v0.9.0

Signing in is no longer tied to Google: any OpenID Connect provider or GitHub can be enabled, and one deployment can be divided into departments that own their own sign-in page, roster and permitted networks. On AWS there is a new runtime that keeps each person’s home on a disk that survives a stop, with the cloud bill shown per member beside it. In the Console, .drawio files open as diagrams, every session lists the files it changed, and passages of a conversation can be highlighted for the people you shared it with.

New

• Sign in with any OpenID Connect provider, or with GitHub. Enable Entra ID, Okta, Keycloak, Auth0, Cognito or GitLab by listing it in AF_OIDC_PROVIDERS with an issuer, a client ID and a secret; GitHub is a separate adapter, gated on membership of an organisation you name. Several providers can run side by side, and Google needs no change. An incompletely configured provider is disabled with a warning rather than taking everyone else’s sign-in down; a Microsoft issuer left on common/organizations without a tenant allowlist is refused outright, because it would put every holder of a Microsoft account at your front door. Setup is covered end to end in the operator guide.
• One person keeps one workspace across an email change, a second provider, or a second sign-in method they add themselves. Identity is now recorded against the provider’s own immutable account id rather than your email address, so a surname change or a domain merger no longer grows a second, empty workspace. A new Account tab lists the sign-in methods attached to you, where you can add another — your own consent attaches it — or detach one you no longer use. A sign-in whose email matches nobody deliberately becomes a new person, and says so right after sign-in.
• One deployment can be split into departments, each with its own sign-in page, roster and sign-in methods. A tenant gets a login URL of its own (/login/<slug>), one roster that decides who gets in, and its own list of sign-in methods. A tenant administrator can register a method for their own directory without anyone editing a file on the host — but it does nothing until a deployment administrator approves it, since being able to declare who someone is would otherwise be enough to impersonate them. Each method has accept and show as a button toggles, so a subsidiary can let head-office staff in without showing a button they cannot use. Tenant administrators get their own Tenant settings dialog for this plus members, sessions, usage, audit and MCP distribution; the admin dialog is now deployment administrators only.
• A tenant administrator can restrict which networks their members connect from. This is not a network defence — the request still reaches the control plane and is rejected after the session is validated, so it does nothing for pre-authentication vulnerabilities, denial of service or scanning. What it does is keep a credential-holder from reaching data from a place you have not allowed. /mcp and /git are out of scope, since those come from the member’s own container.
• A new AWS runtime keeps a workspace’s home on a disk that survives a stop (ecs-ec2). Each person gets an EBS volume that follows them onto a pooled EC2 slot instead of a shared network file system: small files are 8–30× faster to write, the home genuinely persists across stop and start, and workspace sizes are no longer bounded by Fargate’s limits. Start time is not a reason to choose it — against Fargate’s warm restart it is a wash. A home unused for long enough can be moved to a snapshot (opt-in, per tenant), a new person’s home can be created from a pre-warmed golden snapshot, and homes are spread across availability zones. Operators get a slot-pool view and a destroy workspace action. Selecting the runtime is a one-line profile change, and the Fargate adapter is untouched.
• Workspace size is something you choose, per person and per tenant. Memory, CPU and disk are three independent axes, with tenant ceilings alongside the per-person limits. On ecs-ec2 the screen tells the truth about that runtime: CPU is not settable, the memory figure decides which machine you land on rather than capping you, and the disk figure is the size of your persistent home, fixed when it is created. On ECS runtimes, build artefacts that are expensive on network storage and cheap to rebuild are relocated to a local work disk.
• What your cloud provider actually charges, per member. Real spend from Cost Explorer, shown in the admin dialog, in tenant settings, in your own settings and on a member’s detail page — total, by day, by service, over a period you choose. It is deliberately not called “your cost”: only part of a bill attaches to a person, and the label says the shared part is not included.
• .drawio files open as diagrams instead of raw XML, with a switch back to the XML source. Ctrl/⌘ with the wheel zooms about the pointer, a drag pans, two fingers pinch, and a double tap toggles fit and 1:1. The diagram follows your light/dark theme, and the viewer is bundled — no external requests.
• Every session lists the files it changed. A collapsible band under the mirror’s header, and a fourth mode in the command palette, answer “what did this session touch” — which the existing file lists could not, because they are organised by working copy. A file that has since been committed is marked committed rather than lumped in with files that show no diff. Claude, Codex, OpenCode, Cursor and Copilot are covered.
• Highlight passages of a conversation, and the highlights reach the people you shared it with. Select text in the mirror and mark it in one of four colours; a share with write access can add its own, so a reviewer can point at the three lines they mean. The conversation itself is never copied into the control plane’s database.
• Shared conversations carry more of the session — the contents of a handoff proposal, the reading position you left off at, and a tab named after the session with its agent’s icon.
• Swipe between running sessions on a phone. With the drawer closed, a left swipe moves to the next running session and a right swipe goes back, in the order the left pane would show. A replies from the top control jumps to the start of the latest reply.
• File paths in a reply are links. A path that actually exists opens as a file in a pane, or expands the left pane to a folder and hands the keyboard over. Resolution happens in the workspace, so a path written relative to the repository root resolves even when the agent’s working directory is a subfolder.
• A Claude session tells you its login has expired. The badge reads login expired — sign in again, the connection card shows the date instead of claiming you are still connected, and sending a prompt is refused with the reason. Keys still reach the pane, so /login in the terminal recovers.
• A session stopped by a usage limit says so, and when it comes back — waiting for the limit to lift, with the reset time, instead of reading like a session that had finished its work. A balance or spending limit reads balance limit — needs raising, since nothing lifts by waiting.
• A message from one session to another has to say what it is — request, question, answer or notice. The envelope tells the receiving session what kind of reply is expected, which is the part that was missing: a “got it” costs the other side a whole turn.
• A new installation starts closed. The templates default to invite-only, and someone who signs in without a membership gets a screen explaining that they need an invitation instead of a Console where every request fails.
• The AWS ingress template can turn on a WAF — rate limiting and IP reputation only, both off by default. Signature rule sets are deliberately not offered: this product carries code and shell commands as ordinary traffic, so a core rule set would reject normal work at random.

Improved

• Terminal panes are much cheaper to draw in Chrome, where a style rule made the browser re-check the whole pane on every change inside it.
• Idle sessions and workspaces now stop by themselves. The timeouts existed but defaulted to never, so a deployment left overnight kept everything running and paying. The defaults are one hour for a session and two for a workspace.
• ECS deployments show the same update badges as Docker ones, with a one-command update path to go with them.
• A transient provider failure no longer ends the turn for OpenCode and Codex sessions — it is classed as an interruption and picked up by the same managed resume path Claude already had, so the original prompt is never re-sent.
• Shared conversations honour your mirror settings; the skill picker gives the description a line of its own; the appearance popover is ordered and labelled.
• Guides: a walk-through for setting up sign-in methods, covering the identity provider’s side as well as the Console’s.
• Pinned CLI versions: Claude Code 2.1.238, Codex 0.149.0, OpenCode 1.18.19, GitHub Copilot 1.0.80, Antigravity 1.1.17, Kiro 2.19.0, Cursor 2026.08.11, rtk 0.45.0.

Fixed

• The Console froze for seconds at a time in Chrome. Panes were rebuilding healthy GPU contexts until the browser evicted one a visible terminal was still using, and the fallback renderer measured every distinct character through the page layout — on a Japanese screen, thousands of them. Firefox and touch devices were unaffected.
• Learning and history in the settings were wiped on every device at once. Reply suggestions’ learned chips, pins, SSM history and key assignments could all return to their initial state together, because a device that started with defaults saved them over everything. Nothing is sent now until the stored copy has been read.
• Free text typed into a Claude question was thrown away when the question offered previews for its options — pressing submit did nothing and your text came back as user declined to answer questions. A question you dismissed also carries a dismissed badge instead of being rendered as answered.
• A question or plan awaiting approval was shown twice.
• The usage graph stayed one turn behind until you pressed refresh several times.
• A line like [on hold]: … disappeared from the mirror — in Markdown that is a link reference definition, and a Japanese sentence has no ASCII spaces, so an ordinary bullet matched the shape exactly.
• The first instruction at launch did not arrive. It was only sent while its view was on screen, so it appeared to be sent at the moment you first opened the tab, and the same instruction could show twice. Delivery now happens in the workspace.
• “Cannot reach the workspace agent” when the agent had in fact answered — opening a terminal for a stopped session reported a connection failure instead of the real answer.
• Scheduled runs with completion reports off had no badge in the mirror, so the most common kind of schedule was indistinguishable from something you typed.
• Horizontal swipes stopped working entirely in some sessions on a phone. One unbreakable long string in a transcript — a sha256:…, a URL — was enough to make the whole transcript refuse swipes.
• OpenCode started with a plan selected that you never chose. An unset value was treated as Zen, so saving a single key could put a billed path into use. A new workspace now uses nothing until you pick one.
• The member guide would not open on ECS deployments — the guides were never wired up for that adapter, so the menu item did nothing. In the same area, a JDK can be installed from Settings › toolchains with one button.
• ECS fixes: OAuth sign-in inside a workspace failed right after a wake, the first start could return a gateway timeout, and “restart required” lit up when nothing had changed.
• Closing a tab jumped to an unrelated one; option descriptions in a Claude question were clipped to two lines on a phone; every shared-session tab was labelled “Shared session”.

Upgrade notes

Nothing to migrate by hand. Nine additive migrations run at start; they hold no data from before the upgrade and are ignored by an older build, so a rollback is safe. Home directories do not move, and nothing about sign-in changes until you set AF_OIDC_PROVIDERS or register a method for a tenant.

Three defaults changed:

• Idle stop is on: one hour for a session, two for a workspace. Set AF_SESSION_IDLE_TIMEOUT / AF_WS_IDLE_TIMEOUT to 0 to keep the old behaviour — an explicit 0 is now honoured, where before it was replaced by the default.
• New installations are invite-only. Only the templates changed, so an existing .env behaves exactly as before. Redeploying an existing ECS stack will pick up the new parameter default; everyone already in the roster keeps working, and only automatic acceptance of newcomers stops.
• ECS work disk defaults to 50 GiB so the relocation of build artefacts is actually reached. Existing stacks keep the value they were deployed with; WsDiskGiB=0 restores the previous behaviour.

The ecs-ec2 runtime is opt-in and the Fargate path is unchanged. Cost figures require Cost Explorer; the control plane activates the cost allocation tag keys it needs on first use, which is the only write it makes to the account’s billing settings.