMessage noise (Java object is gone) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4610
• feat(web): add machine-readable SEO surface by @agent-kortix in https://github.com/kortix-ai/suna/pull/4604
• feat(llm-gateway): simplify project routing UX by @markokraemer in https://github.com/kortix-ai/suna/pull/4613
• chore(dev-eks): deploy dev-fc1153f2 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4614
• fix(snapshots): synchronize template readiness across providers by @markokraemer in https://github.com/kortix-ai/suna/pull/4615
• fix(llm-gateway): avoid stale routing policy reads by @markokraemer in https://github.com/kortix-ai/suna/pull/4616
• chore(dev-eks): deploy dev-16d559de [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4617
• fix(gateway): serialize routing and default model writes by @markokraemer in https://github.com/kortix-ai/suna/pull/4618
• fix(snapshots): build missing Daytona templates by @markokraemer in https://github.com/kortix-ai/suna/pull/4621
• feat(self-host): add signed enterprise VPC release plane by @markokraemer in https://github.com/kortix-ai/suna/pull/4619
• chore(dev-eks): deploy gateway dev-4ce4a274 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4622
• chore(dev-eks): deploy dev-4ce4a274 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4624
• fix(enterprise): harden updater CodeQL paths by @markokraemer in https://github.com/kortix-ai/suna/pull/4623
• chore(dev-eks): deploy gateway dev-8a3a09be [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4625
• chore(dev-eks): deploy dev-8a3a09be [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4627
• feat: bootstrap enterprise release publisher by @markokraemer in https://github.com/kortix-ai/suna/pull/4629
• fix(snapshots): sync providers after template edits by @markokraemer in https://github.com/kortix-ai/suna/pull/4626
• chore(dev-eks): deploy dev-e4ed32da [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4630
• fix(enterprise): allow publisher repository decrypt by @markokraemer in https://github.com/kortix-ai/suna/pull/4631
• fix(enterprise): bind stable to prod migration provenance by @markokraemer in https://github.com/kortix-ai/suna/pull/4632
• chore(dev-eks): deploy dev-703b8a42 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4633
• fix(enterprise): allow Cosign key metadata lookup by @markokraemer in https://github.com/kortix-ai/suna/pull/4634
• fix(snapshots): surface sandbox provider status by @agent-kortix in https://github.com/kortix-ai/suna/pull/4628
• chore(dev-eks): deploy dev-d62a3002 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4635
• fix(cli): verify migrated Terraform state content by @markokraemer in https://github.com/kortix-ai/suna/pull/4636
• fix(cli): recover refreshed remote Terraform state by @markokraemer in https://github.com/kortix-ai/suna/pull/4637
• chore(dev-eks): deploy dev-0a2574c8 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4638
• fix(enterprise): normalize Route 53 zone guard by @markokraemer in https://github.com/kortix-ai/suna/pull/4639
• chore(dev-eks): deploy dev-cd886ce6 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4640
• fix(enterprise): allow encrypted CloudTrail alerts by @markokraemer in https://github.com/kortix-ai/suna/pull/4642
• chore(dev-eks): deploy dev-4105b5a9 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4644
• docs: refresh connector and runtime references by @agent-kortix in https://github.com/kortix-ai/suna/pull/4641
• fix(enterprise): repair AWS VPC operator and host bootstrap by @markokraemer in https://github.com/kortix-ai/suna/pull/4643
• chore(dev-eks): deploy dev-2b3a6a03 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4646
• release(enterprise): review 0.9.108-e2 contract by @markokraemer in https://github.com/kortix-ai/suna/pull/4645
• chore(dev-eks): deploy gateway dev-f23f8696 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4647
• chore(dev-eks): deploy dev-f23f8696 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4649
• docs: cover self-host AWS VPC and SDK retries by @agent-kortix in https://github.com/kortix-ai/suna/pull/4648
• chore(dev-eks): deploy dev-6f891ef9 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4650
• fix(enterprise): make archive guard awk-portable by @markokraemer in https://github.com/kortix-ai/suna/pull/4651
• fix(enterprise): preserve public Supabase bundle modes by @markokraemer in https://github.com/kortix-ai/suna/pull/4652
• fix(enterprise): pin Supabase runtime paths by @markokraemer in https://github.com/kortix-ai/suna/pull/4653
• fix(enterprise): authenticate Supabase activation health by @markokraemer in https://github.com/kortix-ai/suna/pull/4654
• fix(enterprise): wait for long SSM installs by @markokraemer in https://github.com/kortix-ai/suna/pull/4655
• test(enterprise): isolate SSM waiter regression by @markokraemer in https://github.com/kortix-ai/suna/pull/4656
• fix(enterprise): break Supabase systemd deadlock by @markokraemer in https://github.com/kortix-ai/suna/pull/4657
• fix(enterprise): allow updater to reach private EKS by @markokraemer in https://github.com/kortix-ai/suna/pull/4658
• chore(dev-eks): deploy dev-e4f00dfe [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4659
• fix(enterprise): allow updater to read cluster state by @markokraemer in https://github.com/kortix-ai/suna/pull/4660
• chore(dev-eks): deploy dev-f2798a8f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4661
• Rebuild auth consent surfaces in the /auth dialect by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4662
• fix(enterprise): apply external secrets after CRDs by @markokraemer in https://github.com/kortix-ai/suna/pull/4664
• chore(dev-eks): deploy dev-481dc551 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4665
• Revamp the accounts section UI by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4663
• fix(enterprise): poll external secret readiness by @markokraemer in https://github.com/kortix-ai/suna/pull/4666
• fix(web): hide unavailable sandbox providers by @agent-kortix in https://github.com/kortix-ai/suna/pull/4667
• fix(sessions): sessions always get their real title by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4668
• chore(dev-eks): deploy dev-89e592cf [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4671
• fix(web): suppress storage-blocked SecurityError localStorage noise (BS 09b9cf65…/ac75f0d8…) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4674
• docs: fix SDK namespace for repo imports — kortix.github.linkRepository by @agent-kortix in https://github.com/kortix-ai/suna/pull/4673
• ECS Fargate revival — parallel EKS+ECS with unified Cloudflare router by @markokraemer in https://github.com/kortix-ai/suna/pull/4676
• chore(dev-eks): deploy dev-0737c1d6 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4678
• fix(cli): report secret availability consistently by @agent-kortix in https://github.com/kortix-ai/suna/pull/4677
• chore(dev-eks): deploy dev-b058dd57 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4680
• feat(api/teams): ship the real Kortix logo in the Teams app package by @lillyboga in https://github.com/kortix-ai/suna/pull/4672
• chore(dev-eks): deploy dev-df19f59d [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4681
• content: refresh Introducing Kortix wording by @agent-kortix in https://github.com/kortix-ai/suna/pull/4679
• Staging + Prod ECS Fargate (parallel runtime; prod flip gated) by @markokraemer in https://github.com/kortix-ai/suna/pull/4682
• Flip prod api+gateway to ECS Fargate by @markokraemer in https://github.com/kortix-ai/suna/pull/4683
• feat(marketplace): public project-clone marketplace + unify in-project surface by @markokraemer in https://github.com/kortix-ai/suna/pull/4493
• chore(dev-eks): deploy dev-eea60a86 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4687
• Enterprise VPC on ECS Fargate — full simplification (rip out EKS/Helm/StepFunctions/DynamoDB/WAL) by @markokraemer in https://github.com/kortix-ai/suna/pull/4689
• chore(dev-eks): deploy dev-dff20292 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4690
• docs: trigger session-strategy scope (fresh|reuse|pinned) by @markokraemer in https://github.com/kortix-ai/suna/pull/4686
• feat(triggers): session strategy — fresh|reuse + pinned session picker by @markokraemer in https://github.com/kortix-ai/suna/pull/4688
• chore(dev-eks): deploy dev-2eb03585 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4694
• fix: make agent tunnel npx command workspace-safe by @markokraemer in https://github.com/kortix-ai/suna/pull/4693
• chore(dev-eks): deploy dev-32957ade [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4695
• Enterprise appliance: single-EC2, 100% Docker, self-healing + rolling updates by @markokraemer in https://github.com/kortix-ai/suna/pull/4696
• chore(dev-eks): deploy gateway dev-3019dfc3 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4697
• chore(dev-eks): deploy dev-3019dfc3 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4699
• fix(enterprise-release): pass image digests to build-bundles in promote workflow by @markokraemer in https://github.com/kortix-ai/suna/pull/4698
• chore(dev-eks): deploy dev-f6f61a49 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4703
• fix(appliance): resolve null-passthrough breaking every deploy (instance_type + bedrock) by @markokraemer in https://github.com/kortix-ai/suna/pull/4701
• self-host: rename aws-vpc→aws-ec2, two-target UX, migration-safety gate by @markokraemer in https://github.com/kortix-ai/suna/pull/4702
• chore(enterprise): 0.9.108-e14 contract by @markokraemer in https://github.com/kortix-ai/suna/pull/4705
• fix(appliance): gateway healthcheck hits /health not / (404) by @markokraemer in https://github.com/kortix-ai/suna/pull/4706
• chore(enterprise): 0.9.108-e15 contract by @markokraemer in https://github.com/kortix-ai/suna/pull/4708
• fix(api): filter bare Bun fetch TimeoutError from Sentry (BS c672fb5e) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4709
• fix(web): filter EVM-wallet inpage.js addListener/emit noise (BS 17a0ce67/3a6b00dc) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4710
• fix(web): filter iOS WebKit stack-overflow RangeError noise (BS 87ccbef9) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4711
• docs: refresh Teams channels and CLI/SDK references by @agent-kortix in https://github.com/kortix-ai/suna/pull/4712
• content: add inline money-page links to comparison posts by @agent-kortix in https://github.com/kortix-ai/suna/pull/4714
• Rebuild chat minimap on HoverCard: quieter UX, less render work by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4713
• feat: use-case templates + conversational install via marketplace install-session by @lillyboga in https://github.com/kortix-ai/suna/pull/4719
• fix(api): stop masking git mirror clone timeouts as 'Cloning into' progress noise (BS 8d0cffbb) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4717
• fix(web): drop @embedpdf tiling React #185 render-loop noise (BS 366115d4) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4718
• fix(web): filter EIP-1193 wallet-extension plain-object rejection noise (BS 0f78b2f8) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4720
• chore(dev-eks): deploy gateway dev-d321180f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4722
• chore(dev-eks): deploy dev-d321180f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4723
• fix(web): gate Shiki wasm highlighter on WebAssembly availability (BS 1604d50a) by @agent-kortix in https://github.com/kortix-ai/suna/pull/4721
• fix(iam-web): auto-provision groups defaults ON for new SSO connections by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4724
• Generic Docker self-host + in-app git management by @markokraemer in https://github.com/kortix-ai/suna/pull/4725
• fix(appliance): work out of the box without SMTP + gate SSO probe by @markokraemer in https://github.com/kortix-ai/suna/pull/4715
• chore(dev-eks): deploy gateway dev-f942c625 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4728
• chore(dev-eks): deploy dev-f942c625 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4729
• feat(mfa): complete the account-wide Require MFA loop (member enroll + step-up) by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4726
• chore(dev-eks): deploy dev-98079558 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4731

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.108...v0.10.0

• Promote the fully tested staging candidate to production.
• Includes sandbox identity race protection and restored health deployment identity.
• Includes staged authentication redesign and chat input model-state fixes.
• Includes reliable Slack project default agent/model handling.
• Staging artifact build and deploy passed; public staging ke2e passed 9/9.

What's Changed

• chore(release): VERSION → 0.9.103 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4395
• Use-cases section + "Use this template" guided install (flag-gated) by @lillyboga in https://github.com/kortix-ai/suna/pull/4397
• chore(dev-eks): deploy dev-6e1c7f8a [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4398
• templates: rebuild dependency-upgrades from the real automation by @lillyboga in https://github.com/kortix-ai/suna/pull/4400
• chore(dev-eks): deploy dev-fb6e1b99 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4401
• fix(sandbox): ignore stale failed builds by @agent-kortix in https://github.com/kortix-ai/suna/pull/4396
• chore(dev-eks): deploy dev-df0e1486 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4402
• fix(templates): surface registry:template items in the templates list by @lillyboga in https://github.com/kortix-ai/suna/pull/4403
• chore(dev-eks): deploy dev-819bb8a2 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4404
• fix(web): keep project shell during session loading by @markokraemer in https://github.com/kortix-ai/suna/pull/4405
• feat: add project default agent selection by @markokraemer in https://github.com/kortix-ai/suna/pull/4406
• chore(dev-eks): deploy dev-0cfa5a8d [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4407
• feat(review): per-session review indicators + one coherent needs_you count by @markokraemer in https://github.com/kortix-ai/suna/pull/4408
• fix(runtime): preserve session sandbox identity by @markokraemer in https://github.com/kortix-ai/suna/pull/4409
• chore(dev-eks): deploy dev-61b51bf7 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4410
• feat(session): local CLI attach commands in the Terminal panel by @markokraemer in https://github.com/kortix-ai/suna/pull/4411
• fix(runtime): keep active sandbox turns alive by @markokraemer in https://github.com/kortix-ai/suna/pull/4412
• chore(dev-eks): deploy dev-f67b3a3c [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4413
• fix(session): wrap long unbroken tokens in messages instead of overflowing the page by @markokraemer in https://github.com/kortix-ai/suna/pull/4414
• templates: rebuild standup-summary as the weekly shipping leaderboard by @lillyboga in https://github.com/kortix-ai/suna/pull/4416
• chore(dev-eks): deploy dev-962a5955 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4417
• feat(web): redesign the template install wizard (two-column + logos + stepper) by @lillyboga in https://github.com/kortix-ai/suna/pull/4418
• Harden pentest findings and keep Strix manual by @markokraemer in https://github.com/kortix-ai/suna/pull/4415
• chore(dev-eks): deploy dev-705be76c [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4420
• fix(sandbox-proxy): route Platinum opencode(4096) HTTP through the :8000 agent (fixes opencode attach 502) by @kubet in https://github.com/kortix-ai/suna/pull/4419
• feat(file-viewer): inline PPTX viewer (read-only, minimal) by @markokraemer in https://github.com/kortix-ai/suna/pull/4421
• chore(dev-eks): deploy gateway dev-2c9fbb8b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4422
• chore(dev-eks): deploy dev-2c9fbb8b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4423
• fix(session): 'healthy is not defined' crash on session start by @markokraemer in https://github.com/kortix-ai/suna/pull/4424
• chore(dev-eks): deploy dev-aa635e10 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4425
• feat(file-viewer): slim the PPTX viewer to native, closeable chrome by @markokraemer in https://github.com/kortix-ai/suna/pull/4426
• chore(dev-eks): deploy dev-738a371b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4427
• fix(file-viewer): read-only PPTX treatment for the mobile layout by @markokraemer in https://github.com/kortix-ai/suna/pull/4428
• docs: require PR and deployed dev verification by @markokraemer in https://github.com/kortix-ai/suna/pull/4429
• chore(dev-eks): deploy gateway dev-02ba91a1 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4430
• chore(dev-eks): deploy dev-02ba91a1 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4432
• fix(file-viewer): contain the PPTX mobile Slides/Notes drawer to the panel by @markokraemer in https://github.com/kortix-ai/suna/pull/4433
• fix(llm-gateway): preserve actionable upstream errors by @markokraemer in https://github.com/kortix-ai/suna/pull/4434
• Add durable session-scoped runtime context by @markokraemer in https://github.com/kortix-ai/suna/pull/4431
• chore(dev-eks): deploy dev-717fc422 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4435
• chore(dev-eks): deploy gateway dev-81ff550d [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4436
• chore(dev-eks): deploy dev-feb17f9b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4440
• fix(llm-gateway): restore API typecheck by @markokraemer in https://github.com/kortix-ai/suna/pull/4439
• chore(dev-eks): deploy gateway dev-da75c672 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4443
• fix(gateway): standardize all error exits by @markokraemer in https://github.com/kortix-ai/suna/pull/4444
• chore(dev-eks): deploy gateway dev-6e6eddb9 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4445
• chore(dev-eks): deploy dev-6e6eddb9 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4446
• fix(sandbox-proxy): strip preview cookies upstream by @markokraemer in https://github.com/kortix-ai/suna/pull/4438
• chore(dev-eks): deploy dev-501654ca [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4447
• security(billing): prevent credit balance overdrafts by @markokraemer in https://github.com/kortix-ai/suna/pull/4441
• chore(dev-eks): deploy gateway dev-f6e70cfe [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4448
• chore(dev-eks): deploy dev-f6e70cfe [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4449
• chore(dev-eks): deploy dev-f2a1f24a [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4450
• fix(sessions): recover provider-lost runtimes safely by @markokraemer in https://github.com/kortix-ai/suna/pull/4451
• chore(dev-eks): deploy dev-1cb65dbf [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4452
• Add session-scoped connector profiles by @markokraemer in https://github.com/kortix-ai/suna/pull/4437
• fix(sessions): verify provider restart state by @markokraemer in https://github.com/kortix-ai/suna/pull/4454
• chore(dev-eks): deploy dev-a8fd60a2 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4455
• fix(sessions): reclaim missing runtime identity safely by @markokraemer in https://github.com/kortix-ai/suna/pull/4456
• chore(dev-eks): deploy dev-632c973c [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4457
• feat(sdk): @kortix/sdk v2 — canonical entry, CDN bundles, publish hardening, live-stack playground by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4382
• chore(dev-eks): deploy gateway dev-25260b0b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4459
• chore(dev-eks): deploy dev-25260b0b [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4460
• fix(api): harden pentest auth and billing findings by @markokraemer in https://github.com/kortix-ai/suna/pull/4461
• chore(dev-eks): deploy dev-aa3a0962 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4464
• fix(health): restore staging deployment identity fields by @markokraemer in https://github.com/kortix-ai/suna/pull/4465
• fix(slack): honor project default agent/model reliably, show real channel names by @markokraemer in https://github.com/kortix-ai/suna/pull/4463
• chore(dev-eks): deploy dev-8bbda732 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4469
• chore(dev-eks): deploy dev-e811a05f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4472
• feat(web): redesign auth flow into a staged, minimal experience by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4467
• chore(dev-eks): deploy dev-3c0b0ec5 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4474
• fix: make session uploads recoverable by @markokraemer in https://github.com/kortix-ai/suna/pull/4477

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.102...v0.9.103

New

• Marketplace imports. Agents, commands and bundles install into a project in one click. The detail view now shows what a listing actually contains — bundle contents, capability badges, type-aware copy — before you add it.
• Groups and custom roles on every plan. Previously limited by tier; now available to all accounts.
• Answer permission prompts from the CLI. Sessions that pause for approval can be resolved without leaving the terminal.
• One-click Slack connect via kortix channels connect — no manual app setup.
• Review center approvals. Approve and deny executor requests for real, with change descriptions rendered as markdown.
• OAuth1 connectors for OpenAPI and HTTP.
• Always-bound project CLI. login binds a default project; unbound commands recover interactively instead of failing.

Improved

• kortix.toml is now kortix.yaml (TOML stays supported as v1 legacy), with format-aware manifest errors and agent-scope/trigger-path parity.
• Destructive actions are confirm-gated: deleting secrets, revoking gateway keys, deleting sandbox templates and sessions, archiving projects.
• Loading states unified across the app; onboarding moves Skip into the footer per step.
• Upgrades are surfaced with an accent card and a Recommended badge.
• A complete IAM administrator's guide: SSO/SAML, SCIM, roles, groups, custom roles, agents, audit.

Fixed

• Sessions on projects pinned to the Platinum sandbox provider could not start. Production's sandbox_provider type was missing the platinum value, so every session create failed at the database. The value is now added; a sandbox that fails to start also raises properly so provisioning retries.
• Retry build / Fix with agent works again, snapshot quota cleanup can fire, and the prewarm cache is bounded with an alarm when cleanup falls behind.
• Permission leaks closed. Project detail sections are filtered by read capability, previously ungated project endpoints now check their capability leaf, member management gates on the leaf rather than a broad write floor, and viewers no longer see error toasts for surfaces they cannot read. Read-only users get a degraded view instead of a broken one, and the floor member role can fire triggers again.
• Service-account bearer tokens are accepted wherever user tokens are.
• Unknown CLI commands now error with a suggestion instead of silently scaffolding a project named after the typo.
• The model picker updates immediately after connecting a provider, and setup links render as clean CTA chips rather than raw token URLs.
• Resolved high-severity CodeQL findings (ReDoS, temp-file handling, TOCTOU, CLI opener).
• Rename dialogs no longer close mid-save; sessions and projects show honest error, empty and retry states.

What's Changed

• chore(release): VERSION → 0.9.100 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4281
• fix(web): model picker updates instantly after connecting a provider by @markokraemer in https://github.com/kortix-ai/suna/pull/4283
• chore(dev-eks): deploy dev-bf518cc0 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4284
• refactor(web): onboarding wizard — per-step Skip in the footer by @markokraemer in https://github.com/kortix-ai/suna/pull/4285
• fix(platinum): create throws on terminal failed-start so provision retries by @kubet in https://github.com/kortix-ai/suna/pull/4289
• refactor(web): unify loading states into a single consistent loader by @sutharjay1 in https://github.com/kortix-ai/suna/pull/4287
• chore(dev-eks): deploy gateway dev-763ed695 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4290
• chore(dev-eks): deploy dev-763ed695 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4291
• chore: remove the stale root .kortix dogfood project by @markokraemer in https://github.com/kortix-ai/suna/pull/4294
• chore(dev-eks): deploy dev-b7b37eaa [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4296
• feat(executor): oauth1 auth type for openapi/http connectors by @markokraemer in https://github.com/kortix-ai/suna/pull/4301
• chore(dev-eks): deploy dev-e1f0bcd8 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4304
• fix(cli): unknown commands error instead of scaffolding a project named after the typo by @markokraemer in https://github.com/kortix-ai/suna/pull/4292
• docs(specs): one Kortix token + CLI-centric platform plan by @markokraemer in https://github.com/kortix-ai/suna/pull/4295
• fix(api): combinedAuth accepts service-account bearers, matching supabaseAuth by @markokraemer in https://github.com/kortix-ai/suna/pull/4298
• docs(specs): AGI as API — one resource catalog projected as REST/CLI/MCP by @markokraemer in https://github.com/kortix-ai/suna/pull/4300
• feat(cli): always-bound project UX — login binds a default project, unbound commands recover by @markokraemer in https://github.com/kortix-ai/suna/pull/4297
• chore(dev-eks): deploy dev-e15d5235 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4307
• feat(cli): answer session permission asks and questions from the CLI by @markokraemer in https://github.com/kortix-ai/suna/pull/4305
• feat(cli): one-click Slack connect — kortix channels connect prints the install link by @markokraemer in https://github.com/kortix-ai/suna/pull/4302
• fix(web): setup links render as clean CTA chips, never raw token URLs by @markokraemer in https://github.com/kortix-ai/suna/pull/4306
• refactor: sweep kortix.toml → kortix.yaml (TOML kept only as v1 legacy) by @markokraemer in https://github.com/kortix-ai/suna/pull/4310
• chore(dev-eks): deploy dev-c2413419 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4311
• fix(security): resolve CodeQL high-severity alerts (ReDoS, temp-file, TOCTOU, CLI opener) by @markokraemer in https://github.com/kortix-ai/suna/pull/4313
• chore(dev-eks): deploy gateway dev-aa10200f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4314
• chore(dev-eks): deploy dev-aa10200f [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4316
• chore(security): gitleaks-ignore the published X OAuth1 doc test vectors by @markokraemer in https://github.com/kortix-ai/suna/pull/4315
• fix(iam): gate ungated project endpoints on their capability leaves by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4279
• fix(iam): members.manage routes gate on the leaf, not a project.write floor by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4275
• chore(dev-eks): deploy dev-615075e8 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4317
• fix(iam): filter GET /detail sections by read capability, don't leak them by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4282
• chore(dev-eks): deploy dev-c5237bfc [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4319
• fix(snapshots): unbreak Retry build / Fix with agent, and make quota GC able to fire by @markokraemer in https://github.com/kortix-ai/suna/pull/4320
• chore(dev-eks): deploy dev-60572652 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4321
• fix(config): YAML (v2) manifest parity — agent-scope, trigger paths, format-aware errors by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4323
• chore(dev-eks): deploy dev-cb059309 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4324
• feat(web): highlight available upgrades — accent card + Recommended badge by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4318
• feat(iam): groups + custom roles available on every tier by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4326
• chore(dev-eks): deploy dev-3468e086 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4327
• feat(marketplace): surface agents, commands & bundles as 1-click imports by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4322
• feat(web): UX & functionality improvements — marketplace, review center, customize, projects/sessions by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4325
• feat(review-center): render markdown change descriptions properly by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4329
• fix(web): customize sections visible per read leaf + read-only-safe for all roles by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4328
• feat(review-center): render markdown change descriptions properly by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4331
• fix(iam): no permission-error toasts for surfaces the viewer cannot read by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4330
• fix(web): confirm dialog before secret delete and gateway key revoke by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4332
• fix(snapshots): bound the ppwarm cache, and alarm when GC can't keep up by @markokraemer in https://github.com/kortix-ai/suna/pull/4336
• chore(dev-eks): deploy dev-1a0b95ad [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4337
• docs(iam): complete administrator's guide — SSO/SAML, SCIM, roles, groups, custom roles, agents, audit by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4334
• chore(dev-eks): deploy dev-1c40ba54 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4339
• fix(iam-web): audit export 404 + make the guide's affordances real by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/4341
• chore(dev-eks): deploy dev-4f55e3cc [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/4345

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.99...v0.9.100