v0.26.0

Each version is now one GitHub Release that carries the workspace rootfs too, and the native package ships for arm64 Linux as well as amd64. Stop in a Managed session now takes two steps: the first ends the running turn and keeps what is queued, and a second also discards the queue. The mirror shows a claude reply while it is being written. On AWS, Recreate and Clean home used to report success and remove nothing; they now work on ecs-ec2 and are refused on ecs. AWS credentials of the workspace or its host are no longer handed to agent sessions; operators of AWS and cloud Docker deployments have steps to take.

Security: AWS credentials of the workspace or its host are no longer handed to agent sessions

Before this release, a command in an agent session or terminal that named no AWS profile could silently run as the workspace’s own AWS identity instead of the member. This covered a bare aws, an SDK’s default credential chain, or a build tool such as a Gradle/Maven deploy plugin. On ECS that identity was the workspace task role; on ecs-ec2, the EC2 slot’s instance profile through instance metadata (IMDS); on a Docker host with an instance profile, that profile. Such commands now fail with “Unable to locate credentials”. Members run AWS commands as themselves with af-aws-exec --profile <name> --account <id> -- <command>.

What changed:

ECS / ecs-ec2: the Agent removes the container credential variables from everything it starts and sets AWS_EC2_METADATA_DISABLED=true, including tmux panes and MCP servers.
Docker: the Control Plane starts workspace containers with AWS_EC2_METADATA_DISABLED=true.
ecs-ec2 slots: ECS_AWSVPC_BLOCK_IMDS=true in the slot user data.
ec2-single: the template requires IMDSv2 with hop limit 1.
update.sh also redeploys the slot-pool stack (40-ec2-pool); on ecs-ec2 it stops if it cannot find it — name it with —pool-stack .

Operator action required:

Upgrade as usual (update.sh on ECS; compose pull/up plus the workspace image on Docker).
ecs-ec2: slots launched before the upgrade keep the old user data and can still reach IMDS, and a workspace Stop → Start returns to the same slot. Retire them through the Control Plane’s sweeper by setting Ec2SlotTerminateAfterSec on the ingress stack (14400 recommended); the sweeper detaches the home before terminating and homes are never deleted. Then have users Start their workspaces, which builds new slots. See deploy/aws/ecs/README.md, “Moving retained slots onto new user data”. 🔴 Amended 2026-10-03 (#1473): from the release that adds slot replacement reservations, do not use Ec2SlotTerminateAfterSec for this. Reserve the old slots in Settings → Admin → Slots (“Reserve all N for replacement…” takes exactly the slots below the launch template’s $Latest), then have users stop and start; each next Start moves the home to a new slot and terminates the old one. Ec2SlotTerminateAfterSec terminates every slot stopped that long for good, with a slower next start and lost slot caches, which not every deployment wants. If you set it only for this migration, set it back to 0.
Docker / compose: running workspaces keep the environment they were created with; docker compose up -d and a Docker restart do not change it. Stop → Start every workspace in the Console after upgrading, and again after changing AF_WS_WORKLOAD_AWS.
ec2-single: for an instance created before this release run aws ec2 modify-instance-metadata-options --instance-id <id> --http-tokens required --http-put-response-hop-limit 1 --http-endpoint enabled. Do not apply it by updating the stack: the Ubuntu AMI parameter re-resolves and can replace the instance.
Other Docker hosts in a cloud: require IMDSv2 with hop limit 1, or add a DOCKER-USER rule rejecting 169.254.169.254 from the workspace bridges. Compose needs no new privileges.
Verify from a workspace shell with the opt-in off: echo ${AWS_EC2_METADATA_DISABLED:-unset} prints true; aws sts get-caller-identity with no profile fails with “Unable to locate credentials”; curl -s -o /dev/null -m 3 -w '%{http_code}' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token does not print 200. Do not print the environment.

Opt-in: AF_WS_WORKLOAD_AWS=1 on the Control Plane hands the ECS task role back to sessions and stops suppressing the SDKs’ metadata lookup. It never removes a network block, so it does not give Docker workspaces the host’s instance profile, and it reaches a workspace at its next Start.

Not covered: workspaces on the native runtime run on the member’s own machine and keep that machine’s instance role; a process can still deliberately read the ECS container URI from its own process tree (same same-user boundary as the Agent token).

New

Native package for arm64 Linux. install.sh and af update pick the package for the machine they run on. Versions before 0.26.0 have no arm64 package. (#1345)
Two-stage Stop for Managed sessions. The first Stop ends the running turn only; your queued follow-ups and peer messages then run one per turn. Stop again, or pick Stop and discard the queue, to discard what is still queued; a notice lists it and Put back returns your own input to the input box. Queued bubbles have Back to input and Remove. Terminal (CLI) sessions keep the CLI’s own Esc. (#1289, #1292, #1293, #1294, #1244, #1256)
The mirror shows a claude reply while it is being written, typed out character by character by default. Settings › “Stream replies in the chat view” offers Off / Line by line / Typewriter; with reduced motion, Typewriter behaves as Line by line. (#1250, #1274, #1396)
Initialize Git Flow from the Console: a repository’s right-click menu (and a work-item launch when origin has develop but nothing is declared) writes the git-flow settings and creates local tracking branches for main/develop that exist only on origin. (#1126, #1329)
A workspace stuck starting is stopped after 30 minutes, and you get a notification saying where it stopped. Tenant admins see the auto-stop and its reason in the member list. AF_WORKSPACE_START_DEADLINE sets the limit (0 turns it off). (#1240, #1298, #1384)
Tenant branch naming rules. Tenant admins set naming rules for every member under Tenant settings › Branch naming rules; a repository’s or your own rules still come first. (#1127, #1120)
A work item with a non-ASCII title gets an English branch slug, written by the AI branch-name suggestion when it is on. The deterministic name is offered at once and replaced when the slug is ready. (#1129)
Agents can ask for a branch name through the new branch_name af MCP tool, which applies the same rules as the Console. (#1128)
Claude Code’s push notifications reach the notification center. (#1069)
Settings › AWS profiles/SSM: profiles and hosts can be edited in place. A profile that hosts still use can no longer be deleted. (#1409, #1411)
The image gallery has S / M / L tile sizes and shows each picture’s width × height, and newly generated pictures open faster in the gallery and the mirror’s lightbox. (#961)
Tenant admins can limit the self-hosted LLM and image engines to the members they grant (Tenant settings › Operations › Engine access). The default stays “every member”. (#1215)
Recreating a worktree whose branch was squash- or rebase-merged on GitHub offers the merged pull request’s head, and a reused branch name resolves to its newest merge. (#1043, #1397)
Overview cards show the context gauge, token trend, answering model and last line for every agent kind, not only Claude. (#1342, #1362)
The skill picker offers your personal skills from the other agents (for example a claude skill in a Muse Code or Codex session). (#1351)
llama.cpp sessions have a row in Settings › Agent instructions, and it applies from the next turn. (#1202)
ECS: the EFS file system is backed up daily under Persistence=retain (7 days by default). Not yet run on a real deployment (#1235). (#1195)
ECS: standup.sh and update.sh take --comfy-digest to pin the ComfyUI image they copy, and always print the digest that landed in ECR. (#966, #1319)

Improved

Muse Code: a resumed session’s mirror fills in turns finished while the Agent was down, attached images show as thumbnails, and a command left running after a turn shows as “background command running” (Codex Managed too). (#1197, #1350, #1358)
Switching a Codex session from Managed to Terminal (CLI) now needs the session stopped first; a switch asked too early says to wait. A slow release check can still hold the switch (#1147). (#1148)
Irreversible admin actions (clean home, destroy, member removal, tenant and IdP delete, repository delete and rename, and others) are written to the audit log before they run, and are refused when the log cannot be written. (#1266, #1334)
Only an internal repository’s creator or a tenant admin can rename or delete it; creating one needs a role that can push. (#1200)
The worktree sync chip and “Fast-forward from parent” compare against the parent branch’s upstream (for example origin/develop), so a merged pull request no longer leaves a worktree looking behind. (#1415)
The Work items rail stays in place when the long list collapses, keeps its filter pinned on a crowded rail, and keeps keyboard focus on the fold toggle. (#1348, #1360)

Fixed

Muse Code 1.4 sessions started without a model ran on the data-sharing contributor model, and the launch picker offered only “Default”. The catalogue reads again, and an unreadable one is refused instead. (#1344)
On AWS, Recreate and Clean home reported success and removed nothing. On ecs-ec2 they now work for members (the removal runs at the next start) and admins; on ecs they are refused and hidden until the home can be reached (#1260). (#1225, #1259)
A prompt sent while a Codex, OpenCode or Cursor Terminal session showed a question, permission, update or lock screen was typed into it and could answer it. Such prompts are now refused. (#1227, #1263)
Sessions stuck on “working”: a Codex Terminal turn ended with Esc, an OpenCode Terminal session relaunched after a kill, and Managed queues that stalled after a lost runtime (Muse Code, Copilot, Cursor, Kiro). (#1264, #1265, #1258)
An Antigravity session read “waiting for input” while it was still mid-turn. (#1424)
Console AWS login stopped with “unexpected sign-in URL” for a profile whose SSO start URL is the identitycenter.amazonaws.com/ssoins-… form. (#1408)
A working copy could be deleted, or its branch switched, under a running Managed session. (#1169)
Browser pane: a page read “ready” before it had loaded, an aborted navigation (a 204, a denied download) showed “unreachable” over a live page, a failed load could freeze the pane, and a blocked off-loopback link showed its notice twice. (#1353, #1377, #1381, #1386, #1406)
On AWS, chat compaction, plan refresh, Ask and the editor’s edit suggestion failed with a gateway error when the model took over a minute. (#1151)
The changed-files strip never marked a file “committed”, and Source control never listed submodules. (#1183)
Mirror: a peer message and your own prompt were merged into one bubble; the marker pill painted into the neighbouring pane; the skill picker swallowed the first tap on Send, did not close on an outside tap or Esc, and was hard to read in dark mode. (#1369, #1286, #1217, #1220, #1226)
The diff view drew an empty numbered row after the last line. (#1160)
ecs-ec2: the starting dialog could say “Cannot start” after the workspace had started. (#1271)
“Reuse these settings” on a Qwen-Image-Edit inpaint picture re-ran it as an edit of the whole picture. (#955)
A llama.cpp session started in a subdirectory was offered skills it could not open. (#1361)
Internal git: cloning failed when PUBLIC_BASE_URL carries a port; LFS garbage collection could delete objects still in use when reading a repository failed part-way; the LFS quota could drift after a failed delete, rename or upload. (#1198, #1210, #1211, #1335)
A Control Plane image built from source shipped no user guide. (#1176)

Upgrade notes

Release assets: there is no separate rootfs-<r> release any more; the rootfs is attached to v<version> and each release’s SHA256SUMS lists exactly its assets. Installed copies and af update need nothing; only a script or mirror that downloads from rootfs-<r> releases has to follow. (#1345)
A deployment that signs people in without AF_MASTER_KEY now logs a warning and shows a banner to super admins; nothing stops. (#1080)
Without PUBLIC_BASE_URL, internal git’s clone, push and LFS routes now answer 503. Set it if you use internal git. (#1212)
AF_USAGE_SAMPLE_INTERVAL, AF_GIT_GC_INTERVAL, AF_SCHEDULER_INTERVAL and AF_CLOUD_COST_INTERVAL set to 0 now really turn their loop off. (#1186)
The admin MCP tool that stops another member’s session is now stop_user_session. Under the old name it never ran. (#1188)
AWS credentials in sessions: see the Security section above; it has steps for every deployment on AWS or a cloud Docker host.
ECS: the CP role may run SSM commands, and write the tags that fence them, only on its own slot instances; if you override AF_ECS_EC2_POOL, keep it equal to the cluster name. A retain data stack’s name may be at most 37 characters, and enabling the EFS backup on a live deployment is in the ECS runbook. (#1182, #1419, #1195)

Agent CLI pins: Claude Code 2.1.286, Codex 0.159.3, OpenCode 1.18.34, Copilot 1.0.90, Antigravity 1.2.14, Kiro 2.26.1 and Muse Code 1.4.1-R4503.1. Cursor is unchanged from 0.25.0. (#1164, #1270)