v1.6.0

Highlights

Agent tasks at an invocation URL

In the agent settings, Connection → Endpoint sends the tasks of an external agent to a URL, without a runner that polls the instance. The instance sends each run and each chat message as a signed POST. An agent on AWS Lambda, Azure Functions, or Cloudflare Workers can work this way. Runner 0.6.0 also receives these tasks on a port, with the listen setting. The details are in Agent endpoint.

Invites that expire

An invite expires after 7 days. The instance owner sets the lifetime in god mode → Authentication → Registration, and 0 means no expiry. Renew replaces an expired invite with a new link. The instance emails a team invite when it has a mail provider, and Send email sends the invite again.

Allowed email domains

In god mode → Authentication, Allowed email domains limits new accounts to the listed domains. The limit applies to the email form, magic links, Google, and OIDC. Existing accounts sign in as before. The instance refuses an invite to an address outside the list that has no account.

Microsoft 365 mail with OAuth

The instance SMTP provider in god mode can sign in to Microsoft 365 with OAuth, as an Entra ID app registration. Microsoft 365 refuses a password over SMTP when the mailbox has MFA. Microsoft disables Basic authentication for SMTP by default at the end of December 2026. The steps on the Microsoft side are in Mail.

Persian and Turkish

The web app is available in Persian and Turkish. Persian shows the interface from right to left. Account → Preferences → Language sets the language.

Also in this release

• better-auth 1.7.11 lets Claude Code, Cursor, and the Claude connector register over OAuth again. 1.5.0 refused their registration.
• The Security page lists the MCP clients connected to your account. Disconnect ends the access of a client at once.
• The MCP consent screen names the client, the account you use, and the host that gets the access.
• The get_current_user MCP tool tells a client which user it acts as.
• The create_project MCP tool creates a project in a team. create_team_project is removed.
• When the instance cannot send an MCP authorization error to the client, the sign-in page shows the error and what to do.
• GET /mcp and DELETE /mcp answer 405. Cursor does not mark the server as failed.
• With password sign-in off, the instance sends no password reset links. The reset page says that password sign-in is off, the forgot-password page offers the sign-in providers, and god mode describes the registration modes for provider sign-in.
• GIT_WEBHOOK_BASE_URL sets a public origin for incoming Git webhooks when API_URL is private. A change of the origin updates the existing hook and does not create a second one.
• The project switcher shows workspaces and teams in one pane and the projects of the selected scope in another. It searches projects on the server.
• Docs → Upload Markdown creates a page from a .md file.
• The invite screen shows the other sign-in methods of the instance: OIDC, Google, and passkeys.
• A browser tab shows the name of its screen, for example MP-12 Fix status mapping.
• The instance transliterates names in Cyrillic, Chinese, and other scripts to Latin letters for project keys, team slugs, agent handles, branch names, and file names.
• Workspace settings and god mode show previews of the Cloud and Pro sections.
• A refused sign-up shows the reason in the visitor's language.
• The @ menu in comments shows only the agents that answer a mention from you.
• Project settings can delete an additional backlog state. A project keeps at least one backlog state.
• Gitea and Forgejo branch links use the /src/branch/ path.
• You can archive and delete a Docs page whose editing session did not open.
• The api and web images do not contain drizzle-kit, tsx, esbuild, npm, npx, corepack, or yarn. This removes the HIGH and CRITICAL findings that Trivy reported for the 1.5.0 images.

Breaking changes

• Each team moves to the workspace of its first owner. An owner without a workspace gets a new one. The owner and admins of the first workspace no longer see the teams that moved, unless they are members of these teams.
• POST /projects is removed. Use POST /teams/:teamId/projects.
• POST /teams requires workspaceId.
• An MCP client connected over OAuth before 1.5.0 fails with invalid_client: client not found. To fix it:
  • Claude.ai, Claude Desktop, ChatGPT, Cursor: remove the server and add it again.
  • Claude Code: delete the cached registration, restart Claude Code, and run /mcp → your server → Authenticate. On Linux and Windows, delete the mcpOAuth entry starting with itsaplan| in ~/.claude/.credentials.json. On macOS, run this, with your server name in place of itsaplan:

    python3 -c 'import json,subprocess,getpass;s="Claude Code-credentials";n="itsaplan";d=json.loads(subprocess.check_output(["security","find-generic-password","-s",s,"-w"]));d["mcpOAuth"]={k:v for k,v in d.get("mcpOAuth",{}).items() if not k.startswith(n+"|")};subprocess.check_call(["security","add-generic-password","-U","-s",s,"-a",getpass.getuser(),"-w",json.dumps(d)])'
    

Contributors

Thank you to everyone who contributed to this release.

Code

Requests and reports