v1.0.0

Highlights

Teams

Projects now belong to a team. What was set up per project is set up once on the team, and every project of the team uses it:

• roles and the permission matrix
• AI agents, the skill library, and configured tools
• integration credentials and notification providers
• the MCP switch

A team has owners, managers, and members. An invite can reach a team, and SCIM provisions team membership. God mode has a Teams section with the projects and the members of each team.

Nothing to do by hand. The api creates a team for every account on the first start and moves the existing roles, agents, skills, tools, and credentials into it. A script or an MCP client that calls the API by path needs the new /teams/:teamId/... paths, listed in docs/breaking-changes.md.

Initiatives carry files and Docs

An initiative has attachments and links to Docs pages, the same as an issue. The numbers, the timeline, and the activity feed moved to a Progress tab. You can create an initiative from the issue's initiative picker, from the command palette, or with a hotkey.

Editors

Pasted markdown keeps its structure: a heading, a list, or a table arrives as itself. A link shows a preview card on hover, for public pages and for internal projects, issues, note boards, documents, and saved views.

Comments

The author edits or deletes their own comment, and a project owner can moderate any comment. An edit is marked in the feed, and comment.updated and comment.deleted webhook events fire.

Account security

• "Require email verification" holds at sign-up, not only at sign-in.
• A password reset ends every session of the account.
• A personal API key expires. The default is 90 days, the maximum is one year. Keys created before this release keep working.
• The web app sends a Content-Security-Policy, HSTS, X-Frame-Options, and Referrer-Policy on every response.
• A new instance setting, Trust addresses from sign-in providers, lets a Google or OIDC sign-in join the existing account with the same address. Off by default.

Agents and MCP

Every MCP tool result includes structured data, the HTTP status, a domain error code, and retry metadata, next to the text response. Agents can rename, delete, and reorder checklists over MCP. The Instructions field of an agent has a raw markdown view and a copy button.

Three new interface languages

🇪🇸 Spanish · 🇧🇷 Portuguese (Brazil) · 🇮🇩 Indonesian

Database backup before migrations

The api dumps the database into the db-backups volume before it applies the migrations of a release. A failed dump stops the startup, so nothing is migrated without a way back. Dumps are kept for 30 days.

Also in this release

• Subtasks fold under a card, a table row, or a timeline row. The Display option Start with subtasks collapsed sets what the board opens with.
• The inbox opens the selected issue as a full page.
• The team roles and projects lists are paged and searchable.
• SSRF_ALLOWED_HOSTS names self-hosted repository hosts on a private address that the server may reach.
• An issue or an initiative rejects a due date before its start date.
• A stale session cookie no longer causes a redirect loop.
• The MinIO images are pulled from Quay.
• Only the creator can delete a note board.
• A label group is scoped to its project.
• A bulk issue update checks the column before the WIP limit.
• Archiving an issue keeps the agents' conversation threads, and the auto-archive sweep writes an entry to the issue feed.
• Note links are marked as links.
• The worker and the bot read the database directly. The /internal/* routes are gone.

Upgrade

The api applies the migrations when it starts. Migration 0119_teams gives every account a team and moves every project role to the team that owns the project.

• WORKER_INTERNAL_TOKEN can be dropped from .env. The worker and bot services now need DATABASE_URL and APP_ENCRYPTION_KEY. The three compose files and the Helm chart already set them.
• The api container mounts the db-backups volume for the pre-migration dump. If you run your own compose file, add the volume, or set SKIP_PRE_MIGRATION_BACKUP=1 if you back up by other means. BACKUP_RETENTION_DAYS sets how long dumps are kept.
• The api healthcheck start_period is 180 seconds, to cover the dump and the migrations.
• SSRF_ALLOWED_HOSTS is optional. Set it on both the api and the worker.
• An agent's runnerScope value project is renamed to team. The migration updates the existing rows.
• The runner is unchanged.

Contributors

Thank you to everyone who contributed to this release.

Code

Requests and reports