v0.12.3 — Sandbox hardening, faster navigation, and honest sessions

New

• One-shot approval links: approve or reject an agent's pending request straight from the notification link, without opening the app.
• Sandboxes now ship with a baked-in Python package floor — Pillow, pypdfium2, pytesseract, and 13 more pinned packages — so document and image skills run immediately, with no install step.
• The session header warns when an agent's configuration changed on disk after the session started, with a one-click reload that updates the files the agent actually reads.
• Terms of Service are linked from /legal/terms.

Improved

• Project page navigation is noticeably faster, and the web app moved to Next.js 16.2.0.
• Messages queued while the agent is working now stay queued until the turn actually ends — no more mid-turn releases or duplicate sends.
• One keyboard shortcut (⌘I / Ctrl+I) now toggles the whole right side of a session: the action panel, a detail panel, or both.
• Session error states are clearer: tool failures are reported truthfully, retry states show what is happening, and a stale agent config no longer needs a page reload to surface.
• The CLI is quieter and more honest: --quiet is honoured on every path, and it no longer claims an invite email was sent when none was.

Fixed

• Hardened the sandbox: closed a proxy hole that could leak the sandbox service key to an attacker-named host, closed a DNS-rebind window by connecting only to the address that was vetted, resolved symlinks before authorizing file paths, and stopped one session's credentials from being served to other members of the account.
• Secrets: setup links now expire on time, re-scoped secrets validate against the session owner rather than the caller, and secret identifiers are no longer disclosed through the narrowing report.
• Session reliability: removed two paths that could silently destroy a session's commits, a planned restart now finishes the turn it interrupts, a failed agent spawn schedules a respawn instead of killing the session, and reloading an agent never hard-resets the session branch.
• A transient git failure can no longer compile an agent with an empty prompt.
• Queued API errors: address-validation failures now return a proper 400 instead of a server error.

What's Changed

• CLI: stop reporting failure while a cross-account fallback is still pending by @Ino-Bagaric in #6069
• chore(release): VERSION → 0.12.3 [skip ci] by @github-actions[bot] in #6072
• Executor: one-shot human approval links by @markokraemer in #6078
• Render the connector refusal, fix the reload, and surface stale config in the UI by @Ino-Bagaric in #6074
• feat(sandbox): bake the starter Python package floor, run skills bare by @markokraemer in #6080
• fix(sandbox): target the managed interpreter by path in the floor install by @markokraemer in #6081
• fix(sdk): classify model_not_servable 409 as silent to Sentry (BS ed07f6c5…) by @agent-kortix in #6082
• Fix local Supabase and test runner dependencies by @Ino-Bagaric in #6084
• Make session reload update the agent files opencode actually reads by @Ino-Bagaric in #6083
• Keep content timestamp generation deterministic by @Ino-Bagaric in #6085
• Set a safe default frontend build heap by @Ino-Bagaric in #6087
• Warn on the first secrets narrowing; don't compile an agent with no prompt by @Ino-Bagaric in #6086
• Guarantee accessible public MDX images by @Ino-Bagaric in #6088
• A failed spawn must schedule a respawn, not kill the session by @Ino-Bagaric in #6089
• CLI: stop claiming an invite email was sent when none was by @Ino-Bagaric in #6090
• Validate re-scoped secrets for the session owner, not the caller by @Ino-Bagaric in #6091
• docs: record the connector 'Connected' badge gap and its tradeoff by @Ino-Bagaric in #6092
• Finalize the turn a planned restart kills by @Ino-Bagaric in #6093
• Two paths that silently destroy a session's commits by @Ino-Bagaric in #6094
• mock.module stubs silently delete the exports they omit by @Ino-Bagaric in #6095
• Surface a stale agent config without a page reload by @Ino-Bagaric in #6097
• Port 3211 served another session's credentials to any account member by @Ino-Bagaric in #6098
• Reload 500'd on every session that hadn't pushed its branch by @Ino-Bagaric in #6099
• /web-proxy mailed the sandbox service key to any host you named by @Ino-Bagaric in #6096
• feat(experimental): add meta_agent feature flag by @agent-kortix in #6101
• fix(secrets): setup-link TTL, session callback, secrets sync, diagnostic logging by @agent-kortix in #6100
• fix(web,sdk): keep in-flight sends, tell the truth about tool failures, one code palette by @sutharjay1 in #6058
• fix(web): stop auth cache and markdown prefetch storms by @markokraemer in #6106
• fix: slow project page navigation, and upgrade to Next.js 16.2.0 by @sutharjay1 in #6102
• fix(web,sdk): queued messages stay queued until the turn actually ends by @sutharjay1 in #6110
• fix(executor): align catalog with session connector scope by @markokraemer in #6113
• fix(api): convert assertAllowedSourceAddress throw to typed 400 (BS f5c0ce61) by @agent-kortix in #6112
• feat(legal): publish simplified Terms of Service at /legal/terms by @agent-kortix in #6103
• fix(web): redirect Terms to public Drive folder, drop stale terms body by @agent-kortix in #6114

Full Changelog: v0.12.2...v0.12.3