Skip to main content

​
🛠️ Chores

  • Persistent tool permissions for Agentic Coding sessions Added the underlying database table and model that persist per-session tool permission decisions for Agentic Coding, so that “allow” choices made during a session are remembered.
    • Introduced a new agentic_coding_tool_permissions table that links a session, a tool, and the user who granted access, scoped to a workspace
    • Each session and tool combination is unique, preventing duplicate permission records
    • Tools must belong to the same workspace as the session before a permission can be granted
    • Permissions are automatically removed when the associated session, tool, or granting user is deleted
  • App cloning for Agentic Coding apps Enterprise users can now asynchronously clone an Agentic Coding app into one or more workspaces, with status tracking for progress and failures.
    • POST /enterprise/api/v1/agentic_coding/apps/{app_id}/clones starts a clone job for the given name and workspace_ids, returning a clone_request_id
    • GET /enterprise/api/v1/agentic_coding/clones/{clone_request_id} reports the clone status as succeeded, failed, or in_progress, along with the source app and cloned apps
    • Cloning includes sandbox state and applicable database, storage, and secret resources, and reuses sandbox snapshots when available
    • Parallel clone operations are bounded by a configurable limit, defaulting to five
    • Administrators and members can clone apps; viewers cannot
    • Workspace access is validated, duplicate jobs are prevented, stale requests are recovered, and cleanup and rollback are handled on failure
  • Cleanup of GitHub source control for Agentic Coding apps Refined the GitHub integration for Agentic Coding apps, tightening token rotation, deploy change detection, and commit message handling.
    • GitHub tokens for connected installations are now refreshed by a scheduled daily rotation job that backs off and reschedules when GitHub rate limits are hit
    • Deploys now record the last commit hash alongside the code hash, improving detection of pending changes when publishing an app
    • Commit messages for automatic session pushes are derived from a structured commit-intent emitted by the coding agent, with a consistent AppBuilder Commit prefix
    • New prompts are blocked while a session has an unresolved merge conflict, and conflicts can be resolved with “ours” or “theirs” strategies
    • Git and webhook endpoints are now rate limited to protect against request floods
    • Prompts now record the user who created them
  • Backwards compatibility for older Agentic Coding sandbox images Agentic Coding sessions now verify that Git is available in the sandbox before starting the coding service.
    • Sandboxes built from older images that lack Git get it installed automatically during session setup
    • The check runs whenever a sandbox is created, cloned, or resumed, improving session startup reliability
  • First-session prompt metadata on the get app API The GET app API for Agentic Coding apps now optionally returns metadata about the first prompt session, making it easier to link back to the initial prompts.
    • Adds a last_prompts_link attribute that includes the first session ID and pagination info
    • Prompt listings are ordered by prompt start time, falling back to creation time when unavailable, with a deterministic tiebreaker
    • Pagination reports a fixed page size of 100 prompts
  • Persisted tool permission decisions for Agentic Coding sessions Added a data model for recording which tools a user has allowed for an Agentic Coding session, laying the groundwork for reusing tool-approval decisions across prompts.
    • Introduces an agentic_coding_tool_permissions table linking a session, a tool, and the user who granted access
    • Enforces one permission per tool per session and requires the tool to belong to the same workspace as the session
    • Permissions are removed automatically when the session, tool, or granting user is deleted
  • API to retrieve Git session events for Agentic Coding sessions Added an API endpoint that returns the Git activity history of an Agentic Coding session, making it easier to audit what happened during a session.
    • Events are returned in chronological order with details, metadata, delivery ID, and creation timestamp
    • Sensitive values in event metadata are automatically redacted
    • Results support pagination with a maximum of 100 items per page
    • Access is restricted to authorized workspace members and valid sessions
    • Requests are rate limited to 60 per minute per IP