v0.43.0

Sessions can now wait for a pull request, a review or a set time with the new watch tool, and an opt-in memory tidy-up drafts fixes to agents’ memories for you to approve. Workspaces can start at sign-in or move to a new image on their own, and the Tool permissions switch in Settings › Agents now does what it says. Read the Upgrade notes before updating: the Control Plane no longer starts on a weak AF_MASTER_KEY or AF_COOKIE_SECRET.

New

Sessions can wait for a pull request with watch instead of polling in the background: checks finishing or failing, a conflict, mergeable, merged or closed, changes requested and (on GitHub) new unresolved threads, for GitHub and Bitbucket Cloud through your own connection. list_watches and unwatch manage them, and a child session can send its notices to its parent. A GitHub Actions run, or a workflow’s next run, can be watched on its own too. (#3627, #3628, #3779)
Timers: watch with source: time fires at a time or after a wait of up to 30 days, and can start a stopped workspace for it. (#3632)
Your own MCP server can be a watch source once you mark it Watch source under MCP servers and a tenant administrator allows it in Tenant settings › Watch sources (off by default). (#3631)
Faster watch notices through webhooks. Without one, watches keep polling. The operator turns on GitHub webhooks for public repositories with AF_GITHUB_WEBHOOK_SECRET (the /webhooks/ path must be reachable without signing in); af-watch-hook add github|bitbucket <owner/name> installs a hook for a private repository you administer. (#3630, #3751)
Memory tidy-up (opt-in). While the workspace is idle, a model drafts patches, replacements and merges of memories from agents’ feedback and lint findings. They wait under Suggestions with an If you approve preview; nothing changes until you approve, and an approved change can be undone. Turn it on in Settings › Agent memory; it uses Claude and spends tokens. (#3497, #3702, #3720)
Memory lint report (Settings › Agent memory › Import & export, or af-memory lint): flags memories pointing at paths, symbols or links that no longer exist, oversized bodies and retired terms; af-memory lint-rename rewrites renamed paths. (#3443, #3571, #3496)
New memory tools memory_patch and memory_feedback, also on the external /mcp memory tools: change one passage of a memory, or report one as stale or wrong. (#3441, #3496, #3649, #3636)
Start at sign-in: a tenant setting (off by default) starts a member’s stopped workspace when they sign in; each member can opt out under Settings › Toolchains. (#2031)
Automatic image refresh: a member can let an idle workspace on an outdated image restart onto the new one (Settings › Toolchains, off by default). Nothing is recreated. (#3656)
Running hours and cloud cost by month, with the change from the previous month, on the usage, cloud cost and member panels. (#3383, #3609)
Max PAT lifetime per tenant, in the tenant limits. (#3465)
Merge a Bitbucket Cloud pull request from the work item detail panel, with a merge method and Close source branch; the panel also shows whether it is mergeable or in conflict.
Random colors in the appearance popover and Settings › Display re-pick the surface colors on open, hourly or daily, and the 🎲 button re-picks them now. (#3738)
ECS: the 20-platform parameter MasterKeyKmsKeyArn encrypts /af-cp/master-key with your own KMS key; follow the order of steps in cfn/PARAMETERS.md. (#3470)

Improved

The Control Plane will not start with a weak AF_MASTER_KEY or AF_COOKIE_SECRET under AUTH=oauth or AUTH=proxy; the message names the variable, never its value. (#3552)
Cookies are signed with one key per purpose by default. Cookies issued by 0.42.0 stay valid for one session lifetime, so nobody is signed out. (#3552)
The Console runs only its own scripts, and external images in rendered Markdown load only when you click them. (#3454, #3458)
Archived or superseded memories drop out of index, search, session prompts and the copies written back to Claude Code. (#3495)
File pane: Markdown Split view scrolls the editor and preview together, and a tab keeps its mode and scroll position when you switch away and back. (#3659, #3662)
Starting a session from a Jira ticket no longer guesses the repository: you choose one, and it can be remembered per Jira project. (#3770)
PR notices no longer repeat what a session already watches, a review notice says what is new, and a PR that stays in conflict is not announced again each time its base moves. (#3629, #3732)
Smaller improvements: the skill picker matches word prefixes (/itp finds issue-to-pr); the agy usage popover lists limits Seen on failed calls; the work item Kind row shows the tracker’s own issue type; bkt names the missing Bitbucket scope on a refusal. (#3614, #3744, #3734, #3570)

Fixed

Settings › Agents › Tool permissions was inverted: turning on “Ask for approval before each tool run” skipped the approvals. On now means ask. (#3688)
Jira connections could break by themselves (“the Jira connection is unusable”) when a renewed token was overwritten by an older copy; Bitbucket is protected the same way. (#3723)
The permission card’s Allow failed on Bash dialogs taller than the pane and on commands the rtk hook had rewritten, and a card stayed after claude closed its dialog itself. (#3601, #3725)
Unsaved File pane edits were lost on a tab switch, and reload or close no longer warned. (#3663)
Conversation translation on agy failed for every session, and the translate button was missing on English replies that named Japanese pages. (#3745, #3746, #3747)
muse: a resumed or forked session lost the af tools, and the conversation view hid an answer until it finished and showed failed drafts. (#3611, #3612, #3676)
get_session_output skipped the rest of a reply a non-claude agent was still writing. (#3618)
ECS EC2 pool: opencode’s terminal UI could not start; each workspace picks up the fix on its next Start. (#3682)
Kubernetes: workspaces could not get a token for a tenant’s OAuth MCP server, and some scheduled-run outcomes kept the wrong status. (#3761)
Smaller Console fixes: a carried question showed raw Markdown, built-in MCP rows offered a Disable that always failed, the usage age label could show a long decimal, AWS profile row actions did not look like buttons, and a theme change in another tab showed only after a reload. Chat bridge and ops-monitoring texts now match what is sent. (#3597, #3621, #3703, #3573, #3741, #3667)

Upgrade notes

Before updating, check both keys. A value is weak when it is under 32 bytes of key material (hex or base64 that decodes to fewer than 32 bytes, or a raw string under 43 characters) or is a repeated pattern; it is the rule behind 0.42.0’s warning banner, so no banner means nothing to do. Replace a weak AF_COOKIE_SECRET with head -c 32 /dev/urandom | base64; everybody signs in once more. A weak AF_MASTER_KEY cannot simply be swapped: values sealed under it stop opening. Plan the move first (operator guide, “The deployment keys” and “Keys at rest”), because this release will not start on it. deploy/aws/ecs/standup.sh reports short stored values without printing them. (#3552)
Update to 0.42.0 first. A replica older than 0.42.0 cannot read the new cookie format, so updating straight from an older release signs people out whenever a request reaches an old replica.
To keep the old cookie format for one more release, set AF_COOKIE_PURPOSE_KEYS=0 (ECS: CookiePurposeKeys=0). The opt-out and the old format are removed in a later release. (#3552)
Lowering AF_PAT_MAX_DAYS now also ends existing tokens older than the new cap, not only new ones. (#3465)
Scripts injected into Console pages (for example by a reverse proxy) are now blocked. (#3454)

Other changes

The background memory review is removed. Suggestions still waiting are exported once on the first start and the queue is deleted; the memory tidy-up can use them. (#3440)
The user guide is reorganised into task pages; the old chapter pages point to the new ones. (#3463)

Agent CLI pins: Claude Code 2.1.321, Copilot 1.0.108, rtk 1.2.0 (the rest unchanged from 0.42.0).