v0.65.9

⚠️ Known issue (hosted-SaaS only)

If you run BINARY_SOURCE=github (the hosted-SaaS configuration), do not deploy this release yet — agents will reject the github.com binary download URL during auto-update due to a host-mismatch security check. The fleet stays on the previous version but agents enter a retry loop.

If you run BINARY_SOURCE=local (the configuration this release was built for — closes #625), this release is safe to deploy — binaries are served from your local API and the host-mismatch issue doesn't apply.

Fix tracking: see the auto-update host-mismatch issue. Hotfix planned as v0.65.10.

What's Changed

• fix(api): partner-multi-org orgId pass-through (#620) by @ToddHebebrand in #621
• fix(recovery): construct server-relative download URL for dev_update by @ToddHebebrand in #615
• chore: tidy repo root, surface live demos in README by @ToddHebebrand in #616
• chore(readme): refresh content from #622 by @ToddHebebrand in #623
• chore(readme): correct Mobile/SSO claims by @ToddHebebrand in #624
• fix(api,agent): per-deployment manifest signing for BINARY_SOURCE=local (closes #625) by @ToddHebebrand in #635

Full Changelog: v0.65.8...v0.65.9