v1.7.0

Highlights

Agent run history and the runner queue

Activity → Agent runs on an issue lists the runs of internal and external agents. AI Team → Runner queue lists the active and past runs of external agents. A run shows its task, attempts, and result. With runner 0.7.0, it also shows the transcript of an external agent.

Agent run time limit

God mode → General → Max run time sets how long an internal agent run can take, up to 60 minutes. Advanced → Run time limit in the agent settings sets a lower limit for one agent. A run that reaches its limit fails and keeps the text it produced.

Traditional Chinese

The web app is available in Traditional Chinese (Taiwan). Account → Preferences → Language sets the language.

Security

This release and runner 0.7.0 fix 4 high and 2 medium advisories. Update every instance and every runner.

• GHSA-6mm3-qj6x-hq25 (high): a member with member management permission could give a role with more permissions than their own, and demote or remove project owners.
• GHSA-mr34-5m49-6fvq (high): a member on the default role could read the link of an owner invite and become a project owner.
• GHSA-54vc-ww62-5mhj (high): a personal API key could add a passkey to its owner's account. The passkey kept access after a password reset and the revocation of the key.
• GHSA-x99f-4j7w-gvh9 (high, runner 0.7.0): a chat message that starts with a hyphen could pass an option to the opencode, pi, or omp CLI. With omp, a project member could run code on the runner host.
• GHSA-w3x6-x437-f7pg (medium): the web /media route could request any api GET route that needs no session.
• GHSA-mvpp-hgqh-8vj5 (medium): the api did not check the origin of a request outside /api/auth. With a cookie shared across subdomains, a page on a sibling subdomain could send requests with a signed-in person's session.
• Dependencies: the Mastra update removes an MCP server SDK with GHSA-jm63-cq47-j5jp and GHSA-46jr-4wx8-v453. markdown-it 14.3.2 fixes GHSA-r7fv-28h4-cvq7.

Also in this release

• The / menu of an issue description has To-do list, and the selection toolbar has a checkbox button. The description stores the items as Markdown - [ ] and - [x].
• CLIENT_IP_HEADER and TRUSTED_PROXIES set how the api finds the client IP behind a reverse proxy. Behind nginx, Cloudflare, or a chain of proxies, set one of them. Without them, all clients share one sign-in rate limit. The details are in Client IP.
• Internal agents get the get_project_activity tool with from and to dates. The tool cuts a comment or a value longer than 1000 characters.
• list_issues and search_issues return createdAt, updatedAt, and completedAt. list_issues filters by the created and updated dates.
• An internal agent run retries a temporary provider error (429, 5xx, connection reset) up to 3 times. A stopped chat answer keeps its partial text.
• The sign-in, sign-up, reset-password, and invite forms show refusals in the visitor's language.
• Sign-in does not offer a new confirmation email to a deactivated account.
• When Add passkey refuses an older session, the Security page asks you to confirm your identity. You do not have to sign out.
• Registration with only SSO shows the error of a failed provider sign-in.
• When you remove the mail provider, sign-in links turn off, and you can save god mode → Authentication again. To repair an instance in this state, save the email settings once.
• Inbox → Delete for completed issues also deletes the unread notifications of completed and canceled issues.
• SVG attachments show a thumbnail.
• An internal agent run stops before its claimed lease ends. A second api replica does not start the same run again.
• The opencode, pi, and omp runner presets send a chat message that starts with a hyphen as the task, not as a CLI option.
• When the upload of the last trace batch fails, the runner tries again once. If it fails again, the runner reports the result of the command and logs a warning.
• An interrupted import continues the issue creation from its last record and adds the missing labels, comments, and attachments.
• A Linear import does not stop in the Link phase when both issues return the same relation.

Breaking changes

• The api refuses a request with an x-api-key header on /api/auth/* with 403. The account endpoints need a browser session.
• The kimi-for-coding provider is replaced by kimi-code-plan-cn (api.kimi.com) and kimi-code-plan-global (api.kimi.ai). A migration moves the existing credentials to kimi-code-plan-cn.

Contributors

Thank you to everyone who contributed to this release.

Code

Requests and reports