Kody v2026.07.23

Kody v2026.07.23

This release delivers three major investments: smarter agent discovery with domain-scoped MCP search, a production backup and disaster recovery system, and durable inbound email. It also transitions Kody to Fair Source licensing and completes a full overhaul of the plan system.

New

• Domain-scoped MCP search. Agents can now browse Kody's capabilities by domain instead of always getting a flat ranked list. Broad exploratory queries like "what can you do with email" return a compact one-line-per-domain overview, bypassing embeddings for lower latency and cost. A new domain parameter lets agents scope follow-up searches to a single area, or list an entire domain in curated order with inline call shapes. Every search result now carries its domain annotation, so agents learn the capability map for free and can self-scope follow-ups without guessing. Search result ordering between values and integration entries is also now stable, preserving registry order even when multiple results tie on relevance. (#895, #897)

• Production backups and disaster recovery. Kody now has a backup control plane with immutable storage, signed manifests, and verified restore. Each backup is signed and bound to its source identity, database digest, and trusted baseline; zero-byte exports are rejected before reaching storage. Restore drills verify the exact staged snapshot bytes against the trusted manifest, so no pathname substitution or post-sign tampering can reach the database. Readiness assessment confirms the full provenance chain is intact before signaling healthy. (#884, #899)

• Kody is now Fair Source. Kody is relicensed from MIT to the Functional Source License, version 1.1 (FSL-1.1-ALv2). Source stays public and available for non-competing use; each release converts to Apache-2.0 after two years. Community packages you publish through Kody remain MIT. The home page, README, and docs now accurately reflect Fair Source terminology, and the home page links to Kody's public GitHub repository. (#863, #886, #861)

Improved

• Inbound email is now durable and idempotent. Each incoming message is fingerprinted by provider, envelope sender, recipient, and MIME content so retries never create duplicate threads or attachments and quota is charged exactly once. Storage, quota updates, and downstream subscription effects are written in sequence under account write protection, preventing races with account deletion. A scheduled reconciliation job catches deliveries that stalled mid-processing, and failed subscription effects retry automatically with a dead-letter backstop after three attempts. (#891)

• Plans are now fully explicit and finite. The implicit "unlimited if unset" behavior is gone: every account holds a named plan. New signups default to Free. Existing accounts that previously had no enforced limits have been migrated to Max, which carries high but finite quotas: 10,000 saved packages, 5,000 scheduled jobs, 100 GiB storage, and more. Admins see four concrete tiers, Free, Pro, Partner, and Max, each backed by real numbers rather than a bypass. (#862, #864, #865)

• ChatGPT and Codex now have separate setup tabs in onboarding. ChatGPT setup walks through Settings > Plugins > Browse plugins > Create app, identifies which paid plans support the feature, explains managed-workspace admin enablement, and includes a copyable site icon URL. Codex shows only its own config.toml snippet. (#803)

• Integration package suggestions are now ranked correctly. When you connect an integration, Kody resolves the provider identity from the actual integration domain (including hyphenated names and legacy aliases like googleapis), runs an exact-match filter first, and then applies trust ordering. This prevents prose-only description matches from crowding out the packages you actually want. (#885)

• The scheduled OAuth token cleanup job now saves its progress reliably across runs. Overlapping invocations are serialized so two runs cannot conflict, associated tokens are removed before the grant record is deleted, and a corrupted cursor resets only that listing rather than stalling the entire sweep. (#887)

Fixed

• Account data exports now include your owned media and attachments, delivered in resumable chunks, and the export endpoint is bounded so large accounts do not time out. Account deletion now enters a protected "deleting" state so new writes cannot race the cleanup, with improved retry behavior on partial failures. Privacy redaction for social metadata is tightened to include only signals you own. (#890)

• Outbound email no longer exposes an API path that could insert a message record pointing at a nonexistent attachment blob. (#894)