Suna

From the release notes

New Choose which account a connector runs as, per call. A connection now carries the accounts you may run it as, and the account is chosen when the connector is called rather than pinned to the whole session. The connector catalog, the SDK and the CLI all report the available accounts and the pinned default, and connectors/describe shows accounts instead of only tool counts. An ambiguous connector call is refused, not guessed. When several accounts are reachable and none is named or pinned as default, the call is denied with account_required instead of silently picking one — no more mail sent from the wrong mailbox. Choosing a connector account is discoverable in the CLI rather than a dead end. Improved A connector you have your own accounts for reads as connected, not "needs setup", and the admin connector list now agrees with what each caller can actually reach. Connector accounts are per connection instead of a connector-level strategy, and connections the old strategy flag made unreachable are revoked. The sandbox daemon's internals were reorganised behind explicit service boundaries, with its HTTP controllers separated from its adapters. Fixed A failed identity check no longer signs you out. A failed getUser round trip used to end the browser session; it no longer does, and the new-connection screen offers Upgrade when you are at the project cap. Connector authorization: finalizing a connection that the whole project can use now requires the connections-manage capability, matching the gate the connect step already applied. Previously a role with connector-write but not connections-manage could complete a project-wide shared connection. Auto-created connections no longer claim to be the default, and the CLI's account column no longer truncates away the pinned-default marker. Stale connector banner copy and a dead connector detail shell removed; the account list renders for every direct provider. What's Changed fix(auth): a failed getUser round trip no longer signs the browser out; /new offers Upgrade at the project cap by @markokraemer in #7352 refactor(connectors): credentials are a call-time choice — one access rule, no session gate, no strategy flag by @markokraemer in #7326 refactor(kortixd): introduce internal harness service boundaries by @DimitrijeGlibic in #7220 test(api): wait for the second lifecycle drain instead of a 200 ms margin by @markokraemer in #7357 fix(connectors): account-aware modal header, dead ConnectorDetail shell removed, reconcile re-activates a revoked account by @markokraemer in #7360 fix(build): quick-queue snapshot uses a reverse scan, unbreaking API typecheck on main by @markokraemer in #7368 fix(security): connect/finalize gates a project-owned account on connections.manage by @markokraemer in #7366 chore(staging): bring staging to main (connector-creds, git-connection-logout, 48 commits) by @markokraemer in #7356 Release v0.13.23 — Per-call connector accounts, no more guessed account, an

From the release notes

Mutable DEV CLI build for 437f4a633d59e5f1d87aa16ebff346eb5feedd56. Install: curl -fsSL https://kortix.com/install | KORTIX_CHANNEL=dev bash Defaults to https://dev-api.kortix.com.

From the release notes

New Private provider key pools. Bring several keys for one provider, keep them private or share them with named members, and let each session hold its own key. Sessions fail over to the next key and report the earliest retry time when a pool is exhausted. Gemini and ChatGPT keys pool too, and pooled keys are managed in Models. Pool access is bound to the session owner, and a pool is checked against the model you actually picked. Print a whole conversation. Cmd+P prints the full session as a clean document — every message, not one clipped screen of the app. Queued prompts you can see and edit. Queued messages show in a list above the composer. Press Up to edit the last one, and Resume picks the queue back up. Microsoft Teams install reports what happened. One-click install publishes in the background, lands on Channels with a real status, and offers a retry with the actual reason when publishing fails. Astra is available as a ChatGPT subscription model. Improved Faster project boot. New sessions fetch the project from storage instead of cloning it, and start sooner. Faster session lists. A project's session list is now a page, not the whole inventory. Menus open instantly — menus, popovers, tooltips and the command palette no longer wait to appear. Smaller sandbox images, which start faster. Git connections are organized per account, with one instance backend and an identity that cannot drift. Verifying with GitHub no longer signs you out, and the new-connection screen always has a way out. Fixed Microsoft Entra directory sync. Patches apply atomically, large directories paginate, groups survive while a user is inactive or a sign-in session is stale, deactivation and single-member removal behave correctly, and users resolve across the whole directory. The gateway retries a slow internal call instead of answering "Gateway unavailable". Composer drafts survive session startup, and opening session settings no longer closes itself while the composer takes focus. One session lifecycle drain at a time per API task, so queued work is not claimed twice. Session attachments are more reliable, and model prices show correctly in the ChatGPT picker. Security hardening across session cursors, webhook signing keys, and the remaining high-severity scanner findings. Database migrations apply cleanly on staging and production. What's Changed fix(teams): one-click install publishes in the background, records its outcome, and shows it by @Ino-Bagaric in #7341 fix(api): run one session lifecycle drain at a time per API task by @sutharjay1 in #7343 fix(api): run one session lifecycle drain at a time per API task (staging) by @sutharjay1 in #7344 fix(git): verify-with-GitHub no longer signs out; /new is a git account manager with a way out by @markokraemer in #7330 chore(release): staging VERSION → 0.13.22 [skip ci] by @github-actions[bot] in #7347 chore(release): VERSION → 0.13.22 [skip ci] by @github-actions[bot] in #7348 Default pooled pro

From the release notes

New Print a whole conversation. Cmd+P prints the full session as a clean document — every message, not one clipped screen of the app. Queued prompts you can see and edit. Queued messages show in a list above the composer. Press Up to edit the last one, and Resume picks the queue back up reliably. Private provider connection pools. Bring several keys for one provider, keep them private or share them with named members, and let a session hold its own key. Sessions fail over to the next key and report the earliest retry time when a pool is exhausted. Gemini and ChatGPT keys pool too, and pooled keys are managed in Models. Astra is available as a ChatGPT subscription model. Improved Faster project boot. New sessions fetch the project from storage instead of cloning it, and start sooner. Faster session lists. A project's session list is now a page, not the whole inventory. Menus open instantly. Menus, popovers, tooltips and the command palette no longer wait to appear. Smaller sandbox images, which start faster. Git connections are now organized per account, with one instance backend and an identity that cannot drift. Fixed Microsoft Entra directory sync. Patches apply atomically, large directories paginate, groups survive while a user is inactive or a sign-in session is stale, deactivation and single-member removal behave correctly, and users resolve across the whole directory. The gateway retries a slow internal call instead of answering "Gateway unavailable". Composer drafts survive session startup, and opening session settings no longer closes itself while the composer takes focus. Session attachments are more reliable. Model prices show correctly in the ChatGPT picker. Security hardening across session cursors, webhook signing keys, and the remaining high-severity scanner findings. Database migrations now apply cleanly on staging and production. What's Changed feat(sandbox): bake rg, fd, bat, jq, fzf and a shell tool floor into every image by @markokraemer in #7264 refactor(sandbox): remove the fast cold boot image, its flag, and the experiments it gated by @markokraemer in #7268 test(release): dismiss the welcome card before Save in the repository-access journey by @markokraemer in #7276 fix(cli): connectors apps searches the Composio toolkit catalog by @markokraemer in #7277 feat(project-snapshot): S3 boot acquires the project 3.5× faster than Git (307 vs 1,078 ms) and boots 0.8 s sooner — presign at create, no HEAD on the boot path, kortixd gated on OpenCode's "server listening" by @DimitrijeGlibic in #7242 fix: restore terminal recovery and keep message retries in their session by @sutharjay1 in #7267 fix(usage): show zero cost for ChatGPT subscriptions by @markokraemer in #7278 chore(release): VERSION → 0.13.19 [skip ci] by @github-actions[bot] in #7285 fix: refresh terminal provider credentials after sandbox resume by @markokraemer in #7286 fix(session): isolate optional connector failures and preserve prompt qu

From the release notes

Fixed Projects with thousands of sessions no longer slow the app down. The session list now loads one page at a time — 50 sessions, with a Load more control — instead of returning every session on every refresh. On a project with 12,617 sessions that is a 46 KB response instead of about 11 MB, and the sidebar was refreshing it every five seconds. Opening, sharing, stopping, restarting or renaming a session now works however old the session is. These controls used to look the session up in the full list, so once a project grew past the first page the controls could quietly disappear. Improved Date grouping (Today, This week, Older), filters and search work as before, applied to the sessions you have loaded. A new database index serves the paged list, so a request no longer sorts every session in the project. Security The pagination cursor is encrypted and tied to both the project and the person viewing it. It cannot reveal a session they are not allowed to open, and it cannot be reused by anyone else. What's Changed Release v0.13.20 — Faster session lists in large projects by @github-actions[bot] in #7316 Full Changelog: v0.13.19...v0.13.20

From the release notes

Fix terminal connections that fail after a sandbox resumes because its provider credentials have changed. Refresh rejected provider credentials once for reads and discard stale credentials after a failed WebSocket handshake. Preserve application redirects and sandbox authentication errors. Do not replay writes when provider authentication fails. What's Changed chore(release): staging VERSION → 0.13.19 [skip ci] by @github-actions[bot] in #7284 fix: release provider credential recovery after sandbox resume by @markokraemer in #7287 Release v0.13.19 — Reliable terminal connections after sandbox resume by @github-actions[bot] in #7288 Full Changelog: v0.13.18...v0.13.19

From the release notes

Fixed Terminal opens on a stopped workspace. Opening Terminal requests a wake even before the first shell exists. Connection retries have a deadline and preserve shell output. Session switches keep message retries in the right workspace. Missing conversations stop repeated 404 or 410 requests without clearing cached history. Sessions keep their own agent. A session could be switched to an agent from a different project after a prompt that named no agent, which removed its access to connectors and the Kortix CLI. Every session now always runs as its own agent, and a session that was affected recovers on its next message. The first message on the home screen no longer gets stuck in the composer after a slow start. Project pages load cleanly. The project home shows the Kortix mark while it loads instead of a flashing placeholder. Session history is saved before a session stops, and responses from the in-sandbox model proxy are no longer returned in a corrupted encoding. Admin project list shows each project's own session counts. Customize settings show what you saved. After saving an agent or connector setting, a reload could show the previous value for up to a minute. Improved Connector activity uses consistent names. Connector calls appear as connector calls. Repository access is explicit. Agents now declare whether a session gets the project's files, replacing the older workspace modes. Older API clients keep reading restricted manifests correctly. Previews route correctly and set up shared sandboxes in isolation. Release checks are more reliable: preview environments use their own database, confirm the running runtime, and wait for completed agent artifacts before asserting on them. They also verify cold terminal wake and session-switch routing, allocate sufficient preview frontend memory, and check Docker readiness. What's Changed chore(release): VERSION → 0.13.16 [skip ci] by @github-actions[bot] in #7249 chore(release): VERSION → 0.13.17 [skip ci] by @github-actions[bot] in #7253 Replace workspace modes with explicit repository access by @markokraemer in #7240 fix(preview): a legacy HS256 session opens preview origins again by @markokraemer in #7258 fix(web): a timed-out first prompt no longer stays in the home composer by @sutharjay1 in #7254 fix(web): project home loading paints the Kortix mark, not a skeleton by @sutharjay1 in #7263 fix(api): session tokens no longer adopt another project's agent by @markokraemer in #7262 Release candidate: main 3e7d039 → staging by @markokraemer in #7266 chore(release): VERSION → 0.13.18 [skip ci] by @github-actions[bot] in #7269 chore(release): staging VERSION → 0.13.18 [skip ci] by @github-actions[bot] in #7270 hotfix(staging): editor manifest reads are fresh on every replica; release setup polls retry transport errors by @markokraemer in #7273 fix(web): connector tool calls say "connector", not "app" by @markokraemer in #7272 fix(api): Customize editor reads show the committe

From the release notes

Fixed Previews open again when you are signed in. A sandbox preview opened from a session (prod-p<port>-sbx-….p.kortix.com) showed "Sign in to open this preview" even though you were signed in. Sign-in tokens are still issued with the older HS256 signature while the published key set already holds the newer ES256 key. The API already verified those tokens with the auth server, but the preview gate refused them. It now makes the same check, so the preview panel, pasted preview links, and preview WebSockets open for the account that owns the sandbox. A forged or expired token is still refused, and a test now fails if any verifier caller handles these results in its own way. Internal The release gate quarantines TUN-6 on deployed targets only: Bun's WebSocket client sends no User-Agent, so the edge firewall refuses the tunnel handshake on staging and prod. The flow still runs locally. What's Changed chore(release): staging VERSION → 0.13.16 [skip ci] by @github-actions[bot] in #7248 chore(release): staging VERSION → 0.13.17 [skip ci] by @github-actions[bot] in #7252 test(release): quarantine TUN-6 — Bun WebSocket handshake has no User-Agent, WAF 403s it on staging/prod by @Ino-Bagaric in #7255 hotfix(preview): a legacy HS256 session opens preview origins again by @markokraemer in #7259 Release v0.13.17 — Signed-in previews open again by @github-actions[bot] in #7261 Full Changelog: v0.13.16...v0.13.17

From the release notes

New Project-level provider and model access controls. Owners and admins choose which model providers and which models a project may use, from one model management view that also holds provider links. Kortix managed models sit beside your own providers in the same list, a ChatGPT subscription shows its access beside its credentials, and the picker distinguishes "not shown" from "blocked" so a member sees why a model is unavailable. GPT-6 Astra is in the managed catalog. Select kortix/gpt-6-astra with image input, tools, and the supported reasoning efforts. Routing, prices, capability limits, and sandbox fallbacks are all in step. The desktop app always has a way out. The shell has no browser toolbar, so a page without an in-app exit was a dead end. Every such page now has Close, the Go menu has Back (Cmd/Ctrl+[) and Home (Cmd/Ctrl+Shift+H), a renderer crash offers Reload or Go Home instead of an empty window, and the Electron route allowlist now matches the web middleware's exactly. Improved One noun: project. The interface said "workspace" while the SDK, CLI, API, routes, manifest, and docs all said "project". Screen copy now says project in every one of the nine languages, each with its own word rather than a find-and-replace. The sandbox /workspace directory, the manifest's per-agent workspace: boundary, and Slack workspaces keep their names. Create a project in a specific account. The Switch project menu, already grouped by account, gains a "Create a project in {account}" row for each account where you are an owner or admin, including accounts that have no projects yet. The old global link never said which account it would land in. The SSO and SCIM setup wizards work again. Picking a provider did nothing, and Back or the step rail snapped you to the first step with a render loop in the console. Both are fixed, and a browser journey now walks every step of both wizards on every deploy. Tunnel file transfers are verified end to end. Binary files sent through the Computer Tunnel are checked by digest at the destination, an approval for one exact file no longer grants its parent directory, permission decisions are serialized so an approve and a deny cannot both win, and orphaned upload tasks are stopped. Fixed The sandbox model proxy asked upstream for compressed responses and could not decode them. It now requests identity encoding, so a session on a model that answered with zstd no longer fails its first turn. Internal Project snapshot config provider v2 (S3). Sessions can boot from a prebuilt, blob-less snapshot of the project's committed tree with the history hydrated off the boot path, falling back to Git when no snapshot is ready. Every environment gets a private snapshot bucket and the task-role grant; only staging names its bucket, so production sessions keep the Git path until the in-region measurement lands. The project-snapshot task role gets s3:ListBucket, so a missing object is a 404 and not a denied build, and the grant

From the release notes

New Review Center is on for every project. It is no longer behind a feature flag — the routes, registry, contract, web surfaces, CLI, and docs all ship it by default. A public App can recognise you. public used to mean both "anyone with the link may open this" and "nobody is ever recognised". Now an App you share outside your company still greets your own team, shows them the controls a visitor should not see, and records who acted. Improved Creating an account is reachable again, and it lands you in the account you created. The control had no live entry point, and the one path that reached it dropped you back where you started. There is now a "Create an account…" row in the workspace switcher, and creating an account opens its first workspace with that account selected. Connector categories show their true size. The catalogue counted one page of results and headed every category with "· 1". Categories are now grouped over the complete catalogue on the server, and "View all" filters to the set its heading counted. Secret intake forms read better. Field hints written by an agent become real links, every non-form step shares one status notice, and the header no longer runs under the close button. Modals opened over modals stack correctly. A modal opened while another was open could render underneath it; it now takes the layer above, and the switch control meets contrast in both themes. Session hover cards line up. Sessions carrying a Slack, schedule, or shared marker opened their card inset from the sidebar edge; every row now anchors at the same place. Fixed Sending a message no longer makes the transcript jump twice. An idle send moved the view down and then glided it back. The send is now recognised as the working turn, so the view moves once. Internal 4xx denials are logged as warnings, not errors. Roughly 43% of production error-level lines were expected denials — expired tokens, a project-scoped token refused a cross-project read, an agent missing a grant — which buried real faults. Severity now follows the status class; the lines stay queryable and Sentry behaviour is unchanged. A dropped audit batch now says why. The log recorded the whole failing statement plus its bound parameters — IP addresses, user agents, account and project ids — while hiding the SQLSTATE that distinguishes a transient timeout from a permanent constraint violation. It now reports the code and cause, with no statement text and no parameters. A forced test exit raises a workflow annotation instead of a line buried in a 40,000-line CI log. The staging deploy asserts the host-only access cookie from main, matching what staging already checked. What's Changed feat(apps): a public App can recognise you without shutting anyone else out by @markokraemer in #7197 chore(release): staging VERSION → 0.13.15 [skip ci] by @github-actions[bot] in #7211 chore(release): VERSION → 0.13.15 [skip ci] by @github-actions[bot] in #7212 fix(web): stack modals opened over