v1.5.0

Highlights

What agents spend

Team settings → Usage shows the cost, tokens, and runs of the internal agents, by model, agent, project, and day. Workspace → AI usage shows the same data for all teams of the workspace. In Workspace → Settings → Model prices, the owner and admins set a price for a model that the built-in price table does not include.

Deactivate an account

In god mode → Users, the Active switch deactivates an account and activates it again. A deactivated account cannot sign in. Its sessions and MCP connections end, and its API keys do not work until the account is active again. Its teams, projects, and data stay.

The api on a path of the web's host

API_URL can be a path on the web's host, for example https://app.example.com/api. Then the instance needs one hostname and one certificate. The reverse proxy sends that path to the api and removes it. The setup is in Where the api lives.

Install the web app

Chrome (Install), Safari (Add to Dock), and iOS (Add to Home Screen) install the web app with its name and icon. In a browser that supports app badges, the icon shows the number of unread notifications.

Also in this release

• better-auth 1.7.7 fixes the critical advisory GHSA-965c-763c-88jm. On an instance with Google or OIDC sign-in, an attacker could sign in as the owner of a known email address.
• MCP authorization asks for your consent before it gives a token to a new client.
• The database keeps magic link tokens as hashes.
• The database keeps the access and refresh tokens from Google and OIDC encrypted. A new BETTER_AUTH_SECRET makes them unreadable.
• The web app is available in Korean.
• An agent run that reaches the time limit or the step limit ends as failed, without a retry. In the chat, the answer ends with an error.
• An edit of a paused agent schedule does not start the schedule again.
• The @ menu shows only the agents that answer a mention from you.
• "Add member" does not offer the Owner role for an AI agent.
• The Security page does not show the password change form for an account without a password.
• A public shared view does not send an anonymous viewer to the login page.
• The runner sets ITSAPLAN_TIMEOUT_MS for an agent command to the timeout that the runner uses for that agent.
• The Spanish interface has correct spelling.
• This release updates the dependencies, including better-auth 1.7.7 and Tiptap 3.32.

Breaking changes

• MCP clients that connect through OAuth (ChatGPT, Claude connectors) must connect again once. Connections with an API key do not change.
• The MCP OAuth endpoints are at /api/auth/oauth2/*. In 1.4.0, they were at /api/auth/mcp/*. A client that reads the discovery documents finds them.
• MCP OAuth works only when API_URL uses HTTPS or localhost. On another plain HTTP address, MCP accepts personal API keys only.

Contributors

Thank you to everyone who contributed to this release.

Code

Requests and reports