Appearance

1.2 line ​

June 2026 – present. The current line.

This is where Console grew from a gateway with a dashboard into a platform: the Agent Sandbox, the open-source split, a long security pass on tenant isolation, Web Search, MCP Hubs, and Cost & Optimization.

Unreleased: IAM policy engine ​

Not yet released

One authorization engine now decides every request, with custom policies, approver and session rules, and verified end-user identity for the client API. The new Access control (IAM) section documents it; the pages describe the behaviour of the release that contains the engine and do not apply to earlier builds.

  • One engine, no switch. Every request in every workspace is decided by the same engine. Refusals carry a decision id and an X-Decision-Id header, and a route that declares no authorization is refused. See Troubleshooting and FAQ.
  • Behaviour changes to review before upgrading. Project permissions now apply, API tokens include their owner's group grants, and group project assignments open projects. The upgrade guide lists who is affected and includes a preflight report and a rollback path.
  • Custom policies. Write allow and deny rules in a guided editor (who, what, where, when) or in Cedar, on top of the built-in policies. See Custom policies.
  • Agent approvals and sessions. Agent sessions belong to the person who started them. Who may approve tool calls (an appointed permission, set per agent with Who can answer), who may see or act on other people's sessions, and who may read or change the Files bucket of session files are decided by the engine.
  • New administration services. portals, resources, iam and webhooks join the permission model; see Webhook permissions.
  • Acting for a user. An API token can carry a verified end-user identity with the X-Cognipeer-User-Token header, and the people it identifies can be managed as external users. See Acting for a user.
  • Rate an answer from the API. PUT and DELETE /api/client/v1/agents/sessions/{id}/messages/{messageId}/feedback record or withdraw a rating for the person the session belongs to, the same record a portal's thumbs write. The id of a response's message item is the id to rate. See Feedback.
  • The agent no longer carries presentation. Welcome text, suggested first messages and the switch for tools of an embedding page are not agent settings: a portal sets them for itself, per agent (see the Portals release notes).
  • Portal access boundaries. Network restriction, test sessions and "View as" are covered from the access-control side in Portal access boundaries (Enterprise).
  • Migration steps: follow Upgrading to the policy engine, and run the preflight report first.

v1.9.0-community ​

October 2026

Console expands dynamic routing, adds decision models and structured agent outputs, and tightens access controls across projects and conversations.

  • Dynamic routing now supports cost-aware pools, guardrails, shadow rollout, complexity scoring, decision-model deciders, and richer analytics including decider latency.
  • Existing dynamic routing setups that relied on the estimated cost rule signal should be reviewed before production use, because that signal has been removed.
  • Model Hub now supports a decision model category, and the client API adds a Decisions API for structured-output decision flows.
  • Agent responses and background runs now return parsed structured output and validation errors, so API consumers should update any response parsing that assumed text-only output fields.
  • Admins can disable accounts, and disabled users now lose access consistently across dashboard login and token-based API paths.
  • Agent, tool, MCP, and A2A access is now enforced within the correct project and conversation ownership boundaries, so cross-project integrations should be reviewed before upgrade.
  • No database migration is required; upgrade as a normal image swap after reviewing routing configuration, API integrations, and access expectations.

v1.8.0-community ​

October 2026

Console adds realtime voice workflows with telephony, live transcripts, session handling, and testing tools.

  • Console now includes realtime voice capabilities for live voice interactions, including telephony support, live transcripts, session handling, and testing tools.
  • The release expands what teams can build and validate in Console when working with realtime voice workflows.
  • The change is customer-facing and centered on the realtime experience rather than an internal-only platform update.
  • No migration is required for this release.
  • Upgrade as a normal image update, then validate any realtime voice flows you plan to use in production.

v1.7.1-community ​

October 2026

Realtime sessions can now receive external messages while they are still running.

  • You can now send an external message into an active realtime session without waiting for that session to finish first.
  • This expands what operators can do from the realtime dashboard during a live session.
  • The same capability also reaches the related realtime API paths, so external integrations can inject messages while a session is in progress.
  • Existing realtime workflows do not need a migration or configuration change to use this update.
  • Upgrade as a normal image update, then validate any live-session flows that depend on external message delivery.

v1.7.0-community ​

October 2026

Version comparisons are easier to read, and Web Search instances can now use an optional semantic cache.

  • The compare versions drawer now renders answers as Markdown by default, making side-by-side version output easier to read without leaving the comparison flow.
  • A plain text toggle is still available when you want to inspect the raw answer instead of the formatted view.
  • The comparison view now shows a more detailed token breakdown, giving operators more visibility into what a comparison run consumed.
  • Web Search instances can now be configured to use an optional semantic cache.
  • The semantic cache setting is visible in the Web Search dashboard and is also reflected in the related Web Search API surface.
  • No migration is required for this release; upgrade as a normal image update.

v1.6.0-community ​

October 2026

Helm deployments gain optional ingress settings for dind, jail, and kata, and Azure values now point Vault TLS at the correct CA bundle secret.

  • Helm charts for dind, jail, and kata deployments now include optional ingress configuration, so operators can expose those workloads through ingress when their environment requires it.
  • The new ingress support is a deployment capability only; it does not change Console UI, API, or runtime behavior after the workload is already reachable.
  • Azure deployment values now use the Vault CA bundle secret for Vault TLS, fixing the secret reference used by Azure-based deployments.
  • Azure-based operators should update to pick up the Vault TLS fix even if they do not need the new ingress settings.
  • No migration is required for this release; upgrade as a normal image and chart update, then enable ingress only where you need it.

v1.6.0-community ​

September 2026

Agent conversations can now keep one sandbox running across turns until it goes idle.

  • Agents now reuse the same sandbox across turns in an active conversation instead of starting a fresh sandbox for each turn.
  • This improves continuity for workflows that depend on files, installed packages, or other in-sandbox state remaining available while the conversation is still active.
  • The sandbox mode shown in the agent configuration now reflects this lifecycle as a session-style sandbox rather than a per-message one.
  • Assistants API runs build on the conversation metadata already written by the run, so sandbox reuse is preserved across turns there as well.
  • No migration is required for this release.
  • Upgrade as a normal image update; no special post-upgrade action is required.

v1.5.1-community ​

September 2026

Sandbox previews now load correctly when Console is deployed behind a proxy.

  • Sandbox previews now work correctly when Console is reached through a proxy, fixing failures that could show up as CSP errors or partially loaded assets.
  • The fix is user-visible on sandbox preview flows in the Console UI and on preview links that depend on the same proxy path.
  • This release changes preview delivery only; it does not add a new sandbox feature or change the preview workflow.
  • No database migration is required for this release.
  • Upgrade as a normal image update; no special post-upgrade action is required.

v1.5.0-community ​

September 2026

Dashboard navigation feels more responsive, and sandbox setup now needs an explicit template-seeding step.

  • Dashboard pages now render their layout sooner, more links navigate instantly, and loading and error states are clearer while pages update.
  • Sandbox pages have a redesigned UI with refreshed help text across the sandbox experience.
  • Sandbox error details now open fully from the table instead of being cut off, making troubleshooting easier.
  • Built-in sandbox templates are no longer seeded automatically; use Seed defaults when you want them.
  • Operators should review any sandbox setup, onboarding, or runbook steps that assumed built-in templates would appear automatically after upgrade.
  • No database migration is required for this release.

v1.4.0-community ​

September 2026

Sandbox preview sharing is easier, and large sandbox file downloads are more reliable in Kubernetes environments.

  • Sandboxes can now generate preview links directly from Console, including public share links that work for people who are not signed in.
  • Preview sharing expands how teams can review sandboxed apps and demos without requiring every reviewer to have a Console session.
  • Large binary file downloads from sandboxes now work reliably in Kubernetes environments.
  • The file-download fix is user-visible on sandbox export and retrieval flows that previously failed on larger binary files.
  • No database migration or special upgrade action is required for this release.

v1.3.4-community ​

September 2026

Server-generated links now use the configured app URL, so operators should verify APP_URL after upgrading.

  • Links generated by the server now use the configured application URL instead of deriving their destination from the incoming request.
  • This fixes cases where users received links that pointed at the wrong address.
  • The change affects server-generated links, including flows that send users back into Console from an email or other server-side action.
  • No database migration is required.
  • Upgrade as a normal image update, then verify that your APP_URL setting matches the public URL users should reach.

v1.3.3-community ​

September 2026

Compatibility metadata is updated for Console 1.3.3, with no user-facing product changes.

  • This release updates the compatibility metadata shipped with the Console 1.3.3 community release.
  • No Console UI, API, workflow, or runtime behavior changes are included in this release.
  • Operators can treat this as a normal image update rather than a feature or defect-fix release.
  • No migration or special upgrade action is required.

v1.3.2-community ​

September 2026

User invitations now send a secure password setup link, and invitation email delivery can be routed through SendGrid.

  • Inviting a user from Configure → Members now sends that person a secure link to set their password instead of relying on the previous invitation acceptance flow.
  • The change is user-visible for both admins who invite teammates and the invited users who complete account setup from the email they receive.
  • Console now supports delivering invitation emails through SendGrid, giving operators another email-delivery option alongside the existing SMTP settings.
  • Deployments that use SendGrid should review their email configuration so invitation messages are sent through the intended provider.
  • No migration or special upgrade step is required for this release.

v1.3.1-community ​

September 2026

SaaS sign-in now keeps LDAP and direct SSO shortcuts on on-prem deployments only, and sandbox creation is more resilient after Kubernetes token rotation.

  • SaaS deployments no longer allow LDAP sign-in; users there must use the local password sign-in path instead.
  • The LDAP settings page now makes the deployment boundary explicit by stating that LDAP is available only for on-prem deployments.
  • Direct SSO redirect no longer skips the email discovery step on SaaS, which keeps users in the standard tenant-resolution flow before they are sent to an identity provider.
  • On-prem deployments keep the direct SSO shortcut when exactly one tenant-wide SSO connection is enabled.
  • Sandbox creation is more reliable after Kubernetes service account tokens rotate, reducing failures caused by expired runner credentials.
  • No migration is required for this release, but SaaS operators should review sign-in guidance and avoid configuring LDAP or relying on direct SSO redirect without the email step.

v1.3.0-community ​

September 2026

License settings now show the workspace slug and let operators copy it directly.

  • The license settings page now shows the workspace slug, so operators can retrieve it from the UI instead of looking it up elsewhere.
  • A copy action on the same page lets operators copy the workspace slug directly when they need it for support, licensing, or workspace identification tasks.
  • This release changes the license settings UI only; no migration or special upgrade step is required.

v1.2.64-community ​

September 2026

Crawlers now use Readability-based article extraction by default.

  • Article extraction now uses Readability by default, which can change the content a crawler captures compared with earlier 1.2 releases.
  • The crawler settings UI now includes a setting for Readability-based extraction, so operators can review and adjust extraction behavior per crawler.
  • Existing crawlers do not need a migration or special upgrade step, but teams should validate crawler output after upgrading if downstream processing depends on the previous extraction behavior.
  • This release changes crawler behavior and crawler configuration only; the user-visible impact is on extracted article content and the settings available in the crawler UI.

v1.2.62-community ​

September 2026

Browser flow runs now keep the correct tenant context.

  • Browser flow runs now execute inside the tenant scope they belong to, so a run keeps the correct tenant context instead of drifting to another tenant's context.
  • The fix applies to browser flow execution, which is the customer-visible path affected in this release.
  • This is a defect fix only; no migration or special upgrade action is required.

v1.2.53-community ​

5 September 2026

The Browser module has a dedicated workspace instead of one crowded page. Browsers, Sessions, Flows and Playground are now peers in the left nav under Operate → Browser, each its own screen rather than tabs buried inside a browser's detail page. The Overview tab leads with what a browser is doing — live session count, a 7-day sparkline, recent sessions, the flows recorded against it — instead of a static list of its own fields, with the signed-in profile and session defaults still one scroll away. Sessions is now also a project-wide page: every session across every browser, with filters for browser, status, and a time range (last hour / 24h / 7 days / 30 days / custom), plus a Started by column naming whether a session came from an agent, a recorded flow, MCP, or a person driving it by hand. Playground became a full interactive workspace — action composer on the left, live page preview on the right, so acting on an element never means losing sight of it; its Elements tab lists the page's interactive elements and clicking one fills the composer with the same durable target a recorded flow step would store, and a Console tab surfaces the page's own console messages and failed requests. Once a session has run a few steps there, Record as flow freezes them into a replayable flow directly from the workspace. Create Browser is now a full-page form consistent with the rest of Console, in place of the old modal. See Browser Automation.

v1.2.52-community ​

5 September 2026

Reasoning-leaking upstreams no longer break OpenAI-compatible clients. Several OpenAI-compatible endpoints — AWS Bedrock's /openai/v1 shim in front of gpt-oss and MiniMax among them — write a model's chain-of-thought straight into content as an unclosed <reasoning>… tag instead of a separate field, and the same shim occasionally hands back truncated or brace-mangled JSON when response_format is requested. Both used to reach the client as-is: a client expecting clean JSON got Unexpected token '<', and a client expecting prose got a chain-of-thought preamble mixed into the answer. A new shared stripInlineReasoning/splitInlineReasoning pair (streaming-safe — it buffers a partial tag boundary across chunks rather than emitting half a tag) now runs on every chat response and stream chunk, and a bounded, string-aware JSON-block scanner (repairJsonContent, capped at 20 candidates, never re-serializing — it only returns the model's own matched substring) now runs whenever a caller asked for JSON output and the raw response didn't parse. Both are keyed off tag/brace structure, not a model name allow-list, so the fix travels to any upstream with the same habit rather than only the ones seen in testing.

Tool calls with malformed arguments are no longer silently dropped. LangChain splits a response's tool calls into a tool_calls bucket (parsed successfully) and an invalid_tool_calls bucket (arguments that didn't parse as JSON) — only the first bucket was ever read, so a model that emitted a tool call with slightly malformed arguments (most commonly a bare { where a model got cut off) looked to the caller like it produced no tool call at all. Both buckets are now merged, and the one well-known degenerate shape (a bare "{") is normalized to "{}" rather than invented from nothing.

Azure models sharing one provider no longer collide on deployment. Every model attached to the same Azure provider configuration was resolving to that provider's single top-level deployment name and API version, regardless of the model's own modelId or per-model settings — so a second model on the same Azure resource silently called the first model's deployment. deploymentFor(modelId) and apiVersionFor(modelSettings) now resolve per-model, falling back to the provider's own settings only when a model doesn't override them.

Upstream failures on audio and OCR routes now report their real status. A regex heuristic (/required|must/i on the error message) had been deciding 400-vs-500 for these routes, which collapsed every real upstream fault — a 429, a connection error, an auth failure — into a flat 500. Both routes now go through the same normalizeInferenceError path chat completions already used, and the upstream-fetch helpers raise a typed UpstreamRequestError carrying the real status code instead of a generic exception.

A new model's tool-call, reasoning, and structured-output support now default on. The create-model form previously reset these capability toggles to whatever the provider's own capability profile allowed on every render, snapping a manually-unchecked box back on — and defaulted them off besides. They now default on and only clamp down to what the provider genuinely supports; an operator's in-range choice persists, and can be turned off from Edit if a specific deployment doesn't actually support it.

Image generation joins the Model Hub as a first-class category. POST /v1/images/generations speaks OpenAI's image schema against any image-category model (Azure gpt-image-2, OpenAI dall-e-3, and any OpenAI-compatible image endpoint), billed per image rather than per token, with a matching Playground tab for trying a deployment without writing a client. See Images API.

Moderation gains a native-classifier detector. POST /v1/moderations could previously only judge content with an LLM prompted to imitate a moderation classifier — coarse severity, and a full chat-model call for every check. A guardrail's moderation policy can now instead point at a purpose-built moderation-category model for real per-category scores at a fraction of the cost; the response reports which detector actually ran. See Moderations API and Moderation detectors.

Replica pools ​

A model can now be backed by more than one interchangeable deployment. The Replicas tab on an LLM model lets an operator list several provider/model-ID pairs behind the same model key, each with an optional weight and enabled flag; a request draws a weighted-random order across the pool, tries healthy replicas first, and pushes a replica whose circuit breaker is currently open to the back of the order rather than dropping it outright. A failure that looks capacity-related (429, 5xx, timeout, connection error) moves on to the next replica; a caller's own mistake (400, 401) does not, since retrying it elsewhere would only burn another credential's rate limit for an identical failure. The pool stays deliberately invisible to callers — one price, one capability profile, one cache key, one usage row, regardless of which replica actually answered — which is what keeps it composable with Dynamic LLM routing: Dynamic LLM picks which model, a replica pool then picks which deployment of it. See Replica pools.

Assistants API ​

The OpenAI Assistants API (Assistants, Threads, Messages, Runs) now runs as a fourth wire dialect over the same agent engine /v1/chat/completions and /v1/agents/responses already share — an Assistant is an agent, a Thread is an agent conversation, a Run is one executeAgentChat call, so guardrails, quota and tracing enforce exactly once regardless of which dialect a caller used. Three departures from OpenAI's own semantics follow directly from an engine that runs synchronously and binds a conversation to one agent for its lifetime: a thread's assistant is fixed at creation, a run is always created already completed or failed (there is no requires_action/submit_tool_outputs handshake, and .../runs/:id/cancel always returns 400), and client-executed function tools are refused outright with a message explaining why, rather than silently ignored — file_search still maps to the agent's Knowledge Engine module, and a console_tool extension reaches Console's own tool/MCP/system catalog for a server-executed alternative. See Assistants API.

v1.2.51-community ​

5 September 2026

Browser automation is now replayable, not just scriptable. Driving a browser with a model is discovery — it reads the page, guesses, backtracks, and bills tokens for every step. A new Browser Flow records that discovery once and replays it deterministically afterwards, with no model in the loop: an ordered list of steps with declared inputs (typed values are promoted to {{input.name}} parameters rather than baked in as literals, since the recorder cannot tell a search term from a password) and per-step retry/optional/when/captureAs policy. The foundation underneath is a durable target: browser_snapshot's [ref=e4] markers are only valid for the snapshot that produced them and get renumbered on the next one, so every action result now also returns a resolvedTarget — the same element described by role+name, testId, label, placeholder, text or selector — and that is what gets saved into a flow step; a stored ref is rejected outright. Agents reach existing flows through new browser_list_flows/browser_run_flow tools, so a task with an established flow no longer needs to be worked out step by step every time. The Browser Use MCP toolset grew from 11 to 21 tools (tabs, drag, upload, find-by-text, diagnostics, PDF export, flows) and is now derived from the same tool definitions the agent binding uses, so the two surfaces cannot drift apart the way a hand-maintained schema previously could. Browser profiles can also carry a signed-in profile — a Playwright storageState export, encrypted at rest and never readable back — so an unattended run starts already authenticated instead of pushing credentials through a login form on every session. See Browser Automation and Browser API.

v1.2.49-community ​

September 2026

On-prem and jail operators need to review chart changes before upgrading.

  • On-prem Helm installs can now run Console in single-database mode for MongoDB deployments and can bootstrap the first organization during initial setup.
  • Helm-based upgrades now include migration work as part of the upgrade path, so operators should run the migration before starting the updated release.
  • On-prem charts now pin the validated enterprise image by digest, which makes the deployed image explicit in upgrade workflows.
  • Jail deployments use updated chart values, secrets handling, and sandbox host settings, so jail operators should review and apply the new deployment configuration before rollout.
  • The dashboard now uses AI App Gateway naming where the older Aegis interface appeared, so users and operators should expect the refreshed terminology across Console.

v1.2.40-community ​

24 August 2026

A capacity review closed five places the system had no ceiling under load, not a wrong one.

Provider calls now honor GATEWAY_REQUEST_TIMEOUT_MS. The setting had been defined and documented since early in the line but never actually read, and Fastify's own request timeouts are unset, so a stalled provider held its socket, request context and stream open indefinitely. withResilience now applies the budget per attempt and hands the operation an AbortSignal, which the chat paths pass through to LangChain, so a timeout aborts the upstream call instead of abandoning it.

Quota limit resolution is now cached for QUOTA_POLICY_CACHE_TTL_SECONDS (default 30). A single inference request had been resolving tenant limits three times before reaching the model, each one an uncached tenant read plus a policy read against a ten-connection pool. Only the inputs are cached — scope and domain filtering still run per request, so one caller can never receive another caller's limits — and a policy write invalidates the entry immediately.

Evicted provider runtimes now release their connections. Eviction used to be a bare map delete: the reference dropped while the underlying Postgres pool or Elasticsearch client kept every socket open, an unbounded file-descriptor leak across every tenant/provider pair that was ever evicted. Runtimes now opt in with close(), deferred by PROVIDER_RUNTIME_DISPOSE_GRACE_SECONDS so a request still holding the runtime is never cut off, and immediate at shutdown.

Agent, MCP, browser and crawler queue consumers now take a concurrency setting. All four had been fixed at one, so a single slow cross-node job head-of-line blocked every job behind it until the queue's 60-second invoke timeout failed the ones still waiting. Crawler's default sits lower than the others, since one crawl job already fans out to as many as sixteen fetches.

Knowledge Engine ingest can now run off the request path. Chunking, embedding and upserting a document had run inside the HTTP call with nothing bounding it. A caller opts in with async: true and gets a 202 with a pending document that a queue consumer indexes; the source is committed before the job is published, and a boot-time sweep re-publishes anything still pending, so a restart on the memory queue driver costs the indexing rather than the content. The default stays synchronous — the existing 201-with-indexed-document contract is what callers read chunkCount from and query immediately after.

MCP request logs stop leaking across recycled server names. Logs were joined to their server by serverKey, a slug derived from the server's name. Deleting a server never cleaned up its logs, and creating a new one under the same name regenerated the identical key — so a new server's Logs tab could silently show its deleted predecessor's history interleaved with its own. Logs now carry a durable serverId, matched primarily, falling back to serverKey (scoped by project and capped at the server's own createdAt) for rows written before the migration, so a recycled key can never pull in a predecessor's history.

reasoning_effort is dropped when a call carries function tools. gpt-5.6-terra was returning 400 on /v1/chat/completions whenever function tools and reasoning_effort were set together — the provider wants /v1/responses for that combination, or reasoning_effort: 'none'. Console doesn't proxy /v1/responses, so the gateway now drops reasoning/reasoning_effort itself whenever tools are present on the call, and keeps applying it normally on tool-free calls.

v1.2.39-community ​

22 August 2026

Internal-sourced MCP servers can now be published publicly. The gate that blocked publishing a tenant-internal-data server or composite on a public URL (assertPublicExposureAllowed) is gone — publishing that data publicly is now an intentional, supported choice, guarded by an orange warning in the create form and on the server's overview page rather than a hard block.

A server's public endpoint path is a caller-chosen value. endpointSlug used to be only a random 16-character slug; it can now be set at create time and renamed afterward, validated for format, length and tenant-wide uniqueness.

v1.2.38-community ​

21 August 2026

Azure AI Search rejected every Knowledge Engine write that needed key-encoding. The _b64_ marker introduced for ids Azure's document-key charset can't represent directly violated Azure's other key rule — a document key may not start with an underscore — so no id that needed encoding could ever be written, and every upsert or delete against it failed in production. The marker now starts with a letter (b64_); decoding still accepts the old form, since nothing was ever successfully written under it. The contract suite had asserted the same incomplete rule the code carried, so it stayed green while production rejected every batch — it now asserts the whole rule against the id shapes a real deployment sends.

v1.2.37-community ​

21 August 2026

The largest release in this batch: a full rebuild of the Knowledge Engine (RAG) from the chunker up, two further audit passes that found what the rebuild itself had broken, a tenant-isolation sweep across every by-id route in the product, and three pre-pen-test hardening fixes on the authentication and secrets path. A branch name in the history (claude/console-pen-test-prep-36fywd) places this work squarely ahead of a scheduled security engagement.

Knowledge Engine, rebuilt from the chunker up ​

Chunking now runs on one shared splitter/packer (src/lib/services/rag/chunking.ts) instead of three divergent strategies. token mode counts real tokens with gpt-tokenizer — previously a dependency but unused — rather than splitting on whitespace and ignoring the configured encoding. chunkSize is now a hard cap: text with no usable boundary (CJK, base64, a wide markdown table) used to be emitted whole and could overflow the embedding model. chunkOverlap >= chunkSize, reachable from the UI, used to spin the token splitter forever; it's rejected on write and clamped for existing modules. Three new strategies ship: markdown (never crosses a heading, carries the breadcrumb), sentence, and semantic (cuts on embedding distance), plus an optional contextual header — one LLM-written sentence per chunk situating it in its document, degrading to an unprefixed chunk on failure. Chunks now record charStart/charEnd/headingPath/tokenCount, which is what makes small-to-big parent-window resolution possible without duplicating text.

On top of that: every ingest stores the extracted text (inline under 250k characters, in the file bucket above it) and the original bytes when a bucket is configured, so re-ingest resolves original → stored text → the old lossy chunk join instead of rebuilding a document from its own overlapping chunks. Uploads de-duplicate on a content hash. Deleting a module now cascades to its documents, chunks, stored sources and vectors — it used to delete one row and orphan the rest. Changing chunkConfig or the embedding model marks the module and enqueues a resumable, checkpointed, cancellable re-index; a same-dimension model swap is now flagged instead of silently returning meaningless neighbours. Retrieval gains optional hybrid dense+keyword search with fused scores normalized back onto the similarity scale, and isolateByModule, which ANDs the module key into every query — on by default only when the vector index is actually shared. Query logs now record preFilterMatchCount, topScore, avgScore, minScoreApplied and hybrid, which is what tells "nothing was retrieved" apart from "the threshold discarded everything."

The 27 defects an adversarial review confirmed, and the defects the fixes introduced ​

Two independent reviewers, instructed to try to refute each finding, confirmed 27 defects in the rebuild above — spanning data loss (deleting a module by its non-unique-across-projects key destroyed same-named modules in other projects; documents ingested through /client/v1 were enumerated project-scoped but deleted unscoped), wrong retrieval (a malformed $and filter broke every isolated query on the SaaS default vector provider; minScore was compared against inconsistent scales across reranked and hybrid results), chunking (an unset chunkOverlap made chunks grow unboundedly, since undefined loses every numeric comparison), and operations (a production config failure was swallowed, leaving pods alive, "ready," and serving 503; re-index runs were claimed only in process memory, so a rolling restart re-embedded the same documents on every replica concurrently).

A second review pass then found that three of those 27 fixes were themselves wrong — two of them worse than what they replaced. Re-index had been left unable to run at all, because its cross-replica claim existed only as a TypeScript interface with no implementation on either database backend; both now have real claimRagReindexRun/touchRagReindexRunClaim/releaseRagReindexRunClaim primitives. A guard against storing a bad chunk-join reconstruction had been written so that it also removed a document's only copy when a pod was killed mid-document. And a 409 from the re-index endpoint — meaning a run for the previous config is still in flight — had been reported to the UI as success.

A third pass, after that, found the durability fix still hadn't persisted anything: for text under the inline cap, storeDocumentSource only builds an in-memory object, and the source fields reached the document row only in the success branch — after indexing had already deleted the old vectors and chunks. The source row is now written before any destructive step runs. 3733 tests were green by the end of the chain, none of them the same suite twice.

Tenant isolation: the project boundary, enforced on every by-id route ​

The MCP server routes had a defect worth naming on its own: findMcpServerById resolves only by tenant, so any project member could address another project's MCP server by id — read its config, flip it public, delete it, or POST /mcp/:id/execute to run its tools with that server's own stored upstream credentials. Fixed with a serverInProjectScope() guard across every by-id MCP route, returning the same 404 for an out-of-scope id as for a missing one.

The same defect turned out to repeat across the product — any handler that resolved an id by tenant alone, never checking the object's projectId against the caller's resolved project. Closed with the identical guard on: agents (get/update/delete/versions/publish, plus conversations/chat, which had let a caller drive another project's agent); tools (get/update/delete/logs, and execute, which issued outbound calls under the victim project's stored credentials); RAG (document get/delete/re-ingest, resolved by id alone while only the module was scoped); memory (item delete/update and bulk delete); guardrails (get/update/delete/evaluations, plus the word-list routes); all nine OCR-job by-id routes; and PII policy get/update/delete. Owners and admins keep the tenant-wide reach they already had. The guards live in the API plugins, not the service/database layer, which the commit flags as the durable fix still owed.

Pre-pen-test hardening ​

Three fixes on the authentication and secrets path, ahead of a scheduled penetration test. Production now refuses to boot when config validation reports errors, rather than only logging them — a deployment missing the required 32-character JWT_SECRET or an independent PROVIDER_ENCRYPTION_SECRET had been starting up on the shipped development defaults: a session token anyone could forge, and credentials encrypted under a publicly known key. Production also stops falling back to JWT_SECRET when encrypting provider credentials, so the signing key and the at-rest encryption key can never collide — decryption still tries both, so existing payloads keep working and are re-encrypted on their next save. And the password-reset link is now built from the configured app URL instead of the request's Origin/Host headers, which — on an unauthenticated endpoint — had let an attacker have a genuine reset token mailed to a victim pointing at a host the attacker controls.

Redis connections now identify their node. Cache and queue connections send CLIENT SETNAME as console:<node>:<role>, reusing the existing cluster node identity, so CLIENT LIST on the server can answer the first question asked when connections leak or maxclients fills up: which node, which role.

v1.2.36-community ​

20 August 2026

A streamed call's client disconnect was recorded as a provider error. A stream whose client hangs up lands in the same catch block as an actual provider failure, so every user who pressed stop was logged with status: 'error' and usage: {}. That miscounted two things: the model error rate — and the alerting on top of it — tracked user behavior rather than provider health, and the output the provider had already generated (and billed for) was recorded as zero tokens. A disconnect is now logged under a third status, cancelled, additive to both the SQLite and Mongo usage aggregations since they match success/error by exact value. The output already streamed is estimated from the streamed text using the same chars/4 rule the quota pre-flight uses, tagged output_tokens_estimated so an estimate is never mistaken for a measured count. The streaming output guardrail now also runs on a cancelled stream — those tokens still reached the caller, and auditing only completions that ran to the end had made hanging up a way to skip the audit.

Documentation caught up with the product. The README and site description still advertised the feature set from before MCP Hub, GPU Fleet, Agent Sandboxes, AI Red-Teaming, Realtime voice and Cost Intelligence shipped.

v1.2.35-community ​

20 August 2026

RAG uploads de-duplicate by file name. The crawler bridge can now look up an existing document by file name (findRagDocumentByFileName) and skip or replace a duplicate instead of re-ingesting it. Modules can also set defaultTopK/defaultMinScore for queries that omit them.

Vector index migrations moved onto the durable job queue. The batch-execution loop is now a queue-consumed job (vectorMigrationJob/vectorMigrationConsumer), started at bootstrap and resumable from its persisted cursor after a restart interrupts it mid-run. A new queued status and statuses[] filter track it.

MCP tools carry annotations for strict clients. Every tools/list entry now populates readOnlyHint/destructiveHint/idempotentHint/openWorldHint, derived from the HTTP method or source type when not set explicitly, and operators can override hints and descriptions per tool via PATCH toolAnnotations/toolDescriptions.

The form summary sidebar no longer pushes the form off-screen on mobile. FormShell's summary stacked below the form on narrow viewports and, left expanded, pushed the form itself out of view; it now collapses by default with a toggle. Pinch-zoom is also disabled, since the app has its own responsive layouts rather than a zoomable canvas.

A read-only data-footprint report script was added, estimating data volume per request/user/day across every request-generating collection — gateway, tracing, MCP, RAG, guardrails, web search, reranker, realtime.

v1.2.34-community ​

19 August 2026

A Knowledge Base can be published as an MCP tool without hand-writing an OpenAPI spec. The "Add MCP server" modal gains an "Internal service" source type, backed by an extensible internal MCP provider registry (src/lib/services/mcp/internal/) so future console-native capabilities can register the same way. The Knowledge Base provider exposes a single grounded "ask" tool (answerWithRag underneath) and, on the same create flow, can attach to an existing MCP Hub or create a default one when the enterprise MCP Hub module is licensed.

Agent Observability is a second internal MCP provider, registered next to Knowledge Base: a read-only reporting surface (list_agents, list_sessions, get_session_detail) backed by the tracing service, with no mutation tools. CreateMcpModal's "Internal service" section was generalized so a provider without a per-instance picker — this one covers a whole project, one server per instance — shows a short info note instead of the Knowledge Base instance/answer-model fields.

A MongoDB-backed vector store for Community deployments without Atlas. The built-in SQLite vector store persists to node-local disk with no cluster affinity, so in a multi-instance deployment a knowledge_search call could land on a different node than the one that indexed the documents and silently return zero matches. The new mongodb-community-vector provider scores candidates in application code against any MongoDB deployment — self-hosted Community or Atlas — instead of relying on an Atlas $vectorSearch index, so it works with the plain mongo:7 image and stays safe across instances since the data lives in shared MongoDB rather than on one node's disk. New tenant/project provisioning defaults to it when DB_PROVIDER=mongodb; existing provider records are untouched.

A single-select ChipPicker value for the MCP internal-provider picker is cast to a string, fixing a type mismatch that broke the picker. The Agent Sandbox docs also caught up with the template edit/delete row actions shipped on the enterprise side.

v1.2.32-community ​

19 August 2026

finishReason and reasoningTokens are now first-class trace and Model Hub fields, not values buried inside each event's metadata JSON blob. Both are real columns/fields across every write path (external HTTP and OTLP ingest, the internal agent sink, the Model Hub gateway), every read path (session/event APIs, the tracing UI, the Model Hub logs UI), and the usage_daily rollup. reasoningTokens stays strictly a subset of outputTokens — never billed or summed on top of it — and a shared src/lib/shared/finishReason.ts normalizes provider values (stop/length/tool_calls/…) consistently across server and client. Old rows fall back to their metadata location until scripts/backfill-trace-fields.ts is run, which migrates them in place.

Builds on v1.2.26

v1.2.26 first surfaced finishReason and reasoningTokens as trace event fields, logged for attribution. This release promotes both to queryable, aggregable columns rather than values you can only read off one event at a time.

v1.2.29-community ​

17 August 2026

A cleanup pass for sessions captured before the previous release's guard landed. Older agent-sdk versions (< 0.9.5) answered an absent tool-details payload with the literal string "undefined", which the ingest path then spread into a nine-key object of single characters ({0:'u',1:'n',...}) — v1.2.28 stopped new writes doing this, but every session captured in between still carries that object in the database, and the read path rendered it as-is: the Tool Details panel and the raw Metadata tab both showed the garbled object. Reads now strip it on the fly, matched by shape (keys exactly 0..n-1, every value a single character) rather than by a database migration, since no genuine tool-details record looks like that.

v1.2.28-community ​

17 August 2026

Support tickets now stay attached to the right account. Console had been sending its tenant slug as the CRM support-organization id. Ticket visibility is scoped to that organization, so renaming a slug would have silently created a second organization and hidden every earlier ticket from the customer — and because the key wasn't namespaced per issuer, a human-readable slug also risked colliding with another product's organization id. A Console tenant is both the customer and the workspace, so it now sends a null organization id and lets the CRM derive an issuer-scoped key from the tenant id instead, which also fixes the organization name never following a company rename. Support staff and notifications also greeted people by their email address rather than their name, unlike Studio and Pulse; it now reads the real name from the tenant database, falling back to the email only when the name is absent.

v1.2.27-community ​

17 August 2026

Tracing sessions accept a free-form metadata bag, attributable in spend and usage queries. Metadata (a sibling of agent) is sanitized at ingest and flows through recordUsageEvent into usage_daily as a new dimension keyed by its canonical serialization. spend/report and analytics/usage's group_by[_entity] now accept metadata.<key> for dynamic grouping, validated against an allowlist regex before it reaches a query. Both the SQLite and Mongo backends gain the metadata/metadataKey fields, with the unique-dimensions index bumped to v3 following the same pattern as the earlier agentKey v1→v2 bump. agent-sdk moves to 0.9.4 to pick up TracingConfig.metadata support, and Console's own internal-agent tracing sink now forwards it too.

Tracing navigation. The Agents sub-nav item (Overview/Sessions/Threads/Agents) replaces the old per-agent-name directory that had been rendered directly into the sidebar, backed by a new /dashboard/tracing/agents list page.

package-lock.json was also regenerated with npm 10 to match the Docker build image — no dependency change, just a lockfile format fix.

v1.2.26-community ​

16 August 2026

Traces now record what shape the answer was required to take. A model call has two halves that decide its output: the tools it was offered, and the structured-output contract it was held to. Only the first was ever captured. So a reply that was not valid JSON looked identical whether a schema had been enforced and the model failed it, or nothing had ever asked for JSON — and that is the difference between a bug and a design choice.

Every model-call event now carries a response_format section: the contract type, the schema name, whether it was strict, and the schema itself. It is recorded per call rather than per session, because an agent can enforce a schema on its final turn only. The tracing screen shows it next to the tool menu.

It arrives by every route. The Cognipeer agent-sdk emits it directly — for the native response_format path and for providers without one, where the SDK enforces the same contract through a forced tool call and now says so. OTLP ingestion synthesises it from OpenInference's llm.invocation_parameters and the OTel GenAI gen_ai.output.type

  • gen_ai.request.structured_output_schema pair. The @cognipeer/observability packages (JS and Python) map it from LangChain, the Vercel AI SDK, and OpenAI Agents.

Two logging fields that explain a bad answer. finishReason — length, meaning the model hit its output ceiling, is the single most common cause of truncated and unparseable JSON, and without it that failure is indistinguishable from a model that simply answered badly. It is shown as a badge on the event when the stop was abnormal. And reasoningTokens, a subset of the output count that is routinely most of the output bill on a reasoning model while being invisible in the response text. It is recorded for attribution only and deliberately not added to the bill — the tokens are already inside outputTokens, and counting them again would overcharge.

Gateway request logs keep the JSON schema, not just its name. The logged request contract recorded that a schema existed; a replay needs the schema itself. It is now kept under its own size budget, so an enormous schema drops without taking the messages down with it.

Why this matters beyond the trace screen

The captured contract flows onward. Traffic Snapshots copy it onto each dataset item, and evaluation suites and prompt-optimizer runs send it back on the wire. A test that replays production traffic without production's schema is measuring a looser system than the one you run — which is exactly how a JSON-shape regression survives a green suite.

Evaluation can replay a conversation turn by turn. A suite has always sent the whole recorded prefix and graded one answer. That isolates each decision against a known-good history — cheap, and the cleanest regression signal — but it structurally cannot catch drift: an agent that answers every turn correctly in isolation and still loses the thread once it is reading its own output passes with full marks. The new turn by turn mode drives the conversation and feeds the model its own answers back, at one model call per user turn. Recorded tool exchanges still replay verbatim — a tool result is a fact about the environment a test cannot regenerate — and only the final answer is graded, so scores stay comparable between the two modes. Single-turn datasets behave identically under both.

A JSON-shape scorer. Similarity scoring happily passes a reply that kept the gist and dropped required fields. This one grades structural conformance against the reference output.

Evaluation targets can override the system prompt. Snapshot items embed the prompt they were recorded with, so without an override every run re-tests the prompt already in production. A target now takes a literal prompt or a promptKey resolved per run — promote a new version and the next run tests it. Targets also carry their own response_format and output-token ceiling.

Datasets can be labeled by AI, and sliced by those labels. An analysis definition's field set is a label taxonomy; pointing a run at a dataset instead of the conversation corpus turns the same engine into a labeler. Labels land on each item as queryable key/value pairs, with a distribution panel and filters over them. A human edit always wins: reviewer corrections are stamped as such and later AI runs leave them alone.

Datasets can be cloned into golden sets. Label a captured corpus, correct what matters, then copy the reviewed slice into a new dataset — filtered by segment, by whether a human confirmed it, and by whether the item has anything to grade against. It is a copy rather than a view on purpose: a golden set has to be stable, or tomorrow's traffic capture silently changes what the regression suite means and two runs a week apart stop being comparable.

Prompt optimizer inherits the captured contract. With no response_format configured, a run now optimizes under the contract the captured traffic actually ran with, and records which contract it used — that fact changes what the scores mean, and nothing else on the run said it.

Catalog price fill is reachable from the model screens. The component shipped in 1.2.25 but was never wired into create or edit.

agent-sdk upgraded from 0.7.0 to 0.9.3

Console's own agent runtime moves two minor versions. The only behavioural change that reaches it is maxParallelTools on the balanced profile, rescaled 2 → 5 in agent-sdk 0.8.0 — Console pins the other rescaled limits explicitly. Agents with several tools may now execute more of them concurrently.

v1.2.25-community ​

16 August 2026

Edition change

Cost & Optimization is now an enterprise module in full. It had been shipping in the community edition; it should not have been. The screens, the services and the APIs all moved to the enterprise overlay — not gated at the API layer with the code left behind, but moved.

A community installation keeps the service-catalog entry with an upsell page behind it. /api/cost/* and /api/prescriptions/* answer HTTP 402 naming the module they require, rather than rendering a broken page.

If you are running the community edition and using these screens, this release removes them. Nothing else changes: spend is still recorded, usage_daily is still written, quotas and Model Hub figures are unaffected. Two pieces stayed behind deliberately, because other things depend on them — price resolution for externally-priced models, which runs on the ingest path that writes usage_daily, and the /api/model-price-catalog* route, which also backs the Model Hub.

Prescriptions stops calling itself Analysis. The report screens spoke entirely in the language of the Analysis workbench sitting one click away — "Analysis: <subject>", "New analysis", "Analysis window" — which made the two indistinguishable. "Analysis" now means the workbench; these are reports and say so.

Prescription narratives render as markdown. The narrator writes headings, lists and emphasis. Rendering that as preformatted text turned every report into one grey wall.

Reports can be focused on a single model or agent. A new Everything / By model / By agent control scopes the trend, the totals and both breakdowns together, so a report about one agent no longer sits above tables describing everything else.

Analysis no longer prescribes an SDK upgrade when no per-turn tool menu was recorded. Plenty of people trace through OpenTelemetry or their own ingest; it states the observation instead.

Dense tables became readable. Badge clusters were laid out without wrapping, which shrank each badge until its label ellipsised to something like "P.." — coloured, present and completely unreadable. They wrap now and refuse to shrink.

Release notes. This section. The old Changelog page had not been touched since June and documented a version numbering that was retired; it now points here.

v1.2.24-community ​

15 August 2026

The container image build stops dying silently. Builds had begun failing with no error output at all — the step just ended and the log came back empty. The cause was the build process sizing its memory from the host machine rather than from the container it was running in, growing past what was actually available, and being killed rather than reporting a problem. The build now declares an explicit memory ceiling below the container's limit, so it collects garbage before it hits the wall instead of dying at it.

No application code changed in this release.

v1.2.23-community ​

15 August 2026

Automated prescriptions. Cost & Optimization gained a recommendation engine that runs on a schedule instead of waiting to be asked. It reads your recorded traffic and produces a written report: which agents are costing more than their peers, where a prompt is carrying dead weight, which tool definitions are being paid for on every turn and never called. Seventeen detectors, robust statistics so a single outlier day does not drive a recommendation, and a narrator that writes the findings in prose rather than leaving you a table to interpret.

Workload signals. The same analysis surfaces what a workload actually demands — how long the inputs run, whether responses are structured, whether tools are involved, how much of the traffic is non-English. These are what make a model recommendation defensible rather than a guess based on price alone.

Documentation. Cost & Optimization and the Cost & Prescriptions API reference were written for this release.

v1.2.22-community ​

15 August 2026

Cost & Optimization: from production traffic to a measured model decision. The loop closes. You can take a deterministic sample of real production traffic, put it through a mandatory PII gate before it is stored, and then replay that sample against candidate models and score the results. The point is that the answer comes from a measurement, not a projection: a cheaper model that a spreadsheet says will save you 60% will show up here failing the tests, if that is what it does.

The PII gate is not optional and not a checkbox. Traffic is masked or replaced with pseudonyms before it lands in a snapshot; the pseudonym form preserves the fact that two mentions refer to the same entity, so a conversation still makes sense after redaction, and the salt used to generate them is never written down. Sampling is deterministic — a hash of each row — so the same window produces the same sample and a result can be reproduced.

Dataset import from OpenAI, gateway, Bedrock and Langfuse exports, for evaluation sets you already have.

A tool-call scorer. Scoring the trajectory — which tools the model chose and in what order — not only the final text.

Defects found by running the documented workflow ​

Writing the guides meant executing them, and executing them found five things that had shipped without working.

  • Model Hub spend read zero on SQLite. The aggregate never selected any cost field, while the MongoDB implementation summed it correctly. Two database implementations, one of them silently returning a different answer.
  • A snapshot from a LangChain agent had no reference answer. The recorded response was read from one envelope shape only, so serialized LangChain messages produced dataset items with nothing to compare against — silently.
  • The tool-call scorer could not be selected. The scorer, its tests and the snapshot builder's expected-tool-call output all shipped, but the endpoint's list of valid scorers was a hand-kept copy that omitted it. It now derives from the supported list rather than duplicating it.
  • An assertion scorer with no assertions passed everything. It reported success on every item rather than reporting that it had nothing to check.
  • A collapsible section header was keyboard-inaccessible — it announced itself as a button but could not be focused or activated from the keyboard.

A How-To section. How-To is a set of task-shaped guides written for people who arrived wanting to do something specific rather than to read a reference page — connecting an OpenAI-compatible client, tracing an existing agent, crawling a site, automating a browser task, and a long walkthrough of optimizing token usage end to end.

Broken documentation links are now build failures. Dead-link checking had been disabled, and it was quietly hiding an entire sidebar section pointing at pages that did not exist. It is on, and the pages exist.

v1.2.21-community ​

15 August 2026

A defect-fix release, and a bigger one than its size suggests. Several of these were settings that appeared to work and did nothing.

Request parameters ​

The gateway narrowed every chat request down to four fields before sending it on. Two consequences: models that reject a particular parameter returned a 400 with no way to express that, and anything outside the OpenAI schema could not be sent at all.

  • A registry of parameters each model rejects, per provider driver and model id, unioned with a manual per-model list and switchable off per model.
  • top_p, presence_penalty and frequency_penalty are actually forwarded. They were collected from the request and logged as if they had been applied, then dropped — the Playground's Top P slider was a shipped no-op.
  • The token budget survives when a model rejects max_tokens under that name and wants a different key.
  • Per-model default parameters and opt-in caller passthrough, so fields specific to vLLM and SGLang can reach the upstream.
  • The agent path uses the same resolver. It had hard-coded temperature 0.7, ignored the model's settings entirely, and passed top_p and max_tokens under key names nothing read — so agent Top P and Max Tokens had never taken effect.
  • Retries stop multiplying. The client library's own retry budget nested inside Console's allowed up to 21 upstream calls for one request, 18 of them invisible to the circuit breaker.

Streaming ​

The OpenAI-compatible stream was non-compliant enough that strict clients could not consume it, and it was losing data on the way.

  • Streamed requests were logged with zero tokens. Usage was being read from keys the streaming path does not populate — and because budget and rate-limit updates are gated on usage being present, they were skipped entirely for every streamed request.
  • Tool calls appeared to be called with empty parameters whenever streaming was on. Argument fragments are now emitted as deltas as they arrive.
  • One completion id across all frames, the assistant role on the opening frame, always a terminal finish reason, and string content.
  • A mid-stream failure is delivered as an error frame followed by [DONE] instead of destroying the socket, and the upstream request is aborted when the client disconnects.

If you bill or rate-limit on recorded usage and you serve streamed traffic, this is the release that makes those numbers correct.

v1.2.20-community ​

14 August 2026

Support handoff. Console had no route to Support, so operators fell back to email. A signed-in user can now be handed into Cognipeer Support with their identity already established. The server exchanges its own secret for a single-use code; the browser only ever receives the resulting URL. On-premises deployments that know the Support URL but hold no credentials fall back to the Support login rather than failing the action.

A release runbook. Releasing documents the order the two channels are released in and why it cannot be reversed.

v1.2.19-community ​

4 August 2026

A version alignment release. No application changes.

v1.2.16-community ​

3 August 2026

Vision inputs are normalized, and image data is redacted from logs. Images arriving in different shapes are normalized to one internal form, and the image payloads themselves no longer end up in persisted request logs — a base64 image in a log line is both a privacy problem and a storage problem.

v1.2.15-community ​

3 August 2026

OpenAI-compatible inference errors are normalized. Errors from OpenAI-compatible providers were reaching callers in whatever shape the upstream happened to use. They now come back in one consistent form.

v1.2.14-community ​

31 July 2026

The largest release in the line. It covers everything from the initial open-source release through the end of July, so it is grouped by theme rather than listed chronologically.

Breaking change

The JS Sandbox module has been removed. The in-process JavaScript execution runtime and its API endpoints are gone. Code execution moved to the Agent Sandbox, which runs work in a real container instead of inside the server process. If you were calling the JS Sandbox endpoints, migrate to the Agent Sandbox.

Alongside the removal, outbound HTTP from tools and integrations now goes through a shared SSRF guard — requests to private network ranges are refused unless the integration explicitly opts in.

Tenant isolation ​

The single largest thread in this release, and the reason to upgrade if you run more than one tenant. A series of defects allowed a request to be served against the wrong tenant's database under concurrency — not a broken permission check, but a request that never bound itself to a tenant in the first place and fell through to whatever the last global binding happened to be.

  • Every client-API request, dashboard request, model route and inference plugin now binds its tenant explicitly and per request.
  • Tenant binding was unified onto one canonical wrapper, and three copies that had drifted — one of which skipped the role check entirely — were deleted.
  • Schedulers and queue consumers bind tenant scope too, which is what was letting background jobs write results into the wrong tenant.
  • API-token access and the model/provider creation flows were hardened separately.
  • A legacy data-backfill routine was assigning a default project to providers that were explicitly scoped to other projects, making them visible where they should not have been. Fixed, with a self-heal for records it had already touched.
  • Secrets echoed back by upstream services are scrubbed before request logs are persisted.

A new Web Search service: project-scoped search instances with pluggable engines, its own client API, and a dashboard. Six engines ship with it — Bing, Brave, Serper, Tavily, SearXNG and DuckDuckGo.

Knowledge Engine ​

RAG was renamed Knowledge Engine everywhere it is user-facing — the concept had outgrown the acronym. Module creation also gained reranker selection, so a knowledge module can rerank its own results without a separate step.

MCP ​

  • MCP Hubs groundwork — the types, schema and licence rules for curated catalogs of MCP servers.
  • Per-tool toggles — individual tools on an MCP server can be switched off rather than all-or-nothing.
  • Import from OpenAPI and Postman — point Console at a spec and get a tool or MCP server out of it, with an import UI and a playground for trying calls.
  • Editing a server no longer wipes its stored upstream secrets, spec re-import works from the edit form, and streamable HTTP is served correctly on /sse.
  • Sandbox-backed MCP execution and Aegis policy enforcement are gated behind Enterprise, with a clear message in the UI rather than a silent failure.

Client API ​

  • Admin-surface endpoints for providers, models, projects, members and licence.
  • Observability and authoring endpoints, with per-token scopes so a token can be issued for exactly what it needs.
  • The complete OpenAPI specification is published.

Agents and interoperability ​

  • Runtime context header passthrough — headers from the caller can be forwarded to downstream tools, default-deny and explicitly allowlisted, so a tool can act with the end user's authorization rather than a service account's.
  • Inbound A2A server — Console can be addressed as an agent by other agent-to-agent clients, with a published agent card.
  • Tool-call progress — agent runs surface tool activity as it happens instead of going quiet until the answer arrives.
  • Reasoning content is surfaced across streaming, the API, agents and the UI for models that emit it.
  • Models declare explicit discovery capabilities rather than being probed.

Crawler ​

An extended hardening pass, driven by real crawls failing in production.

  • Structure-preserving markdown conversion (@cognipeer/to-markdown 3.1.0) — tables and nested lists survive the conversion instead of collapsing.
  • Anti-bot challenge pages are detected rather than being stored as if they were content, and the headless fingerprint was reduced.
  • SSRF-safe redirect handling, atomic job claiming, and a persisted cancel signal so a cancel survives a restart.
  • Cancel actually stops the job, within about a second, aborting in-flight requests.
  • Errors no longer consume the page budget, results are no longer dropped when the page limit is reached mid-batch, and all results are shown rather than the first 200.
  • Jobs orphaned by a server restart are reconciled at boot.
  • Page, webhook and Knowledge Engine errors are logged and shown in the Runs UI instead of failing invisibly.
  • Markdown conversion is bounded by a timeout, so one pathological page cannot hold a job open forever.
  • TLS chain and download fallbacks for sites that serve incomplete certificate chains or files the HTTP client cannot fetch directly.

Guardrails ​

Evaluation results were never being written — a guardrail could run for weeks with nothing to show for it. Logging works, and the release adds word filtering, a redact action, a configurable fail mode, and a more robust LLM evaluation path. The model selector is always visible, disabled with an explanation when the project has no model configured, rather than absent.

Red teaming and compliance ​

  • An EU AI Act compliance report and the EU risk taxonomy.
  • A system-prompt-leakage probe.
  • A "Policy Probes" entry for red-teaming Aegis policies.

Providers and storage ​

  • Zero-config built-in vector and file providers — a fresh install has working vector storage and file storage without configuring anything.
  • S3-compatible custom endpoints, so MinIO and similar work with the aws-s3-files provider.

Platform ​

  • The container runs the server directly as PID 1. Previously the process manager sat in front of it and did not reliably forward the shutdown signal, so graceful shutdown never ran and any crawl in progress was hard-killed partway through.
  • A per-request legacy backfill that was running a dozen full collection scans on nearly every authenticated request is gone; database indexes are created from a manifest at boot instead.
  • Auth pages and transactional emails were rebuilt on the design system.
  • Registration defaults to open rather than invitation-only.
  • Agent tracing: a session's totals are no longer reset by its own later legs, and the recently-active-agents panel became a real table.

Earlier in the 1.2 line ​

These changes shipped between the open-source release and v1.2.14-community, and are included in it.

Agent Sandbox and GPU pools ​

1 June 2026

The Agent Sandbox arrived — a container runtime with its own APIs and dashboard, giving agents a real machine to work on. GPU pool management and terminal access over WebSocket landed at the same time.

The open-source split ​

5 June 2026

Console was split into a community edition under AGPL-3.0 and an enterprise overlay. See v1.0.0-community for what the first public release contained. A prompt optimizer module shipped alongside.

Realtime, groups and external auth ​

18 June 2026

  • Realtime voice and chat — the schema and gateway routing landed in the community edition; the realtime service itself is an enterprise module.
  • User groups with tenant and project grants, and permissions resolved as a union across a user's groups.
  • An external authentication seam for directory and SSO providers, so LDAP and SSO can be attached without forking the login flow.
  • Client API expansion — batch, moderation, spend and realtime endpoints.
  • Red-team probes and an overview screen, and evaluation run comparison.
  • Browser automation hardening — stale element references fall back to selectors, action and navigation timeouts are bounded, and a browser_pdf tool was added.
  • Azure's v1 audio endpoint does not route /audio/* by model; requests are now deployment-scoped so audio works against Azure.

Provider scoping ​

19 June 2026

Providers became strictly project-scoped, with error messages that say so. A provider that is not assigned to your project cannot be used from it — and now tells you that instead of failing obscurely.

Studio · Pulse · Console · Agent SDK and more — the Cognipeer documentation hub

© 2026 Cognipeer. All rights reserved.