Kody v2026.09.06

Kody v2026.09.06

Onboarding is no longer a service gateway — it's a three-step home that teaches you what Kody is: the place your agents share memory, secrets, packages, and workflows. First-time Codex users get a one-click launch instead of copy-paste CLI commands, official @kody packages install without a scare dialog, and the whole publish path got meaningfully faster. Plus a quieter dev experience, a cheaper backup seal, and a desktop header that finally reaches your account.

New

• Onboarding is now a three-step home, not a gateway. Step 1 picks your first agent. Step 2 drops the old service quest and gives you four copy-paste teach prompts plus a pointer to the onboarding guide — so you're granting Kody access, not wiring up API middleware. Step 3 picks a second agent and greys out the same vendor family (starting with Codex greying ChatGPT), with a portability-proof card folded in. Old /onboarding/step-2/:service URLs redirect to the new Step 2. The checklist and search leftover now track all three wizard steps. (#2092, #2094)

• Codex connects in one click. Desktop Codex now leads with an Open Codex button that launches the app via protocol handler — copy-CLI and TOML stay as fallbacks. On mobile, Codex keeps the MCP URL and app icon path. (#2091)

• Official @kody packages install without a double-check. First-party listings skip the "someone else's code" caution entirely — one click installs. Third-party listings keep a lighter amber note instead of the old red warning. After install, the page shows Open package / Open fork and Use in agent instead of a dead listing. (#2091)

• Account link in the desktop header. Signed-in desktop visitors now see an Account link immediately left of the avatar, so you can reach the account hub without opening the mobile menu or going through your public profile. The avatar still links to /@username. (#2089)

Improved

• Publishing multi-export packages is faster. Isolated artifact rebuild now chunks four targets per isolate (matching the check-time fan-out) instead of booting one throwaway per export. already_published races no longer force a full rebuild when the snapshot and artifacts already match. Check-time esbuild is deferred to the rebuild phase so the bundler runs once, not twice. Unchanged targets from the previous published snapshot are copied and relinked instead of rebuilt. You'll notice this most on single-export bumps of large multi-export packages. (#2084, #2085, #2086, #2087)

• Publish phase timings are visible to agents. The capability response now includes clone_ms, checks_typecheck_ms, checks_bundle_ms, rebuild_ms, dependents_ms, and total_ms on success, so publish-latency probes no longer depend on worker logs. (#2085)

• Sign-in autofill works with 1Password. Login email now uses autocomplete="username" so vault entries that store the address in the username field can fill. Signup keeps autocomplete="email". (#2091)

• Profile copy trimmed. The "This is how the world sees you." hint is gone from the owner's public profile — you already know it's your page. (#2088)

Fixed

• Local dev no longer reports to production Sentry. Vite HMR crashes from npm run dev are filtered out of the production Sentry project, and readRouterUrl falls back to the current client URL after an HMR identity swap instead of throwing. (#2082)

• Interactive publishes no longer hit Cursor's MCP timeout. The inline escalation budget dropped from 55s to 35s, leaving room to return a dispatched handle before Cursor's ~60s client timeout fires. (#2083)

• Partial full-backup seals can resume cheaply. Sealed dump bodies are now skipped when their size already matches, and referenced-blob verification runs 32 HEADs in parallel instead of sequentially — so a partial seal with 3,000+ blobs completes instead of timing out on binding I/O. (#2080)

• DR control plane accepts Access service-token JWTs. Operator automation using Cloudflare Access service tokens (which carry common_name instead of email) no longer gets rejected. (#2081)

• A lint rule now catches vanished-copy leftovers. not.toContain assertions of instructional copy you just deleted are flagged during npm run lint, and the leftover assertions that motivated the rule have been cleaned out. (#2090, #2095)