kortix-ai/suna v0.10.0

v0.10.0 — Self-hosting: one generic Docker deployment, VPS-first

on GitHub

Self-hosting, rebuilt

One generic Docker Compose self-host that runs the full Kortix platform on any VPS/server — kortix self-host init + start, VPS-first with a persistent domain (Caddy + automatic TLS), plus Cloudflare-tunnel and local modes for evaluation.

• In-app GitHub setup — create an org-owned GitHub App from Settings → Git (manifest flow), paste an existing App, or use a scoped access token. No CLI gymnastics, no PATs required.
• Self-host feature flags — single-account mode, marketing site off by default, enterprise license unlock, billing/connectors gracefully hidden when unconfigured.
• Operations built in — nightly zero-downtime rolling updates on the curated stable channel (promoted via the new Promote Self-Host Stable workflow), kortix self-host secrets management, run-any-version + local-images modes, required-secret enforcement at init.
• Kortix-managed models are cloud-only — self-host deployments use your own model keys (BYOK); the managed catalog is gated behind an explicit flag.
• Reliability — SSE turn-stream no longer leaks connections on retry (fixes tab-wide request starvation); stale sessions self-heal instead of dead-ending on the auth screen.
• New self-host e2e test suite (fast CLI-artifact tier + opt-in live tier) wired into CI.

What's Changed

• chore(release): VERSION → 0.9.109 [skip ci] by @github-actions[bot] in #4521
• fix(web): guard non-string error message to prevent TypeError crash (t.message.includes is not a function) by @markokraemer in #4523
• fix(web): drop expected billing-gate 402 from Sentry noise by @markokraemer in #4522
• fix(api): stop Sentry-capturing the expected request-deadline 503 (BS 29af03…) by @markokraemer in #4524
• chore(dev-eks): deploy dev-0022fc90 [skip ci] by @github-actions[bot] in #4525
• fix(web): show deterministic session switching state by @markokraemer in #4526
• fix(api): retry transient socket-close on git proxy ref discovery (Better Stack df7a31d4) by @markokraemer in #4530
• fix(web): survive storage-disabled in-app WebViews (null localStorage/sessionStorage) by @markokraemer in #4529
• fix(web): suppress stale-deploy webpack-runtime 'call' TypeError noise by @markokraemer in #4528
• fix(web): stop Sentry-capturing the expected client-side request timeout (BS b1db01e5…) by @markokraemer in #4531
• fix(web): suppress old-WebKit lookbehind parse noise (Safari < 16.4) by @markokraemer in #4532
• fix(desktop): restore clickable native window chrome by @markokraemer in #4534
• feat(gateway): default to Codex GPT-5.6 with bounded GLM fallback by @markokraemer in #4535
• chore(dev-eks): deploy gateway dev-f9887b23 [skip ci] by @github-actions[bot] in #4536
• chore(dev-eks): deploy dev-f9887b23 [skip ci] by @github-actions[bot] in #4537
• feat(channels): revive Microsoft Teams + Slack-parity feature set by @lillyboga in #4527
• chore(dev-eks): deploy gateway dev-6456a34f [skip ci] by @github-actions[bot] in #4539
• fix(web): suppress old-browser minified-chunk SyntaxError parse noise by @markokraemer in #4538
• fix(api): isolate effective:batch probe failures so a transient authorize blip degrades instead of 500-ing (BS c0e40278…) by @markokraemer in #4541
• chore(dev-eks): deploy dev-60a70f65 [skip ci] by @github-actions[bot] in #4543
• fix(web): guard undefined/non-array before .filter/.map in customize agents/skills by @markokraemer in #4542
• fix(web): suppress unactionable No-error-message chunk events by @markokraemer in #4540
• fix(web): guard Paper Shaders null-context getSupportedExtensions crash by @markokraemer in #4544
• fix(teams): harden tenant binding and login tokens by @markokraemer in #4548
• chore(dev-eks): deploy dev-7a90fd7d [skip ci] by @github-actions[bot] in #4549
• fix(teams): loading card, /whoami, beautiful commands, widen ids by @lillyboga in #4547
• chore(dev-eks): deploy dev-a0a26619 [skip ci] by @github-actions[bot] in #4550
• feat(web/teams): render Microsoft Teams as a channel table row like Slack by @lillyboga in #4551
• fix(api/teams): Teams install never shows connected (connector-scoped secret read) by @lillyboga in #4552
• chore(dev-eks): deploy dev-a8a49d4f [skip ci] by @github-actions[bot] in #4553
• feat(api/teams): true one-click org install via delegated auth-code publish by @lillyboga in #4554
• chore(api/teams): log org-install outcome in the oauth callback by @lillyboga in #4556
• fix(scim): group member adds stranded when the person joined via SSO JIT by @Ino-Bagaric in #4555
• chore(dev-eks): deploy dev-b2f52c75 [skip ci] by @github-actions[bot] in #4557
• chore(dev-eks): deploy dev-0689722b [skip ci] by @github-actions[bot] in #4559
• fix(scim): close the shadowed-invite holes (offboarding, group remove/replace/create) by @Ino-Bagaric in #4558
• chore(dev-eks): deploy dev-4a852b0a [skip ci] by @github-actions[bot] in #4560
• feat(projects): add session branch environments by @markokraemer in #4566
• chore(dev-eks): deploy dev-0a38bd7c [skip ci] by @github-actions[bot] in #4567
• fix(web/channels): stop the channels table overflowing its card by @lillyboga in #4568
• feat(self-host): add target-aware enterprise foundation by @markokraemer in #4569
• chore(dev-eks): deploy dev-6e5f07eb [skip ci] by @github-actions[bot] in #4571
• content: publish secure agent tool access by @agent-kortix in #4293
• fix(ci): isolate self-host schema bootstrap services by @markokraemer in #4570
• chore(dev-eks): deploy dev-a0182392 [skip ci] by @github-actions[bot] in #4573
• refactor: remove hosted app deployment capability by @markokraemer in #4572
• chore(dev-eks): deploy dev-0a4e9c10 [skip ci] by @github-actions[bot] in #4575
• content: publish Kortix vs Glean comparison by @markokraemer in #4574
• refactor(db): drop retired hosted deployments schema by @markokraemer in #4576
• chore(dev-eks): deploy dev-80b9e6fb [skip ci] by @github-actions[bot] in #4578
• refactor(llm-gateway): move catalog and fallback policy to control plane by @markokraemer in #4577
• chore(dev-eks): deploy gateway dev-b0768610 [skip ci] by @github-actions[bot] in #4579
• chore(dev-eks): deploy dev-b0768610 [skip ci] by @github-actions[bot] in #4580
• refactor: finish hosted app deployment stripout by @markokraemer in #4587
• chore(dev-eks): deploy dev-efcb5ded [skip ci] by @github-actions[bot] in #4589
• refactor: remove final hosted app guidance residues by @markokraemer in #4590
• feat(infra): add enterprise VPC deployment plane by @markokraemer in #4586
• chore(dev-eks): deploy dev-6eb580d6 [skip ci] by @github-actions[bot] in #4591
• feat(llm-gateway): add project routing policy UI by @markokraemer in #4594
• fix(cli): use projects route for repository linking by @markokraemer in #4593
• chore(dev-eks): deploy dev-db83252d [skip ci] by @github-actions[bot] in #4595
• feat(sandboxes): add unified E2B cloud provider by @markokraemer in #4592
• chore(dev-eks): deploy gateway dev-0d8c2cbe [skip ci] by @github-actions[bot] in #4597
• feat(cli): manage enterprise AWS VPC installs by @markokraemer in #4596
• fix(db): unblock E2B provider migration on historical managed sandboxes by @markokraemer in #4599
• feat(projects): treat repository branches as isolated projects by @markokraemer in #4598
• chore(dev-eks): deploy dev-034b5229 [skip ci] by @github-actions[bot] in #4600
• feat(projects): enable branch-isolated repository projects by @markokraemer in #4602
• chore(dev-eks): deploy dev-d784efd5 [skip ci] by @github-actions[bot] in #4603
• chore(dev): add E2B key to encrypted env by @markokraemer in #4606
• fix(web): restore flat projects list by @markokraemer in #4608
• chore(dev-eks): deploy gateway dev-42803b64 [skip ci] by @github-actions[bot] in #4611
• chore(dev-eks): deploy dev-42803b64 [skip ci] by @github-actions[bot] in #4612
• fix(platinum): classify 409 sandbox_not_running as controlled 503, not Sentry by @agent-kortix in #4601
• fix(sessions): guard Daytona 429 on transcript + public-share reads (post-#3567) by @agent-kortix in #4605
• fix(sdk): retry transient 502/503/504 on idempotent reads (BS 994987…) by @agent-kortix in #4609
• fix(web): drop TronLink extension proxy-trap noise from Sentry by @agent-kortix in #4607
• fix(web): filter Android WebView native-bridge postMessage noise (Java object is gone) by @agent-kortix in #4610
• feat(web): add machine-readable SEO surface by @agent-kortix in #4604
• feat(llm-gateway): simplify project routing UX by @markokraemer in #4613
• chore(dev-eks): deploy dev-fc1153f2 [skip ci] by @github-actions[bot] in #4614
• fix(snapshots): synchronize template readiness across providers by @markokraemer in #4615
• fix(llm-gateway): avoid stale routing policy reads by @markokraemer in #4616
• chore(dev-eks): deploy dev-16d559de [skip ci] by @github-actions[bot] in #4617
• fix(gateway): serialize routing and default model writes by @markokraemer in #4618
• fix(snapshots): build missing Daytona templates by @markokraemer in #4621
• feat(self-host): add signed enterprise VPC release plane by @markokraemer in #4619
• chore(dev-eks): deploy gateway dev-4ce4a274 [skip ci] by @github-actions[bot] in #4622
• chore(dev-eks): deploy dev-4ce4a274 [skip ci] by @github-actions[bot] in #4624
• fix(enterprise): harden updater CodeQL paths by @markokraemer in #4623
• chore(dev-eks): deploy gateway dev-8a3a09be [skip ci] by @github-actions[bot] in #4625
• chore(dev-eks): deploy dev-8a3a09be [skip ci] by @github-actions[bot] in #4627
• feat: bootstrap enterprise release publisher by @markokraemer in #4629
• fix(snapshots): sync providers after template edits by @markokraemer in #4626
• chore(dev-eks): deploy dev-e4ed32da [skip ci] by @github-actions[bot] in #4630
• fix(enterprise): allow publisher repository decrypt by @markokraemer in #4631
• fix(enterprise): bind stable to prod migration provenance by @markokraemer in #4632
• chore(dev-eks): deploy dev-703b8a42 [skip ci] by @github-actions[bot] in #4633
• fix(enterprise): allow Cosign key metadata lookup by @markokraemer in #4634
• fix(snapshots): surface sandbox provider status by @agent-kortix in #4628
• chore(dev-eks): deploy dev-d62a3002 [skip ci] by @github-actions[bot] in #4635
• fix(cli): verify migrated Terraform state content by @markokraemer in #4636
• fix(cli): recover refreshed remote Terraform state by @markokraemer in #4637
• chore(dev-eks): deploy dev-0a2574c8 [skip ci] by @github-actions[bot] in #4638
• fix(enterprise): normalize Route 53 zone guard by @markokraemer in #4639
• chore(dev-eks): deploy dev-cd886ce6 [skip ci] by @github-actions[bot] in #4640
• fix(enterprise): allow encrypted CloudTrail alerts by @markokraemer in #4642
• chore(dev-eks): deploy dev-4105b5a9 [skip ci] by @github-actions[bot] in #4644
• docs: refresh connector and runtime references by @agent-kortix in #4641
• fix(enterprise): repair AWS VPC operator and host bootstrap by @markokraemer in #4643
• chore(dev-eks): deploy dev-2b3a6a03 [skip ci] by @github-actions[bot] in #4646
• release(enterprise): review 0.9.108-e2 contract by @markokraemer in #4645
• chore(dev-eks): deploy gateway dev-f23f8696 [skip ci] by @github-actions[bot] in #4647
• chore(dev-eks): deploy dev-f23f8696 [skip ci] by @github-actions[bot] in #4649
• docs: cover self-host AWS VPC and SDK retries by @agent-kortix in #4648
• chore(dev-eks): deploy dev-6f891ef9 [skip ci] by @github-actions[bot] in #4650
• fix(enterprise): make archive guard awk-portable by @markokraemer in #4651
• fix(enterprise): preserve public Supabase bundle modes by @markokraemer in #4652
• fix(enterprise): pin Supabase runtime paths by @markokraemer in #4653
• fix(enterprise): authenticate Supabase activation health by @markokraemer in #4654
• fix(enterprise): wait for long SSM installs by @markokraemer in #4655
• test(enterprise): isolate SSM waiter regression by @markokraemer in #4656
• fix(enterprise): break Supabase systemd deadlock by @markokraemer in #4657
• fix(enterprise): allow updater to reach private EKS by @markokraemer in #4658
• chore(dev-eks): deploy dev-e4f00dfe [skip ci] by @github-actions[bot] in #4659
• fix(enterprise): allow updater to read cluster state by @markokraemer in #4660
• chore(dev-eks): deploy dev-f2798a8f [skip ci] by @github-actions[bot] in #4661
• Rebuild auth consent surfaces in the /auth dialect by @sutharjay1 in #4662
• fix(enterprise): apply external secrets after CRDs by @markokraemer in #4664
• chore(dev-eks): deploy dev-481dc551 [skip ci] by @github-actions[bot] in #4665
• Revamp the accounts section UI by @sutharjay1 in #4663
• fix(enterprise): poll external secret readiness by @markokraemer in #4666
• fix(web): hide unavailable sandbox providers by @agent-kortix in #4667
• fix(sessions): sessions always get their real title by @Ino-Bagaric in #4668
• chore(dev-eks): deploy dev-89e592cf [skip ci] by @github-actions[bot] in #4671
• fix(web): suppress storage-blocked SecurityError localStorage noise (BS 09b9cf65…/ac75f0d8…) by @agent-kortix in #4674
• docs: fix SDK namespace for repo imports — kortix.github.linkRepository by @agent-kortix in #4673
• ECS Fargate revival — parallel EKS+ECS with unified Cloudflare router by @markokraemer in #4676
• chore(dev-eks): deploy dev-0737c1d6 [skip ci] by @github-actions[bot] in #4678
• fix(cli): report secret availability consistently by @agent-kortix in #4677
• chore(dev-eks): deploy dev-b058dd57 [skip ci] by @github-actions[bot] in #4680
• feat(api/teams): ship the real Kortix logo in the Teams app package by @lillyboga in #4672
• chore(dev-eks): deploy dev-df19f59d [skip ci] by @github-actions[bot] in #4681
• content: refresh Introducing Kortix wording by @agent-kortix in #4679
• Staging + Prod ECS Fargate (parallel runtime; prod flip gated) by @markokraemer in #4682
• Flip prod api+gateway to ECS Fargate by @markokraemer in #4683
• feat(marketplace): public project-clone marketplace + unify in-project surface by @markokraemer in #4493
• chore(dev-eks): deploy dev-eea60a86 [skip ci] by @github-actions[bot] in #4687
• Enterprise VPC on ECS Fargate — full simplification (rip out EKS/Helm/StepFunctions/DynamoDB/WAL) by @markokraemer in #4689
• chore(dev-eks): deploy dev-dff20292 [skip ci] by @github-actions[bot] in #4690
• docs: trigger session-strategy scope (fresh|reuse|pinned) by @markokraemer in #4686
• feat(triggers): session strategy — fresh|reuse + pinned session picker by @markokraemer in #4688
• chore(dev-eks): deploy dev-2eb03585 [skip ci] by @github-actions[bot] in #4694
• fix: make agent tunnel npx command workspace-safe by @markokraemer in #4693
• chore(dev-eks): deploy dev-32957ade [skip ci] by @github-actions[bot] in #4695
• Enterprise appliance: single-EC2, 100% Docker, self-healing + rolling updates by @markokraemer in #4696
• chore(dev-eks): deploy gateway dev-3019dfc3 [skip ci] by @github-actions[bot] in #4697
• chore(dev-eks): deploy dev-3019dfc3 [skip ci] by @github-actions[bot] in #4699
• fix(enterprise-release): pass image digests to build-bundles in promote workflow by @markokraemer in #4698
• chore(dev-eks): deploy dev-f6f61a49 [skip ci] by @github-actions[bot] in #4703
• fix(appliance): resolve null-passthrough breaking every deploy (instance_type + bedrock) by @markokraemer in #4701
• self-host: rename aws-vpc→aws-ec2, two-target UX, migration-safety gate by @markokraemer in #4702
• chore(enterprise): 0.9.108-e14 contract by @markokraemer in #4705
• fix(appliance): gateway healthcheck hits /health not / (404) by @markokraemer in #4706
• chore(enterprise): 0.9.108-e15 contract by @markokraemer in #4708
• fix(api): filter bare Bun fetch TimeoutError from Sentry (BS c672fb5e) by @agent-kortix in #4709
• fix(web): filter EVM-wallet inpage.js addListener/emit noise (BS 17a0ce67/3a6b00dc) by @agent-kortix in #4710
• fix(web): filter iOS WebKit stack-overflow RangeError noise (BS 87ccbef9) by @agent-kortix in #4711
• docs: refresh Teams channels and CLI/SDK references by @agent-kortix in #4712
• content: add inline money-page links to comparison posts by @agent-kortix in #4714
• Rebuild chat minimap on HoverCard: quieter UX, less render work by @sutharjay1 in #4713
• feat: use-case templates + conversational install via marketplace install-session by @lillyboga in #4719
• fix(api): stop masking git mirror clone timeouts as 'Cloning into' progress noise (BS 8d0cffbb) by @agent-kortix in #4717
• fix(web): drop @embedpdf tiling React #185 render-loop noise (BS 366115d4) by @agent-kortix in #4718
• fix(web): filter EIP-1193 wallet-extension plain-object rejection noise (BS 0f78b2f8) by @agent-kortix in #4720
• chore(dev-eks): deploy gateway dev-d321180f [skip ci] by @github-actions[bot] in #4722
• chore(dev-eks): deploy dev-d321180f [skip ci] by @github-actions[bot] in #4723
• fix(web): gate Shiki wasm highlighter on WebAssembly availability (BS 1604d50a) by @agent-kortix in #4721
• fix(iam-web): auto-provision groups defaults ON for new SSO connections by @Ino-Bagaric in #4724
• Generic Docker self-host + in-app git management by @markokraemer in #4725
• fix(appliance): work out of the box without SMTP + gate SSO probe by @markokraemer in #4715
• chore(dev-eks): deploy gateway dev-f942c625 [skip ci] by @github-actions[bot] in #4728
• chore(dev-eks): deploy dev-f942c625 [skip ci] by @github-actions[bot] in #4729
• feat(mfa): complete the account-wide Require MFA loop (member enroll + step-up) by @Ino-Bagaric in #4726
• chore(dev-eks): deploy dev-98079558 [skip ci] by @github-actions[bot] in #4731

Full Changelog: v0.9.108...v0.10.0