Kody v2026.09.01

Kody v2026.09.01

The night before open signup. Kody sheds its social layer, retires three brand domains, and tightens every security seam that could bite at scale — then ships a Waiting inbox so you always know what needs your attention.

New

• Waiting is your current-state inbox. /account/waiting shows you everything only you can clear — verify your email, review a locked package, reconnect a failed integration, finish onboarding — derived live from your account state, not a read/unread feed. The header avatar now opens Waiting by default, and agents can call waiting_summary to see the same queue. (#1928)

• You can now change or set a password from Account. A Security panel on /account lets you update your password or set a first one on OAuth/passkey accounts. The password-reset form also stops fighting password managers — the honeypot field that browsers autofilled with your saved URL is renamed, so reset actually goes through. (#1923)

• Package delete is on the website. Free accounts cap at 10 saved packages, and the only way to remove one was through an agent. You can now delete from the package page by typing its name to confirm, and the agent capability requires the same typed confirmation so it can't fire by accident. (#1932)

• Integration logos are data, not deploys. Operators can curate brand marks — Google, YouTube, anything without a usable favicon — through an admin catalog that stays usable at thousands of icons, grouped by letter and searchable. Saved integrations pick the right logo through alias and host matching, so no SVG sits in the repo and no deploy is needed per icon. (#1925, #1941)

• Official guides load through search, not execute. Agents can now search({ entity: "package_authoring:guide" }) to read bundled markdown without spinning up an expensive sandbox call. Guides are a first-class search entity type, ranked by title and summary, and unadvertised guides stay out of listings but still work by exact id. (#1943)

• You hear back when your platform feedback is resolved or dismissed. Feedback no longer ends in silence — when we act on a submission, Kody emails you the outcome and an invite to send more. (#1931)

• Past-due grace and cancellation feedback. If your card retry fails, your paid limits now stay active through Stripe's dunning window instead of dropping to free immediately. When you cancel, a "Before you go" panel asks why, and the pricing page now bridges from the home positioning to the full factory. (#1916)

• control-kody CLI and Feature Map for agent verification. Cloud Agents get a machine-readable catalog of account surfaces, a CLI with doctor, login, request, preview, health, and map commands, and a daily maintenance job that opens a PR when the map drifts from reality. (#1944)

• New public FAQ page at /faq, a memories JSON export on /account/memories, recent successes on /account/activity, and a ChatGPT-sized Kody app icon you can Save As. (#1897, #1899, #1896, #1901)

Improved

• Execute caps tightened for open signup. Free drops from 250 to 100 daily execute calls, Standard from 5,000 to 500, and Pro from 10,000 to 2,000. Usage rollups now record only real MCP execute-tool calls — not jobs — and the operator can see per-user cost so a train of abuse pages instead of a single busy day. (#1940)

• Public/private is a repo setting, not a package.json field. Visibility lives on the repo record now. Public repos are full-source, forkable, and appear on /community and /@username — no MIT gate, no trusted badge, no "public but not listed" teaser state. Going private 404s your public URLs; forks keep their copies. (#1907)

• Agents can lock integrations and secrets to named packages. integration_lock and secret_lock tighten grants one-way — the same shape as mcp_server_lock — so an agent can finish the Gmail-drafts loop without asking the owner to visit /account/integrations. Unlocking or removing a grant stays website-only. (#1924)

• Self-authored secret access is clearer. Packages you wrote or adopted can now read your user secrets without an explicit Allowed packages entry, but host approval is never automatic — for anyone, including your own packages. The secret editor copy and secret_list from a package runtime both reflect this. (#1921)

• Slimmer MCP capability graph. Three duplicated surfaces are gone: package_codemod_* (use the admin fleet tools or the codemod-runner package), email_usage_get (use usage_get), and repo_write_file (use repo_edit_files with a write edit). (#1933)

• Community social is gone. Follows, stars, timeline, and signup auto-follow are hard-cut. The public package catalog — browse, publish, fork, rate, report, featured — stays. /timeline and /account/stars are 404, and profile pages no longer show follower counts. (#1934)

• Legacy brand hosts retired. heykody.app, heykody.dev, and kodyapps.dev are sunset from production; kody.codes is the only origin. Disaster-recovery maintenance posts now point at the live origin, not a parked redirect. (#1935, #1938)

• Durable OpenAPI purged. kody.openapi[...] bindings, synthesized search ops, spec summarize/scaffold, raw-token refresh, and ambient execute scratch storage are all gone. OpenAPI spec fetches now route through the same egress gateway as every other outbound request, and redirect chains no longer leak where they landed. Research moves to forkable packages. (#1936, #1920)

• Built-in OAuth retired as a connect path. New connects and reconnects now require your own OAuth app credentials. Existing platform connections keep refreshing until you migrate, but the chooser no longer lists unused built-in apps. (#1926)

• Official registry packages for forkable lookup. @kody/integrations-sh wraps registry search and @kody/openapi covers bind-and-call, so agents fork a package instead of hunting for retired platform bindings. (#1946)

• Ship-PR Discord posts now carry a human headline and a self-evaluated difficulty (Easy/Medium/Hard), so #github is glanceable instead of a slug. (#1929)

• Onboarding Step 1 is simpler — one primary action, clear help, and warnings where they belong. (f076293d)

• psl@kody.codes is now a reserved system inbox, reserved-sender sends fan out email.system-message.sent events, the public Sentry tunnel is rate-limited per address, compact MCP server instructions are flagged for 2048-character clients, BugBot is triggered through a dedicated handle, the homepage HTML budget is raised for landing growth, and a blog post on owning agent work is live. (#1917, #1892, #1913, #1903, #1906, #1888, #1898)

• Documentation, the Feature Map, and test suites are groomed after the night's hard cuts — stale OpenAPI and community-social references are pulled, leftover assertion pins are dropped, and the largest route and service test suites are split into focused domain modules with zero behavior change. (#1947, #1948, #1886, #1885, #1884, #1882, #1881, #1880, #1879, #1878, #1877, #1875, #1872, #1871, #1870, #1869, #1866, #1865)

Fixed

• Sandboxed packages can no longer reach another package's storage. storage_export, storage_query, and execute({ storageId }) now honor the same per-bucket isolation as packageStorage() — untrusted package code can't name another bucket in your account to read or overwrite. (#1915)

• Security hardening across auth flows. The 2FA verify route now uses the canonical safe-redirect validator (closing an open-redirect via backslash normalization), repeated 2FA code attempts are rate-limited and locked out, and the password-reset timing side channel is closed so you can't probe whether an email belongs to an account. (#1912, #1911, #1914)

• Turnstile no longer crashes on mobile Safari when a Remix re-render wipes the widget host — orphaned mounts are detected and remounted, and reset never throws. (#1930)

• ChatGPT MCP connect works again — a workers-oauth-provider upgrade fixes token exchange for clients that advertise private_key_jwt plus none. (#1905)

• OAuth authorize returns 400 instead of 500 on malformed multipart/form-data without a boundary. (#1919)

• /account/secrets no longer 500s when you have 99+ packages — the listing query now chunks D1 bindings under the 100-parameter cap. (#1918)

• Account deletion no longer redirects in a loop, deleted-email addresses can sign up again without a tombstone blocking them, locked-package approve-publish renders during SSR, and the desktop onboarding agent chooser fills leftover seats. (#1891, #1894, #1895, #1890)

• Production deploys no longer fail on transient Cloudflare 503s during secret sync — retries use the same budget as the deploy step. (#1942)

• Long tokens in walkthrough chat bubbles wrap instead of overflowing, and a stale-fixture hang in the workers-unit suite is cleared. (#1889, #1904)