Kody v2026.08.19

Kody v2026.08.19

This release reworks how you connect external services to Kody. The integrations page is clearer, the OAuth flow is simpler, you can add multiple accounts on the same integration without losing the first, and reconnect notifications now tell you which account needs attention. The landing page is also significantly lighter, Kody publishes discovery documents so unconnected agents can find it, and several retired primitives are cleaned up.

New

• Browse published package files in a read-only explorer. You can now walk the file tree of any community listing or your own saved package at /files — no git session required. Listing, profile, and account package pages get a "Browse files" link that opens a GitHub-like viewer served from the published snapshot. (#1545)

• Kody now publishes agent-discovery documents. Unconnected agents landing on kody.codes can find the MCP server, API catalog, security policy, and public skills through /.well-known/ endpoints, robots.txt, and sitemap.xml. The homepage also serves markdown when an agent prefers it, with RFC 8288 Link headers pointing at the key resources. (#1526)

• Packages can now subscribe to integration.auth.succeeded. Kody emits this event after a successful host-side token refresh or OAuth connect, so packages can track working ↔ failed health instead of relying on a 24-hour cooldown. The payload includes the connection snapshot and source (refresh or oauth_connect) — no tokens or secrets. (#1525)

Improved

• The Integrations page is now one list with connections in the pane. Instead of treating integrations and connections as the same thing, the page shows the services you can connect; selecting a row opens that integration's accounts. Built-in rows carry a key mark, deep links like /account/integrations/google work as expected, and user-registered integrations still expose credential rotation under Advanced details. (#1529)

• The OAuth connect page is simpler. You see the provider, a short explanation, and the one action that matters. Endpoints, allowlists, and stored-config internals move behind Advanced details. Success leads with "Allow access" when a host approval is still needed, then links to the connection instead of account secrets. (#1527)

• You can add another account on an integration without replacing the first. The connections pane now has an "Add another account" link that prompts for a connection name (defaulting to google-2) before the usual authorize step, so both accounts stay connected. (#1544)

• OAuth reconnect notifications now name the connection and the provider account. When a grant dies, the failure event includes the connection label, scopes, timestamps, and a reconnect URL with loginHint when the label is an email — so a Google account picker is no longer a guessing game. (#1517, #1516, #1518)

• Token rotation now persists host-side. OAuth refresh tokens rotate through the host instead of the sandbox, so self-authored packages no longer fail rotation just because they lack a write grant for package secrets. (#1542)

• The landing page is lighter and faster. Shiki loads through a dynamic chunk on code-bearing routes only, the homepage hero gets srcset variants and a preload, styles.css inlines into the HTML, and the shirt pattern is re-encoded as a lossless WebP that is half the size. A weekly performance check runs automatically so regressions get caught early. (#1519, #1535)

• Community listings wait for data before first paint. The community browse page no longer flashes an empty "no results" state while the listing query loads — cards are in the first paint on both hard refresh and SPA navigation. (#1548)

• The account sidebar fades smoothly when you leave a shell page. Navigating away from /account or /admin now fades the sidebar with the page content instead of leaving it frozen on top of the destination. (#1543)

• MCP namespaces can now be destructured in package code. const { home } = kody.mcp works the same as kody.mcp["home"].tool() — bundler destructuring no longer loses the server binding. (#1537)

• Always-on MCP instructions are slimmer. Secrets, package invocation, workflows, and idempotency guidance move behind coding_guide_get, and connected MCP/OpenAPI bindings get a count and search hint instead of a full listing. (#1531)

• MCP search and capability discovery is progressively disclosed. Discovery returns counted domain indexes for broad queries, ranks your saved packages above raw provider operations, and bounds related-operation detail so agents get what they need without a firehose. (#1533)

• Package services, values, and remote connectors are retired. Package services are gone — outbound sockets aren't a process supervisor and a fleet check found no one running them. Values are absorbed into memories, package storage, repos, secrets, and integrations with no replacement key-value primitive; the Values nav item is gone but /account/values stays reachable for migration, and agents of users with stored values get a targeted retirement notice. Remote connectors are replaced by outbound MCP as the way to connect external MCP servers. (#1552, #1558, #1530, #1532, #1536, #1511)

• Smaller polish. Blog RSS subscribes with a full document load instead of a client-app transition; the timeline intro is now one sentence. Onboarding checklist dismissal is a platform flag, so leftover values can drop without a user action. The visual-recap skill now defaults to sequence diagrams. The Remix dependency is on 3.0.0-beta.10. (#1551, #1540, #1528, #1521)

Fixed

• Avatars and account URLs with dots no longer 404. Profile photos, integration names like google.personal, and other dotted ids now encode correctly so Remix doesn't treat the dot as a route delimiter. (#1538)

• Package exports, ad-hoc execute, and artifact rebuilds now survive platform deploys. When a deploy resets an in-flight isolate, Kody retries the operation instead of reporting it as a package crash. Workflows treat these resets as retryable infrastructure, not user errors. (#1520, #1515)

• Job metadata updates no longer force-publish package source. Updating job metadata won't trigger an unnecessary republish of the package that owns the job. (#1510)

• Community report status filters no longer overlay the admin nav rail. (#1550)

• Twitter/X iOS in-app browser scroll noise is filtered from Sentry. (#1549)

• The privacy page now says "MCP server configuration" instead of the retired "remote connector" wording, the auth-failed dispatch example points at the right package, and docs and ADR numbering are cleaned up after recent landings. (#1522, #1524, #1556)