v0.25.0

0.25.0 - 2026-10-14

Bug Fixes

• Log database errors by SQLSTATE, never by their values in #2254 by @daavoo (992df95)
• pricing: Answer invalid_model for an unknown model before the pricing gate in #2266 by @daavoo (e5be6da)
• web: Show "Can't reach the gateway" only when it stays unreachable in #2268 by @daavoo (3fb4474)
• chat: Treat a completion with no choices as a provider error in #2269 by @daavoo (dd553cc)
• tools: Use the provider's own tools unless a fallback needs Otari's in #2263 by @hasangzl (c7acd73)
• web: Offer to price a model only on a request it served in #2271 by @daavoo (d307183)
• auth: Refuse closed signup for an identity the roster no longer holds in #2276 by @tbille (09ea4d0)
• organizations: Require a membership to create one where signup is closed in #2277 by @tbille (66d2bef)
• auth: Hold a provider sign-in to closed signup's live-membership rule in #2280 by @tbille (eae6dd7)
• auth: Let a password reset claim an account nobody has signed in to in #2281 by @tbille (baf148e)
• BREAKING: auth: Verify a signup only with its own password, and hold every claim to one rule in #2288 by @tbille (f86f280)
• organizations: Close stale invitation links and give a claimed identity a home in #2289 by @tbille (44f4645)
• web: Send an invitee with no organization to their invitations in #2279 by @tbille (b5b38f6)
• web: Give a signed-in person with no organization a working dashboard in #2290 by @tbille (b0a5fc8)
• budgets: Refuse a blocked owner's service key on the end-user routes in #2287 by @claude[bot] (a592188)
• BREAKING: identity: Key OAuth sign-in on the provider subject in #2236 by @peteski22 (ad2b5e5)
• identity: Require the published terms when a provider sign-in creates an account in #2297 by @tbille (195ef37)
• identity: Give locked-out members a way back and say why auth refuses in #2298 by @tbille (ef9a86a)
• invitations: Bound invitation mail, reissue lost links, and say how an invitee gets in in #2299 by @tbille (812ed9a)
• organizations: Give an unwanted address its organization when it is claimed in #2300 by @tbille (425e674)
• dashboard: Smooth the sign-in pages found rough in the auth QA pass in #2301 by @tbille (11a2a4f)

Features

• routing: Name the serving model in an Otari-Model header in #2262 by @hasangzl (c1227f3)
• budgets: Send Retry-After when a budget refuses a request in #2265 by @daavoo (6e187a9)
• budgets: Let a service key manage its own end users in #2267 by @daavoo (d149ef7)
• tools: Take over Anthropic's web fetch with an Otari-Web-Fetch header in #2264 by @hasangzl (a745195)
• any-search: Check Exa's answer fields and run live tests in CI in #2272 by @aittalam (f5ff91a)
• search: Run the direct endpoint on any-search in #2273 by @aittalam (0ce9057)
• budgets: Accept end-user ids that contain '/' in #2292 by @daavoo (bb59024)
• tools: Let one request combine web tools, code execution and MCP in #2274 by @hasangzl (af3fd2a)
• tools: Choose what a workspace with no tool policy gets in #2296 by @daavoo (4101863)

Full Changelog: v0.24.0...v0.25.0