v1.2.0

Added

• Profile: set a password under Profile → Security if you were onboarded
  without one, or change the one you have. Every set, change or reset emails
  you and signs you out on your other devices; this one stays signed in.
• Sign-in & onboarding: Forgot password? on the sign-in screen emails a
  single-use link, valid for an hour, to choose a new password.
• Sessions & Runs: the Model field in New session names the default
  model the session will run on (e.g. Default · Claude Opus 4.8), taken from
  the runtime's default in Profile, and lists it first in the dropdown. A
  runtime with no default set keeps Default (runtime selects).

Changed

• Docs: the User guide overview and What Flow is describe every way a
  run starts (column, Run, schedule, Slack or Teams, webhook, tracker),
  whose agent credential it runs on, the session queue, and where results go
  back — not only a card moving on the board. Triggers & gates adds Teams
  messages, tracker events and who a run belongs to.
• The flow-web image is about 130 MB smaller (about 35 MB to pull): it no
  longer carries the native extensions its gems ship for Ruby versions other
  than the one it runs. The flow-grok image is about 160 MB smaller (about
  65 MB to pull) without a second, unused copy of the Grok CLI binary.
• Company settings: cancelling the subscription stops it at once instead of
  at the end of the billing period, so workers are no longer billed for the
  rest of a month nobody wants. Usage up to the cancellation goes on a final
  invoice, and the email to admins says the subscription is cancelled. A
  cancellation already scheduled for a period's end can still be taken back
  until its date.
• Tasks: a link to another site in a card comment opens in a new tab, as
  one in the card description already did; links within Flow stay in the same
  tab, in the description too.
• Templates: links to other sites in a template's readme and setup notes,
  and in the setup page of an installed template, open in a new tab.

Fixed

• Sign-in & onboarding: sign-in and magic-link rate limits now count attempts
  sent as JSON, not only form posts, so the per-account brute-force limit can no
  longer be bypassed by changing the request's content type.
• Sessions & Runs: usage reported for a session is accepted only when the
  batch carries that session's key. Token and cost figures can no longer be
  written to a session by anyone who has seen its (non-secret) terminal link.
• Repositories: gh inside a session is signed in for the attached GitHub
  repositories on Kubernetes deployments too, so agents can read checks, watch
  Actions runs and open pull requests without building a token by hand. Until
  now it only worked with the Docker runtime.
• Company settings: unticking Managed by Aixle on a company puts it
  on the free allowance, or stops it until a card is added if it has already
  used the allowance or its subscription has ended. It no longer shows an
  Active subscription with a Cancel button that refuses. Unticking needs a
  worker limit, as creating a paying company does. An active workspace with no
  subscription is offered Add a card instead of Cancel subscription.

Images

Published as ghcr.io/aixlehq/flow-<name>:1.2.0: flow-web, flow-otlp-ingest, flow-agent-base-core, flow-claude-code, flow-cursor-cli, flow-codex, flow-gemini-cli, flow-antigravity-cli, flow-grok, flow-kiro-cli. Web 1.2.0 launches the agent images of the same version.

What's Changed

• docs: describe every way a run starts in the guide's mental model by @artempartos in #453
• build(docker): drop unused native extensions and Grok binary copy by @artempartos in #454
• fix(repositories): ship the gh wrapper in the agent base image by @artempartos in #455
• feat(auth): set, change and reset a password from the Security tab by @artempartos in #457
• fix(billing): bill a company once it stops being managed by Aixle by @artempartos in #456
• feat(billing): cancel a subscription at once, not at the period's end by @artempartos in #458
• fix(board): open external links in comments and templates in a new tab by @artempartos in #459
• feat(sessions): name the default model in the New Session dialog by @Hitin in #462
• fix(security): close login-throttle JSON bypass and require usage-ingest key by @artempartos in #461
• ci: shard the Rails and Vitest suites and merge their coverage by @artempartos in #460
• chore(release): 1.2.0 by @artempartos in #464

New Contributors

• @Hitin made their first contribution in #462

Full Changelog: v1.1.0...v1.2.0