v0.42.0

This release is mostly security hardening from an assessment of the Control Plane, the Agent and the AWS templates, with stricter defaults for sign-in, cookies, tokens and the terminal clipboard. Idle sessions are now halted even with a Console terminal left open, and the permission card’s Allow works again on long or multi-line Bash commands. Read the Upgrade notes before updating: AUTH must now be set, and ECS deployments deploy 10-data first.

Improved

Agent cards in Settings › Agents appear at once, each with a Checking… chip until its connection is known, instead of the whole tab waiting. (#3385)
A work item’s state is a coloured pill under its title in the detail panel (open, draft, merged, closed, In Progress and so on). (#3542)
A terminal pane says so when its session stops, and points at Resume, instead of freezing silently. (#3472)
ECS: the new 30-ingress parameter EgressEventRetentionDays sets how long egress events are kept (30 days when empty). (#3403)

Fixed

Idle sessions were never halted while a Console terminal was attached, even with nobody typing, and terminal auto-replies, reconnects or a visible browser pane also kept a workspace awake. Only real input within the presence window counts now, on any Control Plane replica. (#3460, #3461, #3473, #3462)
The permission card’s Allow failed on some Bash commands (word-wrapped, multi-line, or shown in claude’s “Dangerous rm operation” dialog) and the card never cleared. (#3491, #3521)
Automatic translation in the conversation view did not fire for a reply that finished while you were on another tab or while background work was still running. (#3437)
opencode on an engine with a known context window but no output limit never compacted, so long conversations were rejected by the engine. (#3559)
Terminal clipboard: a program in the workspace could replace your local clipboard without you doing anything. Each copy requested from inside the terminal now asks first (Allow / Allow for 1 minute); Settings › Display › Terminal › Copy without asking after a mouse drag skips the prompt for your own drag-copies. (#3487, #3518)
A handoff’s first message is no longer sent for you: it is filled into the composer and sent when you press Send. (#3488)
Sign-in, cookies and requests: cross-site writes with the Console’s cookie are refused and the Console cannot be framed; redirect targets, relayed paths and tenant OIDC endpoints are checked more strictly; Jira and Bitbucket connection callbacks are bound to the member who started them. (#3448, #3508, #3490, #3506, #3481)
Between members and tenants: an invite could set the email of another tenant’s identity, a tenant IdP identity could hold memberships elsewhere, tenant sign-in and network rules were not applied to PAT issuance and admin screens, and PATs and MCP grants survived removing the member. PATs now always expire (365 days at most by default). (#3451, #3489, #3450)
Shared features: members could see or stop each other’s jobs on a ComfyUI engine, chat replies could be typed into shell and SSM sessions, shared-session proposals could carry fields the approval card did not show, and notification ids could collide across members. (#3482, #3507, #3483)
Previews and rendered content: with a preview domain, the /preview/<port>/ form on the Console’s own address now redirects to the preview domain; without one it is sandboxed, so apps that need cookies or their own WebSocket should use a preview domain or the browser pane. Rendered Markdown no longer keeps form controls, inline styles or media pointing at the Console’s API. (#3447, #3449)
Workspace files: the file browser’s protected folders could be reached through a rename, upload or symlink, and a branch’s .gitmodules could steer how a new worktree’s submodules were seeded. (#3502, #3484)
Secrets in logs and AWS resources: credentials could appear in access logs, claude audit rows, error bodies and relayed headers, workspace tokens were visible in ECS task definitions, model downloads could send a Hugging Face or Civitai token to another host, and the ecs-ec2 slot role could read Control Plane parameters. (#3501, #3452, #3453, #3446)
MCP OAuth: a trusted client can be pinned to a callback path (claude.ai is by default), and unused dynamic registrations expire after a day. (#3486)

Upgrade notes

AUTH must be set. Outside native, a Control Plane without AUTH (or with a value other than oauth, proxy or dev) no longer starts, and AUTH=dev needs AF_ALLOW_INSECURE_DEV_AUTH=1 and is refused behind https. The compose, Kubernetes and AWS templates already set it; check a hand-written configuration. (#3485)
ECS: deploy cfn/10-data.yaml first (same parameters), then run update.sh as usual; it stops before changing anything if 10-data is older. Between the two, Recreate, Clean home and Destroy fail and are retried; running workspaces are unaffected. See cfn/PARAMETERS.md, “Home task (volume root)”. (#3445)
A weak AF_MASTER_KEY or AF_COOKIE_SECRET now shows a banner in the Console. Nothing stops working; replace the value when convenient. (#3499)
Optional, once every replica and workspace runs 0.42.0: turn on per-purpose cookie keys (AF_COOKIE_PURPOSE_KEYS=1, ECS CookiePurposeKeys=1), and run af-cp advance-bridge-epochs --yes to retire workspace tokens issued before this release, then restart the workspaces the Console marks. The operator guide covers both: “Security Operations” and “Keys at rest”. (#3499, #3452)
API clients: requests under /api/ with a body must send application/json (upload routes excepted). (#3448)

Other changes

Pushes to the internal git are checked for malformed objects. (#3493)
More administrator writes are recorded in the audit log (role changes, tenant creation, member limits, workspace stops), and claude audit rows record a Bash command’s program and subcommand only. (#3500, #3501)
Updated to clear known vulnerabilities: npm in the workspace image and the Console’s Markdown and KaTeX libraries. (#3339, #3504)

Agent CLI pins: Claude Code 2.1.319, OpenCode 2.2.6, Copilot 1.0.107, Antigravity 1.5.3 (the rest unchanged from 0.41.0).