kortix-ai/suna v0.13.23 on GitHub

Choose which account a connector runs as, per call. A connection now carries the accounts you may run it as, and the account is chosen when the connector is called rather than pinned to the whole session. The connector catalog, the SDK and the CLI all report the available accounts and the pinned default, and connectors/describe shows accounts instead of only tool counts.
An ambiguous connector call is refused, not guessed. When several accounts are reachable and none is named or pinned as default, the call is denied with account_required instead of silently picking one — no more mail sent from the wrong mailbox.
Choosing a connector account is discoverable in the CLI rather than a dead end.

A connector you have your own accounts for reads as connected, not "needs setup", and the admin connector list now agrees with what each caller can actually reach.
Connector accounts are per connection instead of a connector-level strategy, and connections the old strategy flag made unreachable are revoked.
The sandbox daemon's internals were reorganised behind explicit service boundaries, with its HTTP controllers separated from its adapters.

A failed identity check no longer signs you out. A failed getUser round trip used to end the browser session; it no longer does, and the new-connection screen offers Upgrade when you are at the project cap.
Connector authorization: finalizing a connection that the whole project can use now requires the connections-manage capability, matching the gate the connect step already applied. Previously a role with connector-write but not connections-manage could complete a project-wide shared connection.
Auto-created connections no longer claim to be the default, and the CLI's account column no longer truncates away the pinned-default marker.
Stale connector banner copy and a dead connector detail shell removed; the account list renders for every direct provider.

What's Changed

fix(auth): a failed getUser round trip no longer signs the browser out; /new offers Upgrade at the project cap by @markokraemer in #7352
refactor(connectors): credentials are a call-time choice — one access rule, no session gate, no strategy flag by @markokraemer in #7326
refactor(kortixd): introduce internal harness service boundaries by @DimitrijeGlibic in #7220
test(api): wait for the second lifecycle drain instead of a 200 ms margin by @markokraemer in #7357
fix(connectors): account-aware modal header, dead ConnectorDetail shell removed, reconcile re-activates a revoked account by @markokraemer in #7360
fix(build): quick-queue snapshot uses a reverse scan, unbreaking API typecheck on main by @markokraemer in #7368
fix(security): connect/finalize gates a project-owned account on connections.manage by @markokraemer in #7366
chore(staging): bring staging to main (connector-creds, git-connection-logout, 48 commits) by @markokraemer in #7356
Release v0.13.23 — Per-call connector accounts, no more guessed account, and a sign-out fix by @github-actions[bot] in #7370

Full Changelog: v0.13.22...v0.13.23