v0.5.1

Highlights

Scoped credit budgets and hosted-plan gates

Operators can set subscription-credit and API-credit allowances on organization limits, projects, and bots. Organization API keys, Messaging, and Managed Agents enforce the applicable cap, and a spent cap blocks only charges that source would pay for; unknown draw sources refuse when either cap is spent. Debit rows record the split plus key, team, project, and bot ids, while projectDaily and botDaily totals appear in the console, Admin API, and web limits page.

On Ryu-hosted nodes, Claude plan backends are disabled so personal Claude plans are not used from datacenter IPs; self-hosted nodes are unaffected, and Claude Code inside a Ryu Box remains allowed with the datacenter-IP warning. The gate mirrors the existing ChatGPT restriction and is controlled by a hosted-Anthropic setting that defaults to off.

Affected packages:
@ryu/api
Documentation site (docs.ryuhq.com)
ryu-core
ryu-gateway
Website (ryuhq.com)
ryu-gw-budget
@ryu/db
@ryu/i18n

Per-surface device limits and counting

Accounts can cap concurrent signed-in devices by surface—web 10, desktop 5, self-hosted Core 10, mobile 5, browser extension 5, and CLI/MCP 5. When a surface is full, sign-in is refused with 403 DEVICE_LIMIT_REACHED instead of silently creating another session. Mobile and CLI sign-ins through a Core node count in their own device buckets via surface=mobile or surface=cli approval links and session tags. Enforcement uses the auth.device_limits rollout flag, off by default, and fails open on lookup errors.

Expired, impersonated, and guest sessions plus managed nodes, Boxes, and managed bots are never counted. Clients explain refusals in place across web sign-in, device approval, desktop sessions and login, extension OAuth, CLI account, and mobile sign-in. The web approval page can sign devices out inline, and the desktop sessions tab lists usage per surface with an API for reading limits.

Affected packages:
apps/cli
Documentation site (docs.ryuhq.com)
Mobile app
Website (ryuhq.com)
@ryu/auth
Desktop app
Browser extension
@ryu/api

3 more packages — see the changelog below.

Theme-aware interfaces and Liquid Glass

The assistant widget accepts auto, light, or dark themes; auto follows the host page and updates when it changes, while light and dark pin the widget. It detects the scheme from class and data-theme markers, color-scheme, background lightness, and prefers-color-scheme, and portaled popups inherit the resolved scheme. The closed Ask Ryu launcher uses the Island's logo circle with a Liquid Glass body, popover scrim, hairline ring, floating shadow, and heavy blur.

Marketplace interface contributions can name color themes per mode; while active, the desktop applies those tokens across the window without replacing saved presets or publishing to Core theme prefs. Sandboxed Companion app UIs follow through the theme bridge, and tokens written to can also carry shape and typography variables. A Settings > Appearance > Interfaces switch, on by default, controls interface color themes. Liquid Glass can be turned off in desktop Appearance, mobile Settings > General, and the Ryu Bot account sheet; the switch defaults on and off drops to flat fallbacks.

Affected packages:
@ryu/assistant-widget
ryu-core
Desktop app
Documentation site (docs.ryuhq.com)
ryu-kernel-contracts
@ryu/i18n
@ryuhq/protocol
@ryuhq/sdk

3 more packages — see the changelog below.

Semantic computer use

Ghost’s click and type tools now act through macOS AX, Windows UIA, and Linux AT-SPI, with each input tool returning a via field and a disposition: delivered, verified, retried, or refused. Automatic HID fallback happens only in auto mode and only for ACTION_NOT_SUPPORTED or PLATFORM_NOT_SUPPORTED with NotDelivered and known bounds; other failures return POLICY_DENIED with details.semantic_error. Shadow’s computer-use loop and AX tools use the same semantic path, and a failed step ends the run as blocked while keeping earlier steps.

Element references carry the snapshot id as @:eN and resolve strictly, so a ref from an older or different snapshot fails with STALE_REF or AMBIGUOUS_TARGET instead of matching another element; secure field values are never stored. Ghost tools return a shared GhostError with code, message, delivery, and retry information. ghost-hands enforces key policy and layout-aware keys so unsendable keys fail before posting, and macOS Cmd+A follows the active layout.

Affected packages:
ghost
ghost-eyes
shadow
plugin: plugins
ghost-hands

Complete changelog

Read the complete release notes.

The complete changelog exceeds GitHub's release-body limit, so it lives on the docs site. That page lists the reviewed changes for every affected package; the highlights above summarize it.

Full changelog: v0.5.0...v0.5.1