Changelog

Features

• feat(credentials): add managed credential groups
• feat(tables): filter by cell value from the cell menu, sort from the column menu
• feat(ashby): incremental job sync, custom field writes, and application lifecycle ops
• feat(connectors): add 9 knowledge base connectors
• feat(integrations): add Azure Data Explorer
• feat(rabbitmq): add RabbitMQ integration

Bug Fixes

• fix(access-control): default every operation and model picker to one the permission group allows
• fix(tables): allow unbounded v1 row queries
• fix(webhooks): read every Ashby error shape when webhook registration fails
• fix(knowledge): remove caution triangle overlay from connector icon
• fix(grafana): validate against the API docs, add data source querying and contact-point CRUD
• fix(settings): redirect unavailable tabs to general
• fix(icons): align table block icon and 12-unit icon stroke with the emcn family
• Revert "fix(integrations): read every service mark from one registry"
• fix(integrations): read every service mark from one registry
• fix(settings): preserve tab when switching workspaces
• fix(logger, blocks): log nested errors and stop spurious model-selection warnings
• fix(v2): close seven correctness and honesty gaps found sweeping the API
• fix(condition): stop a secret value from breaking or forging a condition

Other Changes

• chore(utils): consolidate record guards and remove dead code

View changes on GitHub

Features

• feat(library): How to Turn a Workflow Into a Reusable MCP Tool (Sim vs n8n, Gumloop, and Zapier)
• feat(canvas): add a setting to turn off auto-focus when clicking blocks
• feat(netsuite): add Oracle NetSuite integration
• feat(logrocket): add LogRocket integration
• feat(emails): add aug-13 what's new broadcast
• feat(v2): complete and align the v2 API surface
• feat(windchill): add document integration
• feat(xai): wire reasoning effort through the Grok adapter
• feat(models): add grok-4.6 and make it the xAI flagship

Improvements

• perf(tables): stop a table write refetching every loaded page in the tab that made it
• perf(workspace): stop the sidebar fetching palette data on every route
• improvement(search): make overlap dedupe linear in match count
• improvement(canvas): cancel an in-flight edge drag with Escape
• perf(server): stop calling our own API over HTTP during render, execution, and tool runs
• perf(prefetch): stop calling our own API over the wire during server render
• improvement(nav): cut prefetch and session-recorder waste
• improvement(docs): make the API reference read as code and unify its type token
• improvement(emails): size the header wordmark to the landing navbar's rule
• improvement(workflow): smooth the running hatch and sit it in the slot's own box
• improvement(blog): simplify provenance post structure

Bug Fixes

• fix(agent): show files in tool picker
• fix(search): stop cmd+k boosts from lifting weaker matches over stronger ones
• fix(desktop): let sites copy to the clipboard in the browser tab
• fix(desktop): report a stock Chrome user agent in the browser tab
• fix(tables): stop every table paginating forever on a null totalCount
• fix(execution): give a cancelled async run its terminal metadata
• fix(sidebar): align credits chip with panel toggle and square the collapsed rail
• fix(icons): match folder icon optical size to sibling resource icons
• fix(execution): resolve secrets against the acting principal, not the workflow owner
• fix(logs): record how long a cancelled run had been going
• fix(canvas): stop phantom ports and a latched-open action bar
• fix(v2): hold create to the rules update enforces, and bind the last two cursors
• fix(chat): focus the composer when opening a new or existing chat
• fix(v2): close the defects live probing found
• fix(autolayout): rescue new notes from blocks they were created on top of
• fix(sidebar): stop bubbled dragleave events cancelling an in-progress drag
• fix(desktop): move prereleases to release repo
• fix(v2): stop telling callers something the server did not do
• fix(loading): debounce selector search, fix two row-cache snapshots, and move Vertex refresh to the app
• fix(blocks): give the detail headers the same tile as everything else
• fix(v2): close the correctness gaps the release audit found
• fix(sidebar): keep the right-click context menu open over the collapsed chat flyout
• fix(realtime): keep the file-doc store reconnecting instead of dying quietly
• fix(v2): close the correctness gaps an end-to-end audit found
• fix(tools): resolve credentials over HTTP again so token refresh keeps the app's OAuth config
• fix(files): stop the collaborative editor rewriting and reflowing a document on open
• fix(files): preserve principals when serving generated documents
• fix(emails): re-export the wordmark onto its original canvas
• fix(enrichment): require work email company domain
• fix(copilot): align principal lifetime with orchestration
• fix(files): allow document compiler to read referenced images
• fix(tools): sanitize database execution errors
• fix(billing): checkout guard, admin panel case
• fix(workflow): draw a highlighted edge over the ordinary ones
• fix(workflow): stop a nested block jumping when it leaves its container
• fix(workflow): stop subflows resizing themselves after every load
• fix(v2): give the keyset cursor's timestamp an explicit SQL type
• fix(cmdk): keep the first result focused and the top fog stable across re-ranks
• fix(copilot): surface document render failures
• fix(blocks): give a block one tile everywhere it is listed
• fix(workflow): stop the coloured knob leaving a barb at each shoulder tip
• fix(workflow): allow dual-mode blocks inside loop/parallel subflows
• fix(desktop): fix desktop prod ci #6628
• fix(v2): serve HEAD, advertise PATCH, and document the reachable 403
• fix(v2): tell a caller when to come back on every failure meant to be retried
• fix(docs): include API key header in generated code samples
• fix(v2): give every collection one pagination contract and close four envelope holes
• fix(copilot): keep a file-preview failure from stripping a tool call's arguments

Other Changes

• test(realtime): wait for the idle read the streak test depends on
• test(prefetch): cover the workspace-list seed, and fix two tests that could not fail
• chore(ci): declare least-privilege permissions on the desktop e2e workflow

View changes on GitHub

Features

• feat(blog): Tracking Secrets Through an Agent Run
• feat(library): What Is Retrieval-Augmented Generation (RAG)?
• feat(calendly): extend tools with booking, availability, no-shows, and routing forms
• feat(search): page-aware cmd+k palette with ask-Sim mode
• feat(incidentio): add on-call, alert, catalog, and team tools
• feat(salesforce): add JWT bearer flow and sandbox OAuth support
• feat(workflows): new workflow block card, progress indicator, colors, dsl for natural language preview, retry configs
• feat(comparisons): add code-sandbox and session-policy rows

Improvements

• perf(db): drop 0287's two zero-row scans from the ACCESS EXCLUSIVE hold
• improvement(integrations): add Managed Agents templates and guard docs links
• refactor(audit): derive updatedFields through one shared helper
• improvement(updates): validate update path and fix native mac help
• improvement(desktop, executions): fix desktop update script and throw error when thinking enabled on stream false
• improvement(desktop): help menu
• improvement(desktop): add apple signing, fix some bugs
• improvement(provenance): make the incompleteness reason set closed and complete
• improvement(audits): skip the sql-date-binding parse for files without drizzle-orm
• improvement(external-endpoints): v2 versions with clean signatures + updated docs based on openapi spec
• improvement(ui): align terminal with the workflow design system, fix row hover states
• improvement(setup): complete knowledge and update flows
• improvement(provenance): name every guard that can latch a registry

Bug Fixes

• fix(executor): carry child provenance across the workflow agent tool result
• fix(executor): copy the env map at the workflow-tool boundary
• fix(v2): derive the log and run status enums from the persisted status list
• fix(docs): restore api-reference URL continuity and fix translated SDK bodies
• fix(sdk): make the 0.2.0 SDK release safe to publish
• fix(copilot): clamp the legacy int4 size when materializing a chat upload
• fix(executor): give the workflow agent tool the caller's env and PII policy
• fix(workflows): pin a stored block retry policy when loading it
• fix(mcp): stop refusing tool results authored by another workspace member
• fix(uploads): sign Azure upload URLs create-only
• fix(mcp): audit an upsert that rewrites or revives a server
• fix(uploads): make execution attachment completion replay-safe
• fix(files): restore CSV preview cancellation
• fix(tables): tolerate row deletion during run cancellation
• fix(files): order file folders in SQL like every other folder list
• fix(mcp): audit the columns an MCP server update wrote, not the params it got
• fix(knowledge): return pending status for new documents
• fix(workflows): redact run and export secrets
• fix(tables): prevent legacy group auto-run dispatch
• fix(logs, workflows): snapshot fetch optionality, restore consistent draft read snapshots
• fix(tools): bind schema-enrichment reads to executor delegations
• fix(api): widen the cancel-execution reason contract to what the route emits
• fix(api): wait for knowledge dispatch and encode filenames
• fix(desktop): fix background tab spawning
• fix(security): redact workflow snapshot secrets
• fix(files): preserve slashes in folder paths
• fix(logs): restore narrow v1 detail query
• fix(api): conceal cross-tenant resource denials on internal routes
• fix(tables): preserve group auto-run semantics
• fix(docs): preserve items response fields
• fix(api): close five defects found auditing the v2 migration against main
• fix(authz): enforce credential and workspace boundaries
• fix(api): collapse the internal error envelope and restore requestId
• fix(tables): cap row pages and use native cursors
• fix(api): restore migrated endpoint and SDK compatibility
• fix(mship, desktop): fix bugs
• fix(agiloft): resolve attachment MIME type instead of trusting the header
• fix(v2-api): close three secret disclosures, make the surface consistent, and align docs with signatures
• fix(credentials): authorize shared credentials without requiring a workflow
• fix(agiloft): repoint the block at the alrest surface and fix EWLogin
• fix(forks): detect secrets referenced from advanced-mode fields
• fix(files): let a mouse wheel scroll CSV and XLSX previews horizontally
• fix(api): align v2 permissions and resource behavior
• fix(agiloft): align the integration with the documented ewws REST interface
• fix(files): restore horizontal scroll in CSV and XLSX preview tables
• fix(provenance): make one length floor the whole substitution rule
• fix(auth): rate limit the password reset endpoints
• fix(api): restore legacy endpoint compatibility
• fix(tools): bound internal tool calls by the plan deadline, not Bun's fetch default
• fix(auth): let Microsoft sign-in link via Entra's domain-verified email claim
• fix(cmdk): update search-modal assertions to the renamed New chat label
• fix(atlassian): share one cached, retrying cloudId resolver across Jira, Confluence, and JSM
• fix(v2-api): standardization
• fix(cmdk): New Chat -> New chat
• fix(knowledge): retain model input provenance
• fix(chat): deduplicate chat sends server-side instead of probing for them
• fix(executor): restore delegated workflow execution
• fix(ci): include auth package in app prune
• fix(chat): stop losing sends aborted during mount-settling
• fix(chat): stop the streaming transcript floor inventing scroll space
• fix(logs): keep run provenance when compaction drops the execution state
• fix(workflows): port the canvas card icons off lucide-react
• fix(tables): handle row deletion during cell execution
• fix(folders): show the folder trail in table and knowledge base headers
• fix(knowledge): pluralize the module header and root breadcrumb
• fix(sidebar): pluralize the Knowledge bases nav label

Other Changes

• test(export): pin the table and tool-param loss the sanitized export accepts
• chore: remove the stray .agiloft-spec working notes
• test(table): pin the executor auth pairing on the table read route
• docs(salesforce): correct the setup steps that would strand an admin

View changes on GitHub