Kody v2026.07.29

Kody v2026.07.29

This one is about reliability hardening at every layer. The first full-backup day sealed and the first in-product restore drill went green — two disaster-recovery milestones that caught real bugs on the way. OAuth token rotation is now atomic so a mid-rotation crash can no longer strand your integrations. MCP execute gains idempotency keys so retried runs replay cleanly instead of double-charging. And a round of Sentry noise filters keeps the error inbox focused on things that actually matter.

New

• MCP execute now supports idempotency keys for safe retries. Pass an idempotencyKey and Kody eagerly persists the run record — so if a network timeout or worker eviction drops your connection, retrying the same key returns the original result instead of running the work again. Retries while a run is still in flight report inProgress: true with the existing runId, and retries after completion return replayed: true with the retained result. Handler results are also now captured as a bounded snapshot (4 KiB cap) on webhook deliveries and bundled finishes, so run_get can show you what a completed run actually produced. (#1001)

Improved

• Fewer false Sentry alerts. Four classes of noise that aren't application bugs are now filtered before they open issues: deploy-time platform resets of Durable Objects during code updates (#1007), Firefox's cross-origin DOM permission errors triggered by Session Replay (#1006), package secret-access denials that are correct policy enforcement (#999), and email_send rejections when an agent tries to mail a non-self recipient (#997). The result: your error inbox only surfaces things you can actually act on.

• The disaster-recovery runbook now carries a dated live-evidence log recording the first verified nightly export, the first completed staging run, the first sealed full-backup day, and the first green restore drill — along with what's still unproven. Stale migration-era framing across docs has been cleaned up to describe current behavior. (#1004, #1008)

Fixed

• OAuth token rotation is now atomic and fail-closed. Previously, rotated refresh and access tokens were written as two sequential operations — a crash between them left your integration with an unusable token pair, and the provider had already invalidated the old refresh token. Now both secrets persist in a single batch write, and authorization is checked before the provider request, so a denied package can't trigger a rotation it can't store. This affects every rotating provider — X, Notion, GitHub, Slack, Linear, and any future one. (#1003)

• Backup days now seal despite bucket-lock rejections and inventory drift. The first day with both a verified manifest and a completed staging run couldn't seal because R2's object-lock policy rejects any put to an existing key before evaluating conditional headers — wedging retries at the first already-copied object. Meanwhile, the staging exporter's positional cursor duplicated dumps when new buckets registered mid-window and shifted the sorted inventory. Both are fixed: lock rejections are treated as "object already exists" and fall through to byte-comparison checks, and the exporter now tracks dumps by identity instead of position. (#1000)

• Restore drills no longer fail on D1 import uploads. The first in-product restore drill against a sealed day hit HTTP 411 because streamed upload bodies arrived with chunked encoding and no Content-Length. The upload path now pipes through FixedLengthStream — a Workers-native mechanism that emits the exact byte length we already know from the verification hashing pass — with zero memory overhead on the ~118 MB SQL file. (#1002)