Kody v2026.10.22

Kody v2026.10.22

The signed-in workspace now feels like a real app with persistent navigation and a usage dashboard, first-time sign-up lets you choose your username, and the koala has a fresh new mark. Under the hood, a wave of reliability fixes tackles hung schedulers, stranded webhook deliveries, and MCP grants that were kicking each other out.

New

• You now choose your permanent username before your account is created. First-time social sign-in no longer invents a generic username you can't change. The OAuth callback parks your verified identity and sends you to a username page with live availability checking and suggestions—password and social signup share the same flow. (#4151)

• The signed-in workspace has a persistent sidebar and a usage overview. Organization switching, grouped navigation, and a Resources section stay with you across workspace pages. The overview shows recent repositories, activity, upcoming jobs, and three charts: daily execution outcomes, activity by source, and monthly credits spent by package. (#4153)

• A new koala mark rolls out across the web app. The updated logo appears in the header, auth screens, favicons, PWA tiles, and OAuth/ChatGPT listing surfaces, with a right-click popover on the header brand to copy or download the SVG and PNG assets. A public /brand-guide page collects every format. (#4157, #4161)

Improved

• The homepage comparison sections are redesigned. "Without / With Kody" and "What Kody is and is not" now read as clear before/after pairs with aligned subgrids, arrow connectors, and recessed-vs-raised card styling. A color-mix fix (switching from oklch to oklab) also stops highlighted cards from rendering pink with teal borders. The home-page nav wordmark is enlarged to match. (#4152, #4167)

• Light mode is lighter and the app typography is tighter. The canvas is now near-white with white panels, and account/workspace pages use a smaller, less bulky type scale. Marketing and auth typography stay separate. (#4135)

• Expired package Keys show as Expired, not missing. When a package-scope Key has passed its expiry, the Credentials tab now displays an Expired status with a bound-credential link instead of a confusing "needs attention" card and an Add-credential prompt that could create duplicates. (#4131)

• You get a clear warning when path-encoded credentials cause upstream 4xx errors. The run log and fetch diagnostics now name the credential and explain that path placeholders encode as a single segment, so characters like / or ? in your secret can break routing. (#4148)

• A batch of daily-friction papercuts is smoothed out. Email MCP descriptions now name your current org, control-kody execute prints follow-handle details, fetch-body secret scanning is case-insensitive like the gateway, worker-test types accept preview environments, and the Feature Map documents multi-URL webhook mint. (#4134)

• Docs now describe the workspace as it works today. Guides and architecture pages point at /@<slug>/-/usage and /@<slug>/-/agents, the old island-app migration guide is removed, and leftover rollout phrasing is cleaned up. (#4166, #4150, #4132)

Fixed

• Credit-attribution rollups are unstuck. Hourly usage rollups had failed for every workspace since Oct 9 because non-automation usage wrote an empty string where the schema required NULL. Empty and invalid sources are now normalized, and rollup failures are reported to Sentry. Billing was never affected—only the attribution dashboard was frozen. (#4163)

• Connecting one OpenAI MCP surface no longer kicks out another. ChatGPT, Codex, and similar clients share a single client ID, and each new authorization was deleting older grants for the same user. Kody now keeps concurrent grants and prunes only the oldest excess beyond 10, so reconnecting one surface stops 401-ing the others. (#4154)

• Webhook deliveries with an Idempotency-Key are no longer silently dropped. If the first queue attempt claimed the ledger key and died, retries reused the same key and exhausted after ~5 minutes—while the sender only saw a 202. Same-owner retries can now reclaim an in-progress claim immediately. (#4144)

• Run now stops corrupting package job context. Clicking Run now was overwriting the job's stored storage context with the clicker's session, so later scheduled runs lost access to package secrets until you republished. Run now now uses the job's stored context for execution, never overwrites it, and requires job:execute authorization. Missing-context secret errors also give clearer guidance, suggesting republish instead of a misleading scope change. (#4147, #4149)

• Hung scheduler alarms are contained. A job whose sandbox code left an unresolved Promise could hang the scheduler alarm, stranding the claimed job in a running state and retriggering the hang on every retry. Hung-request cancels are now treated as executor error outcomes, the job is settled as a visible failure, and the scheduler moves on. (#4138)

• Durable Object code-updated resets are retried instead of sent to Sentry. Platform reset messages prefixed with D1_ERROR: were slipping past the isolate-reset normalizer and generating noise. They're now recognized as retryable and dropped from Sentry. (#4136)

• MCP settings mistakes stay off Sentry. Duplicate server names, invalid URLs, and similar caller errors are now classified as McpCallerError so they log to mcp-event without triggering Sentry, while genuine connection failures still do. (#4143)

• Editing a directory path gives a clear caller error. When an agent tries to write to an existing folder (like src), the raw EISDIR error is replaced with a message telling you to pass a file path, and it stays off Sentry. (#4141)

• Missing package-app runtime bundles return a retryable 503. Opening a package app right after publish could hit a 500 and report to Sentry. The same condition that invoke already handles as transient now returns 503 with clear copy and no Sentry noise. (#4139)

• kody dev check fails when bundle inputs aren't in the publish snapshot. A local build could read gitignored generated files and pass offline, then fail at publish. The check now compares esbuild inputs to the publish snapshot and refuses if they diverge. (#4146)

• noreply@anthropic.com is now on the email allowlist. (7f8ab44)

Kody v2026.10.21

Kody v2026.10.21

This release reshapes how hosted package apps are served—moving from /packages/{name} to a short /{name} path on your subdomain—while credentials gain a proper Disconnect that preserves your configuration, and fleet error diagnostics get per-error-name breakdowns for the first time.

New

• Hosted package apps now live at /{name} on your subdomain. Your apps resolve at {user}.kody.run/{name} instead of the longer /packages/{name} mount. Legacy URLs still serve so existing bookmarks and links keep working, and HTML navigations to the old path get a permanent redirect while non-HTML traffic stays on a quiet dual-serve. Kody-owned host routes moved under /-/, reserved name leaves are blocked at create and publish, and a default /robots.txt is served on every host. Docs and CLI examples now teach the short path. (#4096, #4101, #4103, #4107)

• Disconnect and Delete now mean different things for credentials. Disconnect clears the secret value but keeps the credential row and its fill placement, so reconnecting restores your configured setup. Delete removes the credential entirely. The credential editor, lists, and CLI all distinguish the two actions. (#4098)

• Admin agents can check fleet health without a browser. A new adminFleetErrorRate capability returns daily error counts, caught-vs-error breakdowns, and affected-user counts (aggregates only) over a configurable window, with an optional per-user filter. (#4104)

• Platform feedback submitters can now see resolution notes and linked PRs. When an admin resolves or dismisses your feedback, a submitter-visible note and any related pull request URLs are stored and returned through the meta capabilities. Internal admin notes stay private. (#4118)

• Open app uses a self-describing /open handoff path. The package page has a single Open app button that routes through /@{user}/packages/{name}/open, which mints a session and redirects to the hosted origin. Old bare-mount links still hand off. (#4092)

• Self-publish blockers now explain why approval is required. Structured reasons list the exact storage identifiers, mounts, jobs, or webhooks that triggered the gate, and the approval page shows the same copy. Storage detection no longer false-positives on identifiers that appear only inside string or template text. (#4094)

Improved

• kody dev check now runs the same publish checks the server runs. A commit that passes dev check will no longer fail at publish time on the credential stamp gate, and the approval page shows failures inline instead of a generic message. A read-only POST /v1/packages/check endpoint backs the CLI so you can validate before pushing. (#4127)

• Fleet error diagnostics now record the error name. Package-runtime failures write a sanitized error code or name to usage events, and adminFleetErrorRate breaks down failed runs by error name per day. Re-export static-call chains are metered once at the innermost layer, and transient job retries no longer inflate fleet error counts. (#4113)

• control-kody browse --screenshot writes a full-page PNG from a signed-in live origin, so walkthrough evidence comes from real layout instead of a file:// SSR dump. (#4089)

• Docs now describe credential lists, package-app paths, and publish exits as they actually work today, including the lasting legacy /packages mount and current package-approval behavior. (#4100, #4128)

Fixed

• MCP agents no longer ask you to paste an API token. When an agent hits a not-authenticated CLI error, it now bootstraps CLI auth itself via kody login instead of steering toward a pasted KODY_API_TOKEN. Server instructions, CLI help, and local-execute docs all lead with the agent bootstrap path. (#4121)

• Malformed repoApplyPatch diffs now return a clear 400, not a 500. The error message tells you the patch is malformed and that hunk header line counts must match the body, so agents can retry instead of hitting a platform-looking failure. (#4105, #4110)

• secretList with package scope now resolves to the declaring package, not the consumer. An imported provider export that writes package-scoped secrets can now list them too—previously the same code could set secrets it could not see. (#4112)

• Profile package lists no longer appear empty for their own owner. Package lists were keyed by person id instead of personal org id, so post-migration accounts saw zero packages despite direct URLs working. (#4095)

• Spike alerts survive a quiet hour without dropping. A failed alert delivery retries on later sweeps even when the next hour is below threshold, and the alerted index is written once per sweep to avoid KV rate limits. (#4097)

• Package-scope secrets inserted while the manifest was unreadable now get repaired. Reconnect re-applies the declared fill placement when a later value write lands, and the credential page shows a note for secrets still on the unread default. (#4120, #4091)

• Pinned @modelcontextprotocol/server at 2.3.1 to clear a production audit advisory. (#4123)

Kody v2026.10.20

Kody v2026.10.20

This release overhauls how Kody alerts on package-runtime failures—replacing one-size-fits-all fleet paging with per-owner spike emails and a multi-user platform incident alert—while credentials gain editable fill-placement and the publish CLI gets truthful exit codes and network diagnostics.

New

• Credential fill placement is now visible and editable. When you create or edit a secret or connection, you can choose where Kody injects it—headers only, body, or query string. New credentials default to headers-only, and Kody observes and logs cases where a different placement would have blocked a fill, without interrupting the actual injection. The UI, MCP, and CLI all surface the placement metadata, and the CLI warns during publish and dev-check when it can't prove headers-only. (#4081, #3994)

• Package-owner error spikes now email you directly instead of paging the whole fleet. When one of your packages hits ≥20 errors at ≥25% error rate in an hour, Kody sends a single email to your org owners and logs an admin audit event—no repeat pages while the spike is active, and the alert re-arms after two healthy hours or 24 hours of quiet. (#4080)

• Platform-wide incidents get their own alert when multiple users are affected. A new fleet alert watches for sustained errors across many distinct actors over two consecutive 15-minute windows, ranking packages and users by impact and labeling a dominant package when one is responsible for over half. This ships alongside the existing fleet error-rate alert until the new path proves itself in production. (#4082)

Improved

• kody package publish now exits non-zero on refusals. Checks failures, locked packages, approval-required, and non-fast-forward statuses all exit 1 with the API message on stderr, so scripts and CI stop on rejection instead of silently continuing. Already-published and async-dispatched statuses still exit 0. (#4079)

• Publish network failures now tell you whether the request was sent. Connect-phase errors (timeout, DNS, connection refused) say the request was not sent; socket-closed-after-send errors say the outcome is unknown and point you at workflowRunList to check. The --json output includes a sent field so automation can branch on it. (#4077)

• Hosted app URLs now resolve from the package name, not a stale id. Publish and search-detail links open the app that's actually served even when the stored kody id lags behind the current package name. (#4003)

• Contributor docs now describe the stack as it is today. Origin is TanStack Start, Remix covers utilities and optional package apps, webhook ingress names the native Start route, and package-app URL templates use the name leaf. (#4087)

Fixed

• already_published no longer fires on real publishes. A durable escalation could advance the published commit before re-entry, making RepoSession report already_published to agents who then skipped dependent republishes. The capability now remaps tip-moving results to published and reserves already_published for a true no-op. Stale app serve and retryable workflow runs that looked final are also corrected. (#4076)

• Stale-chunk reloads no longer throw a TanStack undefined-module TypeError. After a deploy, the one-shot hard reload resolves the missing chunk as undefined, which TanStack tried to index—Sentry caught the follow-on error before recovery completed. Kody now suppresses that specific follow-on while a reload is pending; real missing-export errors still report. (#4073)

• Community forks are stored under your bound org, not your person id. New signups whose personal org id differs from their person id had forks written to an owner nobody reads, making them invisible in package lists and git remote. Forks now use the same owner resolution as packageSave. (#4069)

• Scheduled job usage metering no longer races the invocation clock. Claimed-run finalization now hands deferred metering to the host lifecycle instead of relying on a two-second finalize window, so large batches or slow writes don't drop usage events. (#4070)

• Fleet error-rate alert stops repeat-paging. Day elevations now cool down for 24 hours, and the same completed window never re-pages with the same top owner. (#4083)

• Local packageSave in dev mode works again—the always-remote Artifacts binding is dropped so the mock client takes over. (#4085)

• Bare Node builtins no longer break after bundling, and package-graph requests build from unresolved imports so dependency resolution matches what the runtime actually loads. (#4074, #4067, #4068)

• The enablements table now requires a package_id, closing a gap that allowed records without one. (#3738, #4084)

• Internal test suites are cleaned up—leftover pins and tautological assertions removed—and a browser e2e now covers the early Emotion SSR style-hoist path that was previously only proven by a fallback assertion. (#4066, #4071)

Kody v2026.10.19

Kody v2026.10.19

Tonight is mostly about hardening the seams: hydration mismatches get quieter and more diagnosable, stale tabs survive deploys without a hard crash, and several production Sentry issues from the TanStack Start migration are closed out. Platform feedback also gets a quota bump and clearer rate-limit messaging.

New

• Platform feedback submissions now show your remaining quota. The feedback list returns how many submissions you have left in the rolling 24-hour window, and the cap is raised from 10 to 20. Rate-limit and queue-limit errors now surface as readable retry messages instead of generic "Internal error." (#4037, #4026)

• Feature Map is now generated from real routes. Instead of hand-maintained path lists that drifted, the map is built from the actual route tree and validated in CI, so verification notes stay accurate. (#4053)

Improved

• Stale browser tabs survive production deploys. Kody now retains hashed client assets for seven days across deployments, so an open tab can still load older route chunks after a release. As a fallback, if a chunk is gone anyway, the page reloads once instead of showing a broken dynamic-import error. (#4022, #4021)

• /health is now a styled page in browsers. It uses Kody design tokens with light/dark support, while the JSON response stays byte-identical for monitors and agents. (#4059)

• Pre-push now catches unused code before CI does. The local pre-push hook runs the same unused-file/export/type check as CI, so agents fix those failures before they reach the pipeline. (#4054)

• Contributor docs trimmed to what's current. Stale architecture, setup, and top-level guide pages that no longer match the codebase have been pruned, and the remaining docs now describe the website as TanStack Start with server-function mutations. (#4064, #4047, #4049, #4057, #4018)

Fixed

• git fetch and git pull work again on existing clones. A protocol mismatch with Artifacts upload-pack negotiation caused fetches to fail with "bad pack header" once the client already had objects. Fresh clones worked; existing ones now fast-forward normally. (#4060)

• Hydration mismatches from the Start migration are resolved. Emotion SSR styles no longer race the hydrate path, browser-extension theme-color edits no longer trigger recoverable mismatches, and component stacks are preserved in error reports so future hydration issues actually point at the offending component. (#4024, #4025, #4039)

• POST /account/packages.json is restored. Older retained client assets still POST mutations to that endpoint; the Start migration had dropped the route, causing empty 405s and JSON parse crashes. (#4033)

• Transient server-function network errors are no longer reported as crashes. Tab-resume fetch() failures to TanStack Start RPC endpoints are now filtered from Sentry while real server errors stay visible. (#4031)

• Caught package throws no longer inflate the fleet error rate. Handled package_static_call exceptions in successful runs are tracked as a distinct caught outcome instead of counting as failures in fleet alerts. (#4040)

• Published repo sessions free their scratch storage immediately. Workspace scratch was counting toward your storage entitlement for 14 days after publish; it's now released as soon as publish succeeds, and older published sessions heal on inspect. (#4036)

• Email delivery holds respect freshness and retry safely. A stale bounce can no longer arm a hold after a newer delivered status, and consecutive-failure counts survive provider-event retries. (#4019)

• Redirect-only account links now leave the document. In-app clicks on routes like /account/credentials and /connect/credential follow the server 302 instead of being handled as broken SPA pages. (#4013)

• Integration credential URLs must use HTTPS. Device and token endpoints can no longer send credentials over cleartext HTTP (except local mocks), and upward imports in the integrations layer have been removed. (#4020)

• Redundant secret database reads are deduped. Concurrent {{secret:…}} expansions on a package-app fetch now share one round-trip instead of issuing six identical queries. (#3959)

• kody dev is hardened against SSRF and mock query edges. Mount-stripped //host paths can no longer rewrite the proxy origin, unrecognized Host headers are rejected, and empty RETURNING results from the mock SQLite layer are handled gracefully. (#4016)

• Production deploys no longer fail on secret sync. Platform secrets are now staged before the reviewed Worker code deploys, avoiding a Cloudflare error that blocked releases when an uploaded version wasn't yet deployed. (#4028)

Kody v2026.10.18

Kody v2026.10.18

Trust and safety take the spotlight this week: admins can permanently delete accounts, credentials warn before stricter package enforcement lands, and email delivery gets a wall of guardrails against bounces, spam backscatter, and verification abuse. On the integration side, Kody now speaks RFC 8628 device authorization, and Hermes Agent joins the supported-client roster.

New

• Admins can hard-delete an account. Suspends first, then purges immediately so the handle is free to re-register. Shared orgs are offboarded, not removed, and owned packages, sole org ownership, and paid billing require an explicit acknowledgement checkbox before the delete runs. (#4002)

• Connect integrations with OAuth device authorization. Integrations that support RFC 8628 can now be connected without a browser redirect: Kody shows a user code and verification link, polls the provider, and persists tokens through the same path as regular OAuth. The device_code and client secret never leave the server. (#3980, #3995)

• Hermes Agent is now a supported client. Hermes appears alongside OpenClaw in onboarding and connections, with its own logo, setup instructions, and desktop placement. (#3954)

• Credential allowed-packages warnings before enforcement. When a package fills a user-scope credential it isn't approved for, you'll see a non-blocking warning on publish and save with a link to approve it. Starting Oct 21, 2026, this becomes enforced — including through transitive dependencies and one-off runs. (#4009)

• team@ inbound mail routes to the support inbox. Messages sent to team@your-org.kody.codes now land in the support system instead of bouncing. (#3962)

Improved

• Hydration diagnostics now carry useful context. Document metadata attribute names, React component stacks, and shared charset/viewport/theme values all survive Sentry normalization, so the next hydration mismatch report can actually point at the offending component instead of [Array]. (#4012, #4008, #4007, #4000)

• Recovery dashboard shows meaning, not just yes/no. Each backup day now reads as queued, in progress, late, or failed — with phase and last-advance timestamps — so a draining backlog doesn't look like data loss. (#4004, #4005)

Fixed

• kody.codes no longer redirects package visitors off-origin. Anonymous and signed-in outsiders stay on kody.codes with a package page that links to the hosted origin. Only owners and members with run permission get the token handoff. (#3996)

• Email delivery hardened across the board. Signup and verification now reject disposable domains and common typos, hard-bounced addresses are suppressed across all mail types (including password resets), destination verification is capped by account age and per-recipient volume, and quarantined inbound mail is refused a reply so spoofed spam can't backscatter through kody.codes. Blocked-recipient cooldowns and per-MX-provider holds stop resending into rejecting providers. (#3992, #3999, #3990, #3991, #3968)

• Org transfers keep memories with their owner. Personal memories, suppressions, and vectors no longer get re-homed onto the target org when an operator moves resources between orgs. (#4011)

• Approve-publish requires a full 40-character commit SHA. A short prefix was treated as a branch name by the underlying git library, producing confusing "restorable backup" errors. (#3997)

• Stale static dependents don't break when an owner removes secret mounts. The credential stamp gate no longer fails a publish whose manifest still declares kody.secretMounts for old dependents that call packageSecrets.get, and a coincidental path that looked nested no longer hides the real manifest. (#3981, #3989)

• Known-stale pushes are rejected without an Artifacts send. (#3820)

• Safari hydration on the homepage agent picker. Rich option content inside <select> elements was discarded by Safari's HTML parser before hydration; the picker now uses plain-text options with the selected agent's icon shown outside. (#3993)

• Account sidebar rail stops jumping on short lists. The sticky rail's top now matches the header height so filtered credential lists don't shift the nav up by ~9px. (#4010)

• CLI fixes: local package-scoped secretSet gives a clear "scope unavailable" error instead of misleading insufficient_scope; kody dev validates Host against the listen origin so CSRF checks pass; local dev boots without Turnstile keys; unknown execute flags like --code-file are rejected; and help text for mocks and --app-base-path ships in the published CLI. (#3977, #3969, #3984, #3956, #3972)

• Org audit write failures no longer leak bound parameters to the console — only the error name is logged, and the full error still goes to Sentry. (#3983)

• Soft-deleted sessions are refused, and concurrent secret reads are deduplicated. (#3960, #3959)

Kody v2026.10.17

Kody v2026.10.17

Your org grows up with you: this release lets you convert a personal org into a team org and brings back deleted orgs from the grave. On the trust side, the credential stamp system now enforces declared slots for stamped packages, audits every MCP tool call, and lets package-bound Keys fill their own package's needs. The CLI also moves in-house and speaks Kody's versioned HTTP API — login mints a revocable device token instead of relying on MCP-only auth.

New

• Convert a personal org into a team org. When your solo project outgrows one person, you can split it: packages, webhooks, email, and plan stay on the team org, while memories, secrets, integrations, and connected-agent grants move to a fresh free personal org with a new username. The conversion is one-way and requires typed confirmation in Account settings. (#3953)

• Restore deleted orgs. Soft-deleted orgs always promised a 30-day restore window, but there was no button. Now your Organizations page shows a Recently deleted section with a Restore action — and if you try to recreate a handle you previously deleted, it offers restore instead of "That name is taken." Account and profile navigation is also clearer, with separate Public profile and Account settings labels and cross-links. (#3950)

• The CLI speaks the Open API. kody login now runs a proper OAuth flow and mints a revocable device token against Kody's versioned HTTP API. Search, execute, whoami, and bootstrap all call the REST surface, and the CLI source lives in this repo as @kodycodes/cli so it ships in lockstep with the platform. (#3940)

• Credential stamp enforcement for stamped packages. Packages with a stored credential stamp can now only use the slots they declared — undeclared credential(key) calls, vault placeholders, and credential.named() all fail closed. Unstamped packages keep the legacy path unchanged, so nothing breaks until a package opts in by stamping. (#3942, #3922, #3836)

• Package-bound Keys fill their own package's needs. A legacy Key bound to a specific package can now satisfy that same package's declared credential needs, so you don't need a second org-level Key. The credential picker auto-selects a package Key when the name matches or it's the only candidate. (#3932)

• Every MCP tool call is audited. Each invocation writes one mcp.call audit row — tool name, connection, success or failure, error class, and duration — without recording arguments, return values, or error messages. Tool names that aren't identifiers are redacted. (#3897)

• Agent discoverability on kody.codes. Generic 404s now return markdown when an agent asks for it, the REST API is listed in the RFC 9727 catalog, the homepage carries SoftwareApplication JSON-LD, and new /about, /contact, and /docs/api-versioning pages give scanners and humans real facts to find. OpenAPI documents now describe the standard Error shape and 429 rate-limit response. (#3933, #3934)

Improved

• The credential scan now recognizes optional-chaining and bracket-style MCP server access (cm.mcp?.['home']) so declared slots aren't falsely flagged as unused. (#3948)

• Package authors get a heads-up when a fetch body could silently fill {{secret:…}} placeholders from forwarded text, with a documented x-kody-secret-resolution: headers-only opt-out. The warning fires in kody dev check and on publish without blocking either. (#3947)

• Credential-free packages with an empty capability set self-publish without a manual Approve click — the enforcement flag gate was unnecessary since the credential door already refuses real capabilities. (#3937)

• The /with connect card keeps its command rows inside the card on every page, scrolling long commands inside the field instead of overflowing the edge. (#3938)

Fixed

• Bare OPTIONS requests to package-app custom hostnames no longer crash the platform — preflight passes the cross-origin gate, and a missing handler returns a clean 204 instead of a 500 crash page. (#3946)

• The Approve hang on internet-visible packages is resolved: the per-package Approve page now records and applies the visitor capability pin, and stale closures can't no-op past a live fingerprint. (#3935)

• Case-only credential renames (e.g. Henry → henry) now persist in place instead of silently failing, so case-sensitive lookups find the renamed secret. (#3929)

• Production signup refuses to boot or accept form submissions when either Turnstile key is missing, closing a fail-open hole that could silently skip the bot challenge. (#3925)

• Several Sentry noise sources are silenced: D1 export-lock errors from the jobs worker no longer flood Sentry, and JobManager alarms rearm with a 30-second backoff instead of going unarmed. Stale browser tabs calling a retired Start release get a one-shot hard reload. Expected anonymous-visitor MCP failures stay on the log and out of Sentry. (#3930, #3928, #3916)

• Post-merge follow-ups: the status page start button works on cached templates without a footer, clearing displayName returns the username in the response, and the browser Sentry filter narrows Message channel disconnected to extension provenance so first-party errors stay visible. (#3917)

• CLI fixes: kody execute no longer imports msw in production, login binds to the granting org, and publish builds before tagging. The CLI also stops importing test-only dependencies on the execute path. (#3940)

• Contributor docs now document the no-breaking-changes principle and the Cloud Agent patch handoff path for CLI changes that live in a separate repo. (#3926, #3915)

Kody v2026.10.16

Kody v2026.10.16

Package apps step into the open: hosted apps can now serve anonymous visitors, sign users in with OAuth, and resolve the owner's credentials on their behalf — all behind the approval and audit trail you expect. Self-publishing means agents can take a package public without waiting on a manual click, and the Triggers tab gets real on/off toggles with multi-instance credential mappings. This is the release where a published package app becomes a first-class thing you can visit, sign into, and trust.

New

• Package apps go public. Internet-visible apps now serve anonymous visitors with a KV-backed circuit breaker so a usage spike doesn't take the app offline, and signed access tickets authorize repeat requests without a storage read on every call. (#3827, #3841, #3835)

• OAuth sign-in for package apps. Hosted apps on *.kody.run and verified custom domains can now offer Sign in with Kody through a proper OAuth + PKCE flow, with a near-zero-config kit helper. The consent screen shows the package name, publisher, app domain, and exactly what access is being granted. (#3889)

• Owner credentials for visitors. Publishers can opt in per credential so an internet-visible app resolves the owner's listed credentials for anonymous visitors and other signed-in users — covering something like world-builder's rooms without handing visitors every key. Non-owner use is audited and rate-limited. (#3914)

• Self-publish. When a package declares no credentials and passes a security audit, the agent can make it internet-visible without Kent's manual approval. One Approve button now covers both the capability set and going public, and approval correctly applies, lists for write-only tokens, and skips re-asking when the fingerprint is already pinned. Credential-need approval is now scoped to internet-visible packages only, so private publishes go straight through. (#3847, #3811, #3887, #3824, #3870, #3796, #3826, #3802)

• Triggers tab: on/off toggles and multi-instance. Each trigger card gets an accessible switch for your own enablement, and you can run multiple cron or subscription instances with independent credential mappings. Webhooks can now mint multiple URLs under the same declared name, each with its own label and Approve. (#3885, #3896)

• Follow any repo. You can now follow any repository from the web UI — a Follow panel on the repo page and a Follows page in your workspace show everything you're tracking. (#3830, #3816)

• Invite collaborators and teams. You can invite outside collaborators to a personal package from the new Collaborators tab, and invite links for teams and packages come with an accept page and a waiting-invites view. (#3813, #3818, #3781, #3793)

• Org credits page. A full credits ledger for your org shows every charge, refill, and adjustment, with the storage meter fixed for team orgs. (#3779)

• One org email address with per-sender enablements. Email routing now supports a single org address with independent enablements per sender package. (#3742)

• GitHub-style raw file URLs. Package pages now have a Raw link for direct file access, matching the URL shape you'd expect from GitHub. (#3764)

• Homepage for teams. The homepage now frames Kody as the shared cloud for your team's agents, with a scrollable, keyboard-friendly agent row. (#3792, #3821)

• Play Breakout. There's a low-key Play Breakout link in the status-page footer while things are operational. (#3759)

Improved

• Credential stamps at publish. Credentials are sealed with HMAC-signed stamps at publish time so the approval fingerprint catches tampering, and republish preserves your job enablements instead of wiping them. Fleet sealing is underway with scanner false positives fixed for typed imports and const MCP names, and client-bundle assets under kody.app.assets are excluded from the stamp scan so large publishes don't time out. (#3836, #3869, #3874, #3888, #3877, #3758, #3752, #3776)

• Cron jobs just run. When you create a scheduled job, the owner enablement turns on automatically — no separate ask-the-user step. If a tick skips because no enablement is on, the skip is now visible in job observability with a clear hint telling your agent exactly what to call. (#3884, #3875)

• MCP metadata and long-running execute. MCP server info and tool metadata are richer, and when a hosted execute outlives the transport budget, it hands back a run id you can poll instead of looking like a failed mutation. (#3843, #3900)

• Credential resolve audit. Security review can now see whether a credential was filled into a header, URL, or body from the audit row alone — no need to dig into package source. (#3899)

• Org identity is cleaner. Personal org ids are distinct and scoped, so entitlement reads, usage sweeps, and org binding lookups key off the right identity. The URL is the only source of truth for which org you're in. (#3053, #3804, #3773, #3057, #3857, #3863, #3801, #3780, #3774)

• Navigation restructure. The workspace rail's name is now the org switcher, the header keeps only the avatar, and the account menu lists every workspace by @slug — including the one you're in. The Workspaces group is gone from the account rail. (#3783, #3790, #3765, #3794)

• Approvals page. A bundled approval page for pending package approvals focuses on what changed, hides raw ids behind a Details disclosure, and rejects unknown page actions with a 400 instead of silently approving. (#3768, #3787, #3893, #3823)

• Email deliverability. DMARC aggregate reporting is configured for kody.codes, dmarc@ is receivable via Email Routing, delivery events are reconnected for the system domain, and signup polls verification delivery status. Allow-sender rules now require auth. (#3876, #3871, #3733)

• Git improvements. Browser visits to a package .git URL now redirect to the package page, git push uses a per-repo queue to avoid receive-pack busy rejections, and smart-HTTP request bodies are properly decompressed before forwarding. (#3878, #3806, #3819, #3797)

• Reserved handles enforced. Reserved username rules now apply to organization handles, so signup can't collide with protected names. (#3844)

• Declared credential needs enforced. When someone else runs your package, declared credential needs are checked at runtime so a missing or wrong credential fails loudly instead of silently proceeding. (#3833)

• Docs. New guides cover every credential kind, what kody dev does while it runs, MCP execute risks, and package publishing requirements. The CLI local-testing step is now optional for MCP-only agents, and outdated rollout phrasing is cleaned up. (#3757, [#3829](https://github.com/ken...

Kody v2026.10.14

Kody v2026.10.14

The credentials story gets its payoff: one unified Credentials page replaces the old Secrets, Integrations, and MCP server screens, and behind it a full mapping system lets you pin which credential each package run uses — per org, per person, and per trigger. Navigation gets a long-overdue restructure with one rail per scope, so switching orgs never hides your tools again. And memory is now personal-only: your assistant remembers for you, not for whichever team you happened to be connected through.

New

• Unified Credentials page. Every credential kind — Keys, OAuth integrations, MCP servers, and the opt-in URL, login, and signing types — now lives in one searchable list at /@org/-/credentials with kind-driven detail panes, filters kept in the URL, and a creation flow for every type. You can see exactly where each credential is used and fix a broken one without leaving the page. (#3708, #3704, #3607, #3605, #3604)

• Credential mappings. You can now set a default credential for each package need at the org level, override it for yourself, and let a trigger pin its own pick — all without granting anyone new access. When a credential goes missing or no longer fits after a republish, the enablement pauses and the Waiting card tells you exactly why, with a link to fix it. (#3608, #3642, #3728, #3663)

• Agent-proposed trigger picks. An agent can now set a trigger's credential pick — but only to a value that same agent already proposed, and only after you approve it. No pick changes without a person saying yes. (#3670, #3646)

• One navigation model, three scopes. The web app now has one rail per scope: You (avatar menu — account, usage, credits), Workspace (org switcher — billing, credentials, agents, settings), and Package (owner pages). "Connections" is now "Agents." Every old URL 301s to its new home, so nothing breaks. (#3516)

• Memory is personal-only. Your assistant's memory now writes to one pool tied to you, regardless of which org you connected through. Shared team knowledge stays in packages and org instructions — auto-surface even labels memories as personal and tells agents to ask before copying into an org package. Existing team memories have been copied to each person who could read them. (#3726)

• Custom domains for package apps (flagged). Org admins can claim, verify, and sync Cloudflare for SaaS custom hostnames for their package apps, with a settings UI for DNS status and an abuse cap of 20 hostnames per org. Still behind package-app-custom-domains until GA. (#3630, #3687, #3697, #3701, #3717)

• Usage and credits per org. Usage and credits now live at /@org/-/usage, next to billing, so team orgs can see their own metering and prepaid wallet. The old /account/usage redirects to your personal org's page. (#3694)

• Animated feature pages. Every feature detail page now has an interactive, animated scene driven by the page's own controls — tabs, toggles, and selects replay the story from the start. Scenes are CSS/SVG only, respect reduced motion, and each page loads only its own keyframes. (#3691)

Improved

• Package pages now have one labeled action group on every tab — Fork, Open app, Update public listing, Review & publish — with at most one filled button per view and clear labels on every action. Topics no longer look like buttons. (#3699, #3690)

• Community listings auto-follow the promoted commit on finalize, so the public version stays in lockstep without a separate republish step. When the listing pin does lag behind a promote, owners now see a clear "Update public listing" prompt with the versions side by side. (#3729, #3668, #3655, #3656)

• Team-org scoping is fixed across package apps, events, credentials, community install, and storage — everything now follows the connection org except things explicitly decided as personal-only. Team members can open team private package apps, events.dispatch no longer leaks to the personal org, and storage quotas use the bound org's plan. (#3727)

• The OpenAPI document is now served with a content-hash ETag, so API clients can revalidate with If-None-Match and skip a ~400 KB download on every run. (#3680)

• External MCP OAuth grants are now bound to the server row and client that started the flow, with identity re-checked at callback — a deleted and re-added server with the same name can't hijack a pending grant. (#3613)

• Credit auto-refill now writes the org id into Stripe metadata alongside the legacy key, so billing attribution works as orgs grow. (#3679)

Fixed

• Saving an account secret no longer reports failure when the provider link fails after the commit — the save succeeds and the provider error surfaces as a message, so a retry doesn't trap you in a 409 duplicate-name loop. (#3744)

• The org picker label no longer clips the @ symbol or descenders on handles like @gjpqy. (#3689)

• control-kody --skip-login now sends a truly anonymous request, request follows redirects manually instead of dumping raw HTML, and browse fails fast with remediation guidance when Playwright browsers are missing. (#3740)

• Stale Mailbox retention alarms that fired during unrelated tests are cleared, fixing a persistent Workers flake. (#3710)

• packageGet now includes published_commit in its response, and tokenRevoke / tokenGet / tokenRotate accept id as an alias for token_id. (#3702)

• Preview deploys no longer create per-PR GitHub Environments. (#3672)

• Org grant revocation now checks manage_access before revoking, and failed publish checks are treated as caller errors with a clear message. (#3662, #3659)

• Published source snapshots are written before flipping published_commit, and missing snapshots are healed on backfill. (#3669, #3667)

• Streamed body redirect handling is hardened, CRLF after CSS hex escapes counts as one whitespace unit, and admin plan breakdown reads correctly after the users.plan drop. (#3657, #3666, #3660)

Kody v2026.10.13

Kody v2026.10.13

The credentials redesign crosses a major threshold: your code can now call credential('github') and get a scoped client that never holds a secret value — the credential decides where its value goes, and it goes only to approved hosts over HTTPS. Personal credentials, org grants, call maps, and opt-in credential types all land together, closing out the T milestone of ADR 0068. On a lighter note, the status page now has a Breakout game built from the page's own bricks.

New

• credential() and credentials() scoped clients. Code can now request a credential client instead of writing a {{secret:…}} placeholder: const gh = await credential('github'); await gh.fetch('/user'). The client never holds a value — it carries a signed handle, and the value is placed only on the credential's approved hosts over HTTPS. This is purely additive: placeholders and every existing fetch path work exactly as before. (#3596, #3614)

• Credential call maps. When you invoke a package, you can now pass a credentials map that picks which credential each credential(key) call resolves to — { github: 'work', google: ['work', 'personal'] }. Strict mode for invoke rejects runs that name a key no package declares, so a dependency can't quietly gain capabilities. Ad hoc code warns instead of rejecting. (#3599)

• Personal credentials and org grants. You can now create credentials in your personal org and grant them to team orgs you belong to — one org at a time, revocable at any time. The grant shows as inactive if you've left the org or the credential expired. Placeholders never resolve personal credentials; this is a new, separate surface. (#3626, #3479)

• Opt-in credential types: url, login, signing. Beyond stored secrets, Kody now supports URL credentials (for path or whole-URL placeholders), login credentials (for password or token exchange bodies), and signing credentials (for JWT or signature key material). Existing Key credentials gain an inject field so credential(key) can place them in headers, basic auth, or query params. All new types are opt-in — nothing changes for packages that don't declare them. (#3575, #3513, #3545, #3537)

• Credential needs and type hints in repo checks. Packages now declare credential needs at publish time, and packageGet reports which credentials a package needs and how each resolves for you. The credentials check ends with optional, neutral suggestions for which scoped credential type fits each placeholder — never a warning, never blocking publish. (#3562, #3579, #3625, #3551)

• Forkable and internet-visible package toggles. Packages now have independent forkable and internet-visible settings, with a one-page capability approval gate before internet-visible can turn on. Approval binds the reviewed fingerprint so drift between page load and submit is rejected. (#3580)

• kody auth setup-git server side. After one setup-git, the credential helper stores your CLI token and git uses plain HTTPS indefinitely for clone, fetch, and push at kody.codes/@owner/name.git. CLI tokens are now user-owned by default and pick an org per request via ?org=<slug>. Existing org-bound tokens keep working unchanged. (#3572, #3574)

• Animated primitive widgets on the marketing site. Each primitive card on /features now shows a small animated widget demonstrating what it does — secrets injection, package publish-and-invoke, webhook triggers, integration round trips, and more. The homepage gets a compact card with a mini version of each. CSS keyframes only, no animation library, and full reduced-motion support. (#3582)

• "Play while you wait" Breakout on the status page. When Kody is having an outage, the status page offers a Breakout game built from the page's own cards, status dots, and day bars. It keeps polling status in the background and tells you the moment Kody is back. (#3606)

• Copy prompt for your agent on error surfaces. When you hit an error in the browser — a 500, a failed OAuth connect, a billing page, a package app — Kody now gives you a ready-to-paste prompt you can hand to Claude, ChatGPT, or Cursor so your agent can help fix it. (#3577)

• Admin automations can mint email verification URLs and call every site-admin capability. (#3527, #3519, #3417)

Improved

• Workspace navigation is now consistent across personal and team orgs. The same sidebar appears for both, the workspace is reachable from your profile and account menu, and the org chooser refreshes your photo without a reload. The "Manage" link is gone from the switcher, and personal orgs are classified by their live owner. (#3558, #3382, #3503, #3622, #3564, #3576)

• Plain repos now have full detail-page parity with package pages, including README loaded from HEAD, and the Repositories page lists them alongside packages. The org list was renamed from "packages" to "repositories" to match. (#3581, #3568, #3591, #3621)

• Secret placeholder fill is now single-pass everywhere. Substituted credential values are never re-scanned for further placeholders, whether the body is buffered or streamed across chunks. Streaming outbound fetch bodies is now supported on both hosted and local execute. (#3567, #3609, #3578)

• Webhook signing now has a 24-hour grace window. When HMAC signing secrets rotate, providers retrying with the previous key are accepted for 24 hours, and the old material retires early once a delivery verifies under the new key. Webhook signing presets and the explicit url-secret type are now documented, with guides redirects in place. (#3571, #3491, #3525, #3526)

• Published-only codemods now promote through locked packages, so fleet-wide apply (like the webhook declaration migration) reaches every package without owners unlocking first. (#3559, #3546)

• Status incidents now open after 3 consecutive failed checks, and health-check-only incidents can be deleted with retrospectives documented. (#3549, #3532)

• The community page is faster for signed-in viewers, Back/Forward navigation restores scroll position, and feature-page buttons and marketing copy are polished. (#3538, #3543, #3536, #3501)

• Git remotes now default from the caller's write access, and repoGetGitRemote accepts a name via the API and CLI. (#3573, #3565)

Fixed

• Deleting a credential now removes all its grants. Previously, grant rows on a deleted credential stayed inert until the owner left the org. Now every delete — single credential, bulk package secrets, or package delete — soft-deletes grants, revokes pending grant invites, and removes personal org grant rows in the same transaction. (#3643, #3651)

• MCP tools now work after an org transfer. When MCP servers moved to a team org via transfer, every execute tool call failed because the registry still loaded servers from the personal org. The registry now uses the bound org, matching the list and call paths. (#3553)

• Last-used org is remembered correctly during SPA navigation. Prefetches no longer count as org switches, and the router commits last-used only for the navigation that actually landed. Unknown runList filter keys are now rejected with did-you-mean suggestions. (#3619)

• You no longer see dangling grants on the personal-org Grants page — revoke works from the web UI, and the rail shows Grants for personal workspaces. ([#3627](https://github.com/kentcdodds/k...

Kody v2026.10.12

Kody v2026.10.12

The credentials redesign takes its next big step: every credential now has a stable id, grants are keyed by that id instead of a name that can be renamed or recreated, and placement metadata is being recorded on the credential rows themselves. At the same time, an urgent webhook regression that silently rejected every URL-secret-only delivery for ~19 hours is fixed, guarded by a new hourly alert, and given a long migration runway through January 2027.

New

• Stable credential ids and grants keyed by id. Every org credential — secret entry, OAuth integration, MCP server connection, vault binding — now carries a stable id. Use, Write, and Delete grants are keyed by that id under one credential resource type, so renaming a credential no longer orphans its grants and deleting a name no longer lets a recreated one inherit them. This is the foundation for the rest of the credentials redesign. (#3442, #3440, #3438)

• Credential placement columns and inventory scan. Each credential row now records its provider, how the value is placed on a request (inject), and where the value comes from (source). A new admin scan reads published package source, attributes every {{secret:…}} placeholder to a live credential id, and reports placement shapes across the fleet — with failed packages and their load errors listed by name so you can fix or exclude them before applying the backfill. (#3468, #3476, #3487)

• Resolver architecture behind the credential door. Each credential kind — stored secrets, package mounts, webhook secrets, vault references, OAuth tokens, MCP connections — is now a resolver behind the single resolveCredential door. The resolution order is explicit and testable: resolve reads metadata, authorize checks permissions, and only then does apply read a value. Adding new credential kinds later means adding a resolver, not growing a switch. (#3470, #3475)

• Org resource transfer. Operators can now move every resource one org owns — packages, secrets, integrations, MCP connections, webhooks, grants — into another org, with full precheck clash detection, encrypted-column re-sealing, R2 backups, and a codemod that repoints package sources at the new owner scope. Dry-run is the default; apply holds a write lease on both orgs for the entire run and refuses on any blocker. The output is structured for runbook automation: coded findings, per-server MCP state, and webhook follow-up tasks. (#3437, #3444)

• Webhook auth-regression alert and rejection report. An hourly scan now watches for endpoints that go from successful deliveries to all-401s and sends a Sentry warning within an hour instead of letting a silent regression burn for a day. A new admin rejection report sizes the blast radius of any incident by counting deliveries and rejections per endpoint and owner. (#3465)

• Webhook verification scan. A new admin tool lists every live webhook URL and classifies it — url_secret_only, signature, undeclared, or manifest_unavailable — so you can see exactly which webhooks still need to declare a verification secret before the URL-secret-only lane is retired. The scan can include disabled webhooks and reports each endpoint's recent delivery success count. (#3478, #3486)

Improved

• Fetch gateway hardening. Every outbound fetch is now capped at five minutes on every surface, and streamed responses are bounded by both an idle gap and an overall deadline. Credential placeholders are filled anywhere on allowed hosts over HTTPS (not just headers), and the gateway refuses to send an unsubstituted {{secret:…}} placeholder in a fetch body instead of leaking it. When placement is refused, webhook callers get a credential_placement_refused reason instead of a bare invocation failure. Secret, memory, job, and integration access are now checked per resource, and webhook secrets follow the package's secret-access rules. Package apps act as their visitor, not as the org Owner. (#3427, #3415, #3408, #3420, #3412, #3398, #3386, #3390, #3406, #3403)

• Webhook verification secret priority. When a webhook manifest declares a verification.secretName, inbound signatures now try that named secret first, then the Kody-generated stored secret as a fallback — so switching a webhook to use a real Stripe or Discord signing secret no longer breaks every delivery. The fallback is logged so you can see which endpoints still depend on the stored secret. (#3471)

• URL-secret-only webhook lane stays open until January 9, 2027. Webhooks that authenticate by URL secret alone keep working, and each acceptance is logged so the migration can be tracked. No enforcement happens before that date, giving every integration owner a long, low-disruption window to declare a verification secret. (#3481, #3478)

• Deploy pipeline no longer starves on a busy main. Main-push Validate runs now queue instead of cancelling each other, and a new SHA guard deploys each validated commit as long as production is behind it — so a merged change reaches production within one Validate cycle even when main is busy. (#3451)

• Preview cleanup is automatic. Failed PR deploys now clean up their own resources, and an hourly sweep removes preview namespaces and databases left behind by closed PRs — so the 500-namespace account cap no longer blocks new previews. (#3457)

• Startup bundle back under budget. Ajv, postal-mime, and acorn — three libraries every isolate parsed at startup but only a few request paths use — moved off the startup graph via deferred loading, shaving hundreds of kilobytes without changing product behavior. (#3459)

• Insufficient-scope errors name the missing scope and give you the mint command. When a token lacks a scope, the error now tells you exactly which scope is missing and prints the full cliCredentialBootstrap or CLI command with the complete scope list, so you mint the right token on the first try. (#3447)

• Local execute matches hosted behavior for nested packages. When one saved package's export imports another saved package, execute --local now binds packageStorage() per package exactly like hosted runs — so a dependency's own storage calls no longer throw. The local-execute guide also documents the CLI's 7-minute CapabilityProxy wait and env-proxy behavior. (#3445, #3455)

• Preview API host is easy to find. control-kody preview now prints the preview's API host and a ready-to-copy KODY_API_URL export, so pointing the CLI at a PR preview is a copy-paste instead of a hunt through docs. (#3452)

• Access control tightening. Role, membership, billing, and site-admin capabilities now require a live person — no background or legacy path can exercise them. A paused enablement waits on its enabler's own access list, not the org's. Breaking package rule changes now trigger an admin owner notice so someone sees what happened. (#3433, #3411, #3399, #3441)

• Git worktree setup documented. Agents running several branches on one VM can now symlink node_modules without workspace packages silently resolving to the main checkout, with a copy-paste loop in the contributing guide. (#3449)

Fixed

• Webhook regression: URL-secret-only deliveries were silently rejected for ~19 hours. A recent change made ingress fall back to HMAC signature verification for webhooks that never declared one, returning 401 missing_signature for every Stripe, Discord, and grok-bot delivery. URL-secret-only authentication is restored, and nothing is enforced before the 2027 migration date. (#3463)

• Unattached job lane is gone, and its leftovers are cleaned up. Package jobs are the only job lane now — there are no unattached jobs, and the retention schema, archived-artifact table, and retired grant columns are dropped. Legacy jobs are moved or deleted by the retire tool, which now reports the underlying error on apply failures. Leftover operator copy and analytics references are removed. (#3422, #3436, [#3416](https...