v0.10.7 — v0.10.7

This release is a top-to-bottom overhaul of the LLM gateway — the layer that carries every model request — plus a round of security hardening and sandbox tooling work.

LLM gateway

The gateway now speaks each provider's API correctly instead of approximately.

• OpenAI routing and parameters. Genuine-OpenAI reasoning models that also use tools now route to the /v1/responses API, where they belong. We translate max_tokens to max_completion_tokens, correct the gpt-5.5 fallback temperature flag, and pin the playground wire shape so what you test is what you ship.
• Anthropic and Bedrock. When extended thinking is on, we stop forwarding temperature/top_p (they conflict with thinking), and Bedrock request/response frames are handled correctly. Bedrock is now available as a standalone bring-your-own-key provider, with its region read from the project's own secret.
• Transport correctness. Safer tool_choice handling, per-provider parameter quirks, message-role normalization, and correct streaming frames across providers.
• A LiteLLM translation sidecar now sits behind the control plane as a stateless translation layer, so provider-shape differences are handled in one place.
• Streaming reliability. Aborts propagate end to end, mid-stream errors surface instead of hanging, buffers are bounded, and requests carry deadlines.
• Error taxonomy. Failures now come back as honest, actionable errors rather than opaque ones.
• Billing correctness. Accurate usage capture, cache-write pricing, and atomic budget holds, with tests to keep them honest.
• A published capability matrix documents exactly what each model and provider supports.

Security

• A DNS-resolving egress guard replaces the old hostname-string regex, closing SSRF gaps.
• Teams bot connector tokens can no longer leak to a caller-supplied serviceUrl.
• Sessions reject client attempts to forge deletedAt/deletedBy metadata.
• Preview shares enforce a view-mode method gate; the Slack file proxy is narrowed to file subdomains; GET /files/history gets the resource denier; the MFA-required setting requires an explicit boolean; and malformed AgentMail webhook bodies are rejected before acknowledgement.

Sandbox and CLI

• New pre-push sandbox gate: the CLI lints your Dockerfile in validate and can build sandboxes locally with sandboxes build --local.
• The Python floor is venv-isolated, custom /workspace contents are preserved, and PTY terminals compile on a supported Bun and recover across providers.
• A stopped sandbox now auto-resumes on active OpenCode access, flipping the session to ready.

Web and fixes

• Rebuilt session panel with Easy/Advanced modes, new file viewers, and modular tool renderers.
• The project no longer reveals the resolved sandbox provider when the project's provider is set to Automatic.
• Clearer CLI install guidance, corrected OpenCode proxy targeting, and "Kortix Computer is starting" renamed to "Kortix Session is starting."
• Infrastructure: HTTPS-only load-balancer listeners, durable WAF ownership, restored prod gateway origin TLS, and recovered prod migrations and session uploads.

What's Changed

• fix(llm-gateway): translate max_tokens -> max_completion_tokens for genuine OpenAI by @markokraemer in #4805
• chore(dev-eks): deploy dev-e437e6c0 [skip ci] by @github-actions[bot] in #4807
• chore(dev-eks): deploy gateway dev-e437e6c0 [skip ci] by @github-actions[bot] in #4806
• ci: enforce complete compliance monitor coverage by @markokraemer in #4786
• fix(terminal): make PTY tabs recover across providers by @markokraemer in #4808
• chore(dev-eks): deploy dev-cd096417 [skip ci] by @github-actions[bot] in #4810
• fix(llm): correct gpt-5.5 fallback temperature flag + pin playground wire shape by @markokraemer in #4809
• feat(web): Easy/Advanced session panel, rebuilt file viewers, modular tool renderers by @sutharjay1 in #4120
• chore(dev-eks): deploy gateway dev-ea1e1680 [skip ci] by @github-actions[bot] in #4811
• chore(dev-eks): deploy gateway dev-614010f8 [skip ci] by @github-actions[bot] in #4812
• chore(dev-eks): deploy dev-614010f8 [skip ci] by @github-actions[bot] in #4813
• fix(llm-gateway): transport correctness — tool_choice safety, param quirks, role normalization, bedrock frames by @markokraemer in #4814
• chore(dev-eks): deploy gateway dev-758505c6 [skip ci] by @github-actions[bot] in #4818
• ci: document reviewed IaC scanner exceptions by @markokraemer in #4816
• fix(terminal): compile sandbox PTYs with supported Bun by @markokraemer in #4819
• feat(llm-gateway): LiteLLM stateless translation sidecar behind the control plane by @markokraemer in #4817
• chore(dev-eks): deploy gateway dev-2d706ac3 [skip ci] by @github-actions[bot] in #4822
• fix(llm-gateway): honest, actionable error taxonomy end-to-end by @markokraemer in #4820
• chore(dev-eks): deploy gateway dev-866ab491 [skip ci] by @github-actions[bot] in #4823
• chore(dev-eks): deploy dev-866ab491 [skip ci] by @github-actions[bot] in #4824
• fix(llm-gateway): streaming reliability — abort propagation, mid-stream error surfacing, bounded buffers, deadlines by @markokraemer in #4821
• chore(dev-eks): deploy gateway dev-c957b0b6 [skip ci] by @github-actions[bot] in #4826
• chore(dev-eks): deploy dev-c957b0b6 [skip ci] by @github-actions[bot] in #4827
• test(llm-gateway): close coverage gaps + backlog hygiene (correlation id, key validation) by @markokraemer in #4815
• chore(dev-eks): deploy gateway dev-7986e1a2 [skip ci] by @github-actions[bot] in #4828
• chore(dev-eks): deploy dev-7986e1a2 [skip ci] by @github-actions[bot] in #4829
• fix(llm-gateway): billing correctness — usage capture, cache-write pricing, atomic budget, tests by @markokraemer in #4825
• chore(dev-eks): deploy gateway dev-b8e392fd [skip ci] by @github-actions[bot] in #4831
• chore(deps): bump actions/cache from 4 to 6 by @dependabot[bot] in #4581
• chore(deps): bump bridgecrewio/checkov-action from 12.3112.0 to 12.3114.0 by @dependabot[bot] in #4582
• chore(deps): bump hashicorp/setup-terraform from 3.1.2 to 4.0.1 by @dependabot[bot] in #4583
• chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4584
• chore(deps): bump github/codeql-action/upload-sarif from 3.27.5 to 4.37.0 by @dependabot[bot] in #4585
• security(teams): block bot connector token leak to caller-supplied serviceUrl (F-7) by @markokraemer in #4561
• security(sessions): forbid client forge of metadata.deletedAt/deletedBy (SSR-7) by @markokraemer in #4562
• security(ssrf): DNS-resolving egress guard, replacing hostname-string regex (F-1) by @markokraemer in #4563
• security: pentest run #4 low-severity hardening (S3-2, NEW-1, MFA-1, F-5, SSR-PV1) by @markokraemer in #4564
• fix(sdk): record hasUsableModel in the public surface snapshots by @sutharjay1 in #4473
• fix(web): don't reveal the resolved sandbox provider when project provider is Automatic by @markokraemer in #4832
• fix(web): 'Kortix Computer is starting' -> 'Kortix Session is starting' by @agent-kortix in #4750
• fix(llm-gateway): route genuine-OpenAI reasoning+tools BYOK traffic to /v1/responses by @markokraemer in #4830
• chore(release): VERSION → 0.10.7 [skip ci] by @github-actions[bot] in #4803
• chore(dev-eks): deploy gateway dev-cb28a245 [skip ci] by @github-actions[bot] in #4834
• refactor(sandbox): move the Dockerfile layer into @kortix/shared and split it by @markokraemer in #4799
• fix(llm-gateway): stop forwarding temperature/top_p when Anthropic thinking is enabled by @markokraemer in #4833
• Fix CLI sandbox OpenCode proxy targeting by @markokraemer in #4458
• fix(sandbox): venv-isolate the Python floor, stop wiping custom /workspace, stop blaming users by @markokraemer in #4800
• fix: manage regional compliance monitoring by @markokraemer in #4835
• Fix CLI install guidance by @agent-kortix in #4707
• docs(llm-gateway): gateway capability matrix — the flawless-gateway scorecard by @markokraemer in #4836
• feat(cli): pre-push sandbox gate — Dockerfile lint in validate, sandboxes build --local by @markokraemer in #4801
• chore(dev-eks): deploy dev-2456ea69 [skip ci] by @github-actions[bot] in #4837
• fix: enforce HTTPS-only ALB listeners by @markokraemer in #4838
• fix: make ALB WAF ownership durable by @markokraemer in #4839
• fix: prevent preview compliance drift by @markokraemer in #4841
• fix: remove legacy ECS HTTP listeners by @markokraemer in #4842
• feat(llm-gateway): Bedrock as a standalone BYOK provider by @markokraemer in #4843
• chore(dev-eks): deploy gateway dev-eb3f28cb [skip ci] by @github-actions[bot] in #4845
• chore(dev-eks): deploy dev-eb3f28cb [skip ci] by @github-actions[bot] in #4846
• feat(cli): kortix gateway — full LLM-gateway control-plane by @markokraemer in #4840
• chore(dev-eks): deploy dev-49a53b46 [skip ci] by @github-actions[bot] in #4848
• fix(compliance): codify all-region AWS controls by @markokraemer in #4849

Full Changelog: v0.10.6...v0.10.7