This page tracks deployed platform functionality, updated daily. It is indexed by the OSC architect RAG system so users can ask "what was recently deployed?" or "when did feature X ship?".

---

• Agent Tasks table now shows a Credentials column with color-coded status for each task's OSC Access Token (Active/Expired) and Git Token (OK/Rotate Soon/Rotate Recommended), plus a mobile alert icon for tasks with credential issues
• Token expiry warning banner now shows separate rows for expired tokens (red) and tokens expiring within 14 days (yellow), with per-row rotate links
• OAuth Apps registration now includes a redirect URIs field
• Instance settings modal shows the current release channel (normal or beta) as a chip when the image tag is known
• Service browse pages now display token consumption (tokens/day), subscription fee (where applicable), and a "Ready to deploy with just a name" indicator for single-option services

• MCP operator surface (/mcp/operator) now returns focused initialize instructions matching its narrowed tool set (osc_search_tools, osc_call_tool, ask-osc-architect) rather than the full 180+ tool context

• New POST /myinstances/:serviceId/:instanceName/restart endpoint for programmatic restart of individual service instances

---

• Updated pricing page prose to clarify custom domain availability per tier
• Expanded MCP acronym in marketing copy and added section heading over the three-doors use-case navigation block

---

• Next.js 14 upgraded to 15 to patch CVE-2026-23864

---

• Add missing-piece build series landing page

---

• OAuth redirect_uri validation errors now include detailed messages describing exactly why the URI was rejected

• Service instance configuration errors now include the service schema inline, showing required and optional fields without a separate tool call
• MCP server now returns a 400 with a migration hint when the retired ?essentials=1 parameter is used; unknown ?filter= values also return 400 instead of silently returning wrong results
• get-mcp-help tool descriptions updated to reflect current surface and category layout
• Job-type services (which run on-demand and terminate) are now correctly excluded from instance listing and deletion; attempting to delete a job-type service instance returns a descriptive error

• Agent Tasks now track which git credential each task is bound to, enabling list-git-credentials to show boundAgentTasks relationships

• Live chat support widget added to the marketing site
• Homepage hero section updated with agent-first messaging and use-case navigation

---

• OAuth client registration now accepts loopback redirect URIs (http://localhost, http://127.0.0.1, http://[::1]) per RFC 8252 §7.3, enabling native desktop and CLI app OAuth flows
• Low-token digest now calculates net daily drain correctly by accounting for token refill in the denominator
• Analytics provisioning is now non-blocking: analytics setup no longer delays app creation

• list-git-credentials now shows which Agent Tasks are bound to each credential (boundAgentTasks), alongside the existing boundApps field
• create-agent-task and update-agent-task now validate that the specified gitCredential exists before creating or updating the task, returning an immediate error with the list of available credential names
• Reserved site names (www, app, api, and others) are now blocked when creating a My Page via MCP
• setup-parameter-store now warns when you attempt to share a single Valkey instance between multiple parameter stores
• Parameter store tools now surface server errors gracefully instead of crashing on unexpected HTML or 5xx responses
• Service dependency probes now correctly resolve {{secrets.X}} references in database and SMB URLs before connectivity checks

• Reserved site names are now blocked at API level when creating My Pages
• HA standby cleanup now runs on both clusters when HA is disabled

• Unknown query parameters in GET /maker are now rejected with a 400 error instead of being silently ignored

---

• Token Consumption card label updated to reflect lifetime semantics (total tokens used since account creation, not a rolling window)
• Service instance name input now enforces a 20-character maximum
• OAuth redirect URIs now accept custom URI schemes (e.g. myapp://callback) per RFC 8252, enabling native app OAuth flows
• Cancelled PayPal plans no longer disappear from the Subscriptions tab and receipts list
• Suspended apps list now refreshes automatically on browser tab focus; resuming an app removes it from the Suspended list immediately without a manual reload
• AI chat streaming rewritten as an async generator, eliminating a persistent ReadableStream teardown crash in long chat sessions

• get-mcp-help now derives its category list from the live tool registry and includes pagination context, improving accuracy of help responses for MCP clients

• Stage/Prod pipeline provisioning now uses a platform-internal token instead of requiring the tenant's Agent Tasks credentials — enabling Stage/Prod on any paid-plan app even if Agent Tasks has never been configured
• HA disable now cleans up the standby instance on both clusters, preventing ghost secondaries from a prior cross-cluster migration

---

• Agent Connector page now uses a modal picker: clicking a row in the compact list opens a full connection details modal instead of an expanded inline card
• Workspace switcher retains the last explicitly selected tenant across page navigations
• My Apps Release to Prod button now shows a disabled state with an explanatory tooltip when the current build status prevents a production release
• Service instance status card shows "Restarting" throughout the full 30-second pod teardown window, preventing a premature flip to "Running" during restarts

• Gitea API token creation now retries on 404 before triggering a full instance rebuild, reducing unnecessary rebuilds caused by transient Gitea startup delays

---

• My Pages now has a web console UI for HTTP Basic Auth: set a username and password from the site detail view, with eye toggle to reveal the password before saving
• Custom domain and wildcard domain types are now available to Basic plan users in the Create Domain and Update Domain modals
• Agent Connector page replaced the expanded card grid with a compact list; clicking a row opens a modal with full connection details
• Parameter inputs in the Manage Parameters modal now have an eye toggle to show or hide the value, and the layout is responsive on mobile

• publish-static-site is deprecated; use My Pages tools (create-my-page, upload-my-page-files, publish-my-page) instead
• upload-my-page-files-from-url now guards against SSRF by blocking requests to internal network addresses
• systemCanGenerate fields in service schemas are no longer flagged as missing required fields when creating instances
• list-published-skill and get-published-skill now handle network errors gracefully
• Improved accuracy for app readiness checks, HA mode detection, token savings estimates, and orphan diagnosis
• call-service-endpoint no longer false-positives on opaque handles with high-entropy substrings

• My Pages directory URLs (e.g. /docs/) now resolve to docs/index.html without a redirect
• Non-secure parameter store responses now include the instance URL

---

• My Pages list now shows a Manage icon (arrow-out-of-box) on each site row, opening the site detail view
• Exceeded-token notification email now accurately reflects limits for paid tenants

• New set-my-page-auth MCP tool: enable HTTP Basic Auth on a My Pages static site (username + password, stored as htpasswd hash)
• New remove-my-page-auth MCP tool: disable HTTP Basic Auth on a My Pages static site
• get-my-page now returns authEnabled and authUsername fields when a page is password-protected
• create-service-instance response no longer crashes when the orchestrator omits the instance URL

---

• Param store Manage button is only enabled after the server confirms the parameter store is ready, preventing premature access to an uninitialized store
• Service instances for services not yet migrated to Elastx are now fetched from their original per-service orchestrator, keeping the dashboard accurate during the migration window

---

• My Pages is now a top-level navigation entry — create and manage static sites at *.pages.osaas.io directly from the dashboard sidebar
• Skills visibility control: choose Draft, Published, or Unlisted when contributing a new skill; toggle between states from the skill card at any time
• Re-upload files to an existing My Page site without recreating it (Update flow with manifest-diff prune)
• Published skills feed now covers the full catalog with additional metadata fields

• New MCP tools for My Pages: list-my-pages, get-my-page, create-my-page, upload-my-page-files, publish-my-page, delete-my-page
• list-agent-tasks, list-my-domains, and list-backups now support limit and hasMore pagination
• New nudge-feedback MCP tool to remind the team of pending unreviewed feedback items
• list-my-apps supports a new includeHealth flag for fleet-level app health monitoring

• osc web publish <name> <dir> now publishes directly to My Pages instead of provisioning a MinIO bucket. This is a breaking change: the previous -s flag and bucket/CDN output are gone, and osc web cdn-create can no longer be chained after web publish. Custom domains/CDN in front of a My Pages site are not yet supported.

---

• Subscription status checks now account for instances running on both clusters, preventing false stale-subscription detections for multi-cluster workspaces

---

• Auth rejection errors in the secrets panel are now handled gracefully instead of crashing the page
• Service detail pages no longer show a false "not found" state when the service token check fails

• New MCP admin tools: admin-list-subscriptions and admin-get-tenant-plan for workspace subscription and plan inspection via AI agents

• New mail delivery status endpoint — check whether a workspace mail server has sent messages successfully via GET /mymail/delivery-status

• Token consumption rates are now snapshotted at the time of use, preventing retroactive price changes from affecting already-incurred charges

---

• Rate limit errors in the service catalog and transactions UI no longer crash the page — handled gracefully with inline feedback
• Service detail pages now handle token errors without showing a false "not found" state

• AI assistant now enforces CouchDB database isolation for Intercom: reusing the same host and database path across multiple instances is rejected with corrective guidance
• Service secrets can no longer be set to literal {{secrets.X}} template strings — the AI rejects these before sending to the platform
• Before creating a service instance, the AI now validates that the URL scheme (https, rtmp, etc.) matches what the service expects
• After a multi-step setup failure, the AI now offers to clean up any orphaned instances created before the failure
• Developers calling the OSC chat API directly can enable MCP tool access by omitting ?disableMcp=true and including a valid x-pat-jwt header

• Private database instances now correctly restore their public-access setting when resumed from a suspended state

---

• AI assistant conversation history panel: browse past conversations and resume any of them directly from the chat card
• Resume AI chat from last saved conversation on page load

• Stage/prod pipeline can now be enabled for GitHub-hosted apps that have no stored git token
• Resolve db-backuper Job cluster by detecting its own domain

---

• Add MCP tools for static site publishing (publish-static-site, upload-object-to-bucket, set-storage-bucket-public)
• Remove Agentic SDLC precondition from Stage/Prod MCP tools — enable-app-stage-prod now requires only a paid plan
• After 3 consecutive "starting" status checks, AI agent automatically escalates to fetching instance logs
• OSC URL wiring gate now skips already-declared service associations and supports session-level confirmation for cross-service wiring

• Stage/prod versions endpoint now returns GitHub tags for GitHub-hosted My Apps
• Custom domain responses now include TLS certificate status for secondary cluster
• Stage/Prod pipeline provisioning and release handlers are now deterministic under concurrent requests
• Drop Agentic SDLC precondition for stage/prod activation — paid plan is the only gate

---

• Day-0 activation emails now include a runway warning for at-risk tenants

• Pricing calculator plan allotments and recommendation thresholds updated

---

• The Solutions page now shows a loading indicator while Recent Deployments is fetching on initial page load
• Server errors during page refresh after a deployment are now handled gracefully — the page no longer crashes on transient errors
• Member users are now redirected away from Workspace Settings instead of seeing an error
• Activation emails now show raw event counts for each instrumented branch — makes metric-based activation signals clearer

• After setting up a parameter store, the AI agent now proactively guides users to bind it securely to their custom app via configService and configApiKey — prevents credentials from being pasted into chat messages where they would be stored in conversation history
• The AI now gives clear guidance when a requested capability is not accessible via MCP (e.g. features that require the OSC web console)
• The AI can now answer "what was recently deployed?" and similar recency questions by querying the indexed Platform Changelog — responses are sourced from live data instead of training knowledge
• For video ingest, transcode, and streaming use cases the AI now recommends Open Videocore as the first option before suggesting lower-level components

• Backup credentials (PATs) are now automatically renewed when they are within 14 days of expiry — scheduled backup runs no longer fail silently when the authentication token ages out
• Backup policies now expose a credentialStatus field (ok / expired / renewed) showing PAT credential health — visible via the list-backup-schedules MCP tool and the My Backups dashboard
• Backup scheduler flags now default to enabled on startup — scheduled backup jobs that were silently not running after a restart will now run correctly

---

• Agent task setup calls now automatically retry on transient TCP-level connection failures — the My Agent Tasks feature is more resilient on brief network hiccups
• Multi-tenant users are now automatically directed to the correct workspace when a Service Access Token expires — eliminates the manual workspace selection step after re-authentication
• The OSC console now sends session keep-alive pings and shows a session-expired banner when the session ends — prevents silent failures on long-running dashboard pages
• The Configure Service modal now exposes a UDP Gateways field for services that require UDP endpoint configuration

• CouchDB connection errors now show actionable recovery steps instead of opaque technical messages — helps users and AI agents diagnose and recover from CouchDB instance issues faster
• MCP instructions now include guidance on Service-to-Service integration using Service Access Token (SAT) exchange for My Apps — makes it easier for AI agents to set up secure inter-service calls

---

• App configuration updates now surface specific error messages when the container is in a failed state (CrashLoopBackOff, OOMKilled, image pull failures) — previously these returned a generic error

• Rolling restarts now return a partial-success response when some instances restart and others fail, instead of treating the whole operation as a failure
• create-service-instance now rejects attempts to override OSC-owned URL fields (such as base URLs for managed services) — prevents misconfiguration
• New find-parameter-key MCP tool searches across all parameter stores in a workspace to locate a key by name — useful when you do not know which store holds a given config value
• Instance naming constraints (alphanumeric only, max 20 characters) are now included in get-service-schema responses — AI agents receive the constraint upfront so they can prompt for a valid name before creation

• Proxy creation no longer duplicates mirror records when a background task wins a race condition
• Partial-success 500 responses now include the configApiKey field — the API key is available even when the instance creation partially succeeded
• Locality predicate for proxy operations now uses real geo-routing data

• Team diary date pages are excluded from search indexing and the sitemap — reduces SEO noise from machine-generated content

---

• wait-for-app-ready now times out after 50 seconds instead of 120 seconds — agents receive faster feedback when an app does not become ready in time
• MCP tool search now supports multi-word queries — searching for "hls monitor" or "media probe" returns relevant results instead of requiring a single keyword

---

• Parameter store API key reveal now includes a download button that saves the key as a .env file — useful as a backup before closing the modal
• The Done button on the key reveal dialog stays disabled until you check "I have saved this key securely" — prevents accidentally closing before saving the key
• Same download and acknowledgment flow applies to the credential regeneration modal
• Remove stale service count copy from the OSC landing welcome text

• create-agent-task now accepts scheduleType: "manual" to create on-demand tasks that never fire automatically — trigger them with run-agent-task whenever you want
• New acknowledge-secret-saved MCP tool creates an audit log entry after a human confirms they have downloaded and saved a parameter store CONFIG_API_KEY from its one-time download link

• Update hero subtitle and portability section title copy

---

• Long prompts on skill detail pages now wrap correctly instead of overflowing
• Screenshots are now displayed on community skill cards in the skills index

• Skill display names are now projected into the title field on public skill routes — improves search indexing for skills with custom display names

• When binding a Umami analytics instance to an existing app, the platform now automatically registers the app URL as a website in Umami and returns the tracking script in the response — no manual Umami setup required
• Skills now support an optional displayName field in the schema — set a human-readable title without changing the skill identifier

---

• HTTP 429 rate-limit errors now surface a user-friendly message instead of a technical error code

• MCP tools now reject requests with unknown query parameters — previously unknown fields were silently stripped, which could mask typos in tool arguments
• get-logs-for-instance now redirects automatically to get-my-job when called with a MyJob serviceId, returning the correct log format without manual intervention

---

• Token usage chip now shows a danger state when the daily consumption rate exceeds the daily refill rate — prevents silent budget exhaustion
• Parameter store tab links now use correct URL encoding for tab names with spaces

• list-community-skills now queries the live community catalog — supports query, type, tags, and limit filters; previously returned a placeholder message
• import-community-skill new tool — copies a community skill from another tenant into your own workspace; the forkedFrom field in the result records the origin
• All appId-based MCP tools (get-my-app, restart-my-app, diagnose-my-app, etc.) now return a structured error with recovery hints when the app is not found, instead of a generic failure

• Community skills index added: a cross-tenant PublishedSkill collection and API enables browsing skills from all OSC workspaces in one place — powers the /skills public index page and list-community-skills MCP tool

• Skill publish, update, and delete operations now write through to the community catalog index immediately — the /skills public index page and MCP tool reflect changes without a reindex delay

• Attribution cookie removed — referral tracking now uses URL-passthrough only, removing a stale cookie that was occasionally causing checkout errors for returning visitors

• Token count queries now default to today's UTC midnight as the start time when no start date is specified — fixes incorrect zero-count readings during the first hours of the day
• Subscription cancellations now update purchase status to CANCELLED immediately — prevents stale ACTIVE status on cancelled subscriptions

---

• Published skill pages now support screenshot uploads — images are rendered on the public skill page alongside the description
• Public skill pages now include a copy-prompt button and a direct MCP connect link for one-click onboarding

• diagnose-my-app now shows unfiltered startup logs for apps in non-running states (building, failed) instead of error-only logs — makes it much easier to diagnose startup crashes where all output is INFO-level
• get-my-app-logs detects git credential failures (HTTP 403, authentication errors, and TTY-style "No such device or address" errors) and emits a structured advisory pointing to list-git-credentials and the 30-day GitHub PAT expiry
• list-git-credentials now reports credential age in days and flags credentials within 5 days of the 30-day GitHub PAT default expiry (HIGH risk) or within 10 days (MEDIUM risk)
• wait-for-app-ready now correctly distinguishes a newly-started app from a restarted one — prevents false "ready" reports when the old pod is still running immediately after a restart is triggered

• Skill API and metadata now support an optional screenshotUrl field, enabling screenshot display on public skill pages

---

• Fix: PKCE OAuth clients that strictly validate code_challenge_methods_supported can now authenticate — plain has been removed from the supported methods list to comply with the PKCE spec

• list-available-services now includes a status: "COMPLETE CATALOG" sentinel in category-filtered responses so AI agents reliably stop re-scanning after receiving the full result set
• getApp now times out after 5 seconds instead of hanging for up to 13 seconds when an app is not found, giving agents faster failure feedback
• openWorldHint annotations corrected on 8 tools that were incorrectly marked as able to access the open web — MCP clients receive accurate tool metadata

• My Apps in a REBUILD_CREATE_FAILED tombstone state now return a 409 with an explicit recovery message on plain restart attempts — covers an additional failure state beyond the case handled in v7.81.2

---

• Public skill share pages are now indexed by search engines and social media crawlers — skills can be discovered via Google and Bing
• FREE plan tenants now see a token budget chip on the dashboard showing their remaining token balance as a percentage

• MCP server now correctly negotiates protocol version during the initialize handshake, resolving connection failures with strict MCP clients
• MCP capability advertisement trimmed to only implemented capabilities — clients no longer receive capability claims the server cannot fulfill
• resources/templates/list handler added per MCP spec, returning an empty array; previously caused JSON-RPC errors on clients that call it
• Cursor-based pagination is now explicitly rejected with an error instead of silently ignored, giving callers actionable feedback
• MCP tool errors (Zod validation, auth failures) now return structured isError tool results instead of throwing — prevents clients from treating validation errors as transport failures
• Audit stats API now accepts a tenantId query parameter to scope aggregation to a single tenant; all MCP tool calls are now tagged with source: mcp in audit metadata

• My Apps stuck in a failed rebuild state now return a 409 error on restart with the message "App is in a failed rebuild state. Use ?rebuild=true to recover, or DELETE the app and recreate it." — previously the restart would silently fail
• PAT validity is now checked before any destructive rebuild operation begins, preventing failed rebuilds due to expired tokens before a single resource is changed

---

• Fix: backup scheduler now re-mints a non-expiring PAT when a backup policy is enabled, ensuring scheduled backups continue running without token expiry failures

---

• Builders dashboard empty states now include direct action buttons — "Submit a Service" navigates to the Service Inbox tab, "Contribute a Skill" opens the contribution modal directly

• Default Node.js version for My Apps deployed on the Web Runner (eyevinn-web-runner) bumped from Node 22 to Node 24
• Apps can now request a different Node.js major via engines.node in package.json (18, 20, or 22 are also available; other values fall back to the default)
• Apps can now opt in to pnpm or yarn via a Corepack packageManager field in package.json, instead of always using npm
• Apps without either field are unaffected apart from now running on Node 24 instead of Node 22
• See Eyevinn/web-runner#50

---

• Add compare-services MCP tool — evaluate multiple services side-by-side to find the best fit for a use case without calling get-service-schema separately for each
• Restart advisory threshold lowered to two consecutive health-check failures and now returns a structured advisory object — agents receive actionable restart guidance sooner
• wait-for-app-ready tool now polls internally until the app is ready, eliminating the need for callers to build their own polling loops
• Fix: AI assistant now correctly advises that NEXT_PUBLIC_* variables set in the parameter store are available in client-side code — OSC injects them before the build runs
• Fix: AI assistant sessions with MCP disabled now exit gracefully when repeatedly blocked by verification prompts instead of looping indefinitely

---

• Logged-in users can now view public skill pages — previously they were redirected to the Builders dashboard instead of seeing the shared skill
• Published skills now render dynamic Open Graph preview images on social media share links
• Public skill pages now display a git clone URL section with the anonymous HTTPS clone URL for the skill's Gitea repository
• Fix: My Apps now shows a clear error state when a bound parameter store has been deleted, instead of silently failing to load configuration
• Fix: Token Usage bar now correctly resets its daily tracking window at midnight

• Public skill share URLs now route through the deploy-manager JSON endpoint — skill pages load reliably for all clients including headless tools
• Fix get-published-skill MCP tool to return structured skill content instead of HTML — wraps JSON parsing in a try/catch for graceful error handling

• Published skills now retain their original type (skill/prompt/runbook) and license after creation — previously metadata fell back to defaults after the initial Gitea write
• Skills list supports pagination — tenants with large skill libraries load reliably without truncation

• Token runway estimate ("days until zero") now uses cumulative lifetime consumption instead of today's usage rate, giving a more accurate long-term projection for steady-state accounts

---

• Public skill pages now include Open Graph meta tags and social share buttons (LinkedIn, X, Bluesky, copy link) — share directly from the skill detail page or the Builders dashboard card
• Builders tab switching on desktop is now reliable — the tab URL parameter is correctly propagated through the tab container
• Token budget warning banner and Usage page now draw from the same projected runway calculation for consistent figures

• AI chat sessions now self-repair when a user asks the same question a second time — the assistant acknowledges the prior answer, identifies what changed, and asks a clarifying question instead of repeating verbatim
• Fix get-published-skill MCP tool to correctly fetch skill content — previously pointed at the HTML share page instead of the deploy-manager JSON endpoint

• Parameter store provisioning is now idempotent — retrying a failed store creation no longer results in a conflict error
• Public skills share URL now links to the skill detail page on app.osaas.io instead of the internal API endpoint
• Skills listing loads faster — Gitea session results are cached per tenant for 5 minutes, reducing repeated authentication overhead on the Builders dashboard

---

• Fix token budget warning — the Low Token banner and Usage page now use the same projected runway calculation

• Published skills can now be previewed without authentication via GET /skills/{tenantId}/{skillName} on the AI API — useful for embedding skill metadata in external tools and dashboards
• Add update-published-skill MCP tool — update the content of an existing published skill, prompt, or runbook without deleting and recreating it
• Add delete-published-skill MCP tool — permanently delete a published skill, prompt, or runbook from your workspace

• Manual My Job runs now update lastRunStatus once the job completes, matching the behavior of scheduled runs
• Skill deletion is now backed by an API endpoint — enables the delete-published-skill MCP tool to remove the underlying Gitea repository

---

• Fix stale sidebar menu item permissions after workspace switch
• Send proactive low-balance email before account token balance reaches zero
• Token balance warning now based on overall runway rather than today's consumption ratio
• Workspace secrets are now selectable as OSC access token source when creating agent tasks

• Add useLatest parameter to create-service-instance MCP tool — deploy the newest available image version without specifying an exact tag
• Parameter tool descriptions now remind users to call list-parameter-stores first to get the correct store name
• estimate-service-cost now includes a disclaimer distinguishing nominal (list price) from observed (actual billed) cost

• MyJob manual trigger (POST /myjobs/{name}/run) now updates lastRunStatus once the run completes, matching scheduled-run behavior
• Block Agentic SDLC auto-merge when a CRITICAL security finding is open — blocked PRs receive a comment explaining the gate
• More reliable Gitea code pushes — 422 errors on file-push now retry up to 3 times before failing

---

• Add edit job modal — scheduled My Jobs can now be updated in place (cron schedule, source URL, worker command, parameter store binding) from the web console without deleting and recreating the job

• Add git clone 403 credential-flow guardrail to diagnose-my-app — the assistant now automatically detects authentication failures on private repos and walks through the credential registration and linking steps
• Surface credential-to-app mapping in list-my-apps and list-git-credentials — each app shows its bound git credential name; each credential shows which apps are using it

• Generate non-expiring scheduler PAT for MyJob runs — previously short-lived tokens caused auth expiry on long-running or delayed job executions
• Store MyJobs credentials as K8s service secrets with Elastx fan-out — jobs running on Elastx now reliably receive their OscAccessToken and ConfigApiKey at trigger time

---

• Fan out PAT expiry reminders to all sub-workspace admins — workspace members with admin role now receive personal access token expiry warnings, not just the primary account holder

• Bump hono transitive dep to resolve HIGH severity CVE (GHSA-88fw-hqm2-52qc) — security patch with no user-facing behavior change

• Guard token refill against past_due/unpaid Stripe subscriptions — token top-up requests on accounts with lapsed billing now return a clear error instead of silently failing

---

• Fix CouchDB connection URL handling in client libraries — Intercom Manager wiring with CouchDB now resolves database URLs correctly

• Fan out GET /admin/myapps to Elastx secondary cluster — the admin MyApps listing now aggregates results from both Linode and Elastx, giving a complete view of all tenant custom apps across clusters

---

• Reduce Skills service fetch timeout to prevent 30 s server-action-failed errors — the Skills list now returns a clear timeout message instead of an opaque failure when the deploy-manager is slow

• Translate ContainerCreating phase to success in update-my-app-config — agents receive a restart_in_progress status with a prompt to call wait-for-app-ready instead of an ambiguous error during rolling restarts

---

• Add workspace secrets to agent task OSC access token selector — workspace secrets stored in your account are now selectable as a reference option alongside runner service secrets when creating agent tasks
• Return RFC 6749 503 on money-manager timeout in /api/connect/token — headless OAuth clients now receive a proper structured error response on timeout

• Include diagnostic snapshot on wait-for-app-ready timeout — timeout responses now include pod health status and HTTP probe results to help diagnose why an app did not become ready
• Return structured not_found envelope on restart-my-app 404 — clients get a clear terminal error instead of a generic failure when the app does not exist

• Pin SDLC bootstrap source ref to commit SHA to survive branch deletion — Agentic SDLC setups no longer break when the source branch used during setup is later deleted

---

• Enforce 20-character max length on service instance names — names exceeding the limit return a clear error with guidance to choose a shorter name
• Mask parameter values and connection-string passwords in MCP tool results — credential values are redacted before being returned to the AI client
• Change get-security-report default format from summary to detailed — reports now include full finding details without requiring an explicit format argument
• Return restart_in_progress status on transient ContainerCreating phase — agents now get a clear non-terminal status instead of an ambiguous error during rolling restarts
• Pre-flight source ref check in enable-agentic-sdlc — validates that the specified branch exists before attempting to enable Agentic SDLC
• Respond to "what's new" and changelog queries with live app health state via list-my-apps

• Fix My Jobs scheduler to resolve correct job status — jobs no longer show "unknown" status after running
• Add enableSecrets flag to parameter store creation — parameter stores can now be created with encryption enabled from the start

• Fix stream abort race condition in AI chat — improves reliability when multiple AI responses are in flight simultaneously
• Store PAT identifier instead of raw token in conversation history — reduces credential exposure in stored sessions

---

• Remove OSC_CONNECT_CLIENT_SECRET startup warning — eliminates a noisy log entry on startup for environments where the OAuth client secret has not been customised

---

• Add personal-use-only note for Claude OAuth token in agent task setup — warns users that subscription tokens are for personal use; recommends API key for automated tasks
• Add crash-at-startup detection to MyApp creation — surfaces "Startup failed" status and log prompt when an app stays in Building state for more than 2 minutes
• Add parameter store API key field to MyJobs create modal — allows encrypted parameter stores to be bound to jobs
• Move Jobs tab to second position in My Apps navigation

• Add diagnose-my-app-orphan MCP tool — diagnoses a vanished app by inspecting K8s state, last-known config, and parameter store bindings directly, bypassing the app registry
• Improve parameter store tool error messages with Levenshtein-based did-you-mean suggestions and mandatory list-parameter-stores prerequisite in tool descriptions

• Add GET /myapps/:appId/orphan-check diagnostic endpoint — inspects K8s runner namespace directly, returns registry state, deployment health, last-known config (secrets redacted), and parameter store bindings

---

• Replace env vars field in Create Job modal with parameter store selector — jobs now bind to a parameter store instance for configuration instead of inline key/value pairs
• Return RFC 6749 invalid_grant JSON on expired refresh token — headless OAuth clients now get a parseable error instead of an HTML redirect
• Move Jobs to top-level tab under My Apps
• Disable Agentic SDLC switch for FREE plan users

• Add MyJobs config API key support — parameter store API key is now persisted and forwarded to the job runner at trigger time
• Fan out git credential updates to all associated app K8s secrets when a credential is rotated
• Add retry-with-backoff to MyApp rebuild POST to prevent permanent deletion on transient errors

• Internationalise agentic-kit page and add MCP-to-agentic-engineering CTA

---

• Guard unauthenticated errors in Terraform server actions — returns a clear sign-in prompt instead of an unhandled exception
• Emit a structured billing_degraded signal when money-manager times out — the degradation is now tracked in the telemetry pipeline for faster incident detection

• Add download-service-secret MCP tool — retrieve a stored service secret value via a secure one-time download link
• Remove commit SHA from update-my-app-source-ref tool description — the tool now clearly communicates it only accepts branch names, not commit SHAs, to prevent misconfiguration

• Clarify that sourceRef fields accept branch names only — commit SHAs are not supported
• Route backup credential lookups through the secondary orchestrator domain for Elastx-hosted instances — fixes credential fetch failures when backing up migrated apps

• Add paste-prompt kit to the /agentic-engineering page — Step 0 connect blocks and three copy-ready prompt cards for Claude Code and Codex onboarding

---

• Show a proactive AI assistant offer during a first session with no engagement — helps new users get started faster
• Forward dashboard UI deploys to the activation audit cohort for conversion tracking

• Add MCP tools for My Jobs management — create, list, run, suspend, resume, and delete scheduled background jobs directly from AI agents
• Auto-nest flat opts.* dot-notation keys in create-service-instance — no need to manually construct nested objects for services like channel-engine
• Guard against unresolved {{secrets.*}} placeholders in create-storage-bucket — returns an actionable error instead of forwarding the literal placeholder to the backend
• Resolve {{secrets.*}} references server-side in create-storage-bucket — credentials are injected at tool execution time within the trust boundary
• Reject commit SHAs in update-my-app-source-ref with an actionable error message explaining that only branch names are accepted
• Surface agent-runner credential prerequisite in enable-agentic-sdlc tool description to guide users before they hit the prerequisite check at runtime
• Guide users to check prerequisites before calling enable-agentic-sdlc

• Add My Jobs API for scheduled background Python jobs — create, list, run, suspend, resume, and delete cron-scheduled jobs that run on ephemeral Python job runners

---

• Add voucher confirmation messages and free-period display during checkout — shows the discount amount and free trial period before payment
• Add REST endpoints for user notifications — platform notifications are now accessible programmatically

• Add workspace member management MCP tools — invite members, list current members, remove members, and update roles directly from AI agents

• Add support for optional originPath when creating a custom domain — requests to the domain root are forwarded to the instance at the specified sub-path (e.g. /my-bucket), enabling path-prefix routing for services like MinIO
• Improve build status detection to prevent a false "ready" state when apps are still building or showing loading pages

• Surface a clear MISSING_PACKAGE_JSON error when a service build fails because no package.json was found — the termination reason is now mapped and returned to the caller

• Fix VAT calculation timeouts by increasing connection pool size and adding write guards — eliminates sporadic billing failures under load

---

• Add repository sub-path field to My Apps create form — specify a subdirectory within your repository when deploying monorepo apps
• Live log viewer for agent task runs now auto-enables and auto-scrolls when the run is currently in progress
• Fix dashboard to show a retry option and user-visible error when instance data fails to load
• Fix custom app domain update to surface domain ambiguity errors clearly
• Fix managed tenant creation to show the correct error when a display name is already taken

• Add rotate-parameter-store-key MCP tool — rotates the parameter store API key and automatically updates all linked agent tasks and My Apps
• Auto-retrieve configApiKey from the parameter store when configService is specified in agent task creation — no need to paste the key manually when using MCP
• Add cursor-based incremental log fetch to get-agent-task-logs — reduces payload size for long-running tasks by fetching only new entries since the last call
• Add server-level instructions to the MCP initialize response — AI tools like Claude Code and Cursor now receive OSC platform context for every tool session without needing a chat session

• Add support for EXTRA_TOLERATIONS configuration — allows service orchestrators to be scheduled on dedicated Kubernetes node pools

---

• Show a user-friendly error during app creation when the GitHub repository URL is wrong or the repository is private — the error message now instructs users to add a Personal Access Token instead of showing a generic 404
• Add an "Ask the assistant" affordance to the Intent Recovery Banner — users who haven't deployed yet can click through to the AI assistant from the service suggestion cards
• Improve contrast for the empty-state CTA button in the first-deploy card to meet accessibility standards

• Return a clear error when an unknown service ID is passed to estimate-service-cost instead of silently failing
• Add Chatwoot live-chat integration to the Connect flow — the AI assistant can now register a website widget inbox in a Chatwoot instance when setting up live chat
• Accept domains with http:// or https:// prefix in create-my-domain and update-my-domain — the scheme is stripped automatically so users no longer need to enter a bare hostname
• Fix Valkey connection URL generation — a null or literal-undefined password no longer produces a malformed redis://undefined@host:6379 URL

• Fix app count metrics to fan out to Elastx — the /myapps/count endpoint now returns accurate totals across both clusters
• Fix proxy service creation on new app deployments to use the correct public instance URL
• Revert custom app URL to the default apps.osaas.io address when a custom domain mapping is deleted
• Fan out Agentic SDLC task secrets to the secondary cluster — agent tasks now work correctly on both Linode and Elastx without manual secret replication

---

• Add explicit Cancel Subscription button to the subscriptions page — users can now cancel directly from the web console without needing to contact support
• Show a Swedish flag badge on custom apps running on Elastx, indicating the app is hosted in a Swedish-owned data centre
• Fix restart flow to send a valid JSON body, resolving intermittent 422 errors when restarting a custom app
• Fix graceful degradation on Terraform deployments page when the backend times out
• Fix stale magic-link redirect — expired magic-link emails now redirect to the login page instead of showing a blank screen

• Add supportsUpdate flag to get-service-schema — AI agents can now determine whether a service supports in-place updates before attempting one
• Deliver Personal Access Tokens and parameter-store API keys via a one-time secure download link instead of displaying them inline in the chat
• Fix JDBC connection URL for PostgreSQL and MariaDB — the jdbcUrl field in connection templates now returns jdbc:postgresql:// and jdbc:mariadb:// format, resolving XWiki startup failures
• Fix MinIO storage operations to surface a clear recovery hint when the request signature does not match — previously this appeared as a generic error

• Replace the enterprise "Contact us" email link with a structured inquiry form on the pricing page

---

• Fix Manage Parameters modal to degrade gracefully when the parameter store returns a 404 or 503, showing a clear error instead of leaving the panel in a broken state
• Add session guards to profile pages to prevent cryptic "digest mismatch" errors when sessions expire during navigation

• Distinguish "orchestrator unreachable" from generic network errors in instance-management tools — the agent now reports the cluster is down rather than retrying indefinitely
• Require explicit confirmation before executing destructive MCP operations (delete, remake, restart) — agents must confirm intent before the action runs, per ADR-0030
• Extend confirmation handshake to admin-remake-service — admin service rebuilds now require the same explicit confirmation as other destructive operations
• Add update-my-app-source-ref MCP tool — repoints a custom app to a different git branch or commit SHA without needing to redeploy from scratch
• Fix MinIO client to parse port and SSL settings from the instance URL — resolves connection failures when the MinIO endpoint uses a non-default port
• Redact sensitive values at write time in the MCP secret scanner — secrets are masked before they can be stored in tool logs or conversation history

• Add sovereignty field to the MyApp response — indicates whether a custom app is hosted on Elastx (Swedish-owned, "se") or Linode/Akamai (US-owned, "us")
• Thread secondary orchestrator domain through all HA standby operations — high-availability MyApps now correctly route standby lifecycle calls to the secondary cluster
• Fix public hostname resolution in switchProxyTarget for Elastx-hosted apps — proxy target switches now use the correct public-facing hostname instead of internal cluster DNS

• Add Open Live launch post to the blog (authored by Magnus Svensson)
• Fix attribution tracking to capture gad_source and gad_campaignid Google Ads parameters

---

• Fix MyApp restarts in multi-region deployments — restart operations now route through the correct orchestrator URL and succeed reliably across all five runner types
• Fix app build status detection to probe the app's public endpoint rather than internal cluster DNS — reduces false "still building" states on newly deployed apps
• Fix MyApp list deduplication — when the same app appears on both primary and secondary sites, the primary site entry now takes precedence

---

• Add live email search to the team members list — admins can now filter by email address without scrolling through the full list
• Show a friendly error when the parameter store is temporarily unreachable in the Manage Parameters panel instead of leaving it in a broken state

• Fix app rebuilds sourced from Gitea repositories — the admin token in the source URL is now refreshed on every rebuild so stale credentials no longer cause build failures
• Fix PostgreSQL connection URL detection to recognise both postgres:// and postgresql:// schemes

---

• Surface the specific reason when workspace deletion is blocked — users now see which active subscriptions are preventing deletion instead of a generic error
• Auto-regenerate a stale service secret when the platform access token has been rotated — reduces "service secret expired" failures after credential rotation
• Fix log viewer stability during pod restarts — cancellation errors no longer surface as UI errors in the live log panel
• Improve text contrast in the empty AI assistant panel (WCAG AA compliance)

• Return a clear "service does not support updates" message when update-service-instance is called on a service that lacks an update endpoint (404/405), so the agent can communicate the limitation rather than emitting an opaque error
• Detect "build in progress" placeholder pages during wait-for-app-ready probing — avoids incorrectly reporting a newly deployed app as ready before it has started
• Handle platform-overload errors (MaxRetriesPerRequestError) with a structured PLATFORM_UNAVAILABLE response rather than crashing the tool call
• Intercom setup now confirms each dependency is fully running before proceeding, even when the dependency was created in a prior session

• Tag custom domain ingresses with the owning tenant ID (osaas.io/tenant-id label) — improves observability and enables per-tenant filtering in cluster tooling

---

• Support configurable ingress class for custom-domain ingresses via environment variable — enables deployments on clusters with non-default ingress controllers

• Fix YouTube video loading in the How It Works section — CSP now allows youtube-nocookie.com embeds so the demo video plays correctly

---

• Remove Easy Install option from the service creation modal — workspace setup now offers AI-assisted or Advanced (manual) setup only
• Fix duplicate WebSocket connections from the Chatwoot live chat widget
• Fix cost estimate display to match the post-creation per-day cost breakdown
• Fix user-friendly error message when the My Apps list fails to load due to a timeout
• Fix service deletion to treat a cast-receiver "No such instance" 500 as a successful no-op, matching the existing 404 handling

• Add refresh-workspace MCP tool — re-reads which workspace the current token maps to, useful when the agent appears to be managing the wrong workspace after reconnecting or switching sub-workspaces
• Add wait-for-service-ready MCP tool for catalog service instances — polls until the instance reports healthy or times out after 5 minutes; called automatically after create-service-instance
• Fix PAT management tools to connect to the correct token service endpoint

• Add publish/unpublish support for services with a status field — services can now be toggled between published and unpublished states in the catalog

• Add error handling to prevent HTTP 500 on Kubernetes API failures — infrastructure errors now return a structured error response instead of crashing the request

• Add click-to-load YouTube embed in the How It Works section — video loads on click to avoid auto-loading third-party resources on page visit
• SEO improvements: Organization entity markup, Products footer links, and sitemap aggregation for better search indexing

---

• Return a clear AUTH_REQUIRED error when MCP tools try to access a parameter store that requires authentication, so the agent knows to configure auth before retrying
• Fix setup-parameter-store to handle responses where the instance URL is not yet available, avoiding a crash during slow provisioning
• Inform the agent that delete-parameter-store takes up to 2 minutes to fully propagate, preventing false "still exists" retry loops
• Auto-fetch startup logs when create-service-instance reports a startup failure — the agent can now diagnose config errors and missing env vars without a separate get-logs-for-instance call

• Fan out MyApp runner-namespace secrets to the Elastx (prod-se) cluster — secrets created for MyApp instances are now automatically replicated to both Linode and prod-se
• Create the correct TLS certificate issuer alias during prod-se provisioning, fixing certificate issuance failures when deploying new service instances to the Sweden region
• Remove the fallback URL from parameter store creation response to prevent agents from connecting to an endpoint before the instance is ready

• Redirect /status to status.osaas.io — the platform status page now shows the hosted status dashboard instead of a broken embed

---

• Add osc_search_tools and osc_call_tool meta-tools for operator-mode embedding — osc_search_tools returns a lightweight tool catalog (name + description, filterable by category or query), osc_call_tool dispatches to any OSC tool without exposing the full schema surface
• Fix storage credential detection to identify the new-instance propagation window: when MinIO credentials are not yet active after instance creation, the tool now returns a clear message to wait 30 seconds and retry rather than a generic error

• Fan out service instance restart calls to the Elastx (prod-se) cluster — restarting an instance from the dashboard or via MCP now propagates to both Linode and Sweden regions

---

• Show a human-readable error when subscription or entitlement limits block instance creation
• Show the variable names in "missing required variables" errors so users know exactly which configuration is incomplete
• Redirect expired or reused magic-link sign-ins to a dedicated /auth/error page instead of a 500 error
• Add outcome-led service descriptions and an in-card "Ask the assistant" button to the empty-state first-deploy card
• Fix paste mode for the OSC token field when editing an agent task with no token saved
• Fix createAgentTask to reject invalid sourceUrl values before they reach the backend

• Add composition mode to estimate-service-cost to estimate the combined cost of a set of services as a group
• Return a clear message when get-logs is called on a service with no log endpoint rather than returning an opaque error
• Add server-side read-only mode: append ?mode=readonly to the MCP URL to restrict all tools to read-only operations
• Require cost confirmation before create-service-instance completes when the estimated cost exceeds the workspace token budget
• Fix network error context in PAT fetch calls and handle stale MinIO credentials and TLS errors in storage tools

---

• Add Regenerate credentials button to the parameter store page so users can rotate the CONFIG_API_KEY without recreating the store

• Organize all MCP tools into named categories — AI assistants now filter by category (e.g. ?filter=databases) more reliably

• Surface clone failure reason and add GitHub repository pre-flight check in MyApps setup
• Show open pull-request status on Agentic SDLC sub-tickets in the issues list
• Fan-out parameter store secret create/delete/rotate operations to the Elastx cluster automatically