Release v1.0.49

What's Changed

Version bumped from 1.0.48 to 1.0.49

Recent Changes

• Bump version to 1.0.49 (#8227) (c53ec6d)
• fix(frontend): render the UTC hover timestamp in UTC, not local time (#7193) (ef7b59b)
• docs(aws): drop stale client parameter from get_file_metadata docstring (#7150) (0e5deae)
• Recover tenant phone formats deterministically and stop re-clicking committed skill pills (#8216) (05f36a4)
• Recover blank multi-entry Workday sections via section-scoped add-control fallback (#8215) (5860156)
• SKY-14046 Let Copilot test-run a workflow whose login step already has a saved credential (#8214) (4caac99)
• Prevent oversized logs from splitting into error fragments (#8213) (2dd9506)
• Fix SkyCDP reload document lifecycle race (#8212) (f4fe10b)
• Remove three Copilot sign-in fields that were always false (SKY-14054) (#8211) (0cbfce0)
• SKY-13777 Stop telling the copilot that a challenge on the page closes the submit path (#8210) (05d4b97)
• Match Playwright selector-engine semantics in the skycdp facade (SKY-13461) (#8209) (c658bc9)
• Downloads-only CDP interception when the egress monitor is unenrolled (SKY-14066) (#8208) (8d64185)
• Bill fair-share pod time, not wall clock, on multi-activity pods (SKY-14049) (#8207) (e4e41a8)
• SKY-14045 Copilot: stop re-deciding login blocks the workflow already has (#8206) (6dc0104)
• SKY-14044 Add an add_block tool so Copilot stops re-sending the whole workflow to add one step (#8205) (595cad7)
• SKY-14047 Copilot: require credential approval only for the blocks a test run will execute (#8204) (e7434da)
• Recover Task v2 summary deliverable when the LLM skips the response envelope (SKY-14004) (#8203) (4a62365)
• Drop the unused drive.file scope from the Google Sheets consent screen (SKY-13427) (#8202) (dba2ceb)
• Give Task V3 observe the question context it drops (curb get_html spam) (#8201) (7d7ff34)
• Let Copilot use a connected inbox for sign-in codes, not just saved credentials (#8200) (22a3292)
• SKY-13979: derive the extraction schema instead of asking to confirm it (#8199) (7138ce8)
• Add ask-calibration eval dataset for the workflow copilot (SKY-13981) (#8198) (a783de8)
• Stop reporting browser-extension clipboard refusals as frontend errors (SKY-13996) (#8196) (357b92a)
• SKY-14030: isolate disabled-control retry cadence (#8195) (6ec6a21)
• SKY-14030: isolate Vaadin polling cadence (#8194) (9c26da3)
• Reap a run-owned external browser immediately when its owner goes terminal (SKY-13546) (#8193) (2e07baf)
• Bound the Hetzner attach lane's scaler ceiling to its node pool (SKY-14022) (#8192) (5de7402)
• fix(ci): read the OSS sync high-water mark from commits, not the PR body (#8191) (af02e59)
• Use one rolling branch for OSS sync PRs (#8186) (27f89ab)
• Preserve database timeouts during idempotent workflow creation (#8183) (41a4a5c)
• Deduplicate copilot credential field sentinel sets (#8182) (eaccc7d)
• Revert the browser prompt-injection defenses, keeping the download authorization seam (#8140) (30b566f)
• Expose MCP code block goals and migration guidance (#8145) (a6b1f31)
• fix(execution-channel): release adopted browser_state on every exit (#8112) (9a3d1b1)
• SKY-13612: Fix ZIP payload type so the OSS sync build typechecks (#8136) (579d463)
• Deflake quickstart capture_logs tests against shard-order structlog state (#8110) (09f5865)
• fix(SKY-13634): stop the copilot without replaying, locking, or faking failure (#8137) (c13d207)
• Keep the copilot auto-bind credential receipt at its original position (SKY-13636) (#8138) (2f61e24)
• docs: fix CLI references and broken links in README/CONTRIBUTING/CLAUDE.md (#7948) (7e07a80)
• Bank the live cookie jar when saving a browser profile mid-run; clear crashed-exit markers on load (#8097) (ee7576e)
• Stop display-capture workers publishing black frames over remote-browser livestreams (SKY-13699) (#8147) (2d0b9b0)
• Extract externalized Gmail OTP body parts so magic-link emails parse with their body (#8091) (c136170)
• Serve live view for externally hosted browser sessions via per-session CDP screencast (SKY-13291) (#8101) (e829eb8)
• fix(SKY-13728): contain Recordings tab overflow and fix tab hierarchy (#8156) (afa7044)
• fix(SKY-13729): consolidate browser session status to the DS Badge (#8155) (49a6b75)
• Fix Bitwarden credential fetch failing when a saved login has no two-factor secret (SKY-13676) (#8103) (e9d3cc8)
• Gate the four task_v2 planner levers behind one org-scoped flag (SKY-13239) (#8150) (f8d51d8)
• SKY-13612: Bulk agent export emits one ZIP with individual per-agent files (#8105) (ae3b857)
• Regenerate the OpenAPI document for the browser session stream_transport field (#8102) (6cbe7f4)
• Secure and automate Chrome extension re-pairing (#8149) (192d3d5)
• Classify the remaining secure CodeBlock runner error codes out of UNKNOWN (SKY-13561) (#8081) (a3ce92f)
• SKY-13605: sanitize local lane fallback browser creation errors (#8093) (b65ef92)
• fix(SKY-13730): remove duplicate logo from browser session header (#8154) (0cdcaf0)
• SKY-13584 persist workflow run browser runtime and fallback signals (#8092) (f0a98e3)
• Open a named site from its credential's login page instead of asking for a URL (#8099) (aa10a95)
• Mediate browser and CDP downloads (#8135) (3e8f015)
• feat: harden browser prompt injection defenses (#8133) (fa75db9)
• fix(SKY-13721): give the initial browser-session load a real spinner (#8157) (8ccec89)
• Shorten the VNC disconnect message to two sentences (#SKY-13720) (#8159) (3fe6159)
• fix(cdp-input): release adopted browser_state on every teardown path (#8111) (93863d0)
• SKY-13503 deduplicate credential placeholder sentinels (#8141) (eca3bc1)
• fix(SKY-13725): use destructive styling for the Stop action (#8153) (c56a015)
• fix: exclude dev_scripts-dependent tests from OSS sync (#8184) (7cf050e)
• Collapse the two code-block env settings into one tri-state (SKY-13242) (#8152) (65b9beb)
• feat(SKY-13761): enable the standalone codeblock-runner on AWS staging/production (#8177) (cb9d096)
• Default MCP YAML workflows to code version 2 (#8148) (3aa597a)
• test(mcp): gate extension bridge and coordinate regressions (#8100) (da93935)
• Bound per-value size of run-detail API payloads (SKY-13015) (#8119) (258125e)
• fix(cdp-input): Delete key does nothing in hosted browser live view (SKY-13682) (#8114) (a35d343)
• Survive browser-extension bridge port contention at MCP boot (SKY-13645) (#8098) (9bcc6a9)
• fix(SKY-13585): allow saving a conditional whose merge point is the finally block (#8096) (77aab67)
• Revalidate revoked API keys immediately (#8126) (90da0e9)
• feat(live-view): add navigable URL input to hosted browser sessions (SKY-13683) (#8143) (0cce730)
• Add a credential Advanced toggle to opt out of automatic browser profiles (frontend) (#8146) (409ebc5)
• Let users opt out of automatic browser-profile saving per credential (backend) (#8144) (9fab949)
• Copilot run rows read as plain language, not Playwright selectors (SKY-13637) (#8142) (713d180)
• SKY-13187 ADR: contain generated cached scripts by mint-time validation (Family B) (#8113) (039c5e1)
• Handle download-directory containment rejection in the action path (SKY-13390) (#8127) (f0c90e3)
• Track which browser profile a boot actually applied; stop silent seed drops (SKY-13545) (#8095) (220a4a5)
• Demote per-step 'Video data not found' warning to debug (#8088) (c355f20)
• Adopt the Chrome Web Store extension identity and add store packaging (SKY-13555) (#8086) (828cc15)
• SKY-13591: Cut Python CI cost with whole-file duration balancing (#8085) (8375d17)
• Document the SKY-13575 artifact-URL remint recovery step and close the #14589 review follow-ups (#8087) (bfbc62a)
• Refuse CLI credentials against the silent production default, everywhere a client is built (SKY-13500) (#8083) (bee072c)
• SKY-13782 Surface partial download-save failures so the binding verdict abstains instead of failing the block (#8176) (7b57efb)
• fix(SKY-13697): disable Done until the debug session's browser session id resolves (#8178) (e0e1596)
• Fix flaky broker spawn cooldown that leaked extra daemon launches (#8173) (70154bc)
• Re-sign first-party artifact URLs whose signature no longer verifies (SKY-13575) (#8082) (82e8237)
• Append the exception class to code-block tab-open failure reasons (SKY-13338 follow-up) (#8040) (da19129)
• fix(SKY-13587): keep the finally block out of conditional branch containers (#8130) (da9b832)
• Request only the current integration's Google OAuth scopes on the consent screen (#8129) (b7742b5)
• fix(SKY-13722): remove unnecessary border from browser session header (#8161) (59ac8db)
• Fix main: point 4 copilot enforcement tests at the renamed nudge helper (SKY-13692) (#8128) (bb0d5b6)
• fix(SKY-13586): stop the editor flagging a finally block as a disconnected block (#8131) (3f610ae)
• Fix mislabeled enforcement telemetry and trim 366 redundant copilot tests (#8077) (ab3744a)
• Revalidate redirect hops on the remaining navigation sinks (SKY-13070) (#8054) (a5a3741)
• Serve MCP initialize without waiting on extension-mode startup side work (SKY-13758) (#8175) (b914f3b)
• Share the browser-extension bridge across concurrent agents (SKY-13757) (#8172) (9ec8f1b)
• Bound workflow idempotency waits (SKY-13795) (#8174) (cb65830)
• fix(SKY-13726): align timeline empty state with sibling tab pattern (#8160) (9a6fbe3)
• Run file parsing off the event loop so the workflow activity keeps heartbeating (SKY-13574) (#8132) (0b36693)
• Fix docs canonical base: Mintlify drops the /docs hosting prefix from page paths (#8171) (1209563)
• Remove Workflow Copilot request-policy classifier pre-pass (#8169) (c7bb008)
• Close out the apex cutover: record the permanent 308 and point docs canonicals at www (#8168) (6a32247)
• Don't lose the record of a downloaded file when a code block fails or auto-recovers (SKY-13694) (#8167) (a043dbb)
• Stop the copilot being cut off mid-repair after 35 model calls (SKY-13734) (#8166) (3c0d5da)
• Let the copilot save an edit to a login step without logging in again (SKY-13709) (#8162) (bd7f9fb)
• Surface DataTables Select row-checkbox cells in the element tree (SKY-13560) (#8151) (b471155)
• Stop Copilot from continuing after a successful workflow run (#8122) (2c8c556)
• Let the copilot finish download requests instead of stalling at the results page (#8125) (ac5959e)
• feat(browser-engine): enable Rustwright on both image lanes with classical fallback (RUS-5 v2) (#8123) (3c2bed1)
• Add fail-closed dice-image captcha solve path (#8124) (0b68a55)
• fix: preserve provider-owned remote download handling (#8115) (1948de7)
• fix: qualify shared browser ownership with live run context (#8121) (c2c2633)
• fix: close browsers when only same-run aliases remain (#8118) (4888e45)
• fix: self-heal free-text input truncated by the fill/type seam (#8116) (d5a8424)
• SKY-13536 Copilot: solve captchas met while exploring, instead of asking the user (#8078) (d89cb8d)
• SKY-13553 Copilot: release a credential onto any site the user named, in words or a link, from any turn (#8079) (a1bf137)
• Name a new agent as soon as the user says what they want (#8084) (acb2580)
• Copilot keeps the code it wrote when editing a workflow; spreadsheet writes fail instead of appending blanks (SKY-13624) (#8104) (416ab03)
• Stop re-sending outdated copies of the copilot's draft code to the model (SKY-13652) (#8106) (3b04388)
• SKY-13579 Copilot: recognize a saved credential by its name, however the message is phrased (#8107) (62bca00)
• Copilot: stop refusing the credential scouting the credential check requires (SKY-13609) (#8089) (c95a991)
• Copilot: recognize a credential ID someone pasted, however the message is worded (#8094) (a03968c)
• Revert #14581: restore scout-before-code; credential-ID fix returns after the interaction is fixed (#8090) (3c3a108)
• Copilot: use the credential ID someone pasted, however they worded the message (SKY-13552) (#8076) (dfe02ce)
• Fix extension bridge reconnect wedge and CDP child-target hang (SKY-13562) (#8075) (6e237f2)
• Serve the browser a scoped session token instead of the organization API key (SKY-13084) (#8074) (fa4319e)
• Classify secure CodeBlock runner fail-closed as an infrastructure error (#8073) (0e5ae31)
• Capture download-wait error overlays that animate in after insertion (#8072) (3140edd)
• SKY-13518: Stop asserting a minted run as browser-session owner in run_sdk_action (#8071) (2f46c12)
• Control your own browser from Skyvern MCP via a Chrome extension bridge (SKY-13370) (#8070) (37e5a14)
• Re-arm the sequential-gate wait every 900s instead of 120s (#8069) (b76a8f7)
• Probe viewer presence via a shared S3 marker so Hetzner pools keep live-view gating (#8068) (f4aaec0)
• fix(SKY-13445): render interim copilot build-test runs neutrally, not as an amber outcome warning (#8067) (d044bec)
• Render the login block URL before the credential profile boot (SKY-13479) (#8066) (8fe8134)
• Show a copilot receipt for a silently auto-bound credential, with Change to correct it (#8065) (79242f0)
• Stamp a read-only auto-bind credential signal on the copilot narrative stream (#8064) (38d2d8a)
• Flush the downloaded profile archive before unzipping it (#8063) (e17cf26)
• Store OTP/magic-link values verbatim instead of LLM-retyped (fixes magic-link 400s) (#8062) (b31f2dd)
• Copilot: stop asking permission for a saved login the workflow already provides (#SKY-13514) (#8061) (036e245)
• SKY-13517 Stop ending the copilot's turn because a page looked blocked (#8060) (6ca0f9d)
• Bound the minted-session ledgers and cover the CDP fan-out with a two-client test (#8059) (d5dabbb)
• SKY-13485 Copilot: bind a requested output to the value on screen, and append to the column you pinned (#8058) (9eeafa6)
• Fail closed on sandbox facade denials, and collapse the runner's three failure channels into one (#8057) (523228e)
• Resolve credential-equal workflow inputs via placeholder tokens in the planning prompt (#8056) (9c6003c)
• Give late-connecting CDP clients their own page sessions on a shared browser (#8055) (5a2dc37)
• [Database] Fix: use portable distinct step count (#7769) (679cafb)
• docs: fix scheduling examples to use client.schedules API (#7924) (0a9df48)

Full Changelog: v1.0.48...v1.0.49

What's Changed

• docs: fix scheduling examples to use client.schedules API by @latent-9 in #7924
• [Database] Fix: use portable distinct step count by @Heman10x-NGU in #7769
• Give late-connecting CDP clients their own page sessions on a shared browser by @AronPerez in #8055
• Resolve credential-equal workflow inputs via placeholder tokens in the planning prompt by @LawyZheng in #8056
• Fail closed on sandbox facade denials, and collapse the runner's three failure channels into one by @AronPerez in #8057
• SKY-13485 Copilot: bind a requested output to the value on screen, and append to the column you pinned by @andrewneilson in #8058
• Bound the minted-session ledgers and cover the CDP fan-out with a two-client test by @AronPerez in #8059
• SKY-13517 Stop ending the copilot's turn because a page looked blocked by @andrewneilson in #8060
• Copilot: stop asking permission for a saved login the workflow already provides (#SKY-13514) by @andrewneilson in #8061
• Store OTP/magic-link values verbatim instead of LLM-retyped (fixes magic-link 400s) by @celalzamanoglu in #8062
• Flush the downloaded profile archive before unzipping it by @celalzamanoglu in #8063
• Stamp a read-only auto-bind credential signal on the copilot narrative stream by @celalzamanoglu in #8064
• Show a copilot receipt for a silently auto-bound credential, with Change to correct it by @celalzamanoglu in #8065
• Render the login block URL before the credential profile boot (SKY-13479) by @celalzamanoglu in #8066
• fix(SKY-13445): render interim copilot build-test runs neutrally, not as an amber outcome warning by @celalzamanoglu in #8067
• Probe viewer presence via a shared S3 marker so Hetzner pools keep live-view gating by @pedrohsdb in #8068
• Re-arm the sequential-gate wait every 900s instead of 120s by @pedrohsdb in #8069
• Control your own browser from Skyvern MCP via a Chrome extension bridge (SKY-13370) by @suchintan in #8070
• SKY-13518: Stop asserting a minted run as browser-session owner in run_sdk_action by @AronPerez in #8071
• Capture download-wait error overlays that animate in after insertion by @LawyZheng in #8072
• Classify secure CodeBlock runner fail-closed as an infrastructure error by @AronPerez in #8073
• Serve the browser a scoped session token instead of the organization API key (SKY-13084) by @trevor-cheung in #8074
• Fix extension bridge reconnect wedge and CDP child-target hang (SKY-13562) by @suchintan in #8075
• Copilot: use the credential ID someone pasted, however they worded the message (SKY-13552) by @andrewneilson in #8076
• Revert #14581: restore scout-before-code; credential-ID fix returns after the interaction is fixed by @andrewneilson in #8090
• Copilot: recognize a credential ID someone pasted, however the message is worded by @andrewneilson in #8094
• Copilot: stop refusing the credential scouting the credential check requires (SKY-13609) by @andrewneilson in #8089
• SKY-13579 Copilot: recognize a saved credential by its name, however the message is phrased by @andrewneilson in #8107
• Stop re-sending outdated copies of the copilot's draft code to the model (SKY-13652) by @andrewneilson in #8106
• Copilot keeps the code it wrote when editing a workflow; spreadsheet writes fail instead of appending blanks (SKY-13624) by @andrewneilson in #8104
• Name a new agent as soon as the user says what they want by @andrewneilson in #8084
• SKY-13553 Copilot: release a credential onto any site the user named, in words or a link, from any turn by @andrewneilson in #8079
• SKY-13536 Copilot: solve captchas met while exploring, instead of asking the user by @andrewneilson in #8078
• fix: self-heal free-text input truncated by the fill/type seam by @LawyZheng in #8116
• fix: close browsers when only same-run aliases remain by @LawyZheng in #8118
• fix: qualify shared browser ownership with live run context by @LawyZheng in #8121
• fix: preserve provider-owned remote download handling by @LawyZheng in #8115
• Add fail-closed dice-image captcha solve path by @LawyZheng in #8124
• feat(browser-engine): enable Rustwright on both image lanes with classical fallback (RUS-5 v2) by @LawyZheng in #8123
• Let the copilot finish download requests instead of stalling at the results page by @andrewneilson in #8125
• Stop Copilot from continuing after a successful workflow run by @andrewneilson in #8122
• Surface DataTables Select row-checkbox cells in the element tree (SKY-13560) by @LawyZheng in #8151
• Let the copilot save an edit to a login step without logging in again (SKY-13709) by @andrewneilson in #8162
• Stop the copilot being cut off mid-repair after 35 model calls (SKY-13734) by @andrewneilson in #8166
• Don't lose the record of a downloaded file when a code block fails or auto-recovers (SKY-13694) by @andrewneilson in #8167
• Close out the apex cutover: record the permanent 308 and point docs canonicals at www by @suchintan in #8168
• Remove Workflow Copilot request-policy classifier pre-pass by @andrewneilson in #8169
• Fix docs canonical base: Mintlify drops the /docs hosting prefix from page paths by @suchintan in #8171
• Run file parsing off the event loop so the workflow activity keeps heartbeating (SKY-13574) by @AronPerez in #8132
• fix(SKY-13726): align timeline empty state with sibling tab pattern by @AronPerez in #8160
• Bound workflow idempotency waits (SKY-13795) by @AronPerez in #8174
• Share the browser-extension bridge across concurrent agents (SKY-13757) by @AronPerez in #8172
• Serve MCP initialize without waiting on extension-mode startup side work (SKY-13758) by @AronPerez in #8175
• Revalidate redirect hops on the remaining navigation sinks (SKY-13070) by @trevor-cheung in #8054
• Fix mislabeled enforcement telemetry and trim 366 redundant copilot tests by @andrewneilson in #8077
• fix(SKY-13586): stop the editor flagging a finally block as a disconnected block by @celalzamanoglu in #8131
• Fix main: point 4 copilot enforcement tests at the renamed nudge helper (SKY-13692) by @celalzamanoglu in #8128
• fix(SKY-13722): remove unnecessary border from browser session header by @AronPerez in #8161
• Request only the current integration's Google OAuth scopes on the consent screen by @celalzamanoglu in #8129
• fix(SKY-13587): keep the finally block out of conditional branch containers by @celalzamanoglu in #8130
• Append the exception class to code-block tab-open failure reasons (SKY-13338 follow-up) by @AronPerez in #8040
• Re-sign first-party artifact URLs whose signature no longer verifies (SKY-13575) by @AronPerez in #8082
• Fix flaky broker spawn cooldown that leaked extra daemon launches by @AronPerez in #8173
• fix(SKY-13697): disable Done until the debug session's browser session id resolves by @AronPerez in #8178
• SKY-13782 Surface partial download-save failures so the binding verdict abstains instead of failing the block by @andrewneilson in #8176
• Refuse CLI credentials against the silent production default, everywhere a client is built (SKY-13500) by @AronPerez in #8083
• Document the SKY-13575 artifact-URL remint recovery step and close the #14589 review follow-ups by @AronPerez in #8087
• SKY-13591: Cut Python CI cost with whole-file duration balancing by @suchintan in #8085
• Adopt the Chrome Web Store extension identity and add store packaging (SKY-13555) by @suchintan in #8086
• Demote per-step 'Video data not found' warning to debug by @wintonzheng in #8088
• Track which browser profile a boot actually applied; stop silent seed drops (SKY-13545) by @celalzamanoglu in #8095
• Handle download-directory containment rejection in the action path (SKY-13390) by @AronPerez in #8127
• SKY-13187 ADR: contain generated cached scripts by mint-time validation (Family B) by @AronPerez in #8113
• Copilot run rows read as plain language, not Playwright selectors (SKY-13637) by @celalzamanoglu in #8142
• Let users opt out of automatic browser-profile saving per credential (backend) by @celalzamanoglu in #8144
• Add a credential Advanced toggle to opt out of automatic browser profiles (frontend) by @celalzamanoglu in #8146
• feat(live-view): add navigable URL input to hosted browser sessions (SKY-13683) by @AronPerez in #8143
• Revalidate revoked API keys immediately by @AronPerez in #8126
• fix(SKY-13585): allow saving a conditional whose merge point is the finally block by @celalzamanoglu in #8096
• Survive browser-extension bridge port contention at MCP boot (SKY-13645) by @suchintan in #8098
• fix(cdp-input): Delete key does nothing in hosted browser live view (SKY-13682) by @AronPerez in #8114
• Bound per-value size of run-detail API payloads (SKY-13015) by @AronPerez in #8119
• test(mcp): gate extension bridge and coordinate regressions by @marcmuon in #8100
• Default MCP YAML workflows to code version 2 by @marcmuon in #8148
• feat(SKY-13761): enable the standalone codeblock-runner on AWS staging/production by @AronPerez in #8177
• Collapse the two code-block env settings into one tri-state (SKY-13242) by @trevor-cheung in #8152
• fix: exclude dev_scripts-dependent tests from OSS sync by @suchintan in #8184
• fix(SKY-13725): use destructive styling for the Stop action by @AronPerez in #8153
• SKY-13503 deduplicate credential placeholder sentinels by @AronPerez in #8141
• fix(cdp-input): release adopted browser_state on every teardown path by @AronPerez in #8111
• Shorten the VNC disconnect message to two sentences (#SKY-13720) by @AronPerez in #8159
• fix(SKY-13721): give the initial browser-session load a real spinner by @AronPerez in #8157
• feat: harden browser prompt injection defenses by @AronPerez in #8133
• Mediate browser and CDP downloads by @AronPerez in #8135
• Open a named site from its credential's login page instead of asking for a URL by @andrewneilson in #8099
• SKY-13584 persist workflow run browser runtime and fallback signals by @AronPerez in #8092
• fix(SKY-13730): remove duplicate logo from browser session header by @AronPerez in #8154
• SKY-13605: sanitize local lane fallback browser creation errors by @AronPerez in #8093
• Classify the remaining secure CodeBlock runner error codes out of UNKNOWN (SKY-13561) by @AronPerez in #8081
• Secure and automate Chrome extension re-pairing by @suchintan in #8149
• Regenerate the OpenAPI document for the browser session stream_transport field by @AronPerez in #8102
• SKY-13612: Bulk agent export emits one ZIP with individual per-agent files by @AronPerez in #8105
• Gate the four task_v2 planner levers behind one org-scoped flag (SKY-13239) by @trevor-cheung in #8150
• Fix Bitwarden credential fetch failing when a saved login has no two-factor secret (SKY-13676) by @AronPerez in #8103
• fix(SKY-13729): consolidate browser session status to the DS Badge by @AronPerez in #8155
• fix(SKY-13728): contain Recordings tab overflow and fix tab hierarchy by @AronPerez in #8156
• Serve live view for externally hosted browser sessions via per-session CDP screencast (SKY-13291) by @AronPerez in #8101
• Extract externalized Gmail OTP body parts so magic-link emails parse with their body by @celalzamanoglu in #8091
• Stop display-capture workers publishing black frames over remote-browser livestreams (SKY-13699) by @celalzamanoglu in #8147
• Bank the live cookie jar when saving a browser profile mid-run; clear crashed-exit markers on load by @celalzamanoglu in #8097
• docs: fix CLI references and broken links in README/CONTRIBUTING/CLAUDE.md by @FixedStarXH in #7948
• Keep the copilot auto-bind credential receipt at its original position (SKY-13636) by @celalzamanoglu in #8138
• fix(SKY-13634): stop the copilot without replaying, locking, or faking failure by @celalzamanoglu in #8137
• Deflake quickstart capture_logs tests against shard-order structlog state by @wintonzheng in #8110
• SKY-13612: Fix ZIP payload type so the OSS sync build typechecks by @AronPerez in #8136
• fix(execution-channel): release adopted browser_state on every exit by @AronPerez in #8112
• Expose MCP code block goals and migration guidance by @marcmuon in #8145
• Revert the browser prompt-injection defenses, keeping the download authorization seam by @AronPerez in #8140
• Deduplicate copilot credential field sentinel sets by @AronPerez in #8182
• Preserve database timeouts during idempotent workflow creation by @AronPerez in #8183
• Use one rolling branch for OSS sync PRs by @AronPerez in #8186
• fix(ci): read the OSS sync high-water mark from commits, not the PR body by @AronPerez in #8191
• Bound the Hetzner attach lane's scaler ceiling to its node pool (SKY-14022) by @AronPerez in #8192
• Reap a run-owned external browser immediately when its owner goes terminal (SKY-13546) by @LawyZheng in #8193
• SKY-14030: isolate Vaadin polling cadence by @AronPerez in #8194
• SKY-14030: isolate disabled-control retry cadence by @AronPerez in #8195
• Stop reporting browser-extension clipboard refusals as frontend errors (SKY-13996) by @AronPerez in #8196
• Add ask-calibration eval dataset for the workflow copilot (SKY-13981) by @andrewneilson in #8198
• SKY-13979: derive the extraction schema instead of asking to confirm it by @andrewneilson in #8199
• Let Copilot use a connected inbox for sign-in codes, not just saved credentials by @andrewneilson in #8200
• Give Task V3 observe the question context it drops (curb get_html spam) by @pedrohsdb in #8201
• Drop the unused drive.file scope from the Google Sheets consent screen (SKY-13427) by @AronPerez in #8202
• Recover Task v2 summary deliverable when the LLM skips the response envelope (SKY-14004) by @suchintan in #8203
• SKY-14047 Copilot: require credential approval only for the blocks a test run will execute by @andrewneilson in #8204
• SKY-14044 Add an add_block tool so Copilot stops re-sending the whole workflow to add one step by @andrewneilson in #8205
• SKY-14045 Copilot: stop re-deciding login blocks the workflow already has by @andrewneilson in #8206
• Bill fair-share pod time, not wall clock, on multi-activity pods (SKY-14049) by @wintonzheng in #8207
• Downloads-only CDP interception when the egress monitor is unenrolled (SKY-14066) by @wintonzheng in #8208
• Match Playwright selector-engine semantics in the skycdp facade (SKY-13461) by @wintonzheng in #8209
• SKY-13777 Stop telling the copilot that a challenge on the page closes the submit path by @andrewneilson in #8210
• Remove three Copilot sign-in fields that were always false (SKY-14054) by @andrewneilson in #8211
• Fix SkyCDP reload document lifecycle race by @LawyZheng in #8212
• Prevent oversized logs from splitting into error fragments by @AronPerez in #8213
• SKY-14046 Let Copilot test-run a workflow whose login step already has a saved credential by @andrewneilson in #8214
• Recover blank multi-entry Workday sections via section-scoped add-control fallback by @trevor-cheung in #8215
• Recover tenant phone formats deterministically and stop re-clicking committed skill pills by @trevor-cheung in #8216
• docs(aws): drop stale client parameter from get_file_metadata docstring by @anxkhn in #7150
• fix(frontend): render the UTC hover timestamp in UTC, not local time by @anxkhn in #7193
• Bump version to 1.0.49 by @wintonzheng in #8227

New Contributors

• @latent-9 made their first contribution in #7924
• @Heman10x-NGU made their first contribution in #7769
• @FixedStarXH made their first contribution in #7948
• @anxkhn made their first contribution in #7150

Full Changelog: v1.0.48...v1.0.49