Fixed
- Bound API database pools against the maximum rolling deployment fleet. This prevents PostgreSQL
53300connection exhaustion. - Isolated audit writes on a dedicated pool. Slow audit inserts cannot starve request handlers.
- Coalesced project environment updates, bounded secret writes, and capped concurrent project sessions to contain request storms.
- Bound public web version metadata to each Vercel deployment. Production web deploys now complete with the correct release version.
- Strengthened release verification for warm-session adoption.
What's Changed
- chore(release): VERSION → 0.13.3 [skip ci] by @github-actions[bot] in #6720
- fix(reaper): stop killing live turns on a box that is merely transitioning by @markokraemer in #6719
- fix(platform): storm controls — coalesced env fan-out, secret-write budget, per-project session cap by @kubet in #6715
- fix(api): bound database connections during rollouts by @markokraemer in #6722
- test(browser): await account render before retry by @markokraemer in #6727
- fix(preview): make preview origins a MUST on a public domain, never a silent downgrade by @markokraemer in #6732
- fix(release): bind Vercel runtime version per deployment by @markokraemer in #6735
- refactor(gateway): bound memory and simplify passthrough by @markokraemer in #6737
- fix(gateway): wire API proxy to standalone service by @markokraemer in #6738
- fix(deploy): persist gateway target in ECS revisions by @markokraemer in #6740
- test(release): prove warm adoption on the target row by @markokraemer in #6739
- feat(cli): UI→CLI parity — every operable dashboard action has a kortix command by @markokraemer in #6731
- feat(composer): persist unsent drafts per project and per session by @sutharjay1 in #6743
- test(release): require Apps list after enabling flag by @markokraemer in #6747
- fix(session): make runtime recovery single-flight and non-destructive by @markokraemer in #6748
- fix(worktree): warn at start when another stack is live on the shared DB (worker cross-talk) by @markokraemer in #6752
- docs(sdk): close runtime recovery progress by @markokraemer in #6754
- security: enforce the sandbox credential boundary by @markokraemer in #6751
- fix(cli): replay manifest CAS 409 once; projects ls honors --host/--account by @markokraemer in #6753
- fix(worktree): tunnel watchdog — rotate a dead quick tunnel and respawn the API with the new KORTIX_URL by @markokraemer in #6755
- test(release): allow later session activity writes by @markokraemer in #6756
- docs(learnings): never resolve a merge inside a worktree whose API runs --hot by @markokraemer in #6758
- fix(worktree): run the quick tunnel over HTTP/2, not QUIC by @markokraemer in #6759
- fix(api): inbox delivery converges the box before every prompt, not only with an opencodeEnv override by @markokraemer in #6761
- security: enforce the sandbox credential boundary by @markokraemer in #6760
Full Changelog: v0.13.2...v0.13.4