Changelog

Features

• feat(providers): support large agent-block attachments via Files APIs and remote URLs

Improvements

• improvement(providers): tighten Gemini and vLLM agent-attachment ceilings

Bug Fixes

• fix(kb): canonicalize knowledge-base upload keys
• fix(realtime): re-check workspace role on mutating socket events
• fix(chat): autoscroll follow-ups — re-engage threshold + keep end-of-turn options in view
• fix(chat): keep autoscroll pinned when the virtualizer re-scrolls during streaming

View changes on GitHub

Features

• feat(scheduled-tasks): migrate jobs agent to scheduled tasks agent
• feat(google-calendar): wire freebusy, align tools with API v3, add calendar + sharing tools
• feat(feature-flags): migrate 3 env-flags to AppConfig-backed runtime flags
• feat(grafana): validate integration and add folder, health, and contact-point tools
• feat(feature-flags): AppConfig-backed gated feature flags
• feat(ci): mship companion pr check
• feat(db): zero-downtime migration safety lint + db-migrate skill
• feat(auth): OAuth-only signup with Microsoft provider
• feat(jsm): add Atlassian Assets (Insight/CMDB) tools for asset management
• feat(copilot): server-side mothership tool/vfs/file metrics

Improvements

• improvement(perm-groups): allow workspace filter for permission groups
• refactor(connectors): split client metadata from server runtime
• improvement(ci): fix companion regex
• improvement(ci): rename companion tags to be more descriptive
• refactor(table): split the 5.3k-line service.ts god-file into per-concern modules

Bug Fixes

• fix(scheduled-tasks): fix scheduled tasks schema validation
• fix(providers): allow HTTP for self-hosted vLLM endpoints
• fix(providers): pin vLLM provider endpoint to validated IP
• fix(webhooks): cap request body size on public webhook receivers
• fix(uploads): authorize internal file URLs before download
• fix(credential-sets): stop leaking open-invite tokens to all users
• fix(providers): pin Azure OpenAI/Anthropic endpoints to validated IP
• fix(execute): reject only cross-site session execution (CSRF guard)

Other Changes

• chore(deps): bump js-yaml to 4.2.0 and nodemailer to 8.0.9 in apps/sim

View changes on GitHub

Features

• feat(square): add Square integration with 34 commerce operations
• feat(context-dev): add Context.dev web + brand data integration

Improvements

• refactor(sim): consolidate record guards + pure utils into @sim/utils
• improvement(mship): add enrichment tool, clean up dead tools
• Revert "improvement(mship): clean up dead tools, add enrichments"
• improvement(mship): clean up dead tools, add enrichments
• improvement(scheduled-tasks): move recurrence into modal body as a section
• refactor(providers,executor): deepen three shallow modules

Bug Fixes

• Revert "fix(execute): block cross-origin session-authenticated workflow runs"
• fix(access-control): exempt legacy blocks
• fix(execute): block cross-origin session-authenticated workflow runs
• fix(billing): deploy modal gates on workspace entitlement, not viewer plan
• Revert "fix(realtime): re-validate socket role and evict revoked collaborator…"
• fix(realtime): re-validate socket role and evict revoked collaborators

View changes on GitHub

Features

• feat(scheduled-tasks): pause/resume, mutation toasts, submit guards, empty state
• feat(scheduled-tasks): minute-granular calendar + user timezone preference
• feat(billing): gate programmatic workflow execution behind a paid plan
• feat(hubspot): add notes, emails, properties & associations tools
• feat(scheduled-tasks): calendar views + persisted, runnable tasks
• feat(blocks): add external-service url to block metadata

Improvements

• improvement(settings): right-align timezone picker, order by popularity, drop tooltip
• improvement(salesforce): align tools + block with Salesforce API and harden CRUD/analytics
• improvement(perms): followup to org scoping of permission groups
• improvement(permissions): permission groups scoped to organization level
• improvement(sim-trigger): change execution terminology to run
• improvement(react-query): codebase-wide audit — server-state hooks, webhook coherence, resume migration
• perf(mothership): virtualize chat transcript and isolate input from stream re-renders

Bug Fixes

• fix(chat): fail closed when embed gate cannot resolve workspace
• fix(mothership): streaming completion-flash fix + Tavily brand icon
• fix(db-part-4): enforce consistent cross-resource lock ordering
• fix(chat): escape attachment filename and validate file URL scheme to prevent XSS
• fix(skills): reuse shared upload field in skill import modal; logo-only Quartr icon
• fix(db): correct misleading error message when DATABASE_REPLICA_URL is malformed
• fix(db-part-3): bound cross-request shared promises against pool wedge

View changes on GitHub

Features

• feat(mailer): gate outbound email on AppConfig access-control ban list
• feat(deployments): add v1 deployment endpoints and Deployments block
• feat(integrations): add Documentation link to service-account connect modals
• feat(integrations): add Vanta integration with compliance, evidence file, people, vendor, vulnerability, and risk tools
• feat(tables): background jobs (delete/export/backfill on trigger.dev) + tenant-scoped query performance

Improvements

• Revert "improvement(auth): layer disposable-email-domains into signup email validation"
• refactor(deployments): consolidate version reads, status mapping, and v1 auth prologue
• improvement(auth): layer disposable-email-domains into signup email validation
• improvement(organization): invite validation experience
• improvement(files): fit-width previews and chip-chrome viewer controls
• improvement(billing): self-heal null usage limits and debounce api-key last-used writes
• improvement(emcn): show per-chip error tooltips on invalid email chips
• improvement(tables): migrate inputs to emcn chip components and clean up tables feature

Bug Fixes

• fix(mothership): tenant-check outputTable writes and route them through replaceTableRows
• fix(tables): heartbeat export job before upload so the stale janitor can't kill a live finalize
• fix(jira): add classic JSM scopes to close granular scope-set gap
• fix(tables): header "T…" flicker — emcn barrel Table component shadowed the Table icon in loading fallbacks
• fix(tables): scope optimistic stop-cancel to the active filtered view
• fix(tables): align sidebar dividers, disclosure spacing, and header height with the editor and page header
• fix(integrations): resolve OAuth connect UI by service id instead of display name
• fix(tables): per-batch delete-job commits, real trigger.dev retries, post-index ANALYZE guard

Other Changes

• chore(providers): remove claude-fable-5 model

View changes on GitHub

Features

• feat(integrations): add Daytona integration with sandbox lifecycle, code execution, and file tools
• feat(integrations): add Quartr integration with company, event, document, audio, and live event tools
• feat(integrations): add Convex integration with function execution and data export tools
• feat(integrations): add Brex integration
• feat(latex): add LaTeX integration with PDF compilation tool, block, and docs
• feat(temporal): add Temporal integration with workflow, schedule, and task queue tools
• feat(integrations): add Trigger.dev integration
• feat(auth): enforce domain and account bans on sign-in and workflow executions
• feat(persona): add Persona identity verification integration
• feat(byok): support multiple keys per provider with round-robin rotation

Improvements

• improvement(integrations): overhaul landing FAQs for SEO/GEO and fix dynamic OG images
• improvement(sockets): make offline mode recoverable and stop transient races tripping it
• improvement(db): route additional staleness-tolerant reads to the read replica
• improvement(logs): add copy raw trace button to trace view header

Bug Fixes

• fix(mothership): re-arm smooth-text reveal timer every render so streamed text can't freeze mid-sentence
• fix(files): support Safari < 17.4 in PDF preview
• fix(db): close optional-executor contract traps
• fix(mship): add tool watchdog
• fix(providers): correct pricing, deprecations, and capabilities across model catalog
• fix(docker): logger import
• fix(db-part-1): eliminate pool self-deadlock from nested checkouts inside transactions
• fix(modal): center full-size modals against the viewport instead of the content area
• fix(deps): dedupe radix focus-scope/dismissable-layer so in-modal dropdowns open
• fix(integrations): stop browser autofilling the service account API token field
• fix(workflow): show Remove from Subflow for unconnected blocks pasted into subflows
• fix(workflow-block): exclude trigger-advanced subblocks from canvas preview outside trigger mode

View changes on GitHub

Features

• feat(ci): run db migrations from github ci with environment-scoped secrets

Improvements

• improvement(docs): align docs UI with the platform emcn design system
• improvement(mship): contract update
• improvement(docs): builder-first IA reorganization of the English docs
• improvement(db): opt-in read-replica client + migration runner hardening

Bug Fixes

• fix(oauth): drop ungrantable JSM Forms scopes from Jira scope list
• fix(table): translate column name-keyed wire data for workflow tool calls on internal row routes

View changes on GitHub

Improvements

• refactor(ui): eliminate prop drilling in editor, home, sidebar, and logs dashboard

Bug Fixes

• fix(attribution): workspace id attr should be best-effort for self hosted users
• fix(security): neutralize CSV formula injection in logs export

View changes on GitHub

Features

• feat(codepipeline): add AWS CodePipeline integration with tools and block
• feat(workflows): sim trigger, logs v2 block, toolbar renaming
• feat(realtime): preflight schema-compatibility check on startup

Improvements

• improvement(mothership): smooth streamed text reveal + dropdown z-index fix
• improvement(chat-voice): modernize ElevenLabs TTS to Flash v2.5

Bug Fixes

• fix(billing): prevent deadlock with timeout
• fix(file-preview): gate streaming animation to prevent file patch issue with scroll based re-render
• fix(security): authz, IDOR, and abuse-prevention fixes
• fix(secrets): keep readonly secret names legible instead of dimming them
• fix(db): serialize concurrent migrations with a Postgres advisory lock

View changes on GitHub

Features

• feat(slack): assistant thread ops, paginated history/replies, and permalink
• feat(integrations): add AWS AppConfig integration with tools, block, and docs
• feat(integrations): expand tool coverage, audit integrations, regen docs
• feat(models): add Claude Fable 5
• feat(tables): stable column ids for metadata-only rename
• feat(emcn/toast): toast redesign — intent variants, stacking, hover reveal, dismiss-all
• feat(sendblue): add Sendblue iMessage/SMS integration with tools and triggers
• feat(auth): dynamic signup/login ban lists via AWS AppConfig
• feat(integrations): suggest curated skills per integration with one-click add
• feat(enrichment): add ZeroBounce, NeverBounce, and MillionVerifier email verification
• feat(tables): row-gutter drag-select, Cmd+F find, and select-all polish

Improvements

• improvement(tools): validate integrations, add Gong activity tools, regenerate docs
• improvement(emcn): consolidate chip chrome, enforce ChipModalField, paint real chrome in loading fallbacks
• improvement(mothership): v0.2
• refactor(emcn): make ChipModal footer/header props-driven and migrate all consumers
• improvement(metrics): emit hosted-key metrics to CloudWatch instead of OTel
• refactor(mothership-chats): rename task feature to chat, move route, add redirect
• improvement(perms): member removal reassignment policies
• improvement(platform): remove tour, simplify sidebar/header, drop loading skeletons

Bug Fixes

• fix(mothership): clear chat input after sending a message mid-conversation
• fix(agent): unique tool ids for multi-instance tools + icon updates
• fix(tables): key filter UI by stable column id; show column name in delete confirm
• fix(modal): preserve spacing in workspace delete confirmation label
• fix(tables): route large CSV imports to the background job instead of 413
• fix(terminal): truncate console values by size and cycles, not nesting depth
• fix(tables): stop insert-row flicker and return order_key from rows list
• fix(home,integrations): optical-center home input + integrations page render fix
• fix(user-input): atomic chip selection, modifier-key handling, and stale overlay ghost
• fix(tables): compare order_key bytewise (COLLATE "C") to stop insert collation errors
• fix(security): SSRF pinning, Twilio webhook auth, copilot token leak, audit-log tenant scoping

Other Changes

• chore(tables): own fractional-indexing in-house, drop runtime dep

View changes on GitHub