Changelog

Every release, straight from the source. New features, fixes, and improvements — versioned and dated. View on GitHub.

v0.14.8

Latest

New

  • Every new session runs pi. The pi_harness flag and runtime: opencode no longer select OpenCode. A session that already runs OpenCode keeps it. OpenCode is deprecated. (#10786)
  • Share one response. Share response, beside Copy response, publishes one finished assistant response through a public link: the response only, or the prompt and the response. Turning the link off ends anonymous access. (#10816)
  • Weekly changelog. /changelog groups what went live in production by week, and each week has its own page with every change. (#10823)
  • Agent marks. Every agent has a pixel mark on Agents cards and in agent pickers. (#10826)
  • Shopify with your own app. Connect on Shopify opens a Kortix form that takes the store and the Client ID and secret of your Shopify Dev Dashboard app. Shopify no longer issues the custom app tokens the old flow asked for. (#10825)

Improved

  • Compaction. pi compacts early enough to leave room for the model's full answer, still compacts after it retries a failed model call, and honours a project's compaction.reserveTokens again; the context meter counts reasoning tokens once. (#10835, #10845)
  • Session history. Messages that only the old transcript store held move into the session log; the daemon keeps every batch the API refuses and sends it again; capture waits for memory and runs one session at a time; the usage panel counts the whole thread. (#10827, #10837, #10829, #10793, #10791, #10783)
  • Deleted sessions are fully gone after 30 days: the conversation, every copy (model requests and responses, prompt commands, questions, notifications, share links), the stored files and the session's branch. Sessions purged before this release lose their remaining copies too. (#10831)
  • Branch cleanup. A session branch that fails to delete no longer stalls the sweep. (#10833)
  • Status page. Upstream capacity errors that a fallback model absorbs no longer open an incident. (#10795)
  • Parked sandboxes. An open tab stops polling the transcript of a sandbox that is parked. (#10820)

Fixed

  • pi permissions. A path rule holds for ./, .., @ and absolute paths. (#10787)
  • Web addresses. /dashboard opens projects; /login and /signup open sign-in; a trailing slash or another letter case redirects to the page; an unknown path answers 404 and a malformed one 400; /privacy, /terms, /imprint and /subprocessors open the legal pages; crawlers can fetch the static assets pages need; each localized page declares its locale; the Apple app-site-association file is served as JSON; the docs touch icon loads. (#10812, #10815, #10814, #10807, #10810, #10818, #10806, #10805, #10817, #10804, #10803, #10808)
  • Sandbox versions. The version feed caches one GitHub read, never names a prerelease as the latest stable version, and still answers when GitHub rejects the token. (#10809, #10811)
  • Marketplace. Paging never skips or repeats an item. (#10802)
  • Scoped tokens resolve the current project. (#10819)
  • Files. A download with a range the file cannot satisfy answers 416 with the file size, not "storage unavailable". (#10790)
  • Agent page. The dev-only layout switcher is gone. (#10813)

Security

  • Unexpected server errors no longer return internal details to the client. (#10785)
  • Shared caches never store an authenticated API response. (#10828)
  • The API and gateway serve security.txt, robots.txt and sitemap.xml. (#10824)
  • Malformed tunnel IDs, fractional gateway day windows and invalid billing pagination are refused. (#10800, #10784, #10781)
  • CodeQL and the security scan run on every push to production. (#10796)

Internal

  • Stateless sandboxes behind an operator-only flag that is off everywhere. (#10846)
  • Session-log groundwork for removing the old transcript tables, CLI installation-proof refactor, local hot-reload connection leak, quieter config-release logs, log lines that keep ids out of format strings, release and incident runbooks, and test upkeep. (#10782, #10822, #10821, #10839, #10847, #10792, #10794, #10798, #10830, #10832, #10834, #10836, #10838, #10840, #10849, #10851)

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.7...v0.14.8

Release on GitHub →

v0.14.7

New

  • Move projects between accounts. A project can be transferred to another organization or account. (#9918)
  • Default reasoning effort per project. Set it once in project settings. (#9935)
  • Run a session on your own machine with a ChatGPT subscription, through kortixd. (#9754)
  • Audit activity. See who was active in a workspace and how often, in the API, CLI and SDK. (#10604)
  • Goals page, a session Goal button and goal health, behind the goals flag. (#10600)
  • Embedded sessions. Public transcript sharing is removed; existing transcript share links are revoked. Embed the real session page instead. (#10008)

Improved

  • Billing. Usage is metered on every plan; only charging is gated. (#9929)
  • Model routing. A project's Routing chain now covers every model. (#8742)
  • Model limits. Every model reports its real context window and output limit, including custom endpoints; Codex models get their 272k window. A custom-endpoint model reads images and reasons when the endpoint supports it. (#10757, #10768)
  • Session history. A new session reads only the session log, and an old session being converted opens its history, not an empty log. (#10722, #10728)
  • Agents and connectors. A cleaner agent page and connector modal, catalogue favicons that recover from broken images, and one design for role dialogs. (#10490, #9924, #10702, #10382)
  • Mobile. Simpler session sheets and tool surfaces. (#10229)
  • Keep-alive. An open page keeps its sandbox awake for the idle window, not 2 hours. (#10026)

Fixed

  • Invites on self-hosted instances without email. A person your identity provider adds through SCIM can join even when their address is outside the provider's domain. The invite page offers Continue with single sign-on, says to ask an admin when single sign-on is not set up, and Resend lets that person accept. (#10707)
  • Routine wakes are silent: no waking notice, boot pill or boot screen. (#10716)
  • Reload keeps your project, and a sidebar click no longer opens a session's hover card. (#10720, #10721)
  • Files. Project owners can edit and commit repository text. (#10517)
  • Projects. Rename a project from the switcher. (#10523)
  • Panels. ⌘I brings back the panel it hid, also from inside the Browser preview. (#10725)
  • CLI. Remote login without a callback (its poll and approve calls get their own rate limit), service-account keys, and connectors call resolves the project like connectors ls. (#10483, #10779, #10235)
  • Sessions. Compacting a busy session no longer shows internal diagnostics; a US-region session boots where its drives live; a daemon restart drops its env-sync trust. (#10442, #10348, #10014)
  • Apps. Existing Apps move from ghcr.io/get-convex to ghcr.io/convex images. (#10353)
  • Connectors. A connector failure line is split in linear time. (#10736)
  • Desktop. The Linux AppImage builds again with electron-builder 26. (#10743)

Security

  • Dependency updates for the advisories of 2026-10-22 (Next 16.4.2, DOMPurify, Sentry, undici, Astro, Electron 42, Vitest 4, KaTeX, Caddy, Hono and others). (#10738, #10739, #10732, #10726)
  • Closed a path traversal in the presentations server. (#10729)
  • The repo-wide deploy role no longer holds prod grants; prod uses its own role. (#9329)
  • The gateway sends browser security headers, and its public health check no longer shows operational detail. (#10750, #10749)
  • Public access requests are rate-limited, device-login polling denials are uniform, and SCIM and git spec routes declare their auth. (#10753, #10773, #10755, #10754)
  • The sandbox web proxy guards egress on every port, and the web app restricts browser feature permissions. (#10752, #10751)
  • Pentest hardening: the marketplace catalog is cached and rate-limited, request bodies are capped at 64 MiB, every 401 names its auth scheme, OAuth client registration honours the requested client authentication, tighter CSP, signed release artifacts, and storage buckets no longer list their objects to signed-out callers. (#10748)
  • Session search rejects NUL bytes. (#10775)
  • A private security reporting policy. (#10756)

Internal

  • Test, CI, scanner and runbook upkeep (#10713, #10723, #10727, #10731, #10737, #10740, #10741, #10744, #10747, #10758, #10759, #10761, #10762, #10763, #10765, #10767, #10769, #10770, #10772, #10760, #10776, #7956, #10689, dependency bumps).

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.6...v0.14.7

Read the full release on GitHub →

v0.14.6

New

  • Retry a failed reminder. A reminder whose last run failed shows its error and a Retry button: in the session's reminders, the project Reminders list and calendar, and with kortix reminders run <id>. A reminder that a session's agent sets now reaches its session. Before, it failed after about 13 minutes when the session belonged to another member.
  • An agent's card shows what its configuration grants.
  • A replaced change request reads "Superseded by #N" and opens its replacement.
  • A filename in a reply opens the session output it names.
  • File versions show their session's title, agent and archive instead of a session id.

Improved

  • The session log is the only saved history. Opening a session reads its log first and makes no request to the old transcript. Older web, mobile and CLI builds keep working. The "Session log" feature flag is gone, because every project uses the log.
  • Self-hosted Kortix converts old conversations into the session log by itself after this update.
  • A pi command that exits non-zero reads as a command. A failure the agent moved past is no longer red.
  • A stalled preview says so and offers Reload.
  • When a provider refuses Kortix's key, Kortix shows the error once, in the search card, and names Kortix as the cause.
  • Connector search survives Back, agent display names find their sessions, and a failed search batch shows its errors.
  • Refreshed model catalog.

Fixed

  • An accepted invite shows the new account and project at once. A declined invite leaves the sidebar at once.
  • Enter no longer submits text in the middle of a Chinese, Japanese or Korean composition.
  • A permission prompt shows the current agent's name after an agent switch.
  • The password reset page removes the used recovery code from the address bar.
  • Security: the mobile map moves to maplibre-gl 6.12.0, which fixes a critical advisory.
  • Smaller fixes: the Rooms join spinner, Capture timeline dragging, changelog links, and copying the logo.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.5...v0.14.6

Read the full release on GitHub →

v0.14.5

New

  • Kortix managed models run on Platinum Inference. The managed model list, prices, limits and reasoning levels come live from Platinum, so a model Platinum adds reaches Kortix without a release. Self-hosted and bring-your-own-key projects can add a Platinum key and call platinum/<model> directly.
  • Session logs for every project. The session log is on by default, so every project stores its conversations in it.
  • Bring your own S3 for Kortix Capture. An admin can keep an account's recordings in the account's own S3 bucket from Capture → Settings → Storage. Self-hosted Kortix can use an external S3 object store for Capture.
  • Session rows say what waits on you. The sidebar shows a question or permission, an open change request, and the sub-agents and sessions a session started.
  • Reminders glide between rows, and 30 or more reminders open in the side panel.
  • The turn-done toast offers Review for the change request the turn opened.
  • Remove a project skill from its card on the Skills page.
  • New sandboxes always run on Platinum. Sandbox templates no longer offer Daytona.
  • White-label examples: Lumen, a legal AI app on one shared Kortix project with a Team Console, and the Lumen Workspace reskin.

Improved

  • Faster LLM gateway admission: each upstream has its own circuit breaker, admission reads run in parallel, and the default model is resolved only when a request needs it.
  • Change requests that an agent opens show at turn end. An applied change request refreshes agents and Needs you.
  • Pinned sessions sit above the Sessions header.
  • Transcripts show while the sandbox is still starting.
  • Compaction stays inside the Worked section.
  • The model picker never preselects a model whose provider is not connected, and it says what to connect.
  • Marketplace add stays on the page, and search keeps its query in the URL.
  • Billing shows Plan member usage and the credit reset and expiry dates.
  • Command palette search finds "Your first chat with Kortix".
  • The session slash menu lists skills again on pi.
  • CLI: 17 commands match the API again, doctor picks an available model, and sessions rm without --project deletes exactly the named session or nothing.

Fixed

  • Security hardening: hosted APIs no longer trust the legacy Supabase signing secret, a token cannot be minted already expired or outlive the token that minted it, the sandbox daemon refuses symlinks that point outside the workspace, billing state needs billing.read, account names refuse markup, and deleting an account revokes its credentials.
  • Trigger runs close when their turn ends, and queued creates link to their run.
  • A skill created with the form shows on version 3 projects.
  • A channel's model pin is stored again.
  • Capture search reads the requested day, routing policy keeps generation defaults, and credit reads follow the account.
  • Editing a v2 agent keeps the keys the update cannot carry.
  • A missing attachment answers 404 instead of a retry. Five routes stop reporting permanent failures as temporary. A command that timed out keeps its unknown outcome.
  • A session mention in a message you just sent keeps its title.
  • Incomplete personal accounts are cleaned up when their user is deleted.
  • Many smaller fixes and cleanups across the web app, the CLI and the API.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.4...v0.14.5

Read the full release on GitHub →

v0.14.4

New

  • One model path: the Kortix LLM gateway. Every project's models go through the gateway, and custom OpenAI-compatible endpoints are set up in the gateway as custom providers.
  • pi is the default agent harness. New sessions in a project start on pi unless the project turns pi_harness off. Existing sessions keep their harness. Projects with the LLM gateway off stay on OpenCode.
  • One Drive with team folders. Files lives under the gear, and kortix drive works from the CLI.
  • Triggers protect themselves. A trigger that stays at its hourly run limit for 2 hours pauses itself, sends one alert, and resumes when you set enabled: true. A new cron trigger skips a fire while its previous run is still active (overlap: allow opts out).
  • @kortix/ui is a plug-and-play UI library. The Kortix web app and the Lumen example now render the same session, workspace and settings screens from one package.
  • Preview text attachments in the app before you send them.
  • Mobile 1.5.1: iOS Liquid Glass chrome, a native glass message menu, smoother sheets and scrolling in long sessions, and an MFA focus fix.

Improved

  • Forked conversations persist and stay reachable after navigation.
  • pi tells the model today's date on every turn, leaves the session title to Kortix (the header no longer flips), and the Changes tab works on pi sessions.
  • Sessions report the model the conversation uses, not the model pinned at creation.
  • The project home sends faster, finished replies no longer stream again, and slash skills and commands show there.
  • Escape in an empty composer stops a streaming reply. The command palette opens at once, and the slash palette opens the agent picker.
  • Drive shows folders as folders and keeps fixed folders in place.
  • Connector catalogs resolve in one batch, and sub-agent links keep their sub-agent.
  • Large files open whole instead of cutting off at 50k characters.
  • Web and CLI show the same model price estimates.
  • Cron triggers show the exact next run with its timezone.
  • Trigger edits keep the comments in kortix.yaml.
  • Faster gateway log and audit reads in projects with a lot of history. Gateway budgets read a running daily total (954 ms → one key read), sign-in checks no longer make an extra auth hop, and a page load fetches its project once.
  • CLI: models lists catalog availability, sessions new streams readiness progress, chat and compact wake a stopped or provisioning session first, access grant --user uses the linked project, marketplace installs resolve short names, doctor names the turn error and explains warm-session retention, project and session URLs match the host, and channels show every state by default.

Fixed

  • Session notifications work in a fresh browser, and blocked notifications recover with a sound fallback.
  • Usage opens from account deep links, and checkout returns to the billing page of the account that paid.
  • The low-balance warning scales to the recurring grant, and a new free account no longer sees a false warning.
  • A deleted project no longer reopens from cache. Enabling a gated feature no longer leaves the page, and a lost session keeps its return path. Account deletion explains that it can be cancelled.
  • Compacting a busy session is refused with a clear message. Forking a stopped session explains what to do.
  • New project invitees get their notification. Removed avatars are erased.
  • Email confirmation is link-first, and the sign-in screen offers password sign-in.
  • The app recovers from a stale code chunk instead of failing to load.
  • Connected accounts stay on the personal identity.
  • The first session of a new project no longer lists the project setup as its own changes.
  • Session tokens can no longer leak after a session ends.
  • Expired branches are deleted without cloning their history.
  • Reminders re-arm from the time they resume.
  • Public transcripts show failed assistant turns.
  • The Agents page shows agent ids, and a direct user grant replaces the existing project role.
  • The public OpenAPI spec publishes a relative server URL.
  • Many smaller fixes across the CLI, triggers, auth and the web app.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.3...v0.14.4

Read the full release on GitHub →

v0.14.3

New

  • Pause all automations: one account switch stops every project's schedules, webhooks, app events and monitors.
  • Trigger run limits: a trigger runs at most 60 times an hour by default, with an optional daily limit, so a runaway trigger stops itself.
  • Drive in the sidebar, with a Drive page, a file viewer, upload, multi-select and file management. Session folders show Drive folders. Repo moves under Customize.
  • Recently deleted lists the sessions you can restore, and a restored session keeps its conversation.
  • Drop a file anywhere on a session page or the project home to attach it to your message.
  • Notifications have All, Needs you and Done tabs, and the bell shows when something needs you.
  • Generative UI is on by default for new sessions: the agent can answer with cards, comparisons, charts, maps and tabs. A project can turn it off in Settings.
  • Computer: every access is granted at pairing with a switch for each afterwards, a new computer starts with every access selected, "Always" is remembered, and Computer Use works on Windows without console windows.
  • The command palette (⌘K) opens Drive, Reminders and Repo.
  • Mobile reminds you when a question has waited 60 seconds for an answer, and renders generative UI like the web app.
  • Connectors v2 (experimental, per project): a catalog of vendor MCP apps signed in with OAuth that Kortix runs, app-event triggers that Kortix checks, an event inbox, and an in-place move for existing Composio and Pipedream connectors and their triggers.

Kortix Capture

  • Windows is ready for company rollout: the install command downloads the installer, waits and reports whether it worked. The macOS and Linux commands do the same.
  • Windows: the app window opens for people without admin rights, a manual MSI install never rolls back, and the app has a Windows icon.
  • App rules match what an admin types on every OS: notepad.exe also matches the packaged Windows 11 Notepad, and the inclusion policy never records an app it cannot identify. The app catalog lists common CAD apps.
  • The timeline keeps the runs of frames taken while the person is idle.
  • The player shows video for computers linked to no one.
  • Settings shows that Capture always starts at login.
  • The Kortix desktop app is no longer recorded on Windows and Linux, as on macOS.

Kortix Desktop

  • Windows installers for Kortix Desktop and Kortix Capture are signed by Kortix AI Corp.
  • Windows: the title bar blends with the app, a Kortix menu replaces the raw menu bar, and the app has a tile icon.
  • Each deployment serves its own desktop build.

Models

  • Kortix-managed models are part of paid plans. Free accounts use their connected ChatGPT subscription or their own provider keys.
  • Kimi K3 leaves the managed lineup. Sessions and defaults that used it move to DeepSeek V4.1 Flash.
  • Managed models fall back across providers in a fixed order, the default model always has a fallback, and legacy model ids get their model's fallbacks. Third-party endpoints are used only with zero data retention and only from subprocessors in effect.
  • Reasoning variants reach the model on the pi harness, and pi decides shell permissions command by command.
  • When a managed model's provider fails, the session stays on the fallback instead of retrying the failed provider on every request.
  • Model-switch notices sit above the turn's work, one row per run of identical switches.

Self-host

  • Platinum is the default sandbox provider. Daytona remains as a legacy fallback. E2B support is removed.

Fixed

  • Members of MFA accounts can open project-wide Apps. Reminders move under Customize.
  • Signed-out devices stop getting push notifications.
  • Connecting an MCP server whose URL does not answer shows the reason instead of a server error.
  • A ChatGPT login that only failed a model check is no longer marked for reconnection.
  • Plural forms and labels in 9 languages are corrected.
  • Reopening a session paints its saved conversation at once, and older tool calls keep their command.
  • A connector whose stored credential the vendor rejects is marked on the account for reconnection, and the call reports it instead of a server error.
  • Billing emails reach the owners of older accounts, and a notice without a recipient is retried.

Under the hood

  • @kortix/ui: one shared component library for the web app and SDK hosts.
  • With the session log flag on, sessions read and write only the session log; older messages and sub-agent threads come from it.
  • Faster requests: the gateway admits a request in one API round trip, the app shell loads after one auth round trip, project details and secrets no longer wait on a git fetch, member and session reads are indexed, and the session lifecycle queue has its own index.
  • Model catalog seeds refreshed. CI signing and publish fixes for Windows builds.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.2...v0.14.3

Read the full release on GitHub →

v0.14.2

New

  • Trigger run history. Every trigger keeps a list of its runs with status, error and end time. You can test-fire a trigger with a payload, replay a past run, and missed cron slots are bounded.
  • More credit tiers and larger top-ups. The Free plan now includes 500 credits and the managed models.
  • DeepSeek V4.1 Flash now serves the 1017 snapshot on Morph (US region, zero data retention).
  • Subprocessor notices. The subprocessor list is published, and owners and admins of paid accounts get a 30-day email notice before a new subprocessor takes effect.
  • White-label license. A free, self-serve white-label license is published next to the repository license (WHITE-LABEL-LICENSE.md).
  • Customize › Agents lists agents first, with subagents in their own section.
  • Kortix Capture: choose an Exclusion or Inclusion policy, categories list what they cover, the cloud policy applies from the first frame, and the app has Restart and Quit.

Improved

  • Provider failures recover better: internal continuations, one terminal error row, suggestions you can act on, and a cancel you made yourself no longer shows as a model failure.
  • Model-switch errors stay in the conversation history.
  • Sign-in and password recovery by email are more reliable. Refused auth emails show an honest message, and the link buttons cool down.
  • The CLI resolves the host and the default project the same way everywhere, keeps its identity inside a delegated sandbox, routes help correctly, and reports billing in the same credit units as the wallet.
  • Connectors: the sync summary agrees with the list, policy ls shows connector rules, and the All tab lists the project's own connectors.
  • API keys: revoked gateway keys are hidden, a create cannot mint twice, and revoked personal keys can be deleted (also from the CLI).
  • /new shows the plan cap before the first failed create.
  • Phone layouts on web and mobile have accessible navigation targets.
  • Platinum images for US-region projects are built and copied in their region, so the first session after a template rebuild does not wait.
  • Sessions start faster: env-sync no longer blocks /start on the model push and no longer pushes into stopped boxes.
  • An opened App scrolls at once, and its bar is Refresh, Open, Settings and Close. App releases run on Platinum when it is configured.
  • "Open as admin" acts as the project's account.
  • Sandboxes clear known-safe caches when their disk fills up.

Fixed

  • Shared session start failures retry.
  • The auth callback logs provider errors safely.
  • Dead public share links show the unavailable page.
  • Streaming markdown keeps its blocks around fenced definitions.
  • A provision stream that closes mid-way recovers its real result; 502/503 alerts show the real reason.
  • App locales are no longer double-prefixed.
  • Onboarding promos stay dismissed and no longer stack after you exit the wizard.
  • A future key expiry shows as a countdown.
  • The agent config and model pins reject an agent name that is not declared.
  • LLM inference refuses principals that have no project (403 project_required).
  • Subscription plan resolution ignores enterprise metadata hints.
  • Many smaller fixes across web, mobile, the CLI, the whitelabel demo, the gateway and the API.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.1...v0.14.2

Read the full release on GitHub →

v0.14.1

New

  • Kortix Capture records only the apps and websites you include: an organization policy plus a per-computer list.
  • kortix.yaml version 3 agents can opt in to the project repository.

Fixed

  • kortix apps works again from CLI versions before 0.14.0. Since 0.14.0 every Apps command from an older CLI answered "Apps is not enabled for this project".
  • A plain member reads and sees only their own work: their own sessions, costs and directory entry. Owners and admins are unchanged.
  • The Usage cost summary no longer fails on a gateway row with an empty provider.
  • A correct two-factor code opens the app at once instead of asking again.
  • Loading older messages keeps you where you were reading.
  • A session's side panel comes back open when you return to the session.
  • Review moves under Customize. Members without the rights see no Review entry and no empty Apps row.
  • The account hub drops the floating "Back to Customize" pill.
  • Connectors drop the "User-managed" badge: a per-person connector shows ✓ or Needs setup.
  • An older agent daemon no longer receives a governance it cannot read.
  • Sales lead emails go out from production only.
  • Connector MCP sync uses a bound project secret, and adding a connector keeps kortix.yaml intact.

Under the hood

  • The session-log backfill keeps its progress in the database, so it resumes when the API leader moves and skips oversized sessions.
  • The retired project.customize.* permissions leave the catalog.
  • Model catalog refresh; staging and dev deploy fixes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.14.0...v0.14.1

Read the full release on GitHub →

v0.14.0

New

  • One credits plan. Every account is on Free or Credits, with top-ups on either. Balances and usage read in credits everywhere; prices you pay stay in your currency. Raising your plan applies at once; lowering it takes effect at the next renewal, with a preview before you confirm.
  • Enterprise is a feature layer. SSO, SCIM, roles and groups, audit and branding come with an Enterprise license or a self-serve demo. Trials are gone. Admins can now manage billing.
  • Restorable sessions. A deleted session can be restored for 30 days, with Undo on web and kortix sessions restore. A session that lost its computer continues on a new one from its saved conversation, including images and files.
  • Pin and archive sessions to keep your list in order.
  • Generative UI. Agents can answer with visual blocks: cards, comparisons, photo steps, product cards, maps and figures, on web and mobile.
  • Themes. Kortix palettes plus 39 interface themes, with a live preview in the command palette.
  • Kortix Apps are generally available, and open in the session browser. Add any site as an external App by its URL, framed in Kortix. The App detail sheet, menu and connect dialog are rebuilt.
  • Kortix Capture, a desktop recorder for your account, with its own area on the web.
  • MCP servers connect from their URL in one step, with one-click OAuth sign-in. New MCP and Computer settings pages.
  • kortix.yaml version 3 is available as an opt-in: the project registers skills, tools and commands, and each agent enables what it uses. New projects still start on version 2, and nothing upgrades on its own. kortix migrate converts a project when you choose to.
  • Desktop: the Dock and taskbar icon counts finished turns you have not seen, and right-click shows the platform menu.

Improved

  • Toasts and notifications are redesigned and say what happened, under the right session.
  • The Customize and Models pages are redesigned; Slack and Teams have new connect flows.
  • pi sessions: codemode is on by default, images work on the computer, and summaries and compaction are steadier.
  • A session opens on its own model on web and mobile, and returning to a session tab no longer redraws the transcript.
  • A draft keeps its attached files across a session switch and a reload; a typed follow-up keeps Send during a turn.
  • Slash commands sent mid-turn wait for the agent to finish; @file and @agent mentions reach the agent on the first message.
  • A running compaction no longer opens on a blank page; its rows sit with the turn.
  • Project members with limited access see only the Customize tabs they can manage.

Fixed

  • The first renewal after checkout is no longer skipped.
  • Only the person who prompted a run, the owner or a manager can stop it, and everyone sees who stopped it.
  • Another person prompting a private session no longer runs with their own personal accounts.
  • A deleted session's transcript, prompts and config now return not found, like the session.
  • Shared sessions render their messages the same way the session does.
  • An idle computer no longer sticks in starting after an update, and a prompt sent while a config change applies reaches the agent.
  • Large agent configs boot; database connections retry when they never establish.
  • New computer images warm up the agent runtime again, so a fresh session starts faster.
  • Many smaller fixes across web, mobile, desktop, the CLI and connectors.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.57...v0.14.0

Read the full release on GitHub →

v0.13.57

New

  • Files handles big folders. A folder with thousands of files loads in pages with Load more, and Find a file now searches file contents as well as names.
  • Arrange your project sidebar. Choose and order the items in the project sidebar. The layout is saved on your account, so it follows you to every browser.
  • Send now on queued messages. Each message waiting in the queue has its own Send now, so you can push one ahead without clearing the rest.
  • Know how long your sandbox stays on. The composer tells you how long the sandbox stays running while you are in the session.
  • Mobile settings drill down into each section, and a mobile invitee lands directly in the project they were invited to.
  • Backend cards show a live preview of their Dashboard tab.
  • Quick Entry on desktop. Start a session from any app with a global shortcut.
  • Spreadsheet previews in the Repo page, read straight from git.
  • Redesigned account settings. Sections are grouped under General, Access and Billing; inviting, granting access, creating tokens and registering apps open in a side sheet next to the page; new avatars.

Improved

  • An agent's question docked on the composer collapses to one line, so it no longer covers the conversation.
  • The reminders calendar stays readable on busy projects.
  • Sidebar, settings and count badges are more consistent across web and mobile.
  • Long Slack turns are no longer stopped at 30 minutes.
  • Sending a prompt is faster: it no longer waits for config updates, environment loading or model catalog repair to finish first.
  • Warm sessions no longer appear in the sidebar list.
  • A session whose agent asked you a question shows Needs you until you answer, and the question closes when the wait ends.
  • A plain member sees only the members and groups they share access with.
  • Web and mobile show only the trigger, review, settings and top-up controls your role allows.
  • A connector whose first sync fails or needs a sign-in opens on its page with the next step ready.
  • Content of a deleted session is now removed 30 days after the deletion, and its files 7 days after that.
  • Groundwork for the new session history: long session texts are stored as attachments, and tool results render from the new session log where it is turned on.
  • Sandboxes and CI run Bun 1.4.3.

Fixed

  • A personal access token can now approve gated connector calls.
  • Changing only the expiry of someone's account access now saves.
  • An App whose machine failed to start recovers on its own the next time it wakes.
  • A failed autosave on repository settings or a workspace rename no longer retries forever.
  • Web Push and the inbox follow the same MFA rule as the rest of your access.
  • On mobile, the drawer closes as soon as you navigate.
  • The Files New menu offers only actions that work, and sharing never suggests yourself.
  • Turning Volumes on never makes an organization stateless, and every server agrees on the Volumes setting right after a change.
  • A pi project's local ./ package loads from the config release and restarts pi when it changes.
  • Malformed account IDs and stray characters in session logs return a clear 4xx error instead of a server error.
  • The composer's stacked layers line up at full width.
  • kortix sessions wait-for exits non-zero when the turn fails, and the CLI prints a preview URL on the host the deployment serves.
  • A prompt sent without an agent runs under the session's agent.
  • An App can give its readers access to the Apps it uses, and the App header shows which App you are in.
  • SSO-only workspaces end the sign-ins they refuse and refuse personal access tokens; mobile sends an SSO-enforced email to SSO.
  • Deleting an account stays blocked when its status check fails.
  • Session screens show their labels in your language.
  • Starting, restarting and repairing a session's box no longer race each other.
  • Apps with volumes deploy without naming a provider, and account commands follow the project link.
  • Logging out of the CLI keeps the registered host, and kortix connectors confirms a revocation before it reports success.
  • Volumes and Stateless sessions are per-project settings.
  • Mobile session lists keep loading past empty pages, and the audit log's Session filter accepts a pasted id.
  • The agent tunnel records that it is offline even when it is stopped right after starting.

Behind the scenes

  • Every merge to dev now runs the full test suite, and releases promote only a tested commit.
  • Database migrations commit one file at a time, which removes the deadlock that stalled the v0.13.54 deploy.
  • Each Terraform environment keeps its state in its own region, and the security alert hub moved to eu-west-2.
  • Unused infrastructure stacks were removed.
  • Security fixes from an external penetration test, and row-level security on every internal table.
  • Staging now runs on the same infrastructure shape as production, so release checks see what production sees.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.56...v0.13.57

Read the full release on GitHub →

v0.13.56

New

  • Tools run on both harnesses. A tool is one module that OpenCode and pi both run. Declare a project's own tools under tools: in kortix.yaml, and limit which agents see them with agents.<name>.tools.
  • The Kortix tools are listed in kortix.yaml. web_search, image_search, scrape_webpage, memory and show appear as kortix:<name>. Delete a line to remove that tool. kortix tools ls lists a project's tools, and kortix tools eject <name> copies one into the project so you can change it.
  • One-step MCP install. Installing an MCP app goes straight to the server's sign-in, and a connector you authorize with your own account loads its tools. The app and connector pages are redesigned.
  • Every connector account picks its audience. Install adds the connector to the project. Add account then asks for a name and Who can use it: only you, everyone in the project, or specific people, groups or agents.
  • Connect MCP in the project sidebar opens the MCP connect dialog.
  • Connector calls from code. Apps and scripts can call a project's connectors through @kortix/sdk, with typed handles and a stable result.
  • Reminders page. A calendar (day, week, month) and a list with bulk pause, resume and remove. Reminders is beta: enable Reminders under Settings → Feature flags.
  • App event triggers (beta). Run an agent when something happens in a connected app, such as a new email or an opened pull request. Every app that publishes events is listed, and you can browse its events before you connect it. Enable App event triggers under Settings → Feature flags.
  • Notification center (beta). Kortix tells the right person when a session needs them: an in-app inbox, Web Push and email. Off by default: enable Notification Center under Settings → Feature flags.
  • Billing alerts for owners. Owners get an email when the wallet runs out, and when a declined card turns auto top-up off. The Billing pane says why auto top-up is off. A member who runs out of credits can ask the owners from the product. Budget managers get an email at 80% and 100% of an LLM gateway budget.
  • kortix feedback "<message>" files a bug, an idea or a friction report from a terminal or from inside a session.

Improved

  • Streaming replies appear word by word, at the pace they arrive, on web and mobile.
  • A long paste (more than 1,000 characters or 10 lines) becomes a "Pasted text" tile on web and mobile.
  • Every prompt a person did not type, from a reminder, a trigger, another session or Slack, shows a source pill above a plain message.
  • The server owns session state and sends it on one stream, so open tabs stop polling for it.
  • Config releases run for every project. What merges to the base branch reaches new sessions, and a large repository no longer loses its config release.
  • A sandbox sleeps sooner: a turn that waits on a person stops keeping it awake, and an open tab keeps it awake only while someone uses it.
  • pi (experimental) loads the project's root AGENTS.md, runs the agent you pick for a prompt, and can take back an unread steer or a queued prompt.
  • Agents in a session use the kortix CLI for connectors; the in-sandbox kortix-connectors MCP server is removed. kortix connectors connect --label names the new account.
  • The hosted MCP server at api.kortix.com/v1/mcp is the one Kortix MCP server. The docs-only server at kortix.com/mcp is retired, and list_projects answers an empty list on an account with no projects.
  • File listings show folders with more than 1,000 files, with search on web and mobile.
  • The invite page names the project and the role. After you accept an invite or switch accounts, you land in that account.
  • Mobile: New session opens project home with the composer focused. Sessions draw tables on a full grid, hide thinking, and keep a floating composer.
  • CLI: sessions ls and sessions status --json show each session's model. triggers info shows the webhook signing scheme with a sample. approvals ls prints the decision link. projects info --json includes the project ID.
  • Session start, connector calls, cost summaries and the Reminders page use fewer database reads.
  • A session with many images or binary files loads them a few at a time instead of all at once.
  • Your computer shows the access the agent on that computer really has, in the browser and in the desktop app. Narrowing access applies at once from anywhere; widening it asks on the computer.
  • 30 API routes that no client calls answer 410 Gone.
  • The subprocessor list adds six vendors.
  • A finished turn folds its work into one Worked for row. The answer and any cards the agent showed stay visible below it.
  • A question from the agent docks onto the composer as one surface, with previous/next and a confirm step that links back to each answer.
  • The docs at kortix.com/docs are rewritten: 31 pages, with Git as a core page.
  • Mobile asks you to update when the installed app is older than the minimum version the API sets.
  • When you mention files on your own machine, the agent offers to connect your computer.

Fixed

  • A Stop wins over a session that is still opening and over its queued prompts.
  • A session whose sandbox provider is at capacity retries the start by itself, with backoff, instead of waiting for Restart.
  • Queued prompts go out at the turn boundary and survive a busy queue. Only a queued prompt's author can edit, send or retry it, and an idle send shows as active, not queued.
  • A session keeps its history when its runtime changes, a degraded transcript copy no longer serves a partial history, and a shorter read never deletes saved messages; only a rewind removes them.
  • A reload paints the conversation this device kept without placeholder rows first, a streamed message settles when its turn ends, and a session whose sandbox lost its state keeps the conversation this device saved.
  • Session boot: sandbox.on_boot runs again after a session resumes, the boot finds its config when a pin file is missing, a failed environment build no longer breaks the boot, and a sandbox falls back to 4 GiB of memory when no size is set.
  • A failed sub-agent run can be retried in its own thread.
  • Sessions: a failed-turn notice clears after you edit and resend, the turn outcome footer is back, the restart offer on a stuck boot follows the session's state, the session list pages correctly, and other tabs learn when a turn finishes.
  • The composer waits for the model list during boot, and a new free account can send with the default model.
  • The connector-connected notice joins the prompt queue and reaches the running turn.
  • Triggers: a cron trigger fires at most once a minute, every webhook delivery runs exactly once, a failed fire is recorded on the trigger, the list says when a trigger runs next, a fire waits when the account has no usable model, and a manual or webhook fire the account cannot pay for answers 402 with the reason instead of a server error.
  • Saving a connector credential is atomic, a Slack undo call is bounded by the call deadline, and a crash in the marketplace dialog stays inside the dialog.
  • The email channel shows on the channels page, and the inbox of a deleted account tells the sender once per thread.
  • Change requests: large change requests show their changed files, a blank diff says why, and the side-by-side toggle works on one-sided diffs.
  • Binary file previews work again, and links to a session's files open instead of showing [blocked].
  • Computer use on a connected computer works for every tool and survives restarts and app updates. The CLI and the desktop app run as one runtime.
  • Sign-in: a magic link works when the browser drops a cookie, a sign-in no longer bounces back to the sign-in page, and a sign-in or sign-up that stalls ends with an error you can retry. On mobile, SSO sign-in completes and the login stays until you sign out.
  • The onboarding wizard opens on an account's first project, owners see the create-project screen on /projects, and the account menu has a Settings row.
  • After a deploy, a page that loads stale code reloads once instead of breaking.
  • Account deletion works when a session sandbox exists, never deletes an operator's login, and works on self-host.
  • A push to GitHub that the remote rejects with a 500 is retried, and an expired checkout link answers with a clear not-found.
  • Trigger and top-up controls show only to people who may use them, and the project config lists every registered agent.
  • Translations and accessible names for icon buttons and the preview toggle.
  • /download has its site navigation again, and /blog serves the blog.
  • CLI: agents ls lists the project's agents, ship and in-sandbox host selection use the right credentials, the CLI token list hides session tokens, reminders ls shows the prompt text, and triggers fire reports the real outcome.
  • Self-host: doctor fails when sign-up is open and unconfirmed, self-host status --json prints clean JSON, the CLI refuses to rotate API_KEY_SECRET and POSTGRES_PASSWORD, and /v1/setup/status no longer stalls the API while it checks Docker.
  • Mobile: streaming turns stay stable, change requests anchor to their turn, the composer stays above the keyboard, and web links open in the in-app browser.
  • The Add account dialog that Install opens proposes a name that is still free.
  • @kortix/agent-tunnel connect and the CLI's sandbox port proxy connect under Bun again.
  • The sidebar toggle tells screen readers whether the sidebar is open.
  • The Providers tab no longer shows the Kortix-managed provider as connected when it serves no models.
  • CLI: kortix providers subcommands reject unknown flags instead of ignoring them.

Security

  • SSO is enforced at the API for every credential. Sign-up without a browser follows the sign-up policy and SSO-only domains. The admin allowlist never matches an SSO identity, and a personal account cannot set up SAML.
  • Offboarding stops what a member left behind: computer calls, reminders, pushes and group memberships. A deleted account closes every side route, account erasure removes stopped sandboxes, session files and managed repos, and deleting a project deletes its managed git repo.
  • A session push reaches only people who may still open the project, and a signed-out device stops getting pushes.
  • kortix secrets unset revokes every outstanding setup link for that secret.
  • /userinfo rejects tokens of a deactivated OAuth client.
  • A trigger with no agent runs with the permissions of the agent its run uses.
  • A single-label egress wildcard matches exactly one subdomain label.
  • The public installer verifies the release checksum.
  • Pinning a session's runtime on the turn stream requires the session's own sandbox credential.
  • Dependency updates for HIGH CVEs (gRPC, golang.org/x/net, sharp, the MCP SDK, undici and others), and the sandbox daemon and release scripts create temporary files owner-only.

Not yet offered in Settings

  • Apps hosting (static sites served without a sandbox, and server Apps on releases, machines and volumes, with a Convex backend as a template), project Files with per-folder access, session boot modes with persistent machines, and organization-wide Volumes and Stateless sessions sit behind switches only Kortix can turn on and are not offered in Settings yet.

Behind the scenes

  • CI runs on GitHub-hosted runners, and database indexes, connection pooling, audit storage and infrastructure checks are tightened.
  • Groundwork for a durable session log, off for every project.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.53...v0.13.56

Read the full release on GitHub →

v0.13.53

New

  • Two-factor step-up opens full screen, and the MCP connect dialog uses a split layout with the details beside the form.

Fixed

  • Slack: in a channel thread, the agent runs only when someone tags it.
  • The /download page shows the original phone screenshots on the mobile card again.
  • Mobile over-the-air publishing no longer fails on the update lookup step.

Security

  • Updated the shell-quote dependency to 1.11.0 (CVE-2026-102422).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.52...v0.13.53

Release on GitHub →

v0.13.52

New

  • Steer a running turn. A message sent with Enter while the agent works reaches the running turn at its next step, and the turn does not stop. The message waits above the composer as "Read at next step". Cmd/Ctrl+Enter still queues a message for after the turn, and a queued message has a "Stop and send" action. The CLI has kortix sessions chat --steer.
  • Live queue state. The queue above the composer updates from the session stream instead of a once-a-second poll.
  • Spend by source. LLM credit usage shows which trigger, member or caller spent it.
  • Trigger templates can use cron.scheduled_date and cron.scheduled_hour.
  • CLI: kortix validate warns about large repositories, and kortix ship runs it first.
  • New skill form: a skill can be created from a form without a model.
  • The new-project handoff shows each provisioning step as it happens.

Improved

  • A ChatGPT connection that reached its plan limit is tried again after 15 minutes, and its owner can retry it at once.
  • pi compacts the conversation at a token budget instead of at the model's full window.
  • A sandbox that cannot start because the provider's storage quota is full says so.
  • A slow session restore shows as waiting, not as stalled or failed.
  • A scheduled account deletion now runs when it is due. It removes the account's data and login, cancels the subscription and stops the sandboxes.
  • Members no longer see Restart, Stop or Delete on sessions they cannot control. A manually fired trigger is labeled as manual.

Fixed

  • YAML and JSON files preview again.
  • A 401 makes every app fetch a fresh token.
  • Usage metering closes gaps where a stream could go unbilled, and refunds are clawed back correctly.
  • Monthly renewals keep credit balances to the full four decimals.
  • An "Only you" secret stays private when its holder's role or group changes.
  • Only live account tokens are listed, and a 401 from a revoked token names it.
  • Security hardening: tenant isolation for invites, usage and setup links, agent app preview isolation, MFA step-up, and sandbox proxy access checks.
  • The API finishes in-flight work on shutdown and retries webhooks until they are acknowledged.
  • CLI fixes for projects link --host, approvals ls and change requests.
  • Slack and Teams file downloads stay inside the project.
  • An approval request sends one notification, not one per server.
  • A change to who can use a secret or a connected account applies on every server at once.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.51...v0.13.52

Read the full release on GitHub →

v0.13.51

New

  • See the model behind each answer. A session shows which model answered and what the answer cost.
  • pi 1.0. The pi harness is on pi 1.0. It brings compaction and slash commands, and pi now runs only inside the sandbox.
  • Config releases follow your repository. A release is a checkout of the base branch with the repository's own layout. An unbuildable or quarantined tip no longer drops a session's configuration without notice.
  • Security settings: a redesigned authenticator-app enrollment, and a list of every signed-in device. Signing a device out stops its access at once.
  • Viewers: the session file and App viewers show an address bar. App previews show calmer loading and build states, and hover cards name running ports and links as well as files.
  • Mobile: an updated app, with JavaScript changes now delivered as over-the-air updates. It adds channel cards for Slack and Teams prompts and one progress indicator per running turn. The Files row opens the Files page, and the project's Apps are listed.
  • Downloads: the desktop installer has a drag-to-install window, and /download links to the App Store and Google Play listings.
  • The website describes Kortix as the open-source AI Operating System.

Improved

  • When a ChatGPT usage limit is reached, the gateway falls back to the project's model chain and says when the limit resets.
  • A failed sandbox template build names its cause.
  • Adding a member by email is faster.
  • Sandbox shells no longer write core dumps.

Fixed

  • Editing a sent prompt keeps its attachments, and so does editing a prompt queued while the session boots.
  • A manual trigger run no longer fails when it races a new session that creates the same agent identity.
  • Relative OpenCode instructions read from the release, not from the workspace.
  • The demo booking confirmation stays open until you close it.
  • The Kortix web app is patched against three new vulnerabilities in its dependencies.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.50...v0.13.51

Read the full release on GitHub →

v0.13.50

New

  • Fork a conversation. A session's conversation offers a Fork action, so you can branch from any point.
  • Cancel a subscription from the billing pane.
  • One permission per topic. The broad project.customize.* permissions are replaced by project.settings.write, project.sandbox.write, and project.model.read/.write. Agent changes use project.agent.write. Every role keeps exactly what it had. Project members can now open Agents and Triggers read-only.

Improved

  • Sign-in: an existing account opens on the password form, and the email link is one click away. After you enroll in two-factor authentication, sign-in asks for the code. A magic link still completes when its verifier cookie is lost. A failed server sign-out is reported on the sign-in page.
  • Security settings list the devices that are signed in.
  • Account deletion: "Delete immediately" deletes the account, and the dialog reads as a choice.
  • Creating a project lands you on the project page.
  • The session key panel says whose keys a session reaches, and why a key is not available.
  • Connectors: Computers appear under Connected only after a machine is paired, and connector notes display the same way on every surface.
  • The audit log: reconciliation catches up on accounts with very large histories.
  • The API returns 400 for a malformed account id, and a marketplace install fails clearly when no model can serve its import.
  • Database health: more RLS policies evaluate the signed-in user once per query, and legacy tables gain primary keys and missing indexes.

Fixed

  • The CLI:
    • sessions log and chat show the real stop or failure reason.
    • Trigger schedule updates keep their time zone.
    • Policy conditions keep their operators.
    • --json output and session listings stay stable.
    • projects rm --purge reports "Purged".
    • Project-scoped commands reach projects that have no session.
    • The empty models state points to providers.
  • Mobile:
    • Question answers can be retried until they are accepted.
    • Mermaid diagrams render.
    • Teams mentions are stripped from session titles.
    • Diff stats keep literal escapes.
    • App previews refresh their credentials when opened.
  • Desktop: "Allow all" adds Kortix to the macOS Screen Recording list.
  • A warm session that has not been prompted reads as starting, not running.
  • The sandbox agent's dependencies are patched against two undici vulnerabilities.
  • Customize tabs appear immediately, and only the page body waits for permissions.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.49...v0.13.50

Read the full release on GitHub →

v0.13.49

New

  • Permissions decide, for agents as for people. An agent that holds a permission can do the work end to end. kortix_permissions: all, "*", and any list that contains "*" mean the same thing. With all, an agent can also manage project members and delete the project. Creating credentials stays with people.
  • An agent can grant only what it holds. When an agent edits an agent's permissions, connectors, secrets, or Apps, it can add only what it holds itself. This applies through every route, change request, and push. An agent that does not hold every grant opens a change request instead of pushing the default branch directly.
  • One authorization path. Every agent with a kortix_permissions grant acts as itself, in every project. The per-project switch back to the authority of the person who started it is gone.
  • One bad permission entry no longer empties an agent. An entry Kortix cannot grant is skipped, and the rest of the agent's grant stays. kortix validate still reports it.
  • The Meta agent is platform-owned. It runs read-only and appears first in the agent picker.
  • No more active-session limits. Billing is the only limit on how many sessions run at once.
  • The blog is served from its own app at /blog.

Improved

  • A change-request merge that edits agents, triggers, or default_agent needs the same permission as the direct route.
  • The download links (/download/macos, /windows, /linux) fall back to the releases page after 3 seconds if GitHub does not answer.
  • Deleting a sign-in removes the accounts that only that person belonged to, and revokes all of that person's credentials.
  • The manager's session inventory no longer lists deleted warm drafts.

Fixed

  • kortix validate rejects invalid arguments.
  • The sandbox's /turn request is read correctly before streaming starts.
  • The mobile stop icon honors its size.
  • The infrastructure audit checks network ACL admin ports separately for IPv4 and IPv6.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.48...v0.13.49

Release on GitHub →

v0.13.48

New

  • Your computer, on the web. Each physical computer appears once, even after you re-pair it. Computer Use runs inside the Kortix desktop app, and it asks for every macOS permission right after you connect. Pairings with no hardware id that stay silent for 30 days are removed.
  • Edit a queued prompt in place. The prompt queue sits in its own card above the composer.
  • Review Center has its own page. You approve requests in a modal on the approve page.
  • Channel bindings live in one dialog, with one tab per platform and a settings dialog for each binding. Teams bindings read "Team › Channel" and include the thread title.
  • Shared sessions show who sent each message, with an avatar per sender.
  • Marketplace redesign: one card per item, a file tree in the sidebar, and related skills.
  • A new /developers page. Its "copy prompt command" output now pastes safely into any POSIX shell.
  • One-day personal API keys. You can create a key that expires after one day.
  • Apps on mobile: a new Apps tab in the project drawer.
  • Show files name the file in a hover card.

Improved

  • Audit log, rebuilt. Events are written to weekly partitions with time-ordered ids, without the per-session lock that slowed ingestion. Noise rows (missing-secret probes, a login event per request) are gone. Weeks older than 90 days move to S3 under Object Lock, and exports read archived weeks too.
  • The agent harness: Kortix tools run on both supported harnesses, and the web, CLI, and mobile clients render from the Kortix session contract.
  • Slack: messages name people and channels instead of showing ids, and plan steps render channels natively. Agent history and thread reads name each author. Slack shows its own logo everywhere.
  • Connectors: discovery tries managed connectors first, with explicit API and MCP sources. Discovery still works when a spec source cannot load.
  • Sandbox file uploads send 8 MiB requests, so a 1 MiB file uploads in about 2 s instead of 20 s.
  • Sessions honor US compute placement and reuse warm sessions. Warm sessions you are billed for stay visible in the session list. You can switch agents in a started session, and the locked agent picker explains why it is locked.
  • Each sandbox sends its calls to its own regional control plane.
  • Database health: RLS policies evaluate the signed-in user once per query, duplicate indexes are dropped, foreign keys are indexed, and unused legacy tables are removed.
  • Apps: deleting an App deletes its deployment images, and you can delete a single deployment.
  • Invite emails name the invited address.

Fixed

  • A session whose turn ends with a terminal error now parks, instead of staying busy.
  • The CLI: --host and named-host project context route to the right host, browser login uses the target host, and --json output carries no human notices. accounts current --json exits 1 when no account is active, projects use reports errors instead of crashing, and tokens rm with a malformed id returns 400.
  • Credit balances read the same on the CLI and the web, and a free account sees its balance on Plan.
  • Sign-in keeps the details of an email sign-in failure. Rate-limit errors show guidance instead of raw text, and account deletion ends active sessions at once.
  • The web: the command palette finds active projects, the selected language persists, the account hub opens from deep links, connected-account settings open again, and settings rows stack on narrow screens. The Apps card shows its live preview again.
  • Video: unsupported fullscreen and blocked autoplay no longer raise errors.
  • Mobile: the composer detects mention and command triggers at the caret, not only at the end of the text.
  • Marketplace installs report failures instead of exiting silently.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.47...v0.13.48

Read the full release on GitHub →

v0.13.47

Microsoft Teams for every project, secrets you can share with an agent, failed-trigger alerts, and immediate sign-out

New

  • Microsoft Teams is on for every project. There is no feature flag to turn on: connect Teams from the project's Connectors → Channels page. A tenant admin consents once, or the project brings its own bot. A project that connected Teams while it was a flag keeps its install. @kortix/sdk keeps teams as a deprecated flag key that always reports enabled. (#8601, #8603)

  • What Kortix says to one person in Teams stays with that person. In a channel or group chat, only that person sees:

    • the prompt to connect an account or request access, with the connect button right in the thread;
    • command replies;
    • why a message did not run;
    • approval requests and decisions.

    Teams marks these "Only you can see this message", as Slack does. The shared "Working on it…" card appears only when the message can run. (#8609)

  • Kortix shows when your Teams app is out of date. When your organization's Teams catalog has an older Kortix app, the Channels page and kortix channels status say so and name the two steps: a Teams admin publishes the update, then a team owner updates the app in each team where Teams offers it. A Teams thread that the agent may not read now comes back with who fixes it, instead of Microsoft's error alone. The Teams app moves to version 1.6.1. (#8624)

  • A failing trigger is no longer silent. When a trigger's run fails, the Schedule page shows the trigger as failed with the reason, and the account owner gets one push when a failure streak starts, not one per fire. The next run that finishes clears it. A reused session that grew too large to compact is retired, so the next fire starts a fresh one. (#8586, #8588)

  • Human Messaging reaches every agent surface (projects with the Human Messaging feature on). Agents in sessions, Slack, Teams and the hosted MCP server know how to ask a person and answer back, and the mobile app groups what people asked you under "Asked you". An ask from a session runs the asking session's own agent. (#8622, #8623)

  • Share a secret or a connector account with an agent. "Who can use it" now offers agents next to people and groups. A value shared with an agent reaches every session of that agent, triggers and schedules included; running the agent stays gated by its own access. A secret link can keep the value to the person who asked. kortix secrets share --agent <name> does the same from the CLI. (#8635, #8638)

  • Approve or deny a connector call from the Review Center header, next to Back, as for a change request. Deny takes an optional note that reaches the agent. Long parameter values collapse behind Show more. (#8641)

  • An agent's ask names the agent, not the session title, in "Asked you" (Human Messaging projects). With the Human Messaging feature off, it no longer appears anywhere. (#8626, #8637)

Security

  • Sharing a session cannot leak a personal value. Making a session project-visible or creating a public share is refused (409 PERSONAL_SECRET_REQUIRES_PRIVATE_SESSION) while the session holds a value shared only with its owner. (#8635)
  • Permissions follow the capability. A rule on bash also covers the terminal tools, websearch covers web and image search, and webfetch covers page scraping. Unknown tools fail closed. (#8553)

Fixed

  • Slack and Teams sign-in links open again. Since 2026-09-24 the link to connect a chat account answered "page not found". (#8611)
  • Accounts that require MFA work after the code is verified. Linking Slack or Teams, and some API routes such as connectors, asked for the second factor again even after it passed. Connecting a chat account now continues by itself after the code. (#8611) Members' sessions in such an account now reach shared provider keys, including a ChatGPT login shared with the project, and changing a shared key still needs the second factor. (#8618, #8620)
  • A Slack or Teams conversation runs the model it shows. A message without a /model change could run on the model of an earlier message instead of the conversation's model. (#8618)
  • Signup asks you to open the emailed link. The confirmation screen no longer asks for a six-digit code that the email does not contain. (#8608)
  • Signing out takes effect on every route at once. A logged-out, banned or revoked access token is rejected everywhere. Before, it stayed valid until it expired, up to an hour, on routes outside the account session check. (#8594)
  • Migrated sessions start again. A session moved from the previous platform could hold a sign-in token that the move had revoked, and never finished starting. Opening it now restores that one token, only for the session's own box. (#8636)
  • Audit ingestion wastes fewer retries. After a database timeout, a retry sends half the rows instead of the same statement again, and a small batch gives up after one try. (#8599)
  • Email connections survive a failed inbox listing. When the inbox listing failed, Kortix treated it as an empty list and removed the project's email connections. It now keeps them and reports the error. (#8607)
  • The bring-your-own Teams webhook answers 404, not 503, for a project that has no bot of its own. (#8603)
  • The Kortix icon is the same everywhere again. The favicon, app icons and home-screen icon all show the light tile with the dark mark, in light and dark mode. (#8647)
  • Translated pages are translated again. Blog titles and descriptions, SEO descriptions, the site description and the open-source headline show in all eight non-English languages. The brand kit had left them in English. (#8587)

Behind the scenes

  • Sandbox boot is split into session setup, prompt delivery and turn relays, with no change in behavior (#8600); its boot-order guards follow the moved code (#8627). The SDK's server entrypoint no longer imports itself in a cycle (#8591).
  • Test repairs for mobile, the CLI and self-hosted Supabase, and the Stop flow (#8575, #8578, #8584, #8590). A flaky kortixd test resets its shared cooldown (#8598). A synthetic test token no longer trips the secret scanner (#8614, #8616). Learnings entries on translating changed copy and on Teams app updates (#8593, #8624).
  • The runtime protocol is Kortix-owned: transcripts are versioned as kortix.transcript.v1, both agent harnesses serve Kortix turn routes, and @kortix/sdk no longer depends on @opencode-ai/sdk. (#8553)
  • SDK and host refactors with no change in behavior (#8246, #8398, #8449, #8581, #8632), billing provider handlers split out (#8628), an engineers IAM group for MFA-gated day-to-day AWS access (#8633), and release-gate fixes (#8643, #8645, #8646, #8648, #8650, #8652). Message ids now use the platform's secure random source. (#8646, #8648)
  • One migration: a nullable run_failing_since column on trigger runtime state (#8588).

Release source: staging 40de384e4f517dacea723221cb430ef45ffe8b00 (promotion #8642; supersedes the earlier candidate 4defc4c213).

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.46...v0.13.47

Read the full release on GitHub →

v0.13.46

An agent permission fix, refresh-token replay protection, prompt authorship, and agents that can ask people (behind a flag).

New

  • Every prompt records who wrote it, and the transcript shows the author.
  • Agents can ask a person a question or start a group conversation with people, behind the human_messaging project flag (off by default).

Security

  • An agent whose policy denies bash or edit can no longer open a shell through the terminal tools or write files through the memory tool.
  • A refresh token cannot be replayed, and logging out revokes the session.

Fixed

  • Chat stays available while a connector waits for approval.
  • The advanced panel preference keeps the panels you open.
  • The cost explorer shows a loading state until usage arrives.
  • Mobile renders model reasoning as a thinking row.
  • Deleting an account no longer reports its sandboxes as lost work.
  • A conversation with people is named at a word boundary.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.45...v0.13.46

Release on GitHub →

v0.13.45

Session labels, a redesigned approval flow, and long sessions that compact instead of failing.

New

  • Sessions carry writable labels and metadata across the API, SDK, CLI, MCP and web, and the session list filters by label.
  • Redesigned approval, preview and install consent screens.
  • A split "Connect your computer" dialog with one-click CLI copy.
  • Recent session views stay open across project navigation; the command palette finds sessions by ID.
  • The desktop app copies the current session URL from the Go menu and reports sanitized crash telemetry.
  • Push notifications route by browser presence: a session open in a tab does not also push.
  • Project-bound agents get their own cost rollups.
  • kortix apps access --viewer, and the CLI lints manifest wiring references.
  • The pi harness loads repository-native Pi configuration and supports config releases.
  • Each agent's OpenCode plugins load in isolation.
  • Sign in to OpenCode Go with your OpenCode account from a sign-in card, instead of pasting a key; each provider now has its own key name.
  • Connector discovery is on by default for every project.
  • Choose who can use a secret's value: only you, everyone, or chosen people and groups.
  • Manifest v3: agents boot from kortix.yaml.

Improved

  • Managed models can write up to 65,536 output tokens; the ChatGPT lineup and provider defaults come from live data.
  • A session whose sandbox lacks the model a turn asks for is repaired, for any provider.
  • Audit reconciliation is incremental, which cuts database load.
  • Session pages prefetch on intent, and a revived stream rehydrates the transcript.
  • Long managed sessions compact instead of failing at the model's context window; new sessions boot with the current managed context limit.
  • The session scope view reads the cached repository instead of waiting for a git fetch.
  • Stop answers within the request deadline and reports stopping while the sandbox finishes shutting down.
  • Creating a project retries the first push while GitHub finishes creating the repository, instead of rolling back.
  • Agent config from the base branch reaches a session on reload, even without config releases.
  • A session restored from an archived sandbox gets up to 12 minutes to wake instead of failing at 8.
  • Mobile queues prompts in the server inbox, and a turn that ended while the stream was down goes idle.
  • New users land on the project selector.
  • Neutral runtime names across the API, SDK and CLI (OpenCode decoupling).

Security

  • Dependency updates close a critical Next.js vulnerability and eight high-severity ones (axios, undici, fast-uri, js-yaml, brace-expansion, @xmldom/xmldom, path-to-regexp, @grpc/grpc-js).

Fixed

  • A malformed access request answers 400 instead of 500.
  • Reminder trigger sessions open themselves, with atomic caps.
  • App viewer tokens no longer fail with 401 after an access-policy save, and no longer appear in App logs.
  • Account API keys are refused before session daemon access; the session token acts as the person who starts each turn.
  • Slack replies to a bound session return to the thread they came from; Slack writes stay inside the calling project's channels and threads; an unavailable model stops before a Slack thread starts.
  • Listing or sharing connectors, or disconnecting a computer, no longer fails with 500 on a database deadlock.
  • An agent cannot be switched while its session is running; overlapping turns keep the running state.
  • A failed secret save keeps the form's contents.
  • Sessions on a sandbox owned by another API instance refuse prompts instead of racing it.
  • Agent .md model references resolve through the Kortix provider in gateway mode.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.44...v0.13.45

Read the full release on GitHub →

v0.13.44

Computers work like every connector, and the audit trail records the credential that made each call.

New

  • Computers are connector accounts like any other: the same row, the same Share dialog (people, groups or everyone), and one registration per machine.
  • The audit trail shows Via for each event: the credential the API authenticated (browser session, personal access token, connected app, session token, API key, service account or SCIM token), never a self-reported client label.

Fixed

  • Slack and Teams connector reads stay inside the calling project's own conversations.
  • Stopping a session no longer fails with a database deadlock when a wake runs at the same moment.
  • A malformed member id returns 400 instead of 500.
  • A stopped session box stays stopped: auto-resume is turned off before the stop, not after.
  • A transient git failure while saving a project's manifest returns a retryable 503 and no longer exposes the repository URL.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.43...v0.13.44

Release on GitHub →

v0.13.43

Every kortix CLI command over MCP, connectors as MCP tools, and US-region sessions.

New

  • The hosted MCP server reaches full kortix CLI parity through a sandboxed kortix tool, and serves project skills.
  • Connectors are first-class MCP tools.
  • Projects can run their sessions in the US East region.
  • A GDPR-complete privacy policy and a public subprocessors page at /legal/subprocessors.

Improved

  • GLM 5.3 Flash is served from OpenCode Zen first, with the OpenRouter pool as fallback.
  • Slack channels have defaults, and Teams and Slack permissions cover roles, identity links, join policies, and the bot's own scope.
  • MCP OAuth refresh tokens get a grace period, a sweeper, and code-reuse revocation. Reads after a push return fresh data.

Fixed

  • A session that was open across a deploy keeps accepting prompts. A runtime restart no longer ends a turn it already accepted, and every turn end reaches the API.
  • A live session no longer goes to sleep after a short network interruption.
  • A session whose sandbox lost its OpenCode root pin resumes the right conversation.
  • A pi model that stops responding ends with a visible timeout.
  • Deleting a user revokes their API tokens, OAuth tokens, and pending authorization codes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.42...v0.13.43

Release on GitHub →

v0.13.42

Connect your own computer from the desktop app, Teams at Slack parity, and saved history that is always on.

New

  • Local mode: connect your computer from the desktop app. Each computer is a connector account with access approval, and the tunnel keeps running in the background while the app is closed.
  • Microsoft Teams reaches Slack parity: direct messages, a connected note, a home tab, message actions, edit and delete, /unbind, /status buttons, /sessions, the full agent picker, review cards, and call-to-action links as buttons.
  • Saved session history is always on, and a reload shows the newer saved copy.
  • Mobile: an empty session opens on its composer, messages queue while the computer wakes, and sub-agents show their saved steps.
  • A redesigned Create a project page. New accounts get their name during onboarding, not from the email address.
  • Sessions list as a tree that shows who started each run, with server-side search.
  • Copy a session ID or link from the session menu.

Improved

  • The desktop app reopens your last project on launch, the same as the web.
  • Connect-computer approval is a dialog you can close.
  • A ChatGPT login the provider refuses is refreshed, and the message says who can reconnect it.
  • Session overrides open while their catalog loads; Save commits what is ready.
  • An agent-created session saves its transcript at every turn end.
  • Audit ingest answers within the request deadline.
  • Transcript reads and gateway resolution do less work per request.
  • MCP list_projects returns the caller's project role.

Fixed

  • Prompt attachment imports keep the sender's access.
  • Computer access and machine states return 4xx errors, not 500.
  • Repository previews in channels show only public repositories.
  • The Composio Microsoft Teams app is hidden; Teams is a native channel.
  • The public health endpoint no longer exposes internal deployment details.
  • A malformed preview cookie is refused, and playground budget denials are typed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.41...v0.13.42

Read the full release on GitHub →

v0.13.41

Kortix as an MCP server, Codex CLI support, reminders, approvals you can answer, and sessions that repair themselves instead of stopping.

New

  • One account-level MCP server at /v1/mcp, bound to your token like the CLI. It exposes sandbox shell and files, skills, and the session list; long commands run as jobs, and connected apps can be listed and revoked. kortix mcp runs the whole CLI as an MCP server, and a Connect MCP menu sets it up.
  • The LLM gateway accepts the OpenAI Responses API, so the Codex CLI works against Kortix.
  • Reminders: schedule prompts into a session, with a Reminders view and a per-project flag.
  • Approvals: the agent describes each gated call, the approver can reply, and approval cards reach Slack and Teams.
  • New projects get a three-step onboarding and a first chat.
  • GitHub projects can be created under personal GitHub accounts, and their sessions start.
  • Sandbox templates can run Docker inside the sandbox.
  • Agents can store secrets they already have, and long setup links load.
  • ChatGPT accounts show when they need reconnection, and a failed ChatGPT turn offers Reconnect or Connect ChatGPT.
  • Saved session history is 1:1 with the live session and on by default, including sub-agents.
  • The mobile app signs in to self-hosted Kortix instances.
  • Slack: a session's Slack thread is bound automatically so replies come back to it, and the agent can remove its own reactions.
  • The CLI saves large connector results as JSON (--out, and MCP results above 16 KB).

Improved

  • A project's fallback model chain runs when a model is unavailable, when a ChatGPT plan or BYOK model fails, and when every pooled account is paused or needs reconnection.
  • The LLM gateway bounds requests per credential.
  • DeepSeek and GLM accept images and a thinking control; model hosting is named accurately.
  • Session connection and run status are accurate across web, mobile and the SDK, without flapping.
  • A session is never parked while its runtime repair is still running, and its model converges when it opens.
  • Sessions move off retired managed models automatically, and the error names the cause.
  • Sharing a session switches it to the project's keys instead of stranding it.
  • Sandbox images carry every runtime asset, and updates move only the chunks that changed.
  • Audit events are ingested and reconciled without blocking requests or scanning whole tables.
  • Sandbox health polls and connector listings answer faster.

Fixed

  • Every prompt file reaches the computer.
  • Every agent picker lists the project's own agent roster.
  • Connector toolkit search returns the same page shape as the unsearched list.
  • A dead credential gets a typed 401, so retrying clients stop.
  • The Firecrawl proxy rejects private and metadata URLs.
  • Values can be copied out of the XLSX and CSV viewers.
  • A pinned runtime that still serves no longer refuses its session.
  • Old saved tool calls show what they kept; an empty session opens on its composer.
  • A stopped session wakes without needing a message.
  • GET /kortix/part in the sandbox requires the same credential as its sibling routes.
  • Teams: the bot token is sent only to stored service URLs, and the sign-in link appears only in one-to-one chats.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.40...v0.13.41

Read the full release on GitHub →

v0.13.40

Sessions recover a stuck sandbox and a stale runtime on their own.

Fixed

  • A session whose sandbox name was still held by an old archived sandbox could never get a new sandbox. It now provisions under a fresh name.
  • Opening a session repairs a stale runtime immediately instead of waiting for the background check.
  • A prompt parked while the sandbox restarts keeps its sandbox deadline through every retry.
  • A Firefox browser-extension error no longer reaches error reporting.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.39...v0.13.40

Release on GitHub →

v0.13.39

Sessions keep working through model and runtime outages, turns start faster, and sessions open instantly.

Improved

  • Opening a session shows its saved history immediately from cache while the live transcript loads, in one request instead of several.
  • Turns start faster: configuration, model catalog and ingress checks run in parallel.
  • Sessions retry transient model errors inside the turn and continue through short provider outages instead of stopping.
  • A session whose runtime was lost resumes automatically when it was running unattended.
  • The sandbox model catalog stays current across boot, wake, restart and every turn.
  • Streaming responses never forward a partial event line; a stream cut before the first byte is retried, and a later cut ends with an explicit error.
  • The kortixt terminal desk adds cloud sessions, port forwarding, a Links panel and a self-updating launcher.
  • Managed models route through their OpenRouter pools by default; direct Morph routing is off unless an operator enables it.
  • Gateway request logs break admission time down by step: preparation, admission, routing, resolution and billing.

Fixed

  • Turns were sometimes marked abandoned while still running.
  • Transcript requests could return 401 during a session.
  • Stopped sandboxes could stay running after their session ended.
  • Orphan cleanup only stops sandboxes that this deployment's database owns.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.38...v0.13.39

Read the full release on GitHub →

v0.13.38

Sandbox image builds keep working under the snapshot quota, and turning off session oversight takes effect everywhere at once.

Fixed

  • Snapshot cleanup now removes images left behind by deleted App deployments, so new sandbox images keep building instead of hitting the provider quota.
  • Turning off session oversight takes effect immediately on every server. Admins can no longer open a member's private session for a few seconds afterwards.

Improved

  • Gateway request logs split latency into admission time and upstream wait.
  • The Settings panel and icon pickers load on demand, so the app opens faster.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.37...v0.13.38

Release on GitHub →

v0.13.37

Deploys no longer cause a burst of errors, and the app is faster.

Fixed

  • A production deploy no longer briefly runs the database out of connections. Session start, stop and model listing stay available while a new version rolls out.

Improved

  • The connector catalog resolves connectors concurrently.
  • Avatars render from generated paths instead of loading the full icon set.
  • Branch listings for views are faster, and Composio auth configuration is served from cache while it refreshes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.36...v0.13.37

Release on GitHub →

v0.13.36

The admin accounts list loads reliably, and sessions resolve their connectors faster.

Fixed

  • The admin console's account list uses an index and no longer times out. A slow query now returns a clear error instead of raw database text.

Improved

  • Sessions resolve their connectors in one batched lookup, and Composio discovery serves cached results while it refreshes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.35...v0.13.36

Release on GitHub →

v0.13.35

Audit events are never lost under load, stuck session starts stop retrying forever, and the app is faster.

Fixed

  • Audit events that hit database lock contention are retried with backoff instead of being dropped.
  • A session start whose repository clone fails now stops after its retry limit instead of retrying forever.

Improved

  • Faster page loads and API responses: cached git reads, fewer browser preflight requests, fewer repeated queries, and smaller payloads.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.34...v0.13.35

Release on GitHub →

v0.13.34

Share connector accounts with groups and people, mobile push notifications, and pi.dev packages for pi sessions.

New

  • Share connector accounts with specific groups, specific people, or everyone in the project. Anything can also be granted to everyone in a project.
  • Mobile push notifications when a turn completes, fails, asks a question, or needs a permission, even while the app is closed. Transcripts can also be shared as a public link from mobile.
  • pi.dev packages. pi sessions can load any extension from pi.dev, per project, per agent, or for every session.
  • Claude Code on the gateway. Claude Code works fully against /v1/messages, and ChatGPT models work from a gateway key.

Fixed

  • A long run whose first prompt has not loaded yet still reads in order.
  • A sandbox's binaries update at a turn boundary instead of waiting for a restart.
  • A restart failure is no longer reported as a lost computer before the provider is asked, and a removed parked box is recovered first.
  • A parked session stays stopped under passive traffic, and the app stops polling a parked or unreachable sandbox.
  • Unconfigured sessions use the project's shared ChatGPT accounts.
  • Bring-your-own Anthropic-compatible providers respect their configured base URL.
  • A session name set at creation is kept.
  • The session audit view loads without 25-second timeouts.
  • Interleaved text in streamed Anthropic responses opens its own content block.
  • An invalid Composio toolkit returns a clear error instead of a server error.
  • Tool output is parsed in linear time on web, mobile and the SDK.
  • Several browser errors no longer surface as app errors.
  • Project routes always run authentication before the route handler.
  • Mobile Review merges work and feel instant, with change-request cards in sessions.
  • Historical session dates and activity ordering are restored for migrated sessions.
  • The web app no longer hits React error #467 while loading translations.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.33...v0.13.34

Read the full release on GitHub →

v0.13.33

This release restores everything from v0.13.32, which was rolled back, and adds fixes for live transcripts, sleeping sessions, the file viewer and connectors.

New

  • Grouped outputs. When the agent shows several results in a row, such as two screenshots, the session renders one tabbed card instead of a card per result.
  • Managed model routes. Each Kortix-managed model routes through its own provider route, and the model picker shows the price for each route.
  • Wake failures are explained. When a sandbox fails to wake, the session page shows the failure and when it retries.

Fixed

  • A live session's transcript recovers when a turn ends even if the working signal was missed.
  • A session idle for more than a day wakes again, and a failed start is recovered instead of reported lost.
  • A config update never interrupts the turn it finds running.
  • Kortix owns the kortix and opencode binaries inside a managed sandbox, so a box cannot end up on a version Kortix cannot heal.
  • The file viewer reloads when the explorer switches between the live workspace and the saved copy.
  • X and other Composio toolkits with their own OAuth connect again, and the Connected tab stays current.
  • Git pushes on branch commits retry a transient failure.
  • Audit writes for one session no longer queue behind each other.
  • A requested Stop keeps its reason in the turn history.
  • Several browser errors from extensions, GPU drivers, closed parent windows and tab discards no longer surface as app errors.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.32...v0.13.33

Read the full release on GitHub →

v0.13.32

Your own model keys and ChatGPT subscription now work in Slack, Teams and the CLI, saved sessions open instantly, and a single Stop can no longer break a session.

New

  • Your own keys and ChatGPT everywhere. Models you reach through your own API keys, keys shared with you, project keys, and ChatGPT subscriptions are available in Teams, Slack and the CLI, not only the web picker.
  • Members bring their own ChatGPT subscription, without needing permission to manage project secrets.
  • Saved sessions open on their conversation. Opening an existing session shows skeleton rows shaped like that session while it loads, instead of the full-screen boot screen.
  • Command palette. ⌘K opens instantly at a fixed position, and search can copy your account, project and session IDs.
  • Connect cards name the app they connect, and render as cards even when an agent writes them in a table.
  • Mobile: dictation in the composer, labelled queue controls with undo, and + only attaches.
  • SSO domain verification. An enterprise account verifies its email domain with a DNS TXT record before SSO is enforced for it. Existing SSO setups keep working.

Fixed

  • One Stop during a session's first turn no longer makes every later turn end immediately, and a Stop during start-up releases the held prompt.
  • A healthy Slack run is no longer closed as idle after 30 minutes of quiet work.
  • A saved secret that is not granted to the session's agent is now reported as "not granted to this agent" instead of silently missing, and an agent session can sync its own secrets.
  • In web terminals on custom Debian templates, Kortix tools stay on PATH and secrets load in login shells.
  • An open file viewer refreshes when the agent edits the file.
  • A turn that fails mid-stream shows one readable line naming the model, with details folded away.
  • Streaming from OpenAI-compatible models that omit event separators no longer fails to parse.
  • The web app detects the end of a turn reliably.

Security

  • Markdown, embedded frames, credential routing, share links and analytics are hardened.
  • SDK token, transport, preview-credential and file-write paths are hardened.
  • Connector requests are checked against private-network egress rules, and connector sync is atomic.
  • Gateway usage settles exactly once per request.
  • SSO emails are trusted only on verified domains, and access-control writes are scoped to their account.
  • Billing wallet functions move to a private database schema.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.31...v0.13.32

Read the full release on GitHub →

v0.13.31

The audit log now reads as plain events instead of raw routes, agents act as their own principal by default, the mobile app gets a large revamp, and the marketing site ships far less JavaScript.

New

  • An audit log you can read. Every entry shows a readable title instead of a raw route, in all nine languages. Every API route and event now has a label, and kortix audit ls prints the same titles in the terminal.
  • More outcomes are audited: sandbox-provider transitions, App deployments, branch cleanup (one entry per deleted remote branch), and an expired tunnel permission. Background jobs run each tick as a named worker, so their work is attributable.
  • Agents act as their own principal by default. An agent has its own identity and permissions rather than borrowing the person who started it.
  • Apps are a per-agent resource in both the editor and the CLI.
  • Reply to several passages at once with inline quote blocks.
  • GPT-6 Sol and GPT-6 Luna are available through a connected ChatGPT subscription.

Improved

  • The marketing pages are static and ship about 80% less JavaScript, and opening a session is faster.
  • Mobile: onboarding, drafts, a reworked drawer header, connectors, a "Needs you" view, session chrome, the browser toolbar, plan rings and sheet contrast.
  • Desktop: native window controls, sidebar and settings alignment, the collapsed sidebar accepts clicks again, and the Customize sidebar toggle stays clickable.
  • File attachments now go through OpenAPI and HTTP connectors.
  • Kortix-managed models route through Morph first, with a confirmed-US, zero-retention failover when it is unavailable.
  • Mobile: attachments upload through the shared SDK, a session starts optimistically, and there is a Members page.

Fixed

  • Creating a session no longer fails with a server error when a transient git-mirror fetch fails; it retries instead.
  • A trigger or channel prompt no longer freezes the mobile app.
  • A request that changes nothing no longer records a change in the audit log, and a rate-limited request no longer stores the path it was refused on.
  • A git push no longer shares its upstream connection with another push.
  • OpenAI and Anthropic models are never presented as Kortix-managed.
  • Quote splitting trims newlines in one pass.
  • A git request that cannot get its repository credential now fails with a clear, retryable error instead of a misleading "repository not found", and a brief credential failure is retried before anyone sees it.
  • Session turns no longer render out of order after prompts sent from the CLI.
  • On the desktop app, Back is clickable again on sign-in, /projects, /new and onboarding, and the window can still be dragged from those pages.
  • The shader wallpaper compiles again; its uniform names used a form GPUs reject.
  • When memory runs out because of files held in RAM, the memory guard now names them instead of reporting only that the turn stopped.
  • An agent merging its own change request no longer gets a false "changes agents or triggers" refusal right after a push; the check reads the current branches.
  • An App's Access list shows an agent grant right after it is saved.

Security

  • Session routes, public shares and proxy edges check access through one shared rule set, and server-managed session metadata can no longer be set by clients.
  • Chat-channel webhooks are scoped to their verified project and workspace.
  • Credit is granted only for settled payments.
  • Tighter database grants for Supabase client roles; 57 unused legacy database functions are removed.
  • Private sandbox ingress, token hashing, and proxy-aware IP rate limits.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.30...v0.13.31

Read the full release on GitHub →

v0.13.30

New

  • Agents act as their own principal. An agent session now acts as the agent, on behalf of the person who started it, and every audit event records both. The kortix_cli permission scope is now kortix_permissions.
  • Microsoft Teams is complete. Agent questions, images, and the remaining Teams flows now work like Slack.
  • Saved history works while the sandbox is off. Session transcripts and their attachments load on web, SDK, and CLI without waking the sandbox.
  • Mermaid previews. .mmd and .mermaid files render as diagrams in the file viewer.
  • Mobile app revamp. New primitives, a project stack, and session chat parity with web. Session logic is now shared through @kortix/sdk.

Improved

  • Download is a visible primary action in the file viewers.
  • Session layout: a centered session column, sub-agent tree lines, neutral queued-message bubbles, tighter connector intake spacing, and a working send from project home.
  • Sandbox memory guard: a turn stops only on real memory pressure, and every stop says why.

Fixed

  • Slack: in a workspace with more than one Kortix Slack app, an app no longer answers replies in another project's thread, so the right bot replies again.
  • BYOK billing: sessions on your own provider key are never charged Kortix credits, and usage is attributed correctly.
  • CLI: kortix sessions rm retries a stalled delete instead of hanging.
  • Git: shallow pushes are accepted.
  • Usage descriptions are fully localized.
  • Internal: the Pi raw event envelope carries its own id; commit hooks block customer data and work in older worktrees; release-gate test fixes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.29...v0.13.30

Release on GitHub →

v0.13.29

Owners can let admins open every session in their account, sending a message from the project home no longer freezes the box, and a woken session fills in its saved history.

New

  • Let owners and admins open every session. An owner can turn on an account policy that gives owners and admins access to every session in the account. It is off by default, only an owner can change it, and every session opened this way is recorded in the audit log.
  • See who owns each session. The Sessions page shows each session's owner and filters by owner and by access.

Improved

  • Sending from the project home sends the message instead of freezing the input, and the composer stays in one place through the send.
  • A session that wakes fills in its saved history.
  • The waiting indicator stops while a turn is waiting on you.
  • When a session cannot start, the reason is shown instead of a generic error.

Fixed

  • Creating a project during a GitHub rate limit now tells you to retry and when, instead of failing.
  • Rebuilding a sandbox image that is still in use explains why it cannot proceed.
  • Restarting or starting a session no longer erases what another in-flight request recorded about it.
  • Session-access audit entries are translated.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.28...v0.13.29

Release on GitHub →

v0.13.28

Projects open on a Slack-style selector, you can stop a running agent straight from Slack or Teams, long sessions load and stop faster, and a git access gap for account members is closed.

Security

  • An account member could push to a project's main branch they had no rights to. The git proxy checked a personal token against the member's account role instead of their project role. It now checks the project role.

New

  • Pick a project from a Slack-style selector. /projects lists your projects and opens them in place.
  • Stop a run from Slack or Teams. The live card has a Stop button, and Teams also gets /stop. /status in Teams shows the current run and links to it.
  • Bring your own Teams bot with a three-step setup wizard.
  • Review decisions carry a reason. Request changes in Slack or Teams and say what should change.
  • Answer questions in Teams directly. The question card answers what was actually asked, and a tapped answer keeps the question it answered.

Improved

  • Long sessions finish a turn and stop faster: ending a turn and pressing Stop no longer re-read or re-write the whole conversation.
  • Saved history keeps loading older messages while the sandbox is down.
  • Members see only what they can change: session settings, the model picker and the sandbox notice no longer show account-level controls they cannot use.
  • Members can open the Sessions page.
  • The notice about a project's previous repository is a dismissible card with one clear update action, in plain language.

Fixed

  • A turn that ends by asking you something is no longer reported as "Task complete" in Slack or Teams, and neither is a review still waiting on you.
  • A run you stopped on purpose no longer shows as "Run failed" in Teams.
  • A failed start is reported as a failure rather than going quiet.
  • A Teams review decision requires access to the project.
  • The Teams agent picker offers only agents you may run.
  • Teams cards no longer show Slack-style formatting.
  • A Teams conversation always shows its name, never a raw id.
  • kortix sessions reads a stopped session's saved transcript.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.27...v0.13.28

Release on GitHub →

v0.13.27

Sharing a provider key with a whole project is now something you choose deliberately, and account roles can be changed from a group's member list.

New

  • Edit a person's account role from a group's member list. You no longer have to leave the group to change what someone is.

Improved

  • A new API key or ChatGPT account is private by default. The Add dialog opens with "Specific members" selected and you already on the list, so sharing a key with everyone in the project is an explicit choice rather than the default.
  • One place to pick provider keys for a session, and the choice saves.

Fixed

  • Sessions stay usable after the project's repository changes.
  • Every role assignment is checked against the owner ceiling, so an assignment cannot grant more than the person making it holds.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.26...v0.13.27

Release on GitHub →

v0.13.26

Sessions now say exactly how a turn ended, signing in lands on a workspace chooser instead of an auto-created project, and every member can mint their own access token.

New

  • A turn tells you how it ended. Every turn carries one typed outcome, so a failed turn reports the recorded cause instead of a blank row — and a turn you stopped yourself is recorded as stopped, not as a failure. GET /turn lists failed turns with the reason each one ended.
  • A workspace chooser on the way in. Signing in shows your workspaces and any pending invites rather than silently creating a project for you. With no workspaces yet, the chooser is the create form.
  • Every account member can mint and revoke their own personal access token. It no longer takes an owner.
  • Teams asks with a card. The question tool renders a real card with inputs, dropdowns and toggles behind one Submit, and replies in a group chat continue the session without a mention.

Improved

  • The model picker collapses every provider group, and the zero-retention and US-inference facts sit on one line instead of a banner.
  • An image sent to a channel never runs on a model the agent is not allowed to use; the pin is checked per message rather than trusted from the catalog.
  • Deleting a project from Settings redirects instead of leaving you on a dead page.
  • Resuming a session keeps the repository workspaces it had before.

Fixed

  • A failed turn with no named cause now says it stopped, rather than showing nothing.
  • The stale-turn sweep aborts the runtime turn, not just its card.
  • An unresolvable agent grant now fails closed for codex models instead of quietly picking a model the agent may not use.
  • An unowned conversation returns "not found" rather than "forbidden", so it cannot be used to probe what exists.
  • A form field id containing a comma is rejected.
  • An audit entry for the new account-invites route renders with a readable label.
  • Release publishing no longer depends on the npm registry: a registry failure can no longer cost a release its tag, its downloads or its changelog entry, and the release refuses to publish with missing downloads.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.25...v0.13.26

Release on GitHub →

v0.13.25

Kortix now runs in Microsoft Teams and in your terminal, a kortix.yaml can be split across files, every managed model accepts images, and sandbox compute is metered correctly on free and trial accounts.

New

  • Kortix in the terminal (experimental). kortix tui opens a full terminal client: sidebar with accounts, projects and grouped sessions; session transcript with tool cards and interactive prompts; a composer with a command palette and model, effort and agent pickers; Files, Review, Apps and Customize screens; an embedded terminal; and opencode attach mode. It installs its own binary on first run, so the CLI stays small.
  • Microsoft Teams. Run an agent from a channel, a group chat, or a direct message. Thread replies continue the same session without a new mention. Files work both ways: inline images reach the agent, and results upload to the team drive with a link back. Join policies (open, owner-approval, owner-only) match Slack, with an Approve/Deny card and /policy. When a tenant has several projects and nothing is bound yet, Teams asks which project to use and replays the message you already sent. The agent's markdown renders as card elements — headings, tables, bold, monospace code — with step source citations.
  • Split a kortix.yaml across files. An imports: list pulls agents, connectors and triggers in from other files, and every connector and agent records which file declared it. The CLI, the manifest reference and the scheduling docs all understand it.
  • Replace a project's repository. Point an existing project at a different repository, authorized per repository rather than per account.
  • Every managed Kortix model now accepts images. The lineup moved to the Morph catalog with Kimi K3 and GLM Flash, plus text-only DeepSeek V4 Pro. Text-only models are hidden rather than offered and then refused.
  • Model pricing and data handling are visible before you pick. The model manager shows each managed model's modalities, its zero-retention status, and which connected account pays. Regional options cover US-only and EU inference, with the retention terms stated.

Improved

  • Session transcripts stay complete. A session accepts messages while its transcript history starts the runtime, so you are not waiting on a sandbox to type.
  • Attachments are stored before the sandbox starts, so a file sent with the first message is still there when the agent reads it. Older sessions recover attachments that previous versions could not read back.
  • Teams replies post faster: the live card goes up before identity resolution, and the webhook acknowledges before dispatch.
  • Provider keys keep your draft while saving, and the provider list collapses to a count so the managed set stays in view.
  • Group and member pages stay current after a directory update, and attaching a group to a project now grants its agents.
  • Deployments report why a rollout failed instead of only that it timed out, and a container starts faster.

Fixed

  • Sandbox compute is metered on free and trial accounts. It was not, so usage on those accounts went unbilled.
  • Starting a session, sending a prompt and waking an App no longer debit a cent each. Those actions placed a charge they should never have placed.
  • Adding a tool authorizes the project's account, not the clicker's. The connection was being created as a private one owned by whoever clicked, so nobody else — and no scheduled run — could use it, while the UI reported it connected.
  • A prompt sent before the model catalog finished loading was dropped. It is now held and sent.
  • The model picker spun forever for every project member, and for a project with no id.
  • A sent message came back as the project-home draft.
  • The session sidebar reordered itself while you were reading it.
  • An idle session's Files panel showed a permanent spinner instead of its files.
  • The Teams source filter crashed the project page.
  • Removing an attachment whose upload was still starting left it behind for a day and counted against the attachment limit.
  • Sessions resumed after a pause no longer fail on stale provider credentials.
  • Repository controls stay visible and readable at the minimum window size, and the replacement flow is fully translated.
  • Teams session titles, sidebar entries and channel cards no longer show raw <at> mention markup.
  • A Teams turn that died mid-flight no longer wedges the conversation.
  • Bot tokens are sent only to Bot Framework attachment hosts, and a team-drive upload is authorized against the conversation it belongs to.
  • An out-of-range attachment part now reports "not found" instead of "not active", so a caller can tell a permanent error from a temporary one.
  • An emptied imported collection stays an empty list rather than becoming an empty object.
  • projects upgrade in the CLI now prompts with the same wording as the dashboard.
Release on GitHub →

v0.13.24

New

  • A second agent harness, behind a flag. pi (pi-agent-core) now runs in-process in the sandbox alongside OpenCode, selected per project by the pi_harness feature flag. It implements abort-after-tool so Quick Queue can stop a turn at a tool boundary, and it enforces the same per-pattern permission rules OpenCode applies. Off unless a project opts in, so nothing changes for existing projects.

Improved

  • The pi_harness setting reads correctly in all nine languages.
  • Internal: the sandbox daemon's timing budgets now tolerate a slow machine during a process respawn, so a correct restart is no longer reported as a failure.

Fixed

  • Restored the load-balancer response-time alarms required by the Drata DCF-86 control.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.23...v0.13.24

Release on GitHub →

v0.13.23

New

  • Choose which account a connector runs as, per call. A connection now carries the accounts you may run it as, and the account is chosen when the connector is called rather than pinned to the whole session. The connector catalog, the SDK and the CLI all report the available accounts and the pinned default, and connectors/describe shows accounts instead of only tool counts.
  • An ambiguous connector call is refused, not guessed. When several accounts are reachable and none is named or pinned as default, the call is denied with account_required instead of silently picking one — no more mail sent from the wrong mailbox.
  • Choosing a connector account is discoverable in the CLI rather than a dead end.

Improved

  • A connector you have your own accounts for reads as connected, not "needs setup", and the admin connector list now agrees with what each caller can actually reach.
  • Connector accounts are per connection instead of a connector-level strategy, and connections the old strategy flag made unreachable are revoked.
  • The sandbox daemon's internals were reorganised behind explicit service boundaries, with its HTTP controllers separated from its adapters.

Fixed

  • A failed identity check no longer signs you out. A failed getUser round trip used to end the browser session; it no longer does, and the new-connection screen offers Upgrade when you are at the project cap.
  • Connector authorization: finalizing a connection that the whole project can use now requires the connections-manage capability, matching the gate the connect step already applied. Previously a role with connector-write but not connections-manage could complete a project-wide shared connection.
  • Auto-created connections no longer claim to be the default, and the CLI's account column no longer truncates away the pinned-default marker.
  • Stale connector banner copy and a dead connector detail shell removed; the account list renders for every direct provider.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.22...v0.13.23

Release on GitHub →

v0.13.22

New

  • Private provider key pools. Bring several keys for one provider, keep them private or share them with named members, and let each session hold its own key. Sessions fail over to the next key and report the earliest retry time when a pool is exhausted. Gemini and ChatGPT keys pool too, and pooled keys are managed in Models. Pool access is bound to the session owner, and a pool is checked against the model you actually picked.
  • Print a whole conversation. Cmd+P prints the full session as a clean document — every message, not one clipped screen of the app.
  • Queued prompts you can see and edit. Queued messages show in a list above the composer. Press Up to edit the last one, and Resume picks the queue back up.
  • Microsoft Teams install reports what happened. One-click install publishes in the background, lands on Channels with a real status, and offers a retry with the actual reason when publishing fails.
  • Astra is available as a ChatGPT subscription model.

Improved

  • Faster project boot. New sessions fetch the project from storage instead of cloning it, and start sooner.
  • Faster session lists. A project's session list is now a page, not the whole inventory.
  • Menus open instantly — menus, popovers, tooltips and the command palette no longer wait to appear.
  • Smaller sandbox images, which start faster.
  • Git connections are organized per account, with one instance backend and an identity that cannot drift. Verifying with GitHub no longer signs you out, and the new-connection screen always has a way out.

Fixed

  • Microsoft Entra directory sync. Patches apply atomically, large directories paginate, groups survive while a user is inactive or a sign-in session is stale, deactivation and single-member removal behave correctly, and users resolve across the whole directory.
  • The gateway retries a slow internal call instead of answering "Gateway unavailable".
  • Composer drafts survive session startup, and opening session settings no longer closes itself while the composer takes focus.
  • One session lifecycle drain at a time per API task, so queued work is not claimed twice.
  • Session attachments are more reliable, and model prices show correctly in the ChatGPT picker.
  • Security hardening across session cursors, webhook signing keys, and the remaining high-severity scanner findings.
  • Database migrations apply cleanly on staging and production.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.21...v0.13.22

Release on GitHub →

v0.13.21

New

  • Print a whole conversation. Cmd+P prints the full session as a clean document — every message, not one clipped screen of the app.
  • Queued prompts you can see and edit. Queued messages show in a list above the composer. Press Up to edit the last one, and Resume picks the queue back up reliably.
  • Private provider connection pools. Bring several keys for one provider, keep them private or share them with named members, and let a session hold its own key. Sessions fail over to the next key and report the earliest retry time when a pool is exhausted. Gemini and ChatGPT keys pool too, and pooled keys are managed in Models.
  • Astra is available as a ChatGPT subscription model.

Improved

  • Faster project boot. New sessions fetch the project from storage instead of cloning it, and start sooner.
  • Faster session lists. A project's session list is now a page, not the whole inventory.
  • Menus open instantly. Menus, popovers, tooltips and the command palette no longer wait to appear.
  • Smaller sandbox images, which start faster.
  • Git connections are now organized per account, with one instance backend and an identity that cannot drift.

Fixed

  • Microsoft Entra directory sync. Patches apply atomically, large directories paginate, groups survive while a user is inactive or a sign-in session is stale, deactivation and single-member removal behave correctly, and users resolve across the whole directory.
  • The gateway retries a slow internal call instead of answering "Gateway unavailable".
  • Composer drafts survive session startup, and opening session settings no longer closes itself while the composer takes focus.
  • Session attachments are more reliable.
  • Model prices show correctly in the ChatGPT picker.
  • Security hardening across session cursors, webhook signing keys, and the remaining high-severity scanner findings.
  • Database migrations now apply cleanly on staging and production.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.20...v0.13.21

Read the full release on GitHub →

v0.13.20

Fixed

  • Projects with thousands of sessions no longer slow the app down. The session list now loads one page at a time — 50 sessions, with a Load more control — instead of returning every session on every refresh. On a project with 12,617 sessions that is a 46 KB response instead of about 11 MB, and the sidebar was refreshing it every five seconds.
  • Opening, sharing, stopping, restarting or renaming a session now works however old the session is. These controls used to look the session up in the full list, so once a project grew past the first page the controls could quietly disappear.

Improved

  • Date grouping (Today, This week, Older), filters and search work as before, applied to the sessions you have loaded.
  • A new database index serves the paged list, so a request no longer sorts every session in the project.

Security

  • The pagination cursor is encrypted and tied to both the project and the person viewing it. It cannot reveal a session they are not allowed to open, and it cannot be reused by anyone else.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.19...v0.13.20

Release on GitHub →

v0.13.19

  • Fix terminal connections that fail after a sandbox resumes because its provider credentials have changed.
  • Refresh rejected provider credentials once for reads and discard stale credentials after a failed WebSocket handshake.
  • Preserve application redirects and sandbox authentication errors. Do not replay writes when provider authentication fails.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.18...v0.13.19

Release on GitHub →

v0.13.18

Fixed

  • Terminal opens on a stopped workspace. Opening Terminal requests a wake even before the first shell exists. Connection retries have a deadline and preserve shell output.
  • Session switches keep message retries in the right workspace. Missing conversations stop repeated 404 or 410 requests without clearing cached history.
  • Sessions keep their own agent. A session could be switched to an agent from a different project after a prompt that named no agent, which removed its access to connectors and the Kortix CLI. Every session now always runs as its own agent, and a session that was affected recovers on its next message.
  • The first message on the home screen no longer gets stuck in the composer after a slow start.
  • Project pages load cleanly. The project home shows the Kortix mark while it loads instead of a flashing placeholder.
  • Session history is saved before a session stops, and responses from the in-sandbox model proxy are no longer returned in a corrupted encoding.
  • Admin project list shows each project's own session counts.
  • Customize settings show what you saved. After saving an agent or connector setting, a reload could show the previous value for up to a minute.

Improved

  • Connector activity uses consistent names. Connector calls appear as connector calls.
  • Repository access is explicit. Agents now declare whether a session gets the project's files, replacing the older workspace modes. Older API clients keep reading restricted manifests correctly.
  • Previews route correctly and set up shared sandboxes in isolation.
  • Release checks are more reliable: preview environments use their own database, confirm the running runtime, and wait for completed agent artifacts before asserting on them. They also verify cold terminal wake and session-switch routing, allocate sufficient preview frontend memory, and check Docker readiness.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.17...v0.13.18

Release on GitHub →

v0.13.17

Fixed

  • Previews open again when you are signed in. A sandbox preview opened from a session (prod-p<port>-sbx-….p.kortix.com) showed "Sign in to open this preview" even though you were signed in. Sign-in tokens are still issued with the older HS256 signature while the published key set already holds the newer ES256 key. The API already verified those tokens with the auth server, but the preview gate refused them. It now makes the same check, so the preview panel, pasted preview links, and preview WebSockets open for the account that owns the sandbox. A forged or expired token is still refused, and a test now fails if any verifier caller handles these results in its own way.

Internal

  • The release gate quarantines TUN-6 on deployed targets only: Bun's WebSocket client sends no User-Agent, so the edge firewall refuses the tunnel handshake on staging and prod. The flow still runs locally.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.16...v0.13.17

Release on GitHub →

v0.13.16

New

  • Project-level provider and model access controls. Owners and admins choose which model providers and which models a project may use, from one model management view that also holds provider links. Kortix managed models sit beside your own providers in the same list, a ChatGPT subscription shows its access beside its credentials, and the picker distinguishes "not shown" from "blocked" so a member sees why a model is unavailable.
  • GPT-6 Astra is in the managed catalog. Select kortix/gpt-6-astra with image input, tools, and the supported reasoning efforts. Routing, prices, capability limits, and sandbox fallbacks are all in step.
  • The desktop app always has a way out. The shell has no browser toolbar, so a page without an in-app exit was a dead end. Every such page now has Close, the Go menu has Back (Cmd/Ctrl+[) and Home (Cmd/Ctrl+Shift+H), a renderer crash offers Reload or Go Home instead of an empty window, and the Electron route allowlist now matches the web middleware's exactly.

Improved

  • One noun: project. The interface said "workspace" while the SDK, CLI, API, routes, manifest, and docs all said "project". Screen copy now says project in every one of the nine languages, each with its own word rather than a find-and-replace. The sandbox /workspace directory, the manifest's per-agent workspace: boundary, and Slack workspaces keep their names.
  • Create a project in a specific account. The Switch project menu, already grouped by account, gains a "Create a project in {account}" row for each account where you are an owner or admin, including accounts that have no projects yet. The old global link never said which account it would land in.
  • The SSO and SCIM setup wizards work again. Picking a provider did nothing, and Back or the step rail snapped you to the first step with a render loop in the console. Both are fixed, and a browser journey now walks every step of both wizards on every deploy.
  • Tunnel file transfers are verified end to end. Binary files sent through the Computer Tunnel are checked by digest at the destination, an approval for one exact file no longer grants its parent directory, permission decisions are serialized so an approve and a deny cannot both win, and orphaned upload tasks are stopped.

Fixed

  • The sandbox model proxy asked upstream for compressed responses and could not decode them. It now requests identity encoding, so a session on a model that answered with zstd no longer fails its first turn.

Internal

  • Project snapshot config provider v2 (S3). Sessions can boot from a prebuilt, blob-less snapshot of the project's committed tree with the history hydrated off the boot path, falling back to Git when no snapshot is ready. Every environment gets a private snapshot bucket and the task-role grant; only staging names its bucket, so production sessions keep the Git path until the in-region measurement lands.
  • The project-snapshot task role gets s3:ListBucket, so a missing object is a 404 and not a denied build, and the grant is gated on a plan-time boolean so terraform plan succeeds on a root that creates the bucket in the same apply.
  • The deployed release gate's contracts were corrected for previews: marketing stays enabled while the browser gate exercises /pricing, App domains are not expected on a sandbox origin, cold Daytona boots get a budget above their measured image builds, encoded-path probes accept the exact auth redirect, and the project submenu is required before a row is selected.
  • The connector connection-flow routing change (#7074) was merged and reverted within the same window; it ships no behavior.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.15...v0.13.16

Release on GitHub →

v0.13.15

New

  • Review Center is on for every project. It is no longer behind a feature flag — the routes, registry, contract, web surfaces, CLI, and docs all ship it by default.
  • A public App can recognise you. public used to mean both "anyone with the link may open this" and "nobody is ever recognised". Now an App you share outside your company still greets your own team, shows them the controls a visitor should not see, and records who acted.

Improved

  • Creating an account is reachable again, and it lands you in the account you created. The control had no live entry point, and the one path that reached it dropped you back where you started. There is now a "Create an account…" row in the workspace switcher, and creating an account opens its first workspace with that account selected.
  • Connector categories show their true size. The catalogue counted one page of results and headed every category with "· 1". Categories are now grouped over the complete catalogue on the server, and "View all" filters to the set its heading counted.
  • Secret intake forms read better. Field hints written by an agent become real links, every non-form step shares one status notice, and the header no longer runs under the close button.
  • Modals opened over modals stack correctly. A modal opened while another was open could render underneath it; it now takes the layer above, and the switch control meets contrast in both themes.
  • Session hover cards line up. Sessions carrying a Slack, schedule, or shared marker opened their card inset from the sidebar edge; every row now anchors at the same place.

Fixed

  • Sending a message no longer makes the transcript jump twice. An idle send moved the view down and then glided it back. The send is now recognised as the working turn, so the view moves once.

Internal

  • 4xx denials are logged as warnings, not errors. Roughly 43% of production error-level lines were expected denials — expired tokens, a project-scoped token refused a cross-project read, an agent missing a grant — which buried real faults. Severity now follows the status class; the lines stay queryable and Sentry behaviour is unchanged.
  • A dropped audit batch now says why. The log recorded the whole failing statement plus its bound parameters — IP addresses, user agents, account and project ids — while hiding the SQLSTATE that distinguishes a transient timeout from a permanent constraint violation. It now reports the code and cause, with no statement text and no parameters.
  • A forced test exit raises a workflow annotation instead of a line buried in a 40,000-line CI log.
  • The staging deploy asserts the host-only access cookie from main, matching what staging already checked.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.14...v0.13.15

Release on GitHub →

v0.13.14

Fixed

  • Sandboxes cannot outlive their work. A session turn now has an absolute ceiling as well as a renewable one. Renewal asks whether a turn is still running, and a wedged turn answers "yes" forever, so a turn record past the ceiling is now settled instead of being renewed indefinitely and its sandbox is reclaimed. This one cause sat behind several classes of server error.
  • Fewer server errors when the database is busy. Connection-class and contention failures are now recognised as the temporary conditions they are and retried, instead of being reported as server faults.
  • Errors say what actually went wrong. A failure now carries its real cause rather than the message of whatever wrapped it, and how serious it is follows that cause. Ordinary customer state no longer looks like a platform failure, so real failures stop being buried.
  • A large unused database index is gone, removing its write cost from every audit record. It was 8.6 GB and had served no read in two and a half months.
  • One subscription dialog, in the right place. The upgrade dialog now renders above the deepest panel that opened it, so its controls stay reachable and screen readers can see it. Escape closes it and leaves account settings open.
  • Ordered lists size their gutter to the widest marker, so long lists no longer clip their numbers.
  • Desktop: the Back control sits correctly on sign-in screens.

New

  • Desktop asks which Kortix instance to use on first launch.

Internal

  • The test harness no longer loses a whole browser shard when a dev-server cache restore fails, and a finished test run now exits instead of hanging when something leaves a connection open. Both had turned passing runs into failed ones.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.13...v0.13.14

Release on GitHub →

v0.13.13

Fixed

  • Billing opens one subscription dialog from the account hub. Its controls remain accessible, and Escape closes the subscription dialog while keeping account settings open.
  • Session Git pushes honor explicit ref grants within the effective IAM role. Manager-authorized sessions can update shared branches; agent grants cannot elevate a member to manager ref authority.
  • Connectors keep working after a bad manifest read. A session no longer loses every connector when one read of kortix.yaml answers wrong. Each grant now records the manifest revision it came from; a grant read from the same revision or an older commit never replaces it, and an unreadable manifest keeps the last known grant. The channel that started a session (Slack, Teams, email) stays callable under any grant, so the agent can always report in its own thread.
  • Connector denials say why. connector_not_assigned now names the agent, its granted list, the manifest revision, and what to change. A declared connector with no credential answers connector_not_connected and lists as needs_auth. Composio connectors no longer show needs_auth while they are connected.
  • Slack progress is never silently dropped. slack step and slack send fail with a reason when a checkpoint or an answer does not reach the thread, instead of reporting success. A replayed idle event no longer closes a turn that just started. Button clicks carry the full turn instructions and never vanish without a trace.
  • Sessions: the waiting row and the Stop button stay accurate while a prompt is in flight.
  • Triggers: the manager override for reuse-mode prompt delivery works again.
  • Web: auth tokens are preserved during hydration and fenced before cross-user adoption, and project access waits for auth, so cold loads no longer show "This project didn't load".
  • Web: 18 toasts no longer render their own translation key; the template OG image route runs on Node and stops bundling every translation.
  • Desktop: navigation layout restored, with parity checks in the package gate.

Improved

  • Self-host operators can set KORTIX_FRONTEND_MEMORY_LIMIT to give the frontend more memory. The setting persists through CLI updates and affects only the frontend.
  • Account hub as a modal. Organization settings, members, groups, roles, identity, billing, and audit open over the page you are on instead of a separate route tree. The /accounts routes are gone; links resolve to ?accountId= on the current page, and Back, reload, and pasted links keep working.
  • Signing in paints one brand mark across the whole path to the project instead of four different loading frames.
  • Command palette: file search is offered only where it can run; the Open URL row and the Jump to message page are removed; the empty state no longer names a row that is not there.

Internal

  • Release fixtures follow the current connector tab and use a normal cancellation request. Test artifacts mask diagnostic credentials and upload only after the secret guard passes.
  • End-to-end flow GH-17 verifies member branch isolation and owner ref authority through real Git HTTP.
  • New end-to-end flow (CONN-27) covers session grant provenance, the channel guarantee, and honest denials, with preview harness support. Browser specs follow the account hub to its new URLs; spec 23 ignores CORS preflights.
  • Connector authorization tests mint credentials through the token API and close database connections after each run.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.12...v0.13.13

Read the full release on GitHub →

v0.13.12

New

  • Every supported language now has complete translations across settings, onboarding, project home and sidebar, sessions, password recovery, sign-in, and workspace administration. Serbian is a new locale. 241 entries that rendered as placeholders now show real text.
  • Headless auth: multi-factor enrolment, enterprise SSO, and profile updates are available through the API and the SDK (PATCH /v1/auth/user, KortixSession.subscribe as the replacement for onAuthStateChange).
  • Kortix Apps: one identity guard for every App (createKortixAppGuard, groups always populated), and an embedded App can complete its own sign-in (cookieSameSite).
  • Session brief: hover a session to see its summary.

Improved

  • Connector catalogue: one-letter searches work, cache entries are compared by identity, and panel padding and search were corrected.
  • Markdown code blocks inside lists are inset correctly.
  • Slack and Teams: a live run keeps its thread after 15 quiet minutes.
  • Triggers: a billing-rejected fire is terminal and keeps its reason code; a reuse, keyed, or pinned delivery handoff is recorded as fired.

Fixed

  • Project creation: a failure while creating the managed repository is now logged with its cause. The edge router in front of the API is deployed with every release, so an origin error is never shown as a maintenance page. The managed-git token is verified by creating and deleting a probe repository before it is stored, and the status endpoint reports which credential is in use.
  • Connector endpoints must be https on a public host. An invalid endpoint answers 400 instead of failing as a server error.
  • Session attachments are reliable again.
  • Kortix Apps: the App guard's trailing-slash handling could take seconds on one config string; the viewer secret is resolved per request; the access picker no longer promises options the code does not offer.
  • MFA unenrol route typechecks (gotrue() accepts DELETE).

Internal

  • Template preview images (/api/og/template) render on the Node runtime with their strings inlined; as an Edge Function the route had grown past Vercel's size limit.
  • Preview environments: Node repaired in persistent sandboxes, failed Platinum templates recover, an explicit Daytona fallback, all runtime secrets forwarded, Node engine floor raised, translations kept out of the edge middleware bundle.
  • Release gate: follows the deployed test contracts, installs with engine-strict relaxed, verifies the host-only access cookie.
  • Route manifest and audit route registry regenerated; the headless auth routes are registered and allowlisted with reasons.
  • pi-js-router: open_access is the operator's override and the workflow honours it.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.11...v0.13.12

Release on GitHub →

v0.13.11

Billing

  • No account runs on an empty wallet. Paid per-seat and credit-plan accounts used to keep spending past $0 with no floor; one six-seat account settled $588.81 against a $150 monthly grant with the wallet at $0.00. Every account now stops at the same floor before new work starts.
  • Work that already ran is always recorded. A settlement that the wallet could not cover used to be refused, which deleted the record of the spend and left "Spent this period" frozen while compute kept running. The ledger now records the overdraft, and the account stays blocked until it is topped up.
  • Wallet alerts agree with the server. Every wallet alert and billing string in the app now reads the account's billing state, so the sidebar and the project page no longer disagree about whether you are out of credits.
  • Credits have their own tab in account settings, with the available balance and where it comes from. Plan keeps its own card.

Git and access

  • Push authority is scoped to who is pushing. A session credential can push only to its own branch. Pushing other refs and deleting refs are two new permissions, project.gitops.ref.any and project.gitops.ref.delete, held by the project manager role and grantable to agents from the agent editor, the CLI scope validator and the docs. Before this, any credential that could push at all could rewrite or delete any branch.
  • Deleting a branch checks the person's role, so a plain push right no longer deletes a colleague's branch.
  • GitHub reconnect is named, not failed. When a stored GitHub App installation stops minting tokens, the app tells you to reconnect instead of throwing an opaque error.
  • A project always has a manifest. Provisioning through the API seeds kortix.yaml by default, and kortix ship refuses to push a project that has none.
  • Signed-in identity is your own. The app no longer shows an account owner's email as the signed-in identity, and account lookups stay inside the account you are in.

Customize, agents and settings

  • Customize is built around the agent. Agents lead the Customize bar, and each agent is a full-page editor with a topic rail: People, Access pages for Skills, Connectors, Secrets and Project actions that reuse the catalog cards and modals, grant editing in place, and a Share button showing who has the agent.
  • Capability tabs live under /customize/<tab>. Old URLs redirect. Review is its own tab on the bar. The per-project config page is retired; its sections live in the settings overlay.
  • Settings is a full-screen shell with Workspace, Personal and Account groups. Security, Appearance, Notifications and Plan are separate tabs. Personal settings are called Preferences, the account Tokens tab is called API keys, and Mod+, opens the panel.
  • Review center is a full-width inbox with an inline review page, no modals.
  • A change request is a card in the turn that produced it, with a status that updates and a URL to share.
  • Admin console rebuilt on the app shell and the design system.
  • Project home and account hub extracted and tidied: hero column centred, composer band on the base surface, the workspace name throws confetti for every project and the icon only when you choose one.
  • Smaller fixes: sidebar active row paints again, info and warning banners are legible, managed repositories no longer read as unmanaged, triggers open in place, the Git repository section is its own settings section, and connector proposals get an <app>-<random> slug.

Docs and support

  • Docs moved to Blume. /docs is rebuilt on a new docs engine with a working favicon, a canonical origin, and no stray files in the published site. The credits guide lives at /docs/credits.
  • One support hub. /help merged into /support: contact channels, guides, FAQ, account deletion and legal in one place.

Sessions and runtime

  • Stop stays visible while a response streams, and the session reports busy for the whole turn.
  • Queued prompts keep their order and sync after a turn completes. Prompts sent during a live turn are forwarded instead of waiting.
  • Turn failures show the real message instead of a raw JSON body.
  • File tool rows use the right tense (wrote, edited, listed) instead of the tool's registry name.
  • The terminal no longer reconnects every 60 seconds. The PTY connection between the API and the sandbox was cut after a minute of silence; both legs are now kept alive.
  • Connecting a provider refreshes the model picker without a page reload.
  • Older sandboxes catch up. Boxes provisioned before the self-updating runtime receive the current daemon, OpenCode and CLI from the control plane, and the daemon re-detects the OpenCode binary after a restart. This revives sessions that went silent after the 2026-08-14 OpenCode message-id rollover.
  • Trigger status is truthful. Reuse, keyed and pinned trigger fires record fired on delivery instead of sitting at queued forever, dead-letters are visible, and a re-prompted session runs on the trigger's model.

CLI and desktop

  • kortix login works against dev and staging again. The web firewall was rejecting the localhost callback.
  • Desktop shows a sign-in dialog for the dev and staging HTTP Basic gate, with an option to remember the credential on the device.
  • pnpm worktree nuke stops on a failed removal instead of reporting success and orphaning the worktree.

Reliability

  • Audit reconciliation writes use the isolated audit pool, so an audit lock convoy cannot starve the gateway's auth queries.
  • Preview environments heal themselves. Disk is pruned, a failed deploy keeps the last good stack, and the environment is named in words rather than by hostname. The JS pi agent has a stable name on Platinum dev.

Under the hood

  • @kortix/sdk root entry is canonical. The root, ./react and ./server are the real entries; the 20 legacy subpaths remain as shims until the next major.
  • One resolved next version across the workspace (16.3.3), with a test that fails the build if the lockfile ever resolves two. Three consecutive dev deploys had died at boot on Cannot find module 'next'.
  • Web tests run isolated, so a partial module mock cannot leak across files.
  • Production has its own managed-git token, separate from staging, and the secrets exception list was cleaned.
  • Two database migrations: the two git ref permissions (4 catalog rows) and a settlement function that records overdrafts. Neither touches user data at volume.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.10...v0.13.11

Read the full release on GitHub →

v0.13.10

Fixed

  • "Kortix is temporarily unavailable" when nothing was wrong. A single failed read of the maintenance flag was treated as a decision to lock the platform down. The API then rejected every write and showed that message to everyone using Kortix, with no one having touched the maintenance setting. An unreadable flag now means normal operation. Maintenance mode is only ever an explicit action, and a real one still holds while the flag store is briefly unreachable.

  • Being sent to the maintenance page after one failed status check. A momentary network problem in the browser was enough to navigate you out of a working session. It no longer is.

Security

  • Updated the SSH library bundled in our app runtime past CVE-2026-56854, an authentication bypass caused by source-address restrictions not being enforced (golang.org/x/crypto 0.53.0 to 0.55.0).

Internal

  • Two browser errors that were never Kortix defects — one thrown by a browser extension, one by the graphics library behind our background visuals — no longer report as product errors in our monitoring.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.9...v0.13.10

Release on GitHub →

v0.13.9

Fix the @kortix/sdk React entry point in fresh npm consumers. Declare the llm-catalog publish tool directly so isolated npm publishing succeeds. Refresh a stale trigger manifest once on a cache miss, with a per-project cooldown, so trigger fire converges across API replicas.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.7...v0.13.9

Release on GitHub →

v0.13.7

Highlights

  • Add Sign in with Kortix OAuth 2.1 flows, headless authentication, and app viewer tokens.
  • Add enterprise organization branding for logos, icons, favicons, and product names.
  • Improve session startup, auto-resume, streaming, queue state, transcript mirrors, terminal cards, and stopped-session recovery.
  • Restore GitHub repository sources on workspace creation and correct People with access visibility.
  • Add GLM 5.3 Flash and remove retired AsterLab and GLM 5.2 routes.
  • Improve secrets, connectors, Slack routing, sandbox lifecycle, preview durability, and provider failover.
  • Allow registered OAuth loopback redirects through the WAF while preserving API redirect validation.

Release validation

  • Staging SHA: 309e0afe1ce19a5674d137e749d8a6511576f2f5
  • Build Staging Artifacts: 33258635866
  • Deploy Staging: 33258801944
  • Full release QA: 33259390663

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.6...v0.13.7

Read the full release on GitHub →

v0.13.6

Sessions start, resume, and stay honest

  • The session loading screen no longer shows a false "Couldn't start session" card. A wake that stalls now escalates on its own — retry, then restart — with a cooldown ladder instead of a terminal state you had to clear by hand.
  • The transcript loads instead of rendering empty while the sandbox boots, and it stays readable for stopped sessions. Transcripts are now mirrored server-side, so a session that is not running can still be read.
  • The frontend no longer falls behind the agent or shows "stopped" while a turn is running. A running session no longer flips to stopped mid-turn.
  • The prompt queue reflects delivery truth: a message is queued until the runtime accepts it, and a message the runtime cannot run is surfaced instead of silently dropped.
  • Long turns no longer stop at random. Fixes cover provider deadline read-back, the request body cap, the OpenCode auto-updater (now off), a progress-aware boot budget, a bounded turn probe, and Bun's 300 s fetch idle timeout.
  • Long sessions no longer run the sandbox out of memory: attachments are offloaded out of the transcript, a memory guard runs before the kernel does, and the reaper backs off its probes. Each sandbox exposes a daemon log and a /kortix/diag endpoint.
  • Audit writes use a single upsert and a dedicated pool, so a lock convoy on the audit table can no longer surface as a "Bad Gateway" during a session.
  • /summarize (compaction) no longer times out through the proxy; the compaction marker is minimal and the summary opens in the panel.
  • A deleted session refuses /start and /restart with 404. Quota and provider races on project creation are gone. Rotated E2B ingress tokens refresh instead of failing.
  • An untouched send skips a no-op scope round-trip, and the approval audit read drops to 100 rows — faster first send.
  • OpenCode is bumped to 1.18.23 everywhere (fixes Bedrock redacted-content streams).

Connect apps from the session (Composio)

  • A new Connect Link flow replaces the connector overlay. Composio is the managed default provider; the agent selects it on its own.
  • You can connect an app from inside the session without typing "done". A connect the human walked away from is finished later, and a stopped session is told when its connector landed.
  • Gmail managed OAuth ships with the minimum scopes. The CLI and the intake link mint a Kortix connect link, never the provider's raw URL.
  • The connector catalogue is sectioned and filterable at the source. A newly created connector keeps its detail view open.

Models and the LLM gateway

  • The LLM gateway is a per-project setting with a first-class native path when it is off: keys go to the sandbox environment and the native provider/model is used. It stays on by default.
  • Native projects get a model picker before the sandbox runtime exists. The picker defaults to the latest flagship set; search reveals all. Deprecated models are hidden; models.dev status passes through.
  • One capability source and one thinking knob for every model. The sandbox learns the project's servable model set at boot, so the picker never offers a model the runtime cannot run. The seed refreshes weekly.
  • Bedrock: inference-profile ids are preferred, a refused bare id is retried with global./us., bare pins are healed, and no bare Bedrock id is used as a default. OpenAI-on-Bedrock reasoning effort now reaches the model. Summarized Bedrock reasoning streams. A rejected reasoning parameter gets one retry with per-model memory.
  • Inline images are windowed inside the sandbox: every gateway session routes through the daemon LLM proxy.

Approvals and permissions

  • Approval and permission notices fill the composer strip. An approval you cannot decide is never rendered as decidable, an unreviewable card says what is true, an unauthorised reviewer is told so, and Approve is not offered on a row the server will reject.
  • A truncated arguments preview no longer blocks approval.

Web

  • Inline "edit from here" editor with an honest Restore control.
  • bash, write, and edit tool rows: zone layout, live counts, and a diff stat.
  • Code blocks always show a copy button. The carousel tab no longer shifts the page sideways. One sidebar opener on every headerless session surface.
  • Session previews stay loaded and both preview frames preload. An HTML file is served, never injected.
  • Triggers keep access across stale reads. The setup-links modal finalizes when it closes.

Change surfaces

  • One vocabulary and one file list for every change surface.

Under the hood

  • CI moved to Blacksmith runners with tiered sizes, a kill switch, sticky-disk Docker cache, and a portable image-digest recipe. PR test lanes run natively.
  • Secrets hygiene: prod dotenvx keys are owner-only, non-prod profiles carry no prod-reaching credential, and a separation tripwire enforces it.
  • The release pipeline refuses a version tag collision.
Release on GitHub →

v0.13.5

Sessions

  • Sessions start faster with OpenCode 1.18.19, leaner runtime assets, reusable Git bundles, and guarded image preparation.
  • Existing sessions recover after sleep, runtime loss, dropped streams, and interrupted connections.
  • Transcripts catch up after missed events, render long threads sooner, and load attachment bytes only when needed.
  • Unsent drafts persist per project and session. The composer can reference recent session files from the / menu.
  • Fixed duplicate prompts, stale status snapshots, malformed runtime responses, and inaccessible backend-origin sessions.

Product experience

  • Every sandbox preview port can use its own origin across cloud and self-hosted deployments.
  • ZIP archives can be browsed and extracted in the file viewer.
  • The CLI now covers models, sessions, agents, connectors, triggers, access, billing, reviews, and project settings.
  • Added ranked command-palette results, a resizable sidebar, clearer change indicators, a rebuilt Apps gallery, and a simpler Customize chooser.
  • Retired the experimental voice runtime and its unused product surfaces.

Security and reliability

  • Preview origins enforce trusted CORS, cross-site write protection, read-only shares, immediate revocation, and host-scoped cookies.
  • Sandbox credentials stay confined to their session. Connector-bound secrets receive tighter delivery boundaries.
  • Experimental network-enforced secrets support streaming bodies, Server-Sent Events, large payloads, and credential substitution in authorization and cookie headers.
  • Paid legacy subscriptions pass the wallet floor correctly and receive renewal credits based on actual payments.
  • The LLM gateway handles large image requests without repeated base64 copies and survives overload without process crashes.
  • Gateway and edge failures return structured retryable errors instead of intermediary HTML or invalid compressed bodies.
  • Audit writes no longer block API traffic. Audit reads use bounded barriers under continuous traffic.
  • Added database connection limits, secret-write coalescing, per-project session controls, safer live-turn reaping, and initial-prompt replay protection.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.0...v0.13.5

Read the full release on GitHub →

v0.13.4

Fixed

  • Bound API database pools against the maximum rolling deployment fleet. This prevents PostgreSQL 53300 connection exhaustion.
  • Isolated audit writes on a dedicated pool. Slow audit inserts cannot starve request handlers.
  • Coalesced project environment updates, bounded secret writes, and capped concurrent project sessions to contain request storms.
  • Bound public web version metadata to each Vercel deployment. Production web deploys now complete with the correct release version.
  • Strengthened release verification for warm-session adoption.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.2...v0.13.4

Release on GitHub →

v0.13.2

Accept webhook requests without a User-Agent at the Cloudflare edge. Mint OpenCode-compatible initial message IDs so webhook-triggered turns complete once instead of replaying.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.1...v0.13.2

Read the full release on GitHub →

v0.13.1

New

  • One URL configures every email Kortix sends. Signup confirmations, magic links, invites and alerts all flow through the same EMAIL_URL transport with the same sender identity and templates — self-hosted installs configure email once. Supabase auth mail now goes through the same path instead of GoTrue's own SMTP.
  • One-click OAuth for MCP connectors. Connecting an MCP server that requires OAuth 2.1 now works end-to-end from the UI or via kortix connectors authorize — discovery, dynamic client registration and token exchange included.
  • Secrets get an exposure and usage model. Each secret declares how it may be exposed and which usages are assigned to it, enforced by one mechanism across every sandbox provider.
  • Session sharing is now the owner's call: managers keep lifecycle control (stop, restart), but only the session's owner can share it or mint public links.

Fixed

  • Revoked API tokens now actually stop working. A personal access token that had been revoked could still authenticate on every surface (REST, the LLM gateway, git proxy, preview proxy, connectors) because the validation query never checked the revocation timestamp. Revoked tokens are now rejected everywhere.
  • Deleting an account now stops and removes every one of its sandboxes — across every account the user owns and every non-terminal state — instead of only stopping the ones under the earliest-joined account.
  • A runaway agent turn can no longer take the API down. Each session's audit-event stream is bounded (900 events per minute); past that ceiling only the high-volume streaming-delta class is dropped while lifecycle, usage and billing events keep flowing.
  • API writes are much faster under load. Audit events are written asynchronously in batches off the request path (they were a synchronous insert into a 14-index table on every request), and the account list no longer makes one admin-API call per member to resolve owner emails. Audit reads flush the queue first, so the audit log stays read-your-writes.
  • A waking sandbox no longer looks like an error. Every surface (web, CLI, SDK) now treats the sandbox-starting state as "waking" with retry, instead of surfacing a 503. Resuming a stopped box also dropped two provider round trips.
  • Gateway reliability: long streaming turns are no longer killed at 255 seconds by a runtime idle timeout; Bedrock requests with trailing prefill or redacted reasoning no longer fail; the gateway's provider shaping now runs on the new AI-SDK-native transport path, which is the default everywhere.
  • Slack: another bot @-mentioning Kortix now works; linking the bot no longer demands owner/admin (it delegates only your own authority); user lookups were sent in a form Slack silently ignored — fixed.
  • Prompt queue and composer: forwarded prompts can no longer strand, Stop can no longer leak into the next turn, fresh sessions paint instantly in one ordered batch, and the boot-time composer shows the session's real agent.
  • Deleted sessions are no longer readable by id. Listing a project's group grants is manager-only, matching the write routes.
  • Sandboxes learn the managed model set from the API on every boot, so a model the picker offers is one the runtime knows.
  • Keyboard scrolling in a session is treated as scroll intent: Cmd+Up no longer snaps back to the end. A session.error is now attributed to the turn that failed.
  • Starter reflector and reviewer agents run without approval prompts. Self-hosted boxes get a daily Docker prune timer.
  • Session titles and conversation counts are recorded again. The per-session metadata mirror was silently never written (the internal call carried no user identity, so the sandbox rejected it) — session names and conversation counts now populate for new sessions.

Security

  • The sandbox egress pin trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope; trigger-session manager visibility no longer extends to session-bound agent tokens.
  • The browser test suite was broadcasting a deployment-protection bypass secret to third-party hosts on every run; it now authenticates once via a scoped cookie and the secret reaches no third party.
  • nodemailer upgraded across two majors to clear open advisories, including one high.

Internal

  • Roles have one store. The RBAC cutover made role_assignments the only authorization store — legacy tables became views, mirror triggers were dropped, and 3,100 lines of parallel code were deleted.
  • The production release gate is now reliable and fast. It runs as 6 API shards + 3 browser shards, cleans up its own test debris, tolerates a traffic-degraded-but-serving gateway, can be rehearsed against staging without opening a release PR, and the test client never replays a non-idempotent request through an edge-laundered error. Staging was right-sized for it, and a workflow-gating bug that had silently frozen the staging frontend for a week is fixed.
  • Container image builds are ~7× faster. Staging and dev images build natively per architecture with a registry layer cache (API image: ~3 minutes, was ~20), and the arm64 frontend image is now genuinely arm64.
  • CREATE INDEX CONCURRENTLY migrations ship with a lock_timeout that can land on a live database, and CI blocks any new one that sets it too low.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.0...v0.13.1

Read the full release on GitHub →

v0.13.0

New

  • Apps is now a stable feature — it moved out of experimental status and sits in the sidebar under Customize. Apps open instantly (no more loading flash), show their desktop layout on the preview card instead of mobile, and get their own IAM permissions and per-team scoping. Non-public Apps are now usable and honest about who can access them; self-host installs can serve Apps even though they can't publish to kortix.com.
  • Invite-time project grants — inviting someone to a project now grants both the account role and project access in one step, instead of two separate actions.
  • Settings unified into one tabbed panel, and the Billing pane was rebuilt with fewer boxes and a single credits card.
  • Chat input rebuilt to stop duplicate and lost sends; triple-tapping Escape now stops the agent even while you're typing.
  • Easy panel overhaul (the non-technical-user view): memory updates are now visible and plainly labelled, skill and task calls expand with live sub-agent activity, and a connect-apps strip and context-card actions were added.
  • Session usage modal reworked for clarity and speed; the model switcher and session usage view now show the real upstream provider instead of "Kortix".
  • Monitors (experimental): a new trigger type that runs on its own provisioned box, with its own CLI command group and MCP surface.
  • Network-boundary secrets on Daytona: an in-guest egress shim scopes a secret to the sandbox it was issued to, replacing the old operator-wide env var.
  • Presentations framework at /presentations, including a diagram-led security deck.
  • Added managed models: DeepSeek V4 Pro 0813 and Grok 4.6.
  • The CLI now shows the identity behind a minted agent token instead of reporting "not logged in".

Fixed

  • A cluster of stuck-session bugs: sessions could get wedged on boot with no retry, get stuck in a runaway self-repeating turn, show phantom interrupts, or strand mid-workspace-switch. A failed direct send now lands in the failed lane instead of disappearing, and prompts no longer get lost around session hand-off.
  • Session truth now reads from a durable server-side turn ledger over HTTP, replacing several client-side guesses about whether a session is still working.
  • Self-host: Storage now hands out public URLs instead of an internal Docker host address, and updates auto-heal from unlogged-table fork corruption that used to block them.
  • The gateway reports what an LLM request actually cost, not what Kortix billed; it no longer kills slow reasoning turns at a hard 90-second timeout, drops the trailing-assistant prefill that made strict backends fail, and its body size ceiling is raised to 1 GiB (was rejecting large multimodal requests).
  • MCP catalog discovery is now authenticated, and private sessions are no longer discoverable by other connectors.
  • Creating a duplicate App slug now returns 409 instead of 500.
  • The Vercel production frontend build now pins its runtime version so it can't get stranded on a stale one.
  • Cleaned up frontend error noise from bot/automation scripts and third-party scripts on Safari.
  • The reasoning-effort icon for Auto is now visually distinct, and agent names are capitalized consistently.

Notes

This release also includes a large internal hardening pass: an in-guest network-boundary/egress-secrets system, a warm-session simplification (session pooling now reuses ordinary sessions instead of a separate warm-session concept), a large API route-file split for maintainability, and expanded test coverage across sessions, monitors, and the deployed staging gate.

Also in this release

  • Security hardening — the sandbox egress pin now trusts the edge-populated client IP rather than spoofable forwarding headers; the App public proxy honors a token's project/session scope when authorizing App access; trigger-session manager visibility no longer extends to session-bound agent tokens; a deleted session is no longer readable by id.
  • Release-pipeline reliability — the release gate is sharded into parallel jobs, cleans up its own test debris, and runs against a right-sized staging; several long-standing test-suite defects that kept the gate red were fixed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.8...v0.13.0

Read the full release on GitHub →

v0.12.8

New

  • Act-as for support — platform admins can open a customer account for up to one hour, with a visible banner and full auditing. Anything that would outlive the hour — tokens, memberships, invites, SSO providers, public shares, tunnels, agent scope changes — is refused during the session.
  • Per-account entitlement overrides — operators grant or extend individual entitlements per account, each with an optional expiry, from a new admin override console. Expired overrides stop applying on their own.
  • One plan catalog — plans now resolve through a single catalog and resolver across API, SDK and web. The duplicate frontend tier catalogs and the "· legacy" plan label are gone.
  • Grant a secret to an agent in one call — a new API route grants an agent access to a secret, and the web app offers that grant directly from the warning that reports the missing access.
  • Session overrides in one place — the Scope panel is replaced by a single overrides popover: agent, model, sandbox and connector overrides together, labels grounded in the agent's real defaults, and a reset that is always reachable.
  • Managed model lineup refresh — Muse Spark 1.2, MiniMax M3 and GPT-5.6 Luna join GLM 5.2, and DeepSeek V4 Flash becomes the platform default.
  • Sandboxes stay current — every deploy serves its CLI and managed skills at /v1/runtime-assets, and sandboxes reconcile against it on start, restart and resume.

Improved

  • Project sessions are grouped by last activity instead of creation date.
  • Account settings are reachable from the user menu.
  • Model errors keep their upstream cause through gateway fallbacks, and context overflow is reported consistently — including after a fallback.
  • Managed-model capabilities reported by the gateway now come from real pricing data.
  • An outdated CLI now gets a clear "update your CLI" warning on the connector routes instead of a raw 404.

Fixed

  • Two ways the session message queue could stall.
  • Saving session scope without touching connectors no longer writes a connector override, and a saved agent secret selection is retained.
  • Secret delivery on Platinum sandboxes resolves replicas reliably and arms the secrecy boundary within the provider's real timing budget, without re-arming on every turn.

Security and compliance

  • The impersonation deny-list also covers agent-governance writes (agents/:name/scope, secrets/:id/grant), connector and channel management, and setup-link minting — all closed during review, before release.
  • MFA enforcement for IAM users, WAF attached to the web load balancers, load-balancer log bucket versioning, and a tightly scoped CI Terraform role.

Internal

  • Terraform for dev and prod now applies from CI behind per-environment OIDC roles, with drift detection re-registered.
  • Production deploys stamp the frontend with the release version and no longer allow mixed frontend/API states; migrations with blocking backfills are rejected at lint time.
  • Full-stack PR previews run in warm sandboxes, and the local test gates were stabilized.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.7...v0.12.8

Read the full release on GitHub →

v0.12.7

New

  • Your terminal is now a first-class way to work with an agent: kortix connect opens a session picker and attaches a full terminal UI to any running session, and can create a session and connect in one step. Bare kortix shows the landing screen again.
  • Feature flags: one gating primitive across API, web, and CLI. Disabled features answer with a clear feature_disabled error everywhere, and each project gets a dedicated Feature flags section under Customize.
  • Network-boundary secrets: secrets can now be marked for delivery only inside the sandbox network boundary, enforced per provider, configurable from web and CLI. Protected Platinum credentials sync automatically, misconfigurations are caught at save time instead of at boot, and the UI only offers delivery modes the project can honour.
  • A workspace switcher and a /new create page: switch workspaces from anywhere, reach account settings from the switcher, and create projects from one place.
  • Connector approvals are reviewed inline in the session, and connector setup finishes through one atomic path — no more half-finished connections when a webhook and a redirect race each other.
  • The starter ships a continual-harness skill: agent scaffolding that reviews its own sessions and refines itself over time.
  • Live session reload: when a session restarts, the UI now streams the reload progress instead of going quiet.

Improved

  • Sandbox lifetime is now bound to the agent. Active turns keep compute alive; finished or inactive sessions contract to a short retrieval window; every stop records why it happened. Wake billing starts only after the provider confirms the machine is actually running — concurrent and failed wakes no longer bill.
  • Session turns read in plain language, and rendering them costs far less.
  • Connector search covers the whole Pipedream catalogue, with categories filtered server-side. New sessions pick up server-resolved connector defaults.
  • Computer profiles are bound per machine, personal machines are allowed in project profiles, and the Computer Tunnel is hardened with computer-use restored.
  • Session titles converge on the runtime title everywhere — no more three names for one session.
  • Workspace file and spreadsheet reads retry during sandbox startup instead of failing on the first try.
  • Audit trails reconstruct complete session integrity chains, and runtime state survives provider restarts.

Fixed

  • A turn that is still being written can no longer be aborted mid-write, and "Interrupted" is only shown when a turn was actually interrupted.
  • The session error card no longer blinks after giving up, no longer appears while the runtime is intentionally parked, and a temporary 503 during startup is no longer treated as a failure.
  • The thinking shimmer only animates the thought the model is still writing.
  • Starter agent templates fetch managed skills through the CLI instead of assuming they are on disk.
  • A building sandbox shows a Details action instead of a broken Retry.
  • Inline content previews render again.
  • The public unauthenticated /review prototype page is gone, a connector URL parsing denial-of-service is eliminated, SES mail now runs on a task role instead of an IAM user, and production deploys refuse a mismatched Supabase auth configuration.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.6...v0.12.7

Read the full release on GitHub →

v0.12.6

New

  • Imported legacy Suna chats are now first-class: migrated sessions show up in the session list with a restore state (instead of a misleading "Done"), and opening one restores its full conversation history into the session. Files from every imported chat live in the project repo under legacy/. (#6235, #6241, #6251)
  • Admin: an activity-analytics dashboard, a projects console, clearer tier labels, and admin-issued trials with per-account entitlement overrides. (#6244, #6249, #6250)
  • Apps: serverless app deployments are provider-neutral — any Dockerfile runtime builds and serves (including non-root images), and the first request after idle reliably wakes the app. (#6253)
  • Reloading a busy session asks before stopping the running turn, and says clearly when a turn was stopped.

Improved

  • Setup links: secret links now last 7 days, an expired link says it expired instead of "invalid", and completing one notifies the waiting session immediately. (#6240)
  • Faster navigation between projects and sessions: one cache entry per entity, and route segments are no longer discarded on the way. (#6231)
  • Browser tabs are named after the session you have open. (#6236)

Fixed

  • Billing: subscriptions activate only after the first invoice is paid; compute metering opens and closes windows atomically with precise start times; sandbox resume reconciliation is fenced so a wake race can't double-bill; a ledger row can no longer be both usage and an admin debit. (#6247, #6248)
  • The terminal stays attached when the session runtime restarts during a reload.
  • Removed noisy request-timeout toasts.
  • Firefox no longer shows a crash message from the background shader when WebGL is unavailable. (#6254)

Removed

  • The local Docker sandbox provider. Sessions run on cloud sandboxes.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.5...v0.12.6

Release on GitHub →

v0.12.5

Secret delivery is now a managed control plane, connectors speak one language across the whole platform, and billing moves to flat credit plans.

New

  • Secret delivery controls. Decide exactly which secrets each agent session can use. Policies are managed from the web app and CLI, secrets reach sandboxes through an audited HTTPS broker with session-scoped handles, revoked secrets disappear from running agents, and LLM, connector, git, and subscription credentials are isolated from each other. A new kortix audit CLI command reads the account audit trail.
  • Unified connectors. One connector model across web, CLI, SDK, and API: consistent Connector and Connection terminology, a single data plane in @kortix/sdk, and connector credentials that bind to project secrets. The connector catalogue now pages through the full ~2,700-app list instead of stopping at 192.
  • Flat credit plans. Plans are priced as flat monthly credits instead of per-seat pricing. Billing also gained idempotent compute debits and accurate spend reporting.
  • Rebuilt project onboarding. A single-column, seven-step flow with a clearer Slack setup and plan selection.
  • Capability pages. Connectors, skills, and agents are browsable pages instead of a configuration overlay.
  • Use-case packs. Marketplace runbooks are grouped into installable packs, with real loading and error states and inline project creation.
  • Document conversion by default. Every new sandbox includes a convert-documents-to-markdown skill backed by a baked-in converter.
  • Serverless app deployments. Provider-neutral serverless deployments for apps, served behind a managed edge with wildcard TLS and signed public hosts.
  • Kimi K3 is available as a managed model.

Improved

  • Sessions survive interruptions. A pending agent question is parked when its sandbox dies and restored on the next boot, and a stored answer is delivered as a follow-up turn. Runtime updates boot and verify the new runtime before retiring the old one.
  • Chat UX. Instant session rename, a truthful header title, idempotent provisioning, preview verdicts, and grouped activity. In-flight sends survive navigation, and tool failures are reported honestly.
  • Session list. Rebuilt with status states, collapsible sections, and a nested filter menu.
  • Faster, calmer navigation. Project pages load faster (Next.js 16.3), and passively opening a project no longer wakes idle sandboxes.
  • Clearer errors. The LLM gateway surfaces real upstream provider errors instead of a generic Bad Gateway, and large repository branch listings are bounded.

Fixed

  • Billing: the same compute window can no longer be charged twice, "spend this period" reports the correct window, the paid seat is released when SCIM deprovisions a member, BYOK failover respects the managed-model entitlement, and the UI shows the concurrency limit the server actually enforces.
  • Agent workspaces are strictly enforced across repository, git, and clone APIs.
  • Approvals require a full review of each call, and the daemon no longer auto-answers questions outside a channel session.
  • The Terms of Service link opens the document directly.
  • Desktop: the title bar aligns with the OS window controls.
  • Production API recovery is hardened: migration-safe restarts and better behavior under memory pressure.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.4...v0.12.5

Read the full release on GitHub →

v0.12.4

Fixed

  • Transactional email — team invites, project access requests, and demo-request notifications — now goes through a chain of email providers. If one provider fails or is unavailable, the next one takes over automatically. This removes the single point of failure that delayed some emails on August 5.
  • The Terms of Service link now opens the document directly instead of its containing folder.

Internal

  • End-to-end cost tests compute gap-fill counts from their own time window, fixing a flaky check.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.3...v0.12.4

Release on GitHub →

v0.12.3

New

  • One-shot approval links: approve or reject an agent's pending request straight from the notification link, without opening the app.
  • Sandboxes now ship with a baked-in Python package floor — Pillow, pypdfium2, pytesseract, and 13 more pinned packages — so document and image skills run immediately, with no install step.
  • The session header warns when an agent's configuration changed on disk after the session started, with a one-click reload that updates the files the agent actually reads.
  • Terms of Service are linked from /legal/terms.

Improved

  • Project page navigation is noticeably faster, and the web app moved to Next.js 16.2.0.
  • Messages queued while the agent is working now stay queued until the turn actually ends — no more mid-turn releases or duplicate sends.
  • One keyboard shortcut (⌘I / Ctrl+I) now toggles the whole right side of a session: the action panel, a detail panel, or both.
  • Session error states are clearer: tool failures are reported truthfully, retry states show what is happening, and a stale agent config no longer needs a page reload to surface.
  • The CLI is quieter and more honest: --quiet is honoured on every path, and it no longer claims an invite email was sent when none was.

Fixed

  • Hardened the sandbox: closed a proxy hole that could leak the sandbox service key to an attacker-named host, closed a DNS-rebind window by connecting only to the address that was vetted, resolved symlinks before authorizing file paths, and stopped one session's credentials from being served to other members of the account.
  • Secrets: setup links now expire on time, re-scoped secrets validate against the session owner rather than the caller, and secret identifiers are no longer disclosed through the narrowing report.
  • Session reliability: removed two paths that could silently destroy a session's commits, a planned restart now finishes the turn it interrupts, a failed agent spawn schedules a respawn instead of killing the session, and reloading an agent never hard-resets the session branch.
  • A transient git failure can no longer compile an agent with an empty prompt.
  • Queued API errors: address-validation failures now return a proper 400 instead of a server error.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.2...v0.12.3

Read the full release on GitHub →

v0.12.2

Promotes the full candidate verified on staging. Prevents passive session reads and project navigation from waking stopped sandboxes; corrects session activity timestamps; adds session access, reload, cost, and guarded secret-delivery controls; improves channel, email, executor, chat, download, PPTX, and account-usage behavior; and completes the ECS-focused infrastructure and deployment updates. Fast-track note: staging image build and deployment passed. One unrelated landing-page accessibility assertion for a scrollable pre element failed; the four browser interaction tests, login accessibility, and migration tests passed.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.12.1...v0.12.2

Read the full release on GitHub →

v0.12.1

New

  • Sessions can require connectors up front: select a connector for a session before it is connected, and when a prompt needs a connector that is not connected yet, the session pauses with a connect card instead of failing.
  • Project icons: pick an emoji or a named glyph for each project.
  • When an app preview stops or fails to load, you can send it straight to the agent to fix.
  • Markdown files with frontmatter now render their metadata.

Improved

  • The project session list was rebuilt as a cleaner everyday list.
  • Model management shows which models are enabled for a project, and the Manage models tab counts them correctly.
  • Error screens include one-click copy so you can report exactly what went wrong.
  • The sidebar merges the Kortix mark and project switcher into one control, with layout and hover fixes.
  • Sandbox capacity problems surface clear retry diagnostics instead of failing silently.

Fixed

  • New signups land directly in their project instead of the project list.
  • E2B sandboxes: template builds route through the self-host domain, concurrent builds settle correctly, build uploads stream reliably, and permanent sandbox removal is bounded.
  • The file viewer no longer errors when a file is missing from the repo.
  • Self-hosted installs can configure the API memory ceiling.
  • Console noise from Android WebView is filtered out of session logs.
  • Release pipeline: a stalled dark-region replica can no longer hold back a release, which had left recent releases without their published notes.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.14...v0.12.1

Read the full release on GitHub →

v0.12.0

New

  • Audit log — every API request and agent action lands in one centralized audit trail. The app gets a project and session audit explorer; the SDK gets reconstruction filters and client attribution.
  • Session costs — one unified cost record per session, and a session cost explorer in billing that shows what each session spent.
  • Session scope controls — new sessions can start with an explicit, opt-in scope over connectors and secrets. Agents can require connector profiles, connector profiles carry an authorization strategy, and denied secrets never enter the sandbox. When a required connector is missing, the session prompts to connect it instead of failing.
  • Answerable approvals — approval prompts show the full tool arguments, and approval policies match on arguments, not just tool names.
  • Automatic session titles — sessions are titled from the first prompt, server-side, on every session-start path.
  • Signup lands in a project — new accounts go straight into a working project, with no blocking provisioning step.
  • Microsoft Teams (experimental) — Teams is available as a per-project experimental channel.
  • Embedding Kortix — per-end-user session caps enforced on create and resume, hardened sandbox isolation between end users, and mid-session re-scoping of secrets and connector bindings.
  • New website — kortix.com rebuilt: home page, Solutions, Security, Self-hosted, Integrations, Channels, Automations, About, Careers, and a public /download page. An accuracy sweep removed claims that were not true and corrected public pricing copy.

Improved

  • The project Files route opens instantly instead of after 5–6 seconds, session transcripts paint from cache instead of waiting on the sandbox VM, the sidebar no longer flickers on cold load, and older history loads by scrolling.
  • Sandboxes have a bounded lifetime that a wedged box cannot escape, and compute is billed against liveness evidence, never wall-clock.
  • Billing is one state machine: running out of credits reads as "out of credits", never "no plan"; one credit-debit function with no wallet-floor bypass; Stripe checkout returns work from any route.
  • Sessions order by last activity, connector profile creation is atomic, and the icon set moved to Phosphor.
  • Managed models group under Kortix in the model picker instead of being split across upstream provider names.

Fixed

  • Gateway: Bedrock adaptive thinking and region-prefix normalization, and the correct base path for standalone OpenAI keys.
  • A broken sandbox template no longer fails the whole template listing.
  • Public file-share links restored across the file and preview surfaces.
  • Signup and sign-in redirects can no longer land in a project the user cannot open.
  • Opening a session with history no longer shows an empty new-session shell, and triggers show as active when they are active.
  • CLI: private and self-hosted API hosts are no longer forced to https, and IPv6 hosts classify correctly.
  • Every /docs route returned 500 after an icon namespace crossed the RSC boundary.
  • Closed public SSH/RDP exposure on a network ACL and added an audit that keeps it closed.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.11.0...v0.12.0

Read the full release on GitHub →

v0.11.0

New

  • Realtime voice calls use LiveKit Cloud and preserve transcripts and worker tool calls in the session UI.
  • Session rewind restores REST and ACP sessions from a selected message.
  • Warm sessions keep one session available per project to reduce cold-start latency.
  • The Marketing Department template adds campaign, content, lifecycle, growth, and brand agents.
  • Connection policies canonicalize connector aliases and enforce the selected shared connection across grant gates.
  • KaaB isolation restricts session access, sharing, approvals, model changes, executor grants, connector use, and OpenCode proxy access.
  • KaaB spend controls enforce per-end-user limits.
  • Secret Delivery Strategy stage 1 adds the schema, policy layer, and shared egress-policy type.
  • White-label session scope controls add end-user session filtering, connector binding, scope visibility, and a testing guide.

Improved

  • Prompt delivery deduplication releases the claim after a final sandbox-down response. A later retry can recover without duplicating a completed prompt.
  • Session transcripts preserve reasoning and tool-step wire order.
  • Runtime-generated session titles synchronize with the canonical session and web UI.
  • Managed repository provisioning uses deterministic pacing and 13 reusable repositories in the release gate.
  • The release gate runs API lanes in parallel and cleans mutable staging fixtures concurrently.

Fixed

  • Session sharing preserves permission status during warm-session claim races.
  • Sandbox secret injection remains scoped to the active agent.
  • Strict model providers receive normalized message history.
  • readRepoFile returns 404 for a missing Git path.
  • Maintenance mode remains visible during an API outage.
  • Worktree shutdown stops the complete process tree.

Operations

  • US East 2 shadow deployment, database reconciliation, writer activation, and cutover tooling remain disabled.
  • This release does not freeze the EU database or switch production traffic.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.15...v0.11.0

Read the full release on GitHub →

v0.10.15

Bound scheduler fleet work, catalog trigger projects, refresh webhook manifests safely, and rate-limit forced manifest refreshes. Source is the targeted staging candidate from PR #5461.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.14...v0.10.15

Read the full release on GitHub →

v0.10.14

  • Use shared Daytona and Platinum runtime images for normal session boots.
  • Disable automatic per-project commit-specific warm image builds.
  • Fix snapshot collision recovery, warm archive handling, and repository Git metadata.
  • Preserve sandbox URLs and reset readiness clocks across session restarts.
  • Add responsive Cmd+J loading feedback and clearer runtime versus accelerator status.
  • Remove the missing MACHINE.md failure and legacy migration eligibility request noise.
  • Refactor release session fixtures to reuse managed repositories, bound SESS-2 to one session, and enforce teardown.
  • Retry transient runtime-readiness failures without leaving failed sessions.
  • Enforce account concurrent-session overrides consistently across API tasks.
  • Correct compute pricing calculations and billing copy.
  • Promote verified staging source d4f665abe258513bb1f48a6606f59c48dbfac835; staging RUN-8 and SESS-2 passed 2/2.

What's Changed

New Contributors

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.13...v0.10.14

Read the full release on GitHub →

v0.10.13

LLM gateway

  • ChatGPT / Codex models work again. Fixed the ChatGPT-subscription (codex/*) 400s end to end: restored the required store: false, stopped sending the unsupported max_output_tokens, and started surfacing the real upstream error detail instead of a bare "Bad Request".
  • Anthropic extended thinking now uses adaptive + effort (not the deprecated enabled + budget tokens), so non-AUTO reasoning effort no longer 400s on newer Claude models.
  • Reworked provider mapping into per-provider adapters typed against each SDK's own option types, with models.dev-driven capability gating — wrong wire shapes are now compile errors.

Models & providers

  • Model picker labels BYOK groups by their real provider (e.g. Amazon Bedrock, not "Kortix").
  • Model show/hide visibility is now consistent across the picker and settings.

Projects & Git

  • Git-provider-first project creation and management; new projects default to managed repositories.
  • Removed an unbuilt "Repository synchronization" placeholder from Git settings.

Marketplace

  • Fixed marketplace item pages returning 500 (they now render correctly, and a missing item 404s).

Identity (SCIM/IAM)

  • Okta group-push renames (PUT /Groups) now work; protection for IdP-synced groups; status-first Identity tab with last-sync activity and per-provider cadence.

CLI & docs

  • Avoids 502s on long chat turns; clearer "vision fallback" model labeling; dev CLI installer surfaced in Git settings.
  • New "Developing with Kortix" guide covering local instances and the CLI workflow.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.12...v0.10.13

Read the full release on GitHub →

v0.10.12

This release fixes the session-start regression behind the v0.10.11 rollback and re-ships the rebuilt LLM gateway.

Fixed

  • New sessions could hang at "Starting the agent" and never become ready — the in-sandbox runtime was rejecting its own model configuration. Sessions now start reliably.
  • Sandbox images re-downloaded the browser engine on rebuilds, which slowed session startup under load; the browser layer is now cached deterministically.
  • Slack channels showing "Not connected" with no connector available.

Improved

  • The LLM gateway is rebuilt on the Vercel AI SDK with a live models.dev catalog (re-shipped from 0.10.11).
  • Broader end-to-end test coverage and infrastructure monitoring.

Internal

  • Groundwork for an alternate managed-git backend (off by default; deployments stay on GitHub).
  • Secrets-management hardening.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.11...v0.10.12

Release on GitHub →

v0.10.11

LLM Gateway

  • Rebuilt on the Vercel AI SDK + live models.dev. The gateway now runs a single AI-SDK transport for every provider (OpenAI, Anthropic, Bedrock, OpenRouter and more), with the model catalog served verbatim from models.dev. The old per-provider transports and the LiteLLM sidecar have been removed.
  • Per-model generation controls. Set reasoning effort, temperature, top_p, and max output tokens per model — each control only appears when the model actually supports it (driven by the live catalog), and applies to every client (chat, SDK, and direct API).
  • Reasoning-effort selector in the chat composer for models that expose it (including a thinking-effort control for Claude models).
  • Two drop-in API surfaces: OpenAI-compatible /v1/chat/completions and Anthropic-compatible /v1/messages, plus /v1/models — all now documented in the API reference.
  • Provider & model manager overhaul: connect providers (incl. Bedrock via bearer token), browse models with pricing, context windows, and capabilities, verify that a key actually works, and see everything grouped under its real provider.
  • Anthropic extended thinking and prompt caching are applied correctly, and cost/usage are recorded accurately per request.
  • A gen_ai.* OpenTelemetry span is emitted per gateway call for downstream observability.

Templates

  • Many new business use-case templates across finance, sales, customer support, marketing, data, and recruiting — each with its own cover art.

Fixes & hardening

  • Sandbox proxy no longer times out healthy long reasoning/tool turns.
  • Blank projects can start sessions immediately (no more "agent not declared").
  • Project-scoped API tokens can drive their own project's sessions.
  • Per-project agent model pins no longer collide across projects.
  • Faster session/gateway paths and clearer errors on upstream failures.
  • Security & compliance: GuardDuty runtime monitoring, IAM baseline, root-login and patch/detection alerting, and corrected SSO/SCIM setup guides.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.10...v0.10.11

Read the full release on GitHub →

v0.10.10

Fixed

  • The workspace could get stuck shifted sideways — chat and panel cards clipped at the left edge, dead space on the right — after opening the browser or terminal in the session panel. Opening those views no longer nudges the layout, and the layout can no longer be scrolled out of place.
  • When the agent shares files or images in the chat, the carousel and file previews render inline again instead of collapsing to a bare one-line row. Clicking the row still opens the full viewer in the side panel.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.9...v0.10.10

Release on GitHub →

v0.10.9

Improved

  • The session panel's terminal now connects reliably and recovers cleanly instead of failing with "pty not found".
  • Browser sessions in the panel now land on a proper starting page instead of a blank view.
  • Tool cards in the session panel now show exactly what each tool did — no more misleading summaries.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.8...v0.10.9

Release on GitHub →

v0.10.8

This release is a focused batch of fixes.

Fixed

  • OpenAI-compatible models now get the correct max_tokens handling based on the model itself rather than the upstream host, so sessions on newer OpenAI models (e.g. gpt-5.6) complete their turns reliably instead of erroring.
  • Bring-your-own-key provider credentials are now always shared across your team — the private "Only me" option has been removed end to end, matching how the gateway actually reads keys and avoiding silent "no upstream configured" failures.
  • The in-terminal experience is more robust: the sandbox terminal now looks up or creates its pty on demand, so a reconnect no longer closes with "pty not found".
  • Approving or denying a request that has already been resolved no longer double-fires a "not found" toast.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.7...v0.10.8

Release on GitHub →

v0.10.7

This release is a top-to-bottom overhaul of the LLM gateway — the layer that carries every model request — plus a round of security hardening and sandbox tooling work.

LLM gateway

The gateway now speaks each provider's API correctly instead of approximately.

  • OpenAI routing and parameters. Genuine-OpenAI reasoning models that also use tools now route to the /v1/responses API, where they belong. We translate max_tokens to max_completion_tokens, correct the gpt-5.5 fallback temperature flag, and pin the playground wire shape so what you test is what you ship.
  • Anthropic and Bedrock. When extended thinking is on, we stop forwarding temperature/top_p (they conflict with thinking), and Bedrock request/response frames are handled correctly. Bedrock is now available as a standalone bring-your-own-key provider, with its region read from the project's own secret.
  • Transport correctness. Safer tool_choice handling, per-provider parameter quirks, message-role normalization, and correct streaming frames across providers.
  • A LiteLLM translation sidecar now sits behind the control plane as a stateless translation layer, so provider-shape differences are handled in one place.
  • Streaming reliability. Aborts propagate end to end, mid-stream errors surface instead of hanging, buffers are bounded, and requests carry deadlines.
  • Error taxonomy. Failures now come back as honest, actionable errors rather than opaque ones.
  • Billing correctness. Accurate usage capture, cache-write pricing, and atomic budget holds, with tests to keep them honest.
  • A published capability matrix documents exactly what each model and provider supports.

Security

  • A DNS-resolving egress guard replaces the old hostname-string regex, closing SSRF gaps.
  • Teams bot connector tokens can no longer leak to a caller-supplied serviceUrl.
  • Sessions reject client attempts to forge deletedAt/deletedBy metadata.
  • Preview shares enforce a view-mode method gate; the Slack file proxy is narrowed to file subdomains; GET /files/history gets the resource denier; the MFA-required setting requires an explicit boolean; and malformed AgentMail webhook bodies are rejected before acknowledgement.

Sandbox and CLI

  • New pre-push sandbox gate: the CLI lints your Dockerfile in validate and can build sandboxes locally with sandboxes build --local.
  • The Python floor is venv-isolated, custom /workspace contents are preserved, and PTY terminals compile on a supported Bun and recover across providers.
  • A stopped sandbox now auto-resumes on active OpenCode access, flipping the session to ready.

Web and fixes

  • Rebuilt session panel with Easy/Advanced modes, new file viewers, and modular tool renderers.
  • The project no longer reveals the resolved sandbox provider when the project's provider is set to Automatic.
  • Clearer CLI install guidance, corrected OpenCode proxy targeting, and "Kortix Computer is starting" renamed to "Kortix Session is starting."
  • Infrastructure: HTTPS-only load-balancer listeners, durable WAF ownership, restored prod gateway origin TLS, and recovered prod migrations and session uploads.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.6...v0.10.7

Read the full release on GitHub →

v0.10.6

Stamp KORTIX_VERSION in the EKS gateway Helm chart and in staging/production GitOps bumps so the standby gateway reports the exact promoted release version. This completes the gateway origin TLS recovery and restores six-endpoint version parity across ECS, EKS, and the public router.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.4...v0.10.6

Release on GitHub →

v0.10.4

Refresh the authenticated managed-model catalog when adopting warm-fork sandboxes, restarting OpenCode only when the live catalog changes. Also preserve the staging Cloudflare Worker gateway bindings so managed inference reaches the configured gateway backend.

Verified on dev and staging with fresh real sandboxes: kortix/glm-5.2 returned exactly PONG. Staging proof used a real Stripe test-mode paid subscription and cleaned up all resources.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.3...v0.10.4

Release on GitHub →

v0.10.3

Self-host hardening wave from the production-readiness audit, an experimental local-docker sandbox provider, and an auth refresh fix.

New

  • Experimental local-docker sandbox provider for self-host — run agent sandboxes as plain Docker containers on the same machine as your Kortix instance, with no cloud sandbox account. All sandbox-facing URLs resolve over the Docker network. Listed last in the provider picker and not recommended for production: it builds sandbox images locally and is noticeably slower than Daytona or Platinum.
  • Moving dev / staging / prod image tags — self-host instances can now track a channel-style tag (kortix self-host init --tag dev|staging|prod); CI re-tags the deployed build by digest, no rebuild.
  • Smoother SSO/SCIM setup — mint the SCIM token and paste it into your IdP on one page, live SSO verification with a resume story, complete Directory Sync and Google guide screenshots, and a visible "Use single sign-on (SSO)" entry on the sign-in page.

Improved

  • Self-host updater — resilient update runs with visible outcomes (kortix self-host status now shows the last update result), rotated container logs, and per-service memory limits so one service can't starve the box.
  • Self-host EC2 (Terraform) — the data volume now survives instance replacement (AZ pinned to the subnet, not the instance), reboot-surviving bootstrap, containerd relocated to the data volume, and CloudWatch status/disk/memory alarms.
  • Zero-downtime migration policy — every new database migration is linted by squawk plus deterministic mixed-version and enum-value guards in CI, with a rewritten migrations runbook.

Fixed

  • Silent auth refresh — sessions renew in the background; an expired token no longer leaves a dead, blank page.
  • Git PAT import — a saved managed-git personal access token is now recognized as a connected GitHub account, so repo import works without reconnecting.
  • SCIM Tenant URL is now correct on same-origin and self-hosted deployments.
  • Removed the legacy SANDBOX_IMAGE configuration surface from self-host.
  • Scoped the ECS deploy role's describe/list IAM actions to Kortix ARNs.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.2...v0.10.3

Release on GitHub →

v0.10.2

New

  • Unified sign-in — login and registration are now one email-first flow: enter your email and Kortix routes you to sign-in, sign-up, or your company's SSO automatically (with closed-signup and enforce-SSO support).
  • SSO out of the box on self-host — SAML is enabled by default, each instance generates its own SAML signing key at init, and SSO/SCIM setup is fully documented.
  • Identity setup wizard overhaul — reworked Entra wizard, SAML-before-SCIM ordering guidance, a provisioning health panel, an enforce-SSO toggle with clear domain consequences, and illustrated guides for all four SSO/SCIM flows.
  • Admin-controlled account creation on self-host — creating additional accounts is now restricted to the server admin by default (signups, teams, and SSO provisioning are unaffected), and the UI hides account creation when restricted.
  • Simpler self-host CLI — one env command, an uninstall command, and a friendlier init: a missing sandbox key warns instead of refusing to boot.
  • Enterprise license availability is now exposed on account state (API + SDK).

Fixed

  • Managed model provider now follows billing configuration by default, fixing managed models being unavailable on some deployments.
  • Self-host updater no longer fails on Docker-in-Docker mounts; the provider menu is always visible; configure records the admin email.
  • Non-admins no longer see a spurious Git-status error.

Behind the scenes

  • Production deploys are now hard-gated end to end: the release only publishes after the API and gateway deploys verify the live version.
  • Demo requests notify the team directly with lead-domain classification, and new signups sync to the contact list that powers onboarding emails.
  • Repo cleanup: self-host layout consolidated, stale roots removed, self-host docs moved under Guides.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.1...v0.10.2

Release on GitHub →

v0.10.1

Self-host hardening — everything live-verified

  • Agent sessions work everywhere: fixed the LLM base URL handed to cloud sandboxes and the in-API gateway path shape — BYOK model keys now carry real agent turns on local machines (Cloudflare tunnel) and VPS (domain) alike, proven end-to-end.
  • Guided setup, VPS-first: kortix self-host init walks domain/reachability → admin email → deployment shape → sandbox provider (Daytona/E2B/Platinum) → optional connectors → update schedule. Help text cut to a page. Auto-update on by default.
  • GitHub connection hardening: personal-account installs route correctly, torn configs are detected, the Git settings tab never renders blank, and 'New project' takes you to Git settings when GitHub isn't connected yet.
  • CLI against your self-host: kortix login opens your deployment's dashboard and the full login → projects → ship flow is verified.
  • kortix-selfhost/: one-README distribution with an optional thin Terraform for AWS/EC2 — durable data volume, automatic EBS-snapshot backups (configurable cadence, keeps N), DNS via Route53 or your own provider.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.10.0...v0.10.1

Release on GitHub →

v0.10.0

Self-hosting, rebuilt

One generic Docker Compose self-host that runs the full Kortix platform on any VPS/server — kortix self-host init + start, VPS-first with a persistent domain (Caddy + automatic TLS), plus Cloudflare-tunnel and local modes for evaluation.

  • In-app GitHub setup — create an org-owned GitHub App from Settings → Git (manifest flow), paste an existing App, or use a scoped access token. No CLI gymnastics, no PATs required.
  • Self-host feature flags — single-account mode, marketing site off by default, enterprise license unlock, billing/connectors gracefully hidden when unconfigured.
  • Operations built in — nightly zero-downtime rolling updates on the curated stable channel (promoted via the new Promote Self-Host Stable workflow), kortix self-host secrets management, run-any-version + local-images modes, required-secret enforcement at init.
  • Kortix-managed models are cloud-only — self-host deployments use your own model keys (BYOK); the managed catalog is gated behind an explicit flag.
  • Reliability — SSE turn-stream no longer leaks connections on retry (fixes tab-wide request starvation); stale sessions self-heal instead of dead-ending on the auth screen.
  • New self-host e2e test suite (fast CLI-artifact tier + opt-in live tier) wired into CI.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.108...v0.10.0

Read the full release on GitHub →

v0.9.108

Fixed

  • Opening an idle-stopped session now wakes it on its own instead of dead-ending on "OpenCode failed to load / sandbox not ready." When a real user hits a stopped-but-resumable box, the runtime resumes in place, and the session's status flips to running without a manual refresh.
  • Invitation listing and acceptance no longer error — a database column the code relied on was missing and is now added.
  • Sessions keep their sandbox identity through recovery and reprovision cleanly after a daemon boot error.
  • Quieter, more reliable UI: the transient "runtime still starting" state is no longer reported as an error, and a couple of edge-case crashes (malformed links, a non-string command template) are guarded.

New

  • Executor connection profiles — group a connector's credentials under a named profile.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.107...v0.9.108

Release on GitHub →

v0.9.107

Fixed

  • Opening a session whose sandbox had gone idle no longer dead-ends on "OpenCode failed to load / sandbox not ready." The runtime now wakes on its own when you open the session — the same recovery a manual refresh used to do — so idle sessions just come back.
  • A session's status now flips to "running" in the sidebar as soon as it connects, instead of staying "stopped" until you refresh the page.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.106...v0.9.107

Release on GitHub →

v0.9.106

Fixed

  • Opening or switching sessions no longer flashes a blank screen. A brief "runtime still starting" moment during a switch is now treated as a loading state, not an error, so the session just renders in place.
  • A session whose sandbox had gone idle no longer dead-ends on "open a new session." It now resumes on its own, with an in-place Restart if it can't wake automatically.
  • Cleaned up the marketing site: removed dead Compare links from the footer, dropped Blog from the nav, and fixed the CLI footer link.

Improved

  • The deploy maintenance banner is clearer and on-brand, and is treated as a critical rollout signal.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.105...v0.9.106

Release on GitHub →

v0.9.105

Fixed

  • Switching between sessions no longer flashes a "Something went wrong" screen. A brief "runtime still starting" state during a session switch now shows a short loader and recovers on its own instead of surfacing as an error.
  • The review inbox (sidebar and Review Center) keeps loading even when one of its sources is temporarily unavailable — it now degrades gracefully instead of failing the whole panel.
  • Session file uploads are recoverable again after an interruption.
  • PDF previews now open at 100% zoom instead of 50%.
  • Sign-in polish on mobile: the mark is pinned top-left, gutters are wider, and the tagline is refreshed.

New and improved

  • Signing in now defaults to a one-time email code, with password kept as a secondary option.
  • Projects still on the older manifest now show a clear v1 → v2 upgrade prompt in the sidebar.
  • Maintenance mode: admins can bypass a full lockdown through a signed session, and deploys now raise a heads-up banner while a rollout is in progress and clear it automatically once the API is healthy.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.104...v0.9.105

Release on GitHub →

v0.9.104

  • Session uploads no longer fail at the generic 15-second proxy cutoff.\n- Failed sends preserve and restore the full prompt and attachments.\n- Legacy personal connector credentials migrate safely into member-owned profiles.\n- Restores missing runtime-context and executor-profile schema.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.103...v0.9.104

Release on GitHub →

v0.9.103

  • Promote the fully tested staging candidate to production.
  • Includes sandbox identity race protection and restored health deployment identity.
  • Includes staged authentication redesign and chat input model-state fixes.
  • Includes reliable Slack project default agent/model handling.
  • Staging artifact build and deploy passed; public staging ke2e passed 9/9.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.102...v0.9.103

Read the full release on GitHub →

v0.9.102

Adds slack bind-thread (bind a session to a Slack thread for approval-reply loops; #4385) plus all other pending main changes promoted through staging (v0.9.102-staging, commit 6275ff93). Enables the WRING funding-request APPROVE-in-thread flow.

What's Changed

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.9.101...v0.9.102

Release on GitHub →