github Skyvern-AI/skyvern v1.0.48
Release v1.0.48
on GitHub

5 hours ago

What's Changed

Version bumped from 1.0.47 to 1.0.48

Recent Changes

  • Bump version to 1.0.48 (#8031) (6195ac8)
  • SKY-10678 Let a diagnosis turn repair the run it just read (#8053) (80aa339)
  • Use the saved login someone picked, instead of asking for it again (SKY-13483) (#8052) (6077d6f)
  • Refuse non-http(s) navigation URLs before consulting DNS (SKY-13070) (#8051) (cd68bdb)
  • Revert "Enforce administrator roles on sensitive organization APIs" (#8050) (77bc9b8)
  • Enforce administrator roles on sensitive organization APIs (#8047) (7104034)
  • test: preserve SKY-13495 review coverage in the OSS-synced tree (#8046) (7f653f1)
  • Validate browser navigation destinations (SKY-13070) (#8045) (11f7dfa)
  • Stabilize screencast timeout test (#8044) (d0606b7)
  • fix(SKY-13502): report a closed browser session as closed instead of high demand (#8043) (3e4efaa)
  • Validate navigation destinations in the MCP browser tools (SKY-13070) (#8041) (bddfabc)
  • Prefer the Playwright error name in tab-open failure reasons (SKY-13338 follow-up) (#8042) (b337820)
  • Validate caller-supplied CDP addresses and withhold the org key from remote endpoints (SKY-13067) (#8039) (3ee6165)
  • Require explicit cloud URL opt-in (#8038) (382d13e)
  • Validate deployed script content before persistence (SKY-13066) (#8037) (701f0a8)
  • Give each code-block engine its own failure reason when it cannot open a tab (SKY-13338) (#8036) (4474620)
  • fix: emit copilot session ID in CodeBlock logs (#8035) (6442cdc)
  • Retry a CodeBlock browser session that times out starting instead of failing the run (#8034) (d961500)
  • Open a tab when a code block's browser session has none (SKY-13338) (#8033) (78ef1de)
  • Stacked: cross-process PBS reads (SKY-13473), fail-closed script execution, vendor teardown budget (#8032) (b416fd4)
  • Carry the typed CodeBlock runner error code onto the block result (SKY-13469) (#8030) (8a28e97)
  • Return the number a user asked for, not the one beside it (SKY-13226) (#8029) (2401cbc)
  • Fix email OTP code persistence, expected-type enforcement, and sign-in link recall (#8028) (ec51e28)
  • fix: reap browser sessions whose runnable owner type cannot be resolved (#8027) (2ce6771)
  • Show a searchable org-credential picker for copilot credential asks (SKY-12832) (#8026) (1ee85ab)
  • fix(SKY-13415): hide the copilot rollup chevron when expansion adds no content (#8025) (a565494)
  • Restore the message field and organization_id on foreign stdlib log records (#8024) (db63d8e)
  • Freeze the wall clock in the select-option widened-shape test (SKY-12634) (#8023) (81ee16e)
  • Fix MCP-created sessions for code-only workflows (#SKY-13338) (#8022) (4089324)
  • Capture downloads from adopted vendor browser sessions (SKY-13263) (#8021) (f4e6322)
  • fix: keep second status batch unbounded in workflow status response (#8020) (68e8f31)
  • Retain vendor browser recordings after session teardown (SKY-13262) (#8019) (05bc544)
  • Fail fast on oversized workflow branch context (#8016) (7f4d1f3)
  • limit workflow status fetch concurrency (#8018) (af84c03)
  • Drop never-deployed CDP route env overrides and share one rollout gate (#8017) (84632e8)
  • Persist vendor live-view metadata securely (#8014) (f92fd03)
  • Route script-assist LLM calls through the per-prompt model config flag (#8015) (ac96c71)
  • Skip the empty-downloads S3 LIST fallback for post-cutover runs (#7983) (68254ba)
  • Pin vendor identity non-disclosure across customer-facing surfaces (SKY-13266) (#7990) (9a17502)
  • Return a card-connected credential as a typed id and bind its login origin (SKY-13432) (#8013) (7abc725)
  • Register OpenAI-direct and Azure GPT-5.6 rates from separate tables (#8011) (e9887bd)
  • Bound LLM provider calls on the direct client path with a real wall-clock deadline (#8010) (6019b41)
  • Shared destructive-confirm dialog primitive + standardized wording (SKY-12989) (#8009) (7b1b0ac)
  • Add atomic one-shot browser effect approvals (#8008) (0f0ac70)
  • Recover adopted-session statement downloads from live and transient PDF blobs (SKY-12621) (#8007) (e7266fb)
  • Give recorded and compute-generated code blocks the new code block shape (SKY-13185) (#8006) (8f02aad)
  • Scope the Copilot sandbox gate to code-bearing drafts and make the refusal terminal (#8005) (a82b1ab)
  • Revert "Block internal navigation hops before the browser follows them (SKY-13377)" (#8004) (ee52227)
  • Recover soft-deleted Key Vault secrets before updates (#8003) (34c6eb7)
  • Resolve the login-block credential the same way at run setup and mid-run (#8002) (4416027)
  • Exclude login-cookie sidecars from fresh browser profiles (start_fresh cross-org leak) (#8001) (83e353c)
  • Show the centered loading indicator while a run resolves (SKY-13416) (#8000) (5266882)
  • Keep the copilot Explore phase active while the scout is still logging in (#7999) (39b9e2a)
  • Move New profile to the top of the browser-profile dropdown (#7998) (1186193)
  • Probe inherited-browser transport liveness before reusing a page-less browser (#7997) (6467bc1)
  • Execute the deterministic custom-select collapse for input_text entries with strict entry-scoped verification (#7996) (be29a33)
  • feat(SKY-12845): credential run-sequentially toggle in edit UI (#7995) (41a1f61)
  • Block internal navigation hops before the browser follows them (SKY-13377) (#7992) (7f72c33)
  • Add live view to the browser infrastructure capability table (#7991) (a73776a)
  • Resolve the effective form action once and stop nested budget replenish (SKY-12875) (#7989) (12572d0)
  • Bound destination-fact resolution work and re-enable capture (SKY-12875) (#7988) (5696727)
  • fix(SKY-13101): documented webhook verifier now rejects forged signatures (#7987) (dd2b6bb)
  • Revert "Add flag-gated skip of the check-user-goal LLM call for cached-script runs" (#7986) (23ad5c7)
  • SKY-13100 Bound gzip decompression in browser recording processing (#7985) (1ab4455)
  • SKY-13097 Apply billing + rate-limit guards to task endpoints (#7984) (b600f4a)
  • Deliver the MCP user-agent header so MCP-triggered runs persist trigger_type=mcp (#7982) (9fe888e)
  • Bind terminal persistence and webhook callbacks (SKY-12887) (#7980) (682692e)
  • Fix browser session download fail-silents (SKY-13385) (#7979) (e945a96)
  • Fail run closed when the CodeBlock auto-provisioned browser session cannot be created (#SKY-13334) (#7978) (bcb36c5)
  • Add flag-gated skip of the check-user-goal LLM call for cached-script runs (#7977) (35bc570)
  • Return standalone (dedented) code from the MCP code-block synthesize tool (#SKY-13336) (#7976) (fa6646d)
  • fix(SKY-13335): emit secure CodeBlock runner telemetry on the success path (#7975) (fb993c7)
  • fix(frontend): stop reporting GitHub star-count rate-limit as a client error (#7974) (46a451e)
  • SKY-13353 Follow Copilot test runs in Live Browser (#7972) (ebff937)
  • Constrain DOM reads and inventory browser-effect sinks (#7971) (ed7b893)
  • Bind protected references to trusted consumers (SKY-12876) (#7970) (06746c0)
  • Document unbound credential denial and remove the credential-fill test shim (#7969) (2f1e15e)
  • Let organizations default their runs to custom Smart/Fast LLMs from settings (SKY-13343) (#7968) (84f3da0)
  • Bind credential fill to the live page origin (#7967) (fdb42f3)
  • Bind the URL-matched saved credential when the agent observes a login page (SKY-13293) (#7966) (0b9190e)
  • Validate shared browser navigation destinations and revalidate redirect hops (SKY-13112) (#7962) (8621363)
  • Redact bearer auth headers and serialized payloads from error logs (SKY-13195) (#7961) (5b9fe2f)
  • fix(SKY-13182): recover a live tab-less inherited browser instead of orphaning it (#7960) (aea531f)
  • Use the existing runaway guard for the download-handler wait timeouts (#7958) (3e48383)
  • Add per-workflow Mask Secrets advanced setting (SKY-11822) (#7955) (68f9764)
  • Downgrade setup_workflow_run client-4xx failures from error+traceback to warning (SKY-13284) (#7954) (5dc96d2)
  • fix(tasks): cancel-button gating, webhook-replay runId, google-oauth valid flag (#7953) (248e1d1)
  • fix: log per-poll OTP webhook fetch failure at warning not error (#7952) (c80b8cb)
  • Materialize the updated row before commit so artifact URI writes stop raising MissingGreenlet (SKY-13354) (#7951) (49b3d8d)
  • Add LLM experiment launch gates: OpenRouter provider routing, pinned DeepSeek 0731 key, multi-arm analyzer (#7950) (2ffdfcc)
  • Add a Gemini API flex-tier config for gemini-3.1-flash-lite (#7949) (ab7e2d9)
  • fix(credentials): delete-path follow-ups from #14215 review (SKY-13271) (#7946) (d025fb2)
  • Fix Cmd+V paste into the VNC live browser stream on macOS (SKY-13324) (#7944) (bc661cb)
  • Expose 1Password and Bitwarden MCP endpoints (#7945) (d95ee2b)
  • Attach at-failure screenshot and final URL to failed code blocks (SKY-13250) (#7943) (ccc2ee5)
  • Count the two-state wait as an observation (SKY-13252 follow-up) (#7942) (ed76dae)
  • Let an MCP agent wait on two page states at once (SKY-13252) (#7941) (3891f4c)
  • Redact secrets in run artifacts: HAR/console scrubbing, LLM-boundary redaction, visual input masking (SKY-11822) (#7940) (5f3062d)
  • Route non-mutating requests to answer-only Copilot turns (#7939) (95c5d7c)
  • Route reasoning_effort via extra_body on the partner-hosted DeepSeek config (SKY-12750) (#7938) (7314bea)
  • Split login from data extraction when the scout demonstrated a credentialed flow (#7934) (16b2efa)
  • Tell the user when a copilot turn runs out of time, and log every timeout (SKY-13249) (#7927) (06938f9)
  • Report code-block browser failures by their real cause, not as unsupported operations (#7913) (f076b0c)
  • Deliver the download instead of shipping a draft the build test disproved (SKY-13230) (#7914) (4bb0105)
  • Keep a Copilot turn in the chat when the server restarts mid-turn (SKY-13205) (#7911) (e3e1f93)
  • Reconcile the strict synthesis partition at one accounting point (SKY-13207) (#7909) (d999952)
  • SKY-13245 Add Magic Link tab to the Credentials page (re-land) (#7908) (1b346bf)
  • Increase loop block iteration limit from 500 to 1000 (SKY-13310) (#7907) (0dc37aa)
  • SKY-13244 Select a connected email account as the 2FA identifier (re-land) (#7905) (330f1cf)
  • Overlay the hover drag grip on the block card gutter instead of reserving header space (SKY-13289) (#7904) (b860f38)
  • Stop a Python comment from killing an entire code block (SKY-13300) (#7903) (5b75e3f)
  • Recover adopted-session blob downloads by reading bytes at the download event (SKY-12621) (#7902) (fbbbca3)
  • SKY-13243 Generalize 2FA email scanning into a source registry with Outlook support (#7901) (80f2dcb)
  • API docs sync: cap browser session lifetime at 4 hours (#7887) (c48bc2f)
  • Copy icon on hover for every JSON tree viewer node (SKY-13286) (#7900) (a2fcc2e)
  • Parse ZIP unzip-only: File Parser always outputs extracted file list for ZIPs (SKY-13279) (#7899) (7855da6)
  • Match the Azure OpenAI host, not a URL substring (#7898) (f5eb24b)
  • build(deps): non-default rustwright dependency group + lock guard (RUS-5) [R1] (#7870) (8f856f6)
  • Copilot: credit working runs and retire the authoring guards that failed them (#7845) (870d61c)
  • Make Copilot GPT-5.6 cache writes reusable and observable (#7888) (5cb87a6)
  • Give copilot-written sign-in code time to load a slow page (SKY-13208) (#7885) (8ec0c37)
  • fix(RUS-5): preserve pinned selection in handler cleanup paths (#7879) (4f43310)
  • Resolve Copilot credentials when the login page appears, not only at turn start (SKY-13200) (#7878) (3c201c6)
  • Report Copilot test-run failures honestly, and remember ones no later run retried (SKY-13206) (#7873) (479da06)
  • SKY-13202 Let the copilot see connected Google and Microsoft accounts (#7871) (e197cc9)
  • Show what the copilot actually did in its activity feed (SKY-13203) (#7869) (7d0370e)
  • SKY-13134: deploy lightweight worker in automatic staging rollout (#7868) (e7ed6f7)
  • fix(openapi): remove orphaned raw TOTP response component (#7867) (786874d)
  • feat(SKY-12845): serialize workflow runs by credential (core, non-scheduled) (#7865) (7df5bad)
  • feat: enable raw OTP fallback by default, remove TOTP_RAW_FALLBACK_ENABLED (#7866) (b670a1e)
  • Collect complete rows from server-windowed virtualized grids (#7863) (436a840)
  • fix: ignore unresolved OTP placeholders (#7859) (c459166)
  • fix(RUS-5): classify page boundary engine errors (#7861) (60ccd70)
  • Restore a local dev path for copilot code-block test runs (#7856) (aab2a29)
  • [SKY-12229] Bump mistune to >=3.3.0 for CVE-2026-49851 (#7785) (682cf7f)
  • feat: support browser session startup URL (#7029) (8934cf8)
  • Scope the task generation cache to the requesting organization (SKY-13102) (#7844) (363b58c)
  • fix(RUS-5): thread selected browser engine into remaining elements (#7843) (a306395)
  • Route scheduled-run finalizers to the derived run id; classify non-timeout activity failures (SKY-12983) (#7842) (7aae240)
  • Fix sequential child runs failing with missing browser page (SKY-13182) (#7841) (314799c)
  • Render Google Sheets destination dropdown options as single A - Header lines (SKY-13180) (#7840) (8496b93)
  • fix(RUS-5): thread selected engine through handler readbacks (#7839) (e2d213a)
  • Clarify browser session defaults and CAPTCHA solver trade-offs in docs (#7836) (f322b48)
  • Read adopted-session blob downloads from every open browser tab (SKY-12621) (#7838) (0c243ea)
  • migrate handler.py canary-critical error catches to selected-engine APIs (SKY-12007) [R6] (#7835) (fe745cf)
  • fix(SKY-12735): preserve open ARIA popups from screenshot-scroll dismissal (#7837) (5e8200f)
  • fix: preserve unparsed OTP content for agent-time resolution (#7834) (1ffc889)
  • SKY-12543: Guard checkbox label fallback from interactive descendants (#7833) (162b27f)
  • Polish studio run pane failure UX (SKY-13141) (#7830) (d9f80eb)
  • Redact secret values from exception text at the reporting seams (SKY-12626) (#7832) (6bc77b8)
  • Revert defineProperty export helper to plain assignment in injected-script wrapper (SKY-12875) (#7831) (311e045)
  • Route download.path() awaiters through shielded resolve_artifact_path (SKY-12982) (#7829) (88a702a)
  • Validate destinations on two unguarded browser navigation paths (SKY-13113) (#7828) (ed81c43)
  • Show complete six-digit labels on the run outcomes chart (#7783) (50a2928)
  • Classify closed browser targets during screenshot capture (SKY-12906) (#7795) (fe40a00)
  • Delete the copilot repair ceiling: a stuck repair is reported, not a reason to end the turn (SKY-13108) (#7802) (27491c0)
  • Fix failing compute-task safety test on main (#7800) (4e5d6e8)
  • Fail the run-timeline query when the API returns a non-array payload (SKY-13162) (#7827) (0da06fe)
  • Validate the create-from-prompt response shape at the boundary (SKY-13154) (#7826) (6d0d31a)
  • Stop the unsaved-changes dialog from exiting its navigation blocker twice (SKY-13124) (#7825) (de44f84)
  • Stabilize download handler timing tests (#7803) (9e565c4)
  • SKY-13109 Give block authoring the steps the copilot's scout already demonstrated (#7805) (dc0f0ef)
  • SKY-13104 Report page controls the copilot can actually act on (#7806) (10fb044)
  • Stop logging an expected analytics serving-table absence as an error (#7824) (575dab2)
  • Stop logging closed browser targets as screenshot errors (SKY-13058) (#7823) (082668c)
  • SKY-13107 Refuse to type a saved credential's secret into a page field (#7807) (0dd0f6a)
  • Stop rationing copilot page inspection and show the page after acting (#7808) (6c5426a)
  • Fix finally block failure propagation (SKY-13122) (#7809) (9ae2e79)
  • Fix end timestamps in code-only runs: finalize uploaded recordings, stamp action times (SKY-13145, SKY-13142) (#7814) (5c5ba71)
  • Let normal-select reach 100% without breaking sibling select experiments' control groups (#7815) (6b6ec53)
  • Make row actions visible with a shared kebab + context-menu component (SKY-12955) (#7816) (19d59d2)
  • Hide Tags, Scripts, and Custom LLMs sections from the API reference (SKY-13151) (#7817) (9502e57)
  • Persist webhook_failure_reason when webhook delivery raises, and name the exception in delivery logs (#7818) (962315e)
  • Reap orphaned upstream browser sessions from outside the process that holds them (SKY-13158) (#7821) (f7dd9b8)
  • Reject knowably invalid Bitwarden item IDs at workflow run creation (#7819) (792c4b2)
  • Report element-tree share and actual drop count when a prompt exceeds the token ceiling (SKY-12350) (#7820) (bfb0faf)
  • Raise cloud storage block limit to 300 files (#7793) (f413ffe)
  • Copilot acts on a page by selector only, and reports why an action failed (#7792) (bb2649d)
  • SKY-13032 Copilot: only three named checks may refuse to save a workflow; delete the rest (#7791) (5189b7f)
  • Cap screenshot and recording URL lifetime at one hour (SKY-12527) (#7788) (24ca0b3)
  • Eval dashboard: difficulty pills, perf-vs-cost quadrant, copyable task titles (#7799) (5ad1e11)
  • SKY-11100: add compute task-type to task_v2 (code-as-action synthesis) (#7798) (c46b500)
  • fix(log-noise): downgrade expected frontend-disconnect in message channel stream (#7759) (0d88589)
  • Allow clicking through conditional branches in read-only workflow canvases (SKY-12861) (#7758) (99e0e76)
  • Fetch a sign-in code from an email address alone, keeping code-vs-link (SKY-13031) (#7756) (a2ca8e6)
  • Let copilot exploration solve login CAPTCHAs via the shared solve ladder (SKY-12967) (#7755) (f3906e6)
  • migrate dom.py catch sites to selected-engine error identity (SKY-12007) [R5] (#7812) (366d5be)
  • feat: backend activity-driven persistent browser session lease renewal (SKY-10833, SKY-13045) (#7813) (57cf308)
  • Route CDP retry/connection classification through the selected engine (RUS-5) (#7810) (a754c05)
  • Route page.py evaluate/context-loss recovery through the selected browser engine (RUS-5) [R4a] (#7811) (e5a37c9)
  • Bind richer per-selected-engine browser error families (RUS-5) (#7801) (3746821)
  • Stream large captured downloads to disk instead of replaying the body (SKY-12642) (#7804) (b353703)
  • Clarify destination-fact security constraints (#7780) (d416c54)
  • SKY-13000 Copilot: a plain single-value extraction verifies as success instead of "not independently verified" (#7779) (e995e87)
  • SKY-13105 Bound the page read that could hang an entire copilot turn (#7796) (be051ad)
  • Temporarily disable destination-fact capture to stop resolved-URL amplification (SKY-12875) (#7770) (33b6c9a)
  • Cap sensitive-artifact TTLs in storage presigned URLs too (SKY-12527) (#7789) (ab469cc)
  • CI fix: restore monotonic-clock stabilization reverted by #7794 (#7797) (5862cd2)
  • SKY-13030 Copilot: work out which email address to sign in with instead of demanding a password that cannot exist (#7761) (5001bbf)
  • fix: log best-effort error-detection fallbacks at warning not error (#7760) (6ac5868)
  • feat(browser-firewall): hydrate destination facts for forms, tabs, and dialogs (SKY-12875) (#7767) (3fa1f81)
  • Copilot: stop discarding saved drafts for reasons the save path only steers on (SKY-13125) (#7794) (42e208a)
  • Route Workday login to the agent; keep fill/submit deterministic (SKY-12657) (#7778) (23ebe8c)
  • Compatibility hotfix: put the input-text runtime hint on the base Action model (SKY-13013) (#7777) (7f5f557)
  • Repair malformed MCP list and timeout arguments (#7765) (ffb5e89)
  • SKY-13061: reach reCAPTCHA v2 anchor inside its frame (#7787) (82fa4ff)
  • Store blank OTP run-scoping ids as NULL instead of empty strings (SKY-13060) (#7784) (8cceb6e)
  • CI fix: stabilize test_paused_loop_does_not_trip_total_timeout_on_resume (#7786) (893f2fa)
  • SKY-12981: invalidate a failed loop block's output to prevent stale prior-iteration reuse (#7775) (d37078a)
  • Classify non-script post-dispatch click timeouts by selected engine (RUS-5) (#7772) (91dcd2a)
  • Recover blocked inline PDF downloads when no download event fires (#7774) (0bb8411)
  • Type into the nested input when a card field's wrapper isn't directly fillable (SKY-12448) (#7773) (22f23de)
  • Bound Redis connect-retry cost and fail open on the browser-address quarantine path (#7766) (8e3b40a)
  • fix(log-noise): downgrade handled screenshot-timeout from error to warning (#7757) (bc396d0)
  • Add Claude Opus 5 as a selectable model (SKY-13026) (#7741) (3a3340c)
  • SKY-12945 Copilot: route the code-authoring guardrail's give-up into the accept-or-build step (#7740) (26f1f93)
  • Stop banning evaluate in Copilot-authored code blocks; fail closed on unparseable drafts (SKY-13043) (#7754) (86f5b83)
  • Add a pure, fail-closed policy core for browser actions (#7753) (1dfc4c9)
  • SKY-12974 Copilot: stop rejecting a saved credential at author time; redact at the log and database seams (#7751) (44029da)
  • Charge 10 credits per OTP-code parse (#7750) (d43eb5d)
  • security: bump auth-stack, next, sharp, brace-expansion, postcss, jupyterlab (Dependabot) (#7747) (c074454)
  • Sync OpenAPI reference from production (#7749) (063b424)
  • security: bump body-parser to 1.20.6 to fix two Dependabot alerts (#7626) (d77df0f)
  • Remove docs/pr-screenshots (internal PR evidence, not docs) (#7744) (402dab6)
  • Scan tests/unit for the url-substring anti-pattern before it reaches OSS CodeQL (#7743) (29542fd)
  • fix(SKY-12998): route verified copilot fixes through the review gate (#7739) (f8c2cf7)
  • Remember the target site across turns, including after a cancel (SKY-12968) (#7737) (f94709f)
  • Stop video-path future poisoning from killing workflow activities and finalize interrupted runs (SKY-12852) (#7723) (55315eb)
  • docs: serve documentation media from jsDelivr (SKY-12977) (#7722) (d064e71)
  • Remove 34 unreferenced documentation media files (#7721) (2d94859)
  • Keep Copilot tool calls paired during context pruning (#7719) (5c19779)
  • Gate AI-fallback completion for the Workday submit block (SKY-12992) (#7718) (8618771)
  • Add an always-on per-iteration TODO list to the copilot agent prompt (#7717) (cfafaae)
  • Use current credential scope in deferral gates (#7716) (a137cbe)
  • SKY-12957 Copilot: stop asking the user to confirm outputs the request contract already pinned (#7715) (fdeb748)
  • SKY-12917 Make Copilot credential resolution exhaustive (#7714) (3902e23)
  • SKY-12933 Copilot: build the login step from what the scout demonstrated (#7713) (bcf7430)
  • Workday submit: require positive confirmation before marking submitted (SKY-12657) (#7712) (2360de1)
  • Let Copilot use credentials saved without a login URL (SKY-12959) (#7711) (808ef71)
  • Classify cached-script timeouts by selected engine (RUS-5) (#7708) (35bb60d)
  • Classify incremental-tree analysis timeouts by the run's selected browser engine (RUS-5) (#7710) (6c59fa1)
  • Classify vendor CDP errors by selected engine (RUS-5) (#7709) (15a28eb)
  • Classify code-block heal errors by selected engine (RUS-5) (#7707) (daa2505)
  • Resolve the output-contract pass path through the single actuation resolver (SKY-12907) (#7706) (de8c2b3)
  • Remove retired Fern documentation and media (SKY-12972) (#7705) (0e793da)
  • Bound feature-flag flip staleness to snapshot sync (SKY-12962) (#7704) (7937156)
  • Save the workflow instead of giving up when Copilot already found the value (SKY-12907) (#7703) (d95cf91)
  • SKY-12918 Copilot: remember the site from the first message when a follow-up doesn't repeat it (#7701) (8ed9fcc)
  • Log the copilot terminal render decision per turn (SKY-12853) (#7700) (44a693c)
  • SKY-12916 Let Copilot safely continue through login and verification pages (#7699) (f1d2ec8)
  • Deduplicate the MCP block walk and store empty code block goals as NULL (#7698) (90ba93b)
  • MCP-created code blocks default to the new code block editor experience (#7697) (54ad287)
  • Stop replaying custom-select clicks that may have already changed the page (#7696) (09d2ff4)
  • fix(SKY-12864): tell MCP agents when code-only rejections come from org policy (#7693) (c547801)
  • Stop PBS OTLP span-export error bursts caused by brief node-local collector blips (SKY-12925) (#7694) (6566255)
  • SKY-12858 Copilot: list the steps a draft workflow is missing, and add them back after repeated omissions (#7695) (3a7746f)
  • Route unsafe checkbox blockers through verified fallback (#7692) (25ea3e2)
  • Classify scrape timeouts by the run's selected browser engine (RUS-5) (#7691) (f40153a)
  • fix(SKY-12641): give the LLM clear no-file-download feedback (#7690) (a49b8a8)
  • Keep real passwords out of generated login code, and stop endless safety-check retries (SKY-12866) (#7689) (918f553)
  • SKY-12733 Stop correct “no” answers from failing completed workflows (#7688) (d0fe4dd)
  • Render the copilot terminal reply from the finalized outcome envelope, behind a flag (#7681) (1f55e4a)
  • SKY-12415 Keep date-driven row selection stable as lists change (#7686) (7bc4913)
  • Let Copilot finish a login it was allowed to start (SKY-12867) (#7684) (0d83e89)
  • Copilot uses a saved credential matching the login site automatically; credential create/update APIs accept tested_url (#7683) (c9aabd3)
  • Copilot chat reads run-outcome facts from the terminal envelope (SKY-12853 FE) (#7682) (60b540c)
  • Re-authenticate an expired integration connection in place (SKY-12572) (#7680) (b6af277)
  • Only upload live-view screenshots while someone is actually watching (#7677) (9af227c)
  • Add a screenshot side-effect hook to the CDP proxy: capture core, config source, artifact sink (#7676) (964f21f)
  • Route vendor hosted-browser sessions through the CDP proxy behind a flag (#7675) (2d0a6f6)
  • Resolve ambiguous typing targets before input (SKY-12707) (#7674) (8fb6403)
  • Truthful stop copy and honest run-outcome rendering in copilot chat (#7673) (0cf768e)
  • Sync OpenAPI reference from production (#7672) (118f77c)
  • Assemble a shadow terminal outcome envelope per copilot turn (#7671) (17fc4ea)
  • SKY-12564 Parameterize witnessed account and month in download filenames (#7670) (70a6d3a)
  • feat(SKY-12843): eval dashboard screenshot gallery with per-step narration + rubric breakdown (#7669) (9d9f04c)
  • Wait for disabled controls before browser actions (SKY-12518) (#7665) (22579ef)
  • Bound workflow copilot debug HTML before prompts (#7664) (38324a0)
  • Add a Past Runs tab to Studio and label the run pane "Run: wr_…" (SKY-12796) (#7667) (7f12a9d)
  • fix(SKY-12416): re-resolve visibility after navigation (#7666) (a6d9f15)
  • fix(SKY-12848): ignore unmatched VNC touch releases (#7663) (8ef5ec6)
  • feat(SKY-12794): keep studio Code a run-view tab; editor Visual/YAML as shared toggles (#7662) (e90e8fb)
  • Deterministic Workday script: fix widget fills + offline regression suite (SKY-12657) (#7661) (8dbb031)
  • fix(SKY-12831): co-locate copilot run-tool narration + name unmapped tools (SKY-12385) (#7660) (b1a907e)
  • Show the test-run count on the copilot not-confirmed checklist stub (#7659) (d49aa76)
  • Classify auth-gated Copilot actions as login intent so the credential prompt fires at turn start (#7658) (b41fe71)
  • Make the copilot's terminal credential ask recoverable (#7656) (6b53bde)
  • Fall back select-verification prompts to the secondary LLM instead of the main model (#7657) (732e461)
  • Show an instant rotating placeholder in the copilot chat after send (#7655) (e1db603)
  • feat(SKY-12835): responsive StatusBadge — collapse to icon-only under container width pressure (#7654) (6628d13)
  • Classify element screenshot capture failures (SKY-12519, SKY-12517, SKY-12477) (#7653) (c5e5df5)
  • Show human-in-the-loop approve/reject buttons in both run views (SKY-12802) (#7652) (495163f)
  • Capture inline data URL downloads as files (#7651) (80da8ad)
  • Handle optional custom-selection misses gracefully; keep required misses typed (SKY-12678, SKY-12631, SKY-12514, SKY-12700) (#7650) (61d3399)
  • fix(copilot): converge repeated metadata rejects (SKY-12763) (#7649) (e4adab0)
  • Keep a credential named earlier in the conversation approved when the user confirms (SKY-12812) (#7648) (3c8fb0a)
  • Bind per-run browser engine's error families to its selection (#7647) (b782251)
  • feat(SKY-12773): show created/queued/started/finished run timing in the Studio run summary (#7646) (534029a)
  • Keep copilot test-run action rows visible at the terminal turn (#7645) (a540d3b)
  • feat(SKY-12798): render the studio run view at /runs/{wr} (#7644) (1f51942)
  • Render Workflow Studio run-view block prompts as prose, not code (SKY-12797) (#7643) (2569a02)
  • feat(SKY-12792): cue the studio title as a link to past runs (#7642) (9e52729)
  • perf(frontend): drop duplicate run-status poll on run view (#7641) (1c343fc)
  • Remove the outputs indicator dot from the Studio v2 Outputs toggle (SKY-12793) (#7640) (f15056e)
  • test(guard): close aliased ImportFrom submodule bypass in browser-object identity guard (#7639) (8a1274d)
  • fix(SKY-9971): bound transient download observation gaps (#7638) (6820670)
  • Recover and classify stale frame/element targets in typing and frame resolution (SKY-12618, SKY-12558) (#7637) (6836b25)
  • fix(SKY-12710): scope domUtils.js injection to avoid page global collisions (#7636) (4a492b8)
  • fix(SKY-12817): support hover instructions in single-action task parsing (#7635) (0795160)
  • test(SKY-12575): cover delimiter-broken JSON in the LLM href-render repair path (#7634) (0ebce51)
  • fix(SKY-12786): lower expected CDP frame publisher logs (#7633) (5ed9a5d)
  • Keep required steps in generated browser workflows (#7632) (950990a)
  • fix(SKY-12743): add opt-in popup grace for file-download clicks (#7631) (ce21fea)
  • SKY-12732: Stop the copilot from putting real passwords into generated login code (#7630) (85dd46a)
  • SKY-12760: Ask for login credentials at turn start, not end-of-turn (#7629) (00000b8)
  • SKY-12811 Let the copilot keep exploring until it finds every value the request asked for (#7628) (169407c)
  • Supersede stale markerless pinned scripts with the current static module (SKY-12657) (#7625) (b0c6640)
  • security: bump body-parser, dompurify, fast-uri, pyasn1, setuptools to fix 11 Dependabot alerts (#7627) (3e16016)
  • Resolve Copilot bare-word entrypoints from verified evidence (#7624) (e1789f9)
  • workday runs onto the deterministic script (#7622) (cf0efa9)
  • eval.skyvern.com improvements (#7615) (b351024)
  • fix(SKY-12490): retry profile creation when startup sweep tombstones a freshly locked dir (#7621) (1d66418)
  • Revert "Replace the Workday static script (deterministic) + flag-gated code-mode rollout" (#7620) (2f29ec1)
  • Set up MCP without leaving the app (#7619) (38e81d0)
  • feat(SKY-12771): add Agent filter to Run History page (#7618) (481c62a)
  • feat(SKY-12788): add Gemini 3.5 Flash Lite and Gemini 3.6 Flash model support (#7617) (2c7283f)
  • Copilot: the log-only feature flag can now disable any draft-blocking check, not just 3 of 7 (#7616) (2ef1714)
  • feat(SKY-12138): default-enable copilot credential-pause kill-switch (#7614) (6d9d604)
  • Stop recording completed Copilot runs with registered outputs as failures (SKY-12765) (#7613) (14974a4)
  • Suppress recurring Playwright collected-object teardown log burst (SKY-12701) (#7612) (5da73bf)
  • Restore SKY-12240 failure-scope FE changes reverted by #13707 (#7611) (473fb0e)
  • feat(SKY-11258): stream code-block actions live via idempotent upsert (#7610) (c674778)
  • feat(SKY-12766): render copilot test-run action rows live during runs (#7609) (216a63b)
  • feat(SKY-12766): surface run id on copilot block_progress frames (#7608) (a4652f5)
  • fix(SKY-11513): link studio title to runs page with a blended edit button (#7607) (88f12a8)
  • Rename Studio header CTA "Agent Inputs" to "Inputs" (SKY-12237) (#7606) (e416dc4)
  • chore(SKY-12238): rename studio Run CTA "Run agent" to "Run" (#7605) (480cc35)
  • Restyle the studio action-detail failure block to the app's destructive convention (#7604) (2bc822c)
  • Replace the Workday static script (deterministic) + flag-gated code-mode rollout (#7603) (62d14e9)
  • Studio block detail: render status via the shared StatusBadge pill (#7602) (f901a9d)
  • fix(SKY-12242): fill studio browser media pane edge-to-edge (#7601) (12f0897)
  • chore(SKY-12746): rename studio run-view sections to Run inputs/Run outputs (#7600) (83cd727)
  • fix(SKY-12246): respect canvas lock for studio block expand/collapse (#7599) (7f897af)
  • fix(SKY-12245): disable double-click zoom on the workflow editor canvas (#7598) (951c280)
  • feat(browser): cloud per-run engine resolver + fail-closed engines (SKY-12007) [5/5] (#7597) (2700c29)
  • Stop rejecting valid requested outputs after copying errors (#7596) (f1e679b)
  • fix(SKY-12240): scope failure reason to one place per surface (#7595) (199fae2)
  • security: bump brace-expansion and Pillow to patched versions (#7591) (65ea026)
  • security: bump brace-expansion, js-yaml, and Pillow to fix eleven Dependabot alerts (#7592) (fb976c3)
  • Revert the six flag-gated agent-handler verification PRs for SKY-12398/12399/12400 (#7590) (584eb78)
  • feat(SKY-11571): let collapse feature flags target individual workflows (#7589) (c08f705)
  • Remove obsolete standalone container definition (#7588) (0ecc9a9)
  • chore(deps): bump axios from 1.16.1 to 1.18.0 in /skyvern-frontend in the npm_and_yarn group across 1 directory (#7584) (63fe173)
  • feat(SKY-12676): show every browser action live on the session Timeline for MCP sessions (#7587) (1b6f2e8)
  • feat(SKY-12443): make studio run-view JSON blocks searchable (#7586) (e870b72)
  • Accept phone numbers that country-aware fields rewrite with an explicit +1 (SKY-11718) (#7585) (35e38d0)
  • feat(SKY-12490): clean up browser profile folders orphaned by hard-killed local MCP servers (#7580) (0889d7d)
  • DB-back the Odysseys runtime/tokens/cost panel (drop the hardcoded dataset) (#7582) (fac111a)
  • Remove the CDP proxy service and proxy configuration from the package (#7583) (a20c56f)
  • fix(SKY-12698): auto-wire workflow parameters into code blocks on code-only create/update (#7578) (e73bac0)
  • feat(browser): terminal cleanup for standalone script browsers (SKY-12007) [4/5] (#7577) (072f416)
  • Bound max_screenshot_scrolls to prevent workflow_runs integer overflow (SKY-12445) (#7575) (8b12660)
  • Add paused to the public RunStatus enum (SKY-12549) (#7576) (a77cdac)
  • Reject malformed MCP tool arguments with a clear error (SKY-12666) (#7574) (892e2a0)
  • test(browser): engine-owner cancellation and cleanup races (SKY-12007) [3/5] (#7573) (541af0c)
  • chore(security): non-security md5 flag in copilot schema test and npm ignore-scripts for proxy js_clients fixture (#7572) (20a496d)
  • SKY-12561: Remove unreachable submit rung binding channel (#7568) (2740602)
  • Guard element ops against incompatible element types (SKY-12687, SKY-12566, SKY-12673) (#7544) (c22c402)
  • Classify page-analysis timeouts as page-load timeouts (SKY-12629) (#7538) (46ea228)
  • feat: land run-level tagging workstream (#7259) (3940728)
  • feat(browser): pin one browser engine per logical run (SKY-12007) [2/5] (#7571) (82e0212)
  • fix(SKY-12143): recover credential inputs corrupted by the fill+type caret race (rotation + truncation) (#7570) (905d846)
  • fix(SKY-12715): accept template variables in HTTP Request block URL validation (#7569) (e331d17)
  • SKY-12613: Add selection-shaped routes to the typed binding corrective (#7567) (a89e503)
  • Preserve delivered-unverified Copilot output (SKY-12614) (#7566) (1e188e2)
  • SKY-12588: withhold block runs while declared workflow inputs are wired to nothing (stacked on #13549) (#7565) (da5afc7)
  • SKY-12548: Copilot: carry a typed binding directive across author-time declared-input rejects so the next attempt converges (#7564) (290b16c)
  • Copilot: stop unbounded retry loops on code-block turns — end with an honest failure message or a corrective hint (SKY-12711) (#7557) (df443c1)
  • Gate durable Copilot authoring on scout goal-reach; arm the freehand reject by selector provenance (SKY-12547) (#7556) (6d49ba1)
  • fix(SKY-12701): disable OTLP trace export on Hetzner temporal workers and quiet exporter logs (#7552) (d3ba7ef)
  • feat(SKY-12649): browser profile usage endpoint + atomic delete used-by guard (#7550) (706799b)
  • SKY-12309: Avoid failing successful Copilot runs when an optional blocker is absent (#7549) (ed492e4)
  • feat(SKY-12649): Browser Profiles Refresh-in-place, role badges, used-by delete guards (#7548) (677cdc9)
  • Honor CDP proxy denylist env knobs in production; second-signal fast drain exit (SKY-12533) (#7547) (0373f34)
  • Production entrypoint, health/drain, and cloud image for the CDP proxy (SKY-12533) (#7546) (b691820)
  • fix(SKY-12530): don't remove shared workflow-run context on SDK run_action cleanup (#7545) (0504175)
  • Guard undefined block parameters in workflow editor (SKY-12405) (#7543) (a300961)
  • Support org-level CDP operation denylists (SKY-12538) (#7542) (8e96fda)
  • Classify transient LLM upstream failures as retryable (SKY-12620) (#7541) (3228cf1)
  • Reject ambiguous xpath-fallback element resolution (SKY-12606, SKY-12605, SKY-12635) (#7540) (f71fe69)
  • Harden skyvern-api parsing/validation boundaries (SKY-12523, SKY-12625, SKY-12515) (#7539) (61d1ef2)
  • Add the command-interception middleware seam for custom CDP-op implementations (SKY-12535) (#7537) (eabfab9)
  • Add CDP proxy benchmark harness: direct vs proxied on identical workloads (SKY-12503) (#7536) (ff95642)
  • feat(SKY-12505): ADR + hexagonal scaffold for the Python CDP proxy service (#7535) (9ca4896)
  • feat: code-first browser recording (opt-in feature preview) (#7534) (59b739e)
  • Arm an escalating convergence directive when Copilot authors code blocks without metadata (SKY-11949) (#7533) (79b0bf1)
  • fix(SKY-12398): verify text-input commit with fallback ladder and repeated-action circuit breaker (#7531) (f6dff06)
  • Scope the public eval artifact lookup to the eval org (SKY-12639 follow-up) (#7530) (9f3ad0d)
  • test: stop hand-quoted Playwright snippets from drifting back into the MCP tools (#7529) (b939daf)
  • fix(SKY-12153): address codex review on fallback credentials (follow-up to #13599) (#7528) (844cc3b)
  • Converge Copilot author-time metadata-gate rejects to a typed terminal (SKY-12594) (#7527) (6ce4735)
  • fix(SKY-12400): verify autocomplete commit on all selection paths with polled suggestion detection (#7525) (cdc4cb5)
  • feat(SKY-12612): run-list outcome-risk marker (#7526) (0ed96a3)
  • fix(SKY-12661): route select-verification prompts through LLM_CONFIG_BY_PROMPT_TYPE (#7524) (6be22e4)
  • feat(SKY-12612): batch run-heal-summary endpoint for run-list outcome-risk (#7523) (7a42e92)
  • feat(SKY-12153): fallback credentials with automatic run retry (#7521) (27c90a1)
  • fix(SKY-12399): surface a diagnostic when a submit click does not advance the form (#7520) (29e4fb9)
  • docs(SKY-12601): make MCP element-ref lifetime truthful per transport (stdio vs hosted HTTP) (#7519) (579c9ed)
  • fix: run background work when FastAPI BackgroundTasks is unavailable (#7518) (27583a0)
  • fix(SKY-12399): verify masked input commits, retype on empty/placehol… (#7517) (2d3be92)
  • fix(SKY-12399): shadow-DOM-aware incremental dropdown detection with scoped fallback (#7516) (5ecabeb)
  • test(SKY-12634): stop two select tests racing a real wall clock under CI load (#7515) (dcda6e6)
  • refactor: extract _is_org_flag_enabled so org-bucketed flag gates stop being copy-pasted (#7514) (485f166)
  • Show unsaved workflow changes and change summaries in Studio (SKY-12442) (#7513) (68d138f)
  • Render-validate copilot code blocks at the persist seam (SKY-12591) (#7512) (58b0397)
  • feat(browser): OSS browser-engine registry/adapter foundation (SKY-12007) (#7511) (6086909)
  • fix: offer the Skyvern credential source outside the cloud shell (#7510) (555fc82)
  • fix(SKY-12590): treat off-schema OTP parser output as 400, not retryable 502 (#7509) (91db8f4)
  • SKY-12593: load legacy copilot criteria-set rows via tolerant decode, fail closed on drift (#7508) (42865f1)
  • fix(SKY-12545): keep credentialed terminal actions past login (#7507) (e06e65e)
  • feat(SKY-12600): add an artifact timeline tab to browser sessions (run view for MCP-driven sessions) (#7506) (0f97394)
  • Redact signed/presigned artifact URL params from webhook delivery logs (SKY-12624) (#7505) (21f67b2)
  • Strip metadata from signed artifact URLs and redact signature params from logs and traces (#7504) (66c964b)
  • [SKY-12553] Add per-gate Copilot author-time log-only registry (#7503) (19fe761)
  • Import externally recorded eval runs into the eval dashboard (#7502) (28db09c)
  • feat(SKY-12550): record what an agent does in the browser so it can be replayed as a workflow (#7498) (446e3ee)
  • Gate artifact URL re-minting to Skyvern signed content URLs (#7499) (8ed3be1)
  • Refuse Copilot drafts whose entire output contract is a null blocker (SKY-12539) (#7497) (3fcac5d)
  • chore(deps): bump mcp to 1.28.1 to fix 3 high-severity Dependabot alerts (#7496) (1443952)

Full Changelog: v1.0.47...v1.0.48

What's Changed

New Contributors

Full Changelog: v1.0.47...v1.0.48

Check out latest releases or
releases around Skyvern-AI/skyvern v1.0.48

Don't miss a new skyvern release

NewReleases is sending notifications on new releases.

Get notifications