Agents act with your rights, no repository checkout at boot, and stateless sandboxes by default
New
- Agents act with their person's rights. My Kortix uses every connector and secret you can use and posts or edits a Slack message itself, without starting other agents. Refusals name the missing permission and who grants it, instead of "agent sessions cannot". Starting a workspace-shared sign-in from a session works for anyone who may share accounts (#12240).
- The connector catalog lists apps; it no longer decides what may connect. Wispr Flow connects through its own server in one click, ahead of Composio. A server an agent adds that no catalog lists gets a one-time approval link that opens the address prefilled (#12240).
- Sessions start without a repository checkout; repository access comes from grants (#12136).
- Workspace agents clone their workspace from a session again (
kortix workspaces clone), and committing from the host fetches the repository when the session has none (#12323, #12308, #12315). - Stateless sandboxes are the default for new sessions (#12172).
- One-off credit top-ups are an Enterprise option; the out-of-credits dialog leads with the plan (#12130).
- The usage page shows spend as a chart, a heatmap and an activity feed (#12238).
- An agent's workspace declares the repositories it clones and its setup steps; they run in the background when a session starts (#12262).
- Behind the
voice_callflag: an empty composer calls the agent (#12297).
Improved
- My Kortix names which agent does the work on every hand-off; it never starts an unnamed helper by default (#12248).
- Agent prompts and skills say that /workspace starts empty and how to clone a repository (#12255).
- The audit log keeps 14 days in the database with the S3 archive on (#12243).
- The frontend for staging and production is built in CI; Vercel only hosts it (#12245).
- The release suite's slowest lane drops from about 21 to 11 minutes (#11588).
- The model catalog sync stops re-asking for secrets it was refused (#12256).
- The workspace diff builds its untracked-file patches in one git call (#12220).
- Internal cleanup: shared API primitives, App route gates, the platform-admin webhook pipeline and the IAM read models each have one implementation; dead UI code and source-text tests are gone (#12224, #12223, #12213, #12191, #12185, #12231, #12230, #12227, #12226, #12260). Two legacy database drops are parked and the database password stays out of the backup's arguments (#12261).
Fixed
- The desktop app opens its workspaces again, and 404 pages render (#12253).
- Sessions moved to another workspace keep their git access, and paying accounts split too (#12285).
- A session an agent starts inherits the connectors its parent could reach (#12257).
- Folder uploads to Files show progress at once and recover from a busy server (#12317).
- Notification toasts show only inside the app, never on marketing pages (#12322).
- Chinese and Japanese plural strings for workspaces and storage render correctly (#12341).
- Sessions no longer fail on a catalog check no sandbox could pass (#12244).
- A failed session's prompt queue no longer floods the audit log and payload storage (#12241).
- The LLM gateway meters a retried request once (#12210) and keeps a truthful per-credential counter on unvalidated requests (#12212).
- Connector call failures report their own status instead of a generic 500 (#12221).
- The email sign-in link returns to the site that started it (#12232). The auth timeout error is built on the server only (#12236).
- The create-workspace dialog says why a name is rejected (#12228).
- The embed action moves out of the Session access dialog (#12247).
- The CLI ships to the seeded workspace remote correctly (#12229), and
whoami --jsonbounds its account list (#12197). - Billing: the transactions count is bounded and the audit reconciliation scan is paced (#12249).
- History recovery keeps a log whose todo status is unknown (#12235). The config-release tick is exempt from the 25 s request deadline (#12222).
- App scaling survives a database deadlock (#12195). Superseded gateway-log index builds are skipped (#12214).
- Fewer noisy logs: agent-grant denials, inbox transcript reads and the manifest tripwire are rate-limited or downgraded (#12234, #12252, #12211, #12338), and third-party tracking-pixel noise is dropped from error reports (#12225).
Security
- Suna-era tables in the public and basejump schemas are frozen for writes and closed to anonymous and signed-in database API access ahead of their removal. Contact-form submissions move to the kortix schema (#12243).
- A crafted frame filename can no longer stall the browser-noise filter (#12266).
What's Changed
- fix(tests): MCP-6 whoami runs as a one-workspace user; gitleaks-ignore scans only the flagged file by @markokraemer in #12189
- refactor(api): dedupe the IAM read models to one row reader per table (KRTX-4587) by @agent-kortix in #12191
- ci: pull the supabase CLI images from ghcr.io, not public.ecr.aws (KRTX-4594) by @agent-kortix in #12192
- fix(ci): retry the git-core PPA add through Launchpad's sporadic HTTP 500s (release train 2026-11-09) by @agent-kortix in #12205
- fix(tests): the machines hosting stub removes a runtime the way production does (KRTX-4599, release gate) by @agent-kortix in #12196
- fix(tests): WS-ROUTE-3 compares the identity, not OWNER's growing workspace list by @markokraemer in #12207
- fix(cli): KRTX-4597 whoami --json bounds the accounts list by serialized bytes by @agent-kortix in #12197
- fix(tests): the scale test settles its background reconcile before the cleanup cascade (release suite) (KRTX-4600) by @agent-kortix in #12198
- refactor(api): one token wire beside keyWire; typed accounts handlers; dead exports gone (KRTX-4573) by @agent-kortix in #12185
- fix(tests): the machines integration stub extends AppHostingProvider so hosting.remove exists (KRTX-4606, KRTX-4607) by @agent-kortix in #12202
- fix(api): the manifest tripwire logs at warn, not error (KRTX-4605) by @agent-kortix in #12211
- fix(db): skip the superseded gateway_logs v2/v3 index builds that INCLUDE metadata by @markokraemer in #12214
- Promote dev 1a6a26f to staging by @github-actions[bot] in #12215
- fix(apps): the scale reconcile survives a deadlock victim, and its test stub removes boxes (KRTX-4595) by @agent-kortix in #12195
- chore(release): VERSION → 0.15.4 [skip ci] by @github-actions[bot] in #12217
- chore(release): staging VERSION → 0.15.4 [skip ci] by @github-actions[bot] in #12218
- docs(learnings): never INCLUDE jsonb in a btree index; cost the widest row on prod by @markokraemer in #12219
- fix(gateway): enforce a truthful per-credential counter on the unvalidated /v1 surface (KRTX-4608) by @agent-kortix in #12212
- fix(llm-gateway): a retried inference request meters once (KRTX-4612) by @agent-kortix in #12210
- perf(kortixd): generate the workspace diff's untracked patches in one batched git diff (KRTX-4601) by @agent-kortix in #12220
- refactor(api): one webhook pipeline, one failure policy in platform admin (KRTX-4593) by @agent-kortix in #12213
- fix(api): connector-call failures surface as their own status, not a blanket 500 (KRTX-4614) by @agent-kortix in #12221
- fix(api): exempt the config-release descriptor tick from the 25s request deadline (KRTX-4615) by @agent-kortix in #12222
- refactor(apps): one typed route gate, one App cap, one manifest load, one token gate (KRTX-4617) by @agent-kortix in #12223
- fix(web): drop third-party tracking-pixel Response.json noise at Sentry beforeSend (KRTX-4624) by @agent-kortix in #12225
- refactor(web): delete the source-text test suites in customize/sections (KRTX-4630) by @agent-kortix in #12226
- fix(web): tell the user why the create-workspace name is rejected (KRTX-4627) by @agent-kortix in #12228
- refactor(api-contract): single-source the runtime audit summary allowlist (KRTX-4621) by @agent-kortix in #12227
- refactor(shared): one canonical mermaid diagram-starter list (KRTX-4490) by @agent-kortix in #12230
- refactor(ui): retire the dead capabilities tree (KRTX-4632) by @agent-kortix in #12231
- fix(cli): ship fetches and reconciles the seeded workspace remote (KRTX-4626) by @agent-kortix in #12229
- refactor(api): consolidate shared primitives behind one cause walk, one channel registry, one notifier leaf (KRTX-4620) by @agent-kortix in #12224
- docs(workspaces): status after Release 1 shipped, the Release 2 gate on prod, open decisions by @markokraemer in #12233
- feat(sessions): stateless sandboxes become the default on prod by @DimitrijeGlibic in #12172
- fix(api): the history recovery keeps a log whose todo status is unknown by @DimitrijeGlibic in #12235
- fix(api): rate-limit agent-grant denial warn lines (KRTX-4635) by @agent-kortix in #12234
- feat(billing): one-off top-ups only on Enterprise; out-of-credits modal leads with the plan by @sutharjay1 in #12130
- fix(web): the email auth link returns to the origin that started it (KRTX-4628) by @agent-kortix in #12232
- fix(auth): construct the auth timeout error on the server only (KRTX-4637) by @agent-kortix in #12236
- fix(api): a failed session's prompt queue stops flooding the audit log and payload storage by @DimitrijeGlibic in #12241
- fix(connectors): agents act with their person's rights; the catalog never blocks a connector by @markokraemer in #12240
- perf(ci): the release suite's slowest lane drops from ~21 to ~11 min by @DimitrijeGlibic in #11588
- feat(db): audit log keeps 14 days in PostgreSQL with the S3 archive on; Suna-era tables frozen before the drop by @DimitrijeGlibic in #12243
- feat(sessions): no repository checkout at boot; repository access comes from grants by @markokraemer in #12136
- fix(web): staging and prod build the frontend on the CI runner, Vercel only hosts it by @DimitrijeGlibic in #12245
- fix(ci): dev passes the billing override-key and @kortix/ui export tests again by @DimitrijeGlibic in #12246
- fix(kortixd): My Kortix names who works on every hand-off, no silent colleague by @markokraemer in #12248
- docs(db): legacy backup restore note restores the big tables with --data-only by @DimitrijeGlibic in #12250
- fix(api): stop refusing every box on a catalog proof no daemon can give (KRTX-4642) by @agent-kortix in #12244
- fix(web): the desktop app opens its workspaces again and 404 pages render by @DimitrijeGlibic in #12253
- docs(learnings): desktop paths map in the middleware; pages outside app/[locale] need their own intl provider by @DimitrijeGlibic in #12254
- fix(agents): prompts and skills say /workspace starts empty and how to clone by @markokraemer in #12255
- fix(billing): bound the transactions pagination count and pace the audit reconciliation scan (KRTX-3175) by @agent-kortix in #12249
- feat(worktree): create and start reclaim idle worktrees and build output on their own by @markokraemer in #12258
- fix(api): rate-limit the inbox transcript read warn per session (KRTX-2349) by @agent-kortix in #12252
- fix(web): move the embed action out of the Session access dialog (KRTX-4639) by @agent-kortix in #12247
- Promote dev 1037495 to staging by @github-actions[bot] in #12259
- chore(db): park the kortix_yolo and drizzle drops and keep the DB password out of the backup's argv by @DimitrijeGlibic in #12261
- test(api): the cost-explorer LLM scans stay index-only (KRTX-4638) by @agent-kortix in #12242
- feat(worktree): autoclean caps active .next, cleans merged and Claude worktrees, every 15 min by @markokraemer in #12263
- refactor(sdk): projects-client barrel re-exports ./spaces once (KRTX-4505) by @agent-kortix in #12260
- feat(agents): an agent's workspace declares its clones and setup, run in the background by @markokraemer in #12262
- feat(web): usage page shows spend as a chart, a heatmap and an activity feed by @sutharjay1 in #12238
- test(db): audit v2 lifecycle test expects no row for queue churn by @markokraemer in #12265
- fix(codeql): linear-time pixel.js frame check and race-free stale autoclean lock by @markokraemer in #12266
- fix(starter): the kortix-system skill fits its 1500-line budget again by @markokraemer in #12267
- fix(tests): release-gate assertions follow agent = human and the removed git route by @markokraemer in #12268
- test(db): audit v2 lifecycle test expects no row for queue churn (release gate v0.15.4) by @agent-kortix in #12270
- fix(starter): the kortix-system skill fits its 1500-line budget again (release gate v0.15.4) by @agent-kortix in #12271
- fix(tests): release-gate assertions follow agent = human and the removed git route (release gate v0.15.4) by @agent-kortix in #12274
- fix(sdk): the gateway-catalog sync stops re-asking a denied secrets read (KRTX-4636) by @agent-kortix in #12256
- fix(workspaces): moved sessions keep git; paying accounts split too by @DimitrijeGlibic in #12285
- fix(tests): RUN-7 and GOLD-1 clone the repository before the host commit-push by @markokraemer in #12291
- fix(release): CodeQL fixes and RUN-7 clone step picked onto staging (release gate v0.15.4) by @markokraemer in #12292
- Promote dev 3ba7c2d to staging by @github-actions[bot] in #12295
- chore(db): settle the Suna-era subscription precondition of the parked schema drop by @DimitrijeGlibic in #12296
- feat(db): backup-legacy-schemas verify proves a legacy backup restores before the drop by @DimitrijeGlibic in #12301
- fix(ui): an agent's workspace field opens on the Workspace rail by @markokraemer in #12318
- fix(daemon): a refresh of a session with no checkout answers a no-op, not 409 (KRTX-4667) by @agent-kortix in #12315
- fix(ui): an agent's workspace field opens on the Workspace rail (release gate v0.15.4) by @agent-kortix in #12320
- fix(tests): RUN-7 and GOLD-1 clone the repository before the host commit-push (release gate v0.15.4) by @agent-kortix in #12321
- fix(web): notification toasts show only on app routes, never on marketing pages by @sutharjay1 in #12322
- fix(api): workspace agents can clone their workspace again (record readable by its own agent) by @markokraemer in #12323
- fix(drive): folder uploads show progress at once and recover from a busy server by @sutharjay1 in #12317
- fix(tests): RUN-7 and GOLD-1 clone with kortix workspaces clone, onto the session branch by @markokraemer in #12325
- fix(api): workspace agents can clone their workspace again (release gate v0.15.4) by @markokraemer in #12324
- feat(session): an empty composer calls the agent (flag voice_call) by @kubet in #12297
- fix(connectors): a spawned session inherits its spawn line's connector reach (KRTX-4643) by @agent-kortix in #12257
- stage-fix: the agent editor's workspace rail key follows #12262's schema (v0.15.4 gate) by @agent-kortix in #12328
- stage-fix: v0.15.4 gate — the agent workspace rail key and the session-branch clone by @agent-kortix in #12329
- fix(kortixd): the host-driven commit-push materializes the repository on demand (KRTX-4657) by @agent-kortix in #12308
- fix(ui): one workspace key in the agent rail map (KRTX-4668) by @agent-kortix in #12327
- fix(release): zh/ja plural strings, ledger labels pass the i18n audit, race-free worktree cache read by @markokraemer in #12341
- fix(release): zh/ja plurals, ledger labels, worktree cache race picked onto staging (release gate v0.15.4) by @markokraemer in #12342
- fix(ui): one workspace key in the agent-rail map (KRTX-4679) by @agent-kortix in #12334
- Promote dev 6339f3b to staging by @github-actions[bot] in #12343
- fix(api): preview port-not-ready retries log at info; one warn at give-up (KRTX-4673) by @agent-kortix in #12338
- fix(ui): agent-tabs keeps one workspace rail row (KRTX-4676, release gate) by @agent-kortix in #12331
- Promote dev 2d86ac9 to staging by @github-actions[bot] in #12348
- fix(release): one workspace key in agent-tabs and an atomic worktree cache write (release gate v0.15.4) by @markokraemer in #12355
- stage-fix: the staging tree's agent rail map keeps one workspace key (v0.15.4 gate) by @agent-kortix in #12356
- Release v0.15.4 — Agents act with your rights, no repository checkout at boot, and stateless sandboxes by default by @github-actions[bot] in #12216
Full Changelog: v0.15.3...v0.15.4