v0.12.5 — Secret delivery controls, unified connectors, and flat credit plans

Secret delivery is now a managed control plane, connectors speak one language across the whole platform, and billing moves to flat credit plans.

New

• Secret delivery controls. Decide exactly which secrets each agent session can use. Policies are managed from the web app and CLI, secrets reach sandboxes through an audited HTTPS broker with session-scoped handles, revoked secrets disappear from running agents, and LLM, connector, git, and subscription credentials are isolated from each other. A new kortix audit CLI command reads the account audit trail.
• Unified connectors. One connector model across web, CLI, SDK, and API: consistent Connector and Connection terminology, a single data plane in @kortix/sdk, and connector credentials that bind to project secrets. The connector catalogue now pages through the full ~2,700-app list instead of stopping at 192.
• Flat credit plans. Plans are priced as flat monthly credits instead of per-seat pricing. Billing also gained idempotent compute debits and accurate spend reporting.
• Rebuilt project onboarding. A single-column, seven-step flow with a clearer Slack setup and plan selection.
• Capability pages. Connectors, skills, and agents are browsable pages instead of a configuration overlay.
• Use-case packs. Marketplace runbooks are grouped into installable packs, with real loading and error states and inline project creation.
• Document conversion by default. Every new sandbox includes a convert-documents-to-markdown skill backed by a baked-in converter.
• Serverless app deployments. Provider-neutral serverless deployments for apps, served behind a managed edge with wildcard TLS and signed public hosts.
• Kimi K3 is available as a managed model.

Improved

• Sessions survive interruptions. A pending agent question is parked when its sandbox dies and restored on the next boot, and a stored answer is delivered as a follow-up turn. Runtime updates boot and verify the new runtime before retiring the old one.
• Chat UX. Instant session rename, a truthful header title, idempotent provisioning, preview verdicts, and grouped activity. In-flight sends survive navigation, and tool failures are reported honestly.
• Session list. Rebuilt with status states, collapsible sections, and a nested filter menu.
• Faster, calmer navigation. Project pages load faster (Next.js 16.3), and passively opening a project no longer wakes idle sandboxes.
• Clearer errors. The LLM gateway surfaces real upstream provider errors instead of a generic Bad Gateway, and large repository branch listings are bounded.

Fixed

• Billing: the same compute window can no longer be charged twice, "spend this period" reports the correct window, the paid seat is released when SCIM deprovisions a member, BYOK failover respects the managed-model entitlement, and the UI shows the concurrency limit the server actually enforces.
• Agent workspaces are strictly enforced across repository, git, and clone APIs.
• Approvals require a full review of each call, and the daemon no longer auto-answers questions outside a channel session.
• The Terms of Service link opens the document directly.
• Desktop: the title bar aligns with the OS window controls.
• Production API recovery is hardened: migration-safe restarts and better behavior under memory pressure.

What's Changed

• chore(release): VERSION → 0.12.5 [skip ci] by @github-actions[bot] in #6148
• Billing correctness + park-and-restore for blocked turns by @Ino-Bagaric in #6145
• fix(db): generated migrations get the safety header, unblock the squawk gate by @Ino-Bagaric in #6150
• chore(web): upgrade Next.js to 16.3.0 by @sutharjay1 in #6151
• Rework connectors, skills and commands into browsable capability pages by @sutharjay1 in #6054
• fix(daemon): stop auto-answering questions outside a channel session by @Ino-Bagaric in #6153
• feat(secrets): complete secure delivery controls by @Ino-Bagaric in #6134
• feat(web): session list — status states, collapsible sections, and a nested filter menu by @sutharjay1 in #6142
• fix(approvals): require full one-call review by @markokraemer in #6154
• fix(web): keep standalone output off Vercel by @markokraemer in #6155
• fix: attribute CLI actions in centralized audit logs by @Ino-Bagaric in #6156
• fix(billing): stop quoting the wrong seat grant and seat price by @Ino-Bagaric in #6157
• feat(secrets): bind project secrets to connectors by @Ino-Bagaric in #6158
• fix(web): align approval indicator with design system by @markokraemer in #6159
• fix(web,api,sdk): chat UX — header title, instant rename, provision idempotency, preview verdicts, activity grouping by @sutharjay1 in #6136
• feat(billing): flat credit plans replace seats, no included managed LLM by @Ino-Bagaric in #6160
• feat(web): update secrets optimistically by @Ino-Bagaric in #6164
• fix(api): support pinned secret broker requests on Bun 1.2 by @Ino-Bagaric in #6167
• fix(web): guard tool-outcome parsing against null JSON output (session page crash) by @agent-kortix in #6163
• fix(web): de-noise old-browser DOM null-deref on marketing homepage (scrollLeft / appendChild) by @agent-kortix in #6161
• fix(web): de-noise model_not_servable unhandled rejection (BS 9784f440) by @agent-kortix in #6162
• fix(web): hide the regressed capability pages behind a flag by @Ino-Bagaric in #6168
• refactor: unify CLI connector and connection terminology by @markokraemer in #6165
• feat(sandbox): bake @firecrawl/anydoc + default convert-documents-to-markdown skill by @markokraemer in #6170
• fix(marketplace): stop listing use-case pack skills as Kortix Starter contents by @markokraemer in #6171
• Remove standalone Commands capability page by @agent-kortix in #6169
• test(marketplace): add convert-documents-to-markdown to the pinned starter floor by @markokraemer in #6172
• refactor(db): cut over connector physical identifiers by @markokraemer in #6173
• feat(marketplace): group use-case runbooks under a browsable Use-case pack project by @markokraemer in #6174
• fix(web): use-case install dialog — real load/error states + inline project creation by @markokraemer in #6175
• refactor(connectors): remove executor and profile compatibility by @markokraemer in #6176
• fix(desktop): pin the title-bar band to the OS window controls by @sutharjay1 in #6178
• feat(web): adopt smooth shadow system by @sutharjay1 in #6179
• refactor(sdk): unify Connector data plane by @markokraemer in #6180
• feat(web): add standalone Agents capability page by @sutharjay1 in #6177
• feat(worktree): multi-name nuke with per-worktree confirmation by @sutharjay1 in #6181
• feat(web,api,sdk): a calmer, more personal onboarding experience by @sutharjay1 in #6111
• fix(prod): harden API recovery after OOM incident by @markokraemer in #6182
• fix(prod): enforce migration-safe ECS recovery by @markokraemer in #6183
• fix(secrets): verify sandbox env delivery end to end by @markokraemer in #6184
• fix(web): filter Supabase gotrue OTP-expired Object-Not-Found rejection noise by @agent-kortix in #6189
• fix(ke2e): align release flows with current contracts by @markokraemer in #6190
• fix(release): retry transient flow and trigger conflicts by @markokraemer in #6192
• fix(release): bound and expose full gate progress by @markokraemer in #6194
• feat: teach agents how to use scoped secrets safely by @Ino-Bagaric in #6195
• fix: clear revoked secrets from new sandbox processes by @Ino-Bagaric in #6198
• feat(apps): add provider-neutral serverless deployments by @markokraemer in #6197
• fix(ci): clear v0.12.5 security findings by @markokraemer in #6199
• fix: keep agent config freshness safe and unobtrusive by @Ino-Bagaric in #6202
• ci(apps): provision wildcard edge DNS by @markokraemer in #6201
• fix(ci): use supported Wrangler secret-list format by @markokraemer in #6204
• fix(apps): honor managed storage upload limit by @markokraemer in #6205
• fix(apps,connectors): repair edge routing and long sync calls by @markokraemer in #6206
• fix(apps): update Caddy security release by @Ino-Bagaric in #6208
• fix(apps): build patched Caddy in API image by @markokraemer in #6209
• fix(apps): build static Caddy runtime by @markokraemer in #6212
• fix(apps): make Caddy cross-build reproducible by @markokraemer in #6214
• feat(daemon): verified opencode reload — boot the new one, then retire the old by @Ino-Bagaric in #6213
• feat(api): materialize restricted agent environments by @Ino-Bagaric in #6126
• fix(ci): resolve staging scanner findings by @markokraemer in #6218
• test(daemon): make the reload decline path provable on a real box by @Ino-Bagaric in #6219
• fix(apps): preserve runtime billing through idle lifecycle by @markokraemer in #6220
• ci(apps): provision nested wildcard certificate by @markokraemer in #6207
• fix(ci): make Rekor signing retries idempotent by @markokraemer in #6221
• fix: promote verified agent config replacements by @Ino-Bagaric in #6223
• fix(ci): checkout signing helper in supply-chain job by @markokraemer in #6224
• fix(ci): scope Apps edge certificate token by @markokraemer in #6222
• fix(web): de-noise Canvas getImageData OOM on marketing homepage (BS b4b43847) by @agent-kortix in #6225
• fix(apps): gate projects and bootstrap Platinum runtime by @markokraemer in #6226
• fix(web): connector catalogue stops at 192 of ~2,700 apps — restore paging, add infinite scroll by @sutharjay1 in #6228
• feat(reload): say the turn was stopped, and ask before stopping it by @Ino-Bagaric in #6230
• fix(proxy): the opencode PTY must follow opencode across a reload swap by @Ino-Bagaric in #6233
• perf(web,sdk): one cache entry per entity, and stop discarding route segments by @sutharjay1 in #6231
• fix: suppress request deadline toasts by @markokraemer in #6234
• fix(projects): re-land legacy-migration chat rehydrate on session open by @markokraemer in #6235
• fix(apps): make cold wake and Dockerfile runtimes reliable by @markokraemer in #6227
• fix(web): name the session browser tab, owned by route metadata by @sutharjay1 in #6236

Full Changelog: v0.12.4...v0.12.5