Cloud

Changes to the browser workspace and cloud agent experience.

For the visual release feed, see ara.so/news.

August 9, 2026: Persistent cloud sessions can push their branches

Git credentials and commit identity now remain available to each isolated session process after its persistent workspace is prepared. Concurrent cloud sessions can commit, push their own branches, and open pull requests without writing credentials into the shared repository or global Git configuration.

August 9, 2026: Concurrent sessions keep their shared workspace alive

Finishing or failing one session no longer deletes a persistent cloud workspace that other sessions are still using. Each session stops only its own Hands processes; the shared workspace remains available to sibling sessions and their isolated Git worktrees.

August 9, 2026: “Cost by provider” no longer lumps most spend under “Other”

Usage & analytics → Usage by member attributed a large share of every member’s spend to a provider called Other, often the largest row on the breakdown. It was not a real provider: it was OpenAI and Anthropic usage that failed to resolve.
A run records its model as a bare name (gpt-5.6-sol, claude-opus-4) rather than a vendor-qualified id (openai/gpt-5.6-sol), and only the qualified form carried a vendor Ara could read. The same model could therefore appear as OpenAI on one row and Other on another.
Bare model names now resolve to the vendor they belong to, so each provider’s real dollar cost is shown. Other is now limited to usage with no model recorded at all.

August 9, 2026: Revert and Dream now move next to Open session

Revert and Dream now are now pill-shaped buttons next to Open session on a memory history entry, instead of living in the sidebar’s History list.
A changed file’s diff now uses the same corner rounding as a memory file’s own preview, instead of the accordion’s larger default rounding.

August 9, 2026: Faster first commands in persistent workspaces

Ara now starts the secure Hands relay while it prepares the repository instead of waiting for checkout to finish first. Bash and REPL become available sooner without changing the workspace or tool security model.
Session titles no longer compete with the first answer for the run’s inference lane, removing an avoidable retry from Ara-hosted models.
A first Bash or REPL call in a persistent workspace now waits for its already warming Hands connection instead of returning early and making the agent retry.

August 9, 2026: Memory’s sidebar is a single Settings/History/Files accordion

Settings, History, and Files are now one accordion in the Memory sidebar instead of three separate rows plus a full History panel. Only one section is open at a time, and Files is open by default.
Opening History lists past runs right there in the sidebar; picking one shows its diff in the main area, which is now full width.
The session list in the main sidebar (Projects, recent runs) now stays visible while on the Memory page, matching every other primary page.

August 9, 2026: Memory History skips empty runs and folds diffs into an accordion

Memory History no longer lists runs that produced nothing — a dreaming pass that had no new facts to promote, or a failed run, is skipped instead of cluttering the feed.
The separator lines under the panel heading and the selected entry’s title are gone.
A run’s changed files now expand and collapse as an accordion, matching the rest of the app, instead of separate bordered boxes.

August 9, 2026: Persistent workspaces provision and prepare repositories again

The persistent per-repository workspace could not be created at all: the identifier sent to the sandbox provider was built from the workspace and user identifiers verbatim, which exceeds the provider’s 64-character limit for every workspace. Every attempt failed immediately, before any work started.
The identifier is now the same short, stable digest already used to name the workspace, so provisioning succeeds.
Repository setup now keeps its internal per-session Git ref separate from the optional public API start ref. An empty start ref can no longer erase the fetched commit before Ara creates the session worktree.
Persistent sessions now offer Bash and REPL while Hands is still attaching. Calls wait behind the same bounded startup gate, so a short tool-required task no longer finishes by claiming the workspace is unavailable moments before it becomes ready.
The sandbox device now shuts Hands down before the session becomes terminal. Its completion can no longer be fenced by the finished session and turn an otherwise successful run into a forced persistent-workspace deletion.

The button at the bottom of the sidebar is now a Discord icon and links straight to the Ara Discord instead of opening a menu with Feedback and @aradotso · X DMs.
Feedback is still available inside a session by typing /feedback in the composer.

August 9, 2026: Runtime notices are visible in the transcript

When a session’s workspace finishes starting mid-answer, Ara tells the agent so it can stop saying it has no way to run commands. That message was only ever sent to the agent, so the transcript showed a reply to something the reader could not see (“Noted — the workspace is up…”).
These runtime notices now appear as a collapsed System Notification row, the same one a finished subagent’s report uses. Expand it to read the exact text the agent received, or copy it.

August 9, 2026: Memory moves to the home screen, with a real History panel and Revert

Memory now lives on the home screen next to Skills & Plugins instead of under Settings, since it is a shared, organization-wide surface rather than per-workspace configuration.
Memory History is now its own full panel: a list of past extraction and dreaming runs on the left, and the selected run’s file-by-file diff on the right.
History entries can be reverted. Revert undoes that run’s recorded changes on top of the file’s current content, and records the undo as its own history entry.
The Memory icon changed from a lightbulb to a head-with-spark glyph.

Models & credentials now lets a workspace connect more than one account of the same provider. Connect a second subscription and it appears as its own row alongside the first; the account is identified from the credential itself, so re-connecting the same subscription updates it in place instead of adding a duplicate.
Subscription sign-in is scoped to a single supported provider for now. Other providers remain available by API key.
Connecting a subscription opens the provider’s sign-in page automatically, and the device code has a one-click copy button. The device-code flow completes on its own once you approve, with no callback URL to paste back.

August 9, 2026: Analytics no longer lists a model name as a provider

The cost by provider breakdown under Usage by member could show a model name (such as gpt-5.6-sol) as if it were its own provider. Usage that does not identify a provider now rolls up under Other, and named providers are unaffected.

August 9, 2026: One Ara control plane, with Hands only when connected

Ara’s Brain and external MCP clients now use the same scoped ara_* catalogue, the same /mcp/ara transport, and the same audited handlers. A run-bound token changes authorization, not the tool contract.
Before Hands connects, a session has its scoped Ara controls plus planning and delegation. When Hands is ready, exactly bash and repl appear; disconnecting Hands removes both. Legacy local_* relay operations remain internal and are never advertised.
Repository setup now lives in .ara/runbook.md, and repository secrets are identified by connected repository, provider, and name. The old customer-facing environment, recipe, image-build, and snapshot controls have been retired.

August 9, 2026: The Analytics time range applies to the whole page, and member usage breaks down by provider

The 30 days / 7 days / 24 hours control moved out of the Activity over time card and into the page header, next to the member/team selector. It now filters the whole page, so Usage by member changes with the selected window instead of always showing lifetime totals.
Each member row now also shows PRs shipped and agent minutes for that window, plus a cost by provider breakdown of their spend across Anthropic, OpenAI, Google, and the other models Ara routes to.

August 9, 2026: See usage broken down by member on the Analytics page

The Usage & Analytics settings page now has a scope selector (all members, a configured team, or one member) and a Usage by member section showing each member’s lifetime token usage and real dollar cost. Available to workspace owners and admins.
Copy across the app that referred to change requests now says pull requests, matching the term used everywhere else in Ara.

August 9, 2026: The sidebar’s hover preview stays open while other parts of the page scroll

The floating chat preview that opens when you hover a session row was wired to close on any scroll event anywhere on the page, including the session chat pane auto-scrolling while a run streams. With almost always something streaming somewhere, the preview would vanish out from under the pointer seconds after opening even though you never moved the mouse or touched the sidebar.
It now only closes on a scroll or resize that could actually move it: the window itself, or this sidebar’s own row list. Everything else is ignored.

August 9, 2026: Skills & Plugins opens every category up front

Opening Plugins used to expand only the first category (Git providers) and leave every other one - Communication platforms, Task management, Databases, Observability, and the rest - collapsed, even though they’re short, scannable grids with nothing to hide. They now all open by default.
Searching used to have the same problem: if your query matched entries in more than one category, only the first matching category expanded. Every category with a match now stays open at once.

August 9, 2026: A subagent’s transcript is its own conversation

Opening a subagent now shows its opening instruction. The child view was reusing the parent session’s first message, so every subagent appeared to have been asked whatever you asked the main agent.
A finished subagent’s report now appears inside that subagent’s own thread, where it is the answer, instead of the thread ending on its last tool call with nothing to read.
The header carries the same agent pill the chat does - lit mark, quieter label - and the session title beside it is the way back to the main thread, so the separate back arrow is gone.
The message box stays where it is while you read a subagent, but sending is declined with an explanation: only a subagent’s parent session can steer it.
Plan updates carry the same check mark as the plan itself rather than a generic tool icon.

August 9, 2026: The model picker’s trigger shows its provider logo

The composer’s model selector already showed each provider’s logo inside its dropdown; the closed button (e.g. “Claude Fable 5”) only showed the model name. It now repeats the same provider mark on the button itself, so the active model reads with its provider at a glance without opening the menu.

August 9, 2026: The review composer follows you down the thread

The comment box in Overview now sticks to the bottom of the panel as the discussion scrolls beneath it, so replying never means scrolling to the end first. It also picks up the session input bar’s shape and surface, so the two places you type in Ara look like the same control.
The merge button is a pill, matching the other actions in the review header.
The checks indicator is a progress ring rather than a filled dot - the same meter the composer uses for the context window - so it fills in as checks finish reporting instead of only changing color.

August 9, 2026: Persistent workspaces (early access)

A new workspace model, enabled per organization, keeps one cloud machine per person and repository instead of building a fresh one for every session. It sleeps when idle and wakes in well under a second, so starting a new session on a repository you already use skips the clone and setup entirely. Each session still runs in its own isolated checkout inside that machine. Off by default while it is validated on a dedicated org.

August 9, 2026: The sidebar’s hover highlight stays where your pointer is

The sidebar session list refreshes its relative timestamps (“3 minutes ago”) every second, and that refresh could snap the row-hover highlight back to your open session if you rested on another row for more than about a second. The row itself and its preview still tracked the mouse correctly, but the highlight visibly jumped, making hover feel broken on a slow, deliberate pass down the list.
The highlight now stays under the pointer regardless of how often the list around it re-renders.

August 8, 2026: The agent can see which machines and repositories you have connected

A session can now ask what machines you have paired with Ara, and gets back each one’s name, operating system and hardware, whether it is reachable right now, which folders you granted it, and what that machine is able to do. This is how the agent learns it has a choice at all, rather than assuming there is only the workspace it happens to be running in.
It is read-only, and it changes nothing about where work happens: a session still runs entirely in its own workspace, and the agent still cannot reach another machine. Filesystem paths are never included, and only your own machines are ever listed.
A session can also now list the repositories connected to the workspace, which are the ones Ara can act on. Previously an agent could work in a repository without being able to check which others existed, so it had to guess at names it had only seen written down. It reads the workspace’s own connection list rather than asking GitHub, so it stays fast and costs no API quota.

August 8, 2026: A finished subagent’s report reads as a system notification

When a subagent finished, its report arrived on the transcript as a bare grey box in the browser’s default control styling, which read as a rendering fault rather than a message.
It now takes the shape of the message it sits beside: the same bubble and right-hand alignment as your own messages, captioned System Notification and marked with the subagent’s own pointer instead of your avatar, so it is clear a subagent wrote it and not you.
The full report is still one click away. Hovering the notification reveals a toggle that expands the raw text, and a copy button.

August 8, 2026: Merge Bot gets its own page

Merge Bot is a decision pipeline, not a prompt-shaped automation, and its page now says so: it opens with a four-step “How it decides” walkthrough (change opened, signals settle, risk report and gates, merge or hold), puts the merge policy front and center, and folds the assessment prompt behind a toggle instead of leading with it.
The repository list on the page grows with its content instead of scrolling inside a small box, which also fixes the page trapping the mouse wheel and refusing to scroll to the bottom.
The always-on safeguards (human vetoes, the contributor guard, fail-closed behavior) have their own section, separate from the configurable policy.

August 8, 2026: Configure Merge Bot’s policy from the automation page

The built-in Merge Bot page gains a Merge policy card: risk tolerance (zero to high), the required gates (passing checks, Ara verification, Ara-authored only, no blocking findings, human approval for protected paths), a maximum change size, branch cleanup, an editable protected-paths list, and the merge guidelines the risk assessment reads as trusted repository configuration.
The policy applies to every repository Merge Bot is enabled for. When repositories currently disagree on a value, the control shows a Mixed badge and the next change aligns them.
Members see the policy read-only; changing it stays owner/admin only, and the page now also explains what the bot does at run time.

August 8, 2026: Merge Bot’s risk assessment is back online

The merge-risk assessment runs again, now on Ara’s own inference lane with a short-lived, run-bound grant (the same mechanism that powers PR reviews). Since the earlier model retirement every audit had been forced to a conservative HIGH-risk hold; unattended merging works again for repositories that enabled it.
The assessment always uses Ara’s platform model, never a workspace’s own BYOK or subscription credentials, and every failure mode (no lane, denied grant, unparseable output) still fails closed to a hold with a visible failed execution in the Automations activity feed.

August 8, 2026: Merge Bot gains protected paths, a size limit, and branch cleanup

The migration gate is now a configurable protected-paths list (auto_merge_protected_paths, newline-separated globs, case-insensitive, rename sources included). Any change touching a matching path requires a standing human approval before an unattended merge. The default list keeps covering database migration directories, so existing behavior is unchanged.
A new size limit (auto_merge_max_changed_lines) holds any pull request whose total changed lines exceed it. 0, the default, disables the limit.
auto_merge_delete_branch deletes the source branch after an unattended merge. Fork branches and branches that other open pull requests target are never deleted. On GitLab the branch is removed atomically with the merge.
The changed-file list is now treated as merge-critical evidence: a failed read retries, and a provider-truncated list counts as touching protected paths instead of silently passing.
All three knobs are settable per repository via the admin CLI and the guardrails API today; workspace settings UI ships separately.

August 8, 2026: Merge Bot honors human vetoes and demands real CI evidence

A standing human “request changes” review now always holds the pull request, no matter what the risk assessment or the repository’s merge settings say. A later approval or a dismissed review lifts the hold.
Adding a do-not-merge label (also dnm, no-merge, dont-merge, hold-merge, or any do-not-merge/... scoped label, in any casing) vetoes unattended merging. Remove the label and push a new commit, or merge manually.
A repository with no CI checks at all no longer counts as “green”. Merge Bot waits up to 45 minutes for a first check to register, then holds with a clear reason. Repositories that genuinely run no CI can disable the green-CI requirement for the repo to keep unattended merges.
Immediately before merging, Merge Bot now re-reads the pull request and its reviews. A head that moved during the assessment aborts the merge (the new commit is assessed fresh), and a veto that arrived mid-assessment is honored.

August 9, 2026: Review is two surfaces, and the conversation is one of them

Review used to spread a change across four tabs. It now has two: Overview is the conversation - demos, description, and the discussion thread - and Code is the file diff together with the commits that produced it. Sections with nothing in them collapse instead of showing a placeholder.
The discussion composer is always open at the bottom of Overview, so leaving a comment no longer starts with finding a button. Reply on any comment aims the composer at that person, and the reply posts with that attribution.
Checks collapsed from a status card into a single dot beside the merge button. Hovering it lists every check, and each one can be copied or opened on GitHub.

August 8, 2026: Session headers lead with the session, not the repository

A session header used to read owner/repo / Session title. A session can span several repositories, or none at all, so leading with one repository described it inaccurately. The header now shows only the session title.
The same repository line is gone from the session preview opened from the sessions list. Repository context is still available on the session itself.

August 9, 2026: Sessions get their hands sooner

The machinery that lets the agent run commands used to be set up strictly after the workspace was cloned, adding a fixed delay to every session start. The half of it that does not need the repository (installing and enrolling the in-machine worker) now runs while the clone is still in progress, so the agent’s first command is available seconds earlier on every cold session.

August 8, 2026: A session picks its tools up the moment its workspace is ready

An agent that started before its workspace was ready did not get the ability to run commands back until its next message, even though the workspace often arrived seconds into the first one. For the rest of that answer it had no way to run anything, so it reported the task as impossible instead of doing it. The workspace’s tools now reach the answer already in progress.
The agent is also told, in the moment, that its workspace is ready, so it stops working from an earlier conclusion that it had no way to run commands.

August 8, 2026: Session machines sleep the moment your run ends

A session’s cloud machine now suspends as soon as its run finishes, instead of being held awake by background helpers (the preview supervisor, the terminal bridge, the recording and browser processes). Only the run’s own worker keeps the machine active, and it is bounded by the run’s time budget, so a machine can no longer stay hot after the work is done.
Nothing you see changes: previews, the terminal, and the file browser wake the machine transparently on the next request (well under a second), and long-lived helpers survive the sleep and resume where they left off.
Follow-up: the process that carries a live run’s commands now also counts as “the run is active”, so a machine can never doze off in the middle of a long model turn; it still sleeps the moment the run actually ends.
The platform now audits the whole machine fleet every few minutes and flags any machine that is awake with no session using it, so a machine that fails to fall asleep is caught by monitoring instead of by a bill.

August 8, 2026: The model picker keeps up with the pointer

Moving between providers in the model picker used to leave the previous provider’s models on screen for a moment before the new ones appeared. The options panel now swaps as soon as you move, so the list always matches the provider you are pointing at.
The provider list scrolls under the Settings link rather than pushing it off the panel, so the route to Models & credentials stays in place however many providers a workspace connects.

August 8, 2026: A roomier model picker, and a branch that stays under the composer

The model picker is wider, drops the rule under its search field, shows each model’s provider logo beside the model name (not just on the provider row), and ends with a Settings link for connecting more providers.
The branch under the composer no longer hangs past the left edge of the input on a long branch name. It now truncates instead, so the device and context ring stay put.

August 8, 2026: Branch and device act like the controls they are, and providers show their logos

Under the composer, the branch and the execution target now read as pills with the same hover and focus treatment as the model and thinking selects beside them, instead of looking like plain text. Clicking the branch still copies it; clicking the execution target still moves the session to another workspace.
The model picker’s provider list now shows each provider’s logo in front of its name, the same marks the Providers settings card uses.

August 8, 2026: See when a session’s model, provider, or thinking level changes

Changing the model partway through a session used to be invisible: later turns looked identical to earlier ones even though they ran on different settings. The transcript now marks the switch inline, between the turns it separates, with a note such as Model changed from GPT-5.6 Sol to GPT-5.6 Terra. The same note appears when the provider changes or when the thinking level changes, so it is clear which settings produced which answer when you look back at a session. This holds for a switch made between turns, which starts a new run behind the scenes: the note still appears above the first turn that used the new setting. Model names in the note match the model picker exactly, so a switch to GPT-5.5 reads as GPT-5.5 rather than splitting the version off the family name.

August 8, 2026: The agent says something before it starts working

On a new session the agent now answers you first and picks up its tools on the next step, instead of running a planning step before it has said anything. That planning step was costing about seven seconds of silence on a typical first message, and nothing was on screen until it finished.
Sessions whose workspace is already warm are unaffected: the agent has its full toolset from the first message, as before.

August 8, 2026: The branch and execution target are visible again under the composer

The row beneath the message box lists the session’s branch, where it runs (Cloud or a connected device) and how much of the context window is spent. The branch and execution target were being painted over by the composer’s own backdrop, leaving that part of the row blank. They now render again.

August 8, 2026: A session no longer claims it cannot do something while its workspace is still starting

A workspace takes several seconds to come up, and a command run in that window did not execute. The agent now retries once the workspace lands instead of reporting the capability as unavailable, so a question like “what time is it in India” gets a real answer rather than an apology.

August 8, 2026: Subagents wait for their workspace before answering

A subagent could finish before its workspace finished starting and report that it had no way to run commands. Subagents now start with their full tool set and wait for the workspace instead of answering without it.

August 8, 2026: Subagents start correctly in enabled workspaces

Delegating to subagents failed immediately in every workspace where it was turned on. The lookup that enforces how many subagents may run at once was querying a table that does not exist, so the request errored before any subagent started. Delegation now works, and the same fix covers cancelling a parent’s subagents when the parent stops.

August 8, 2026: See what a compacted session’s follow-ups will inherit

When a finished session has been compacted, the session’s ··· menu now shows a Context summary section with the summary your next follow-up will start from (plus a short tail of the most recent turn), and when it was generated. Long summaries are collapsed by default with a Show full summary toggle.

August 8, 2026: Skills & Plugins now stays compact while you browse

Skills & Plugins puts connected tools in an open Installed section before the plugin catalog, then groups every remaining plugin category into the same spring-open sections used across Ara settings. Open the group you need and the previous one folds away; the scope choice and search continue to apply. Plugin rows keep their generous click target, but hover now stays on their controls and icon instead of tinting the entire row. The two-option scope choice uses the same segmented control as Automations.
Skills remain their own sibling catalog section, without the old collection cards or visual divider system.
Added skills now sit with connected plugins in the open Installed section, using the same compact icon grid and name-on-hover treatment. The old skills.sh collection browser has been removed; searching now shows public skill results directly in the same responsive two-column rows as plugins.
The Installed skills strip stays to one compact row; its +N tile expands the remaining skill icons inline.
While searching Skills & Plugins, every top-level section with a match opens together; sections without a match stay folded.
The page now uses the same high workspace header as Automations: compact search and activity controls live beside the scope and type pills, and repository-authored skills appear in the workspace catalog instead of behind a repository filter. Skills & Plugins activity records actual skill reads and connected plugin tool calls, linking back to the session without showing tool arguments or results.
Two-option choices on Automations and Skills & Plugins now use the rounded-square segmented control.
Opening a skill now uses Ara’s normal session-style Files sidepanel: the selected SKILL.md is a closable file tab instead of a separate properties view. Curated MCP setup pages now use the same spring-open sections for connection, credentials, endpoint, and skills; connection actions use the shared status badge, switch, and pill buttons.
Organization-authored skills now carry the workspace avatar (or its initial fallback) in the Skills grid. Ara-provided skills carry a small neutral Ara source mark. Their SKILL.md file panel includes copy-reference, copy-path, and direct Pierre editing actions while the normal view remains rendered Markdown.
Organization memory files now use that same rendered Markdown viewer and direct editor instead of a separate raw-text textarea.

August 8, 2026: Images and videos the agent touches now appear in chat automatically

When a command the agent runs saves or references an image or video in its workspace, that file now appears inline in the session chat automatically, the same way a file you attach yourself renders. There is nothing to ask for: a screenshot taken, a chart generated, a diagram written to disk all surface the moment the agent’s command output points at them.
This is a repair, not a new feature: it restores behavior that was live before the runtime change in early August and had gone quiet since.

August 8, 2026: The agent replies first when its sandbox is still starting

While a repository is still being cloned, the agent is no longer offered the commands it cannot yet run. It answers you with what it knows, and the commands become available the moment the sandbox is ready. Previously it reached for a command, was told the sandbox was still starting, and tried again, so nothing appeared on screen until the setup had finished.
Sessions whose sandbox is already warm, including most follow-up messages, are unchanged: the commands are there from the first message as before.

August 8, 2026: Cleaner results from self-verifying sessions

Sessions that run the experimental self-verification loop no longer show the loop’s internal completion marker at the end of the final answer or the session summary. The marker is coordination between the agent and its verifier, not part of the result.
No change for ordinary sessions.

August 8, 2026: Ephemeral preview environments can run full agent sessions

A cloned preview deployment of the platform (an environment named preview-*) now routes model-inference grant redemption to its own API origin instead of the shared production endpoint, so agent chats in a preview environment complete end to end against that environment’s own isolated database. Production and staging routing are unchanged, and a preview origin is only ever the deployment’s own platform-provided domain.

August 8, 2026: The queue only appears when messages are actually stacking

A message sent while the agent is working now goes straight to the agent when nothing else is waiting, and appears in the conversation like any other message. The queue was holding every mid-run message, so a single reply sat above the message box with Steer and remove controls around it, waiting for a step to finish, before dropping into the chat seconds later.
The queue still does its job the moment it has one: send a second message while the first is still on its way and it waits, in order, one per finished step. Steer still jumps a waiting message to the front, and removing one before the agent reaches it still takes it out entirely.
Releasing, cancelling, or reordering a queued message now updates every open view of the session immediately. Those changes were previously only recorded, so a browser could keep showing a message as queued after it had already gone to the agent.

Opening a saved session keeps that session selected in the sidebar. Moving back to New Task or to a top-level page such as Repositories or Automations transfers the shared highlight to that destination instead.
The previous resting highlight can no longer remain on New Task after you open a session, so the sidebar now always reflects the page currently open.

August 8, 2026: `/compact` always works, including on finished sessions

Compacting a session no longer requires a live run. On a finished session, /compact now summarizes the whole conversation in the background, and your next follow-up starts from that summary instead of only the tail of the last turn. Triggering it again when nothing new has happened answers “already compact” instead of showing a red error card.
The toast reports what actually happened - requested for the next model step, queued for a run that has not started, running in the background, already compact, or out of credit - instead of announcing “Context compacted” before anything had run.
A compaction request made while a run was starting up used to be silently dropped after the toast said it was accepted; it now applies at the run’s first opportunity, and a request that arrives just as a run finishes says so in the transcript instead of vanishing.
The transcript now shows a “Context compaction” row while a summary is being generated and when it completes.
On workspaces that bring their own model keys, Ara never starts model calls on your credentials: /compact on a finished session answers “already compact” there, and follow-ups still start from a compact summary of the prior turn.

The session composer’s / menu now lists Compact context as a dedicated entry beside your skills. Picking it summarizes the older part of the conversation to free up context, exactly like typing /compact, and the entry only appears while the session has a live run that can be compacted.

August 8, 2026: Sessions can move between a cloud workspace and your Mac again

The “Continue on” picker in a session works again. Choosing a new location used to fail with a raw harness1_target_handoff_required error for every session; picking a fresh cloud workspace or one of your paired devices now continues the session there. The moved session keeps its conversation context, model settings, and pull request, starts from the session’s branch, and the picker’s promise holds: a cloud move lands in a genuinely fresh sandbox, never a reused one. Only pushed work travels; the original session is stopped once the new one is safely queued.

August 8, 2026: Workspace controls now follow one interaction system

Settings, Automations, Templates, analytics, the command palette, Ara API, and Review now use the same compact animated controls: two-option mode choices use a segmented squircle; peer views and filters use a pill tab group with one moving active surface. The Review’s Overview, Discussion, and Commits group sits in the Review header, above the divider that separates it from the checks and changed files.
Settings and automation lists share one resting hover/selection surface across grouped rows. Repository and automation configuration now use the same spring-open sections, while non-expandable groups use the matching quiet rounded surface rather than a one-off card treatment.
Choosing a model and thinking level when starting a task is now two explicit controls below the message box. Trigger selection follows the same nested source-to-event menu pattern, so dependent options appear beside the choice that revealed them.
The model control now picks a provider first and then its available model, so connected providers can grow without turning the composer into one flat mixed list. Opening it starts with the provider categories; the model panel unfolds only after you choose or focus a provider. If a saved provider model becomes unavailable, it stays visibly named as the current selection until you choose a replacement rather than being represented as a different Ara model. In an existing session, its branch and where it is running remain visible on the left below the composer while the model controls stay on the right.
Opening a repository or an automation now uses the same compact navigator as a session: its source, a /, and the item title sit in the top rail. The existing edit, run, save, and more actions remain exactly where they were.
The redundant session-summary icon has been removed from the session rail; the session menu and panel control remain available there.
The composer summary pill now groups plan progress, changed files, and active subagents in one row, with | dividers and an independent action for each segment. Its active-agent segment opens the full subagent list rather than choosing one worker arbitrarily.

August 8, 2026: The agent can ask for a missing plugin or secret right in the chat

When the agent hits a service it cannot reach (an unconnected plugin, or a missing API key), it can now surface an inline card in the session chat: Connect adds a plugin with one-click OAuth, and Add secret takes the value without it ever appearing in the conversation. This restores a capability that had been dark since the runtime cutover in early August.
The cards never block the run. The agent keeps working on what it can, a saved secret is injected into the live sandbox for the agent’s next turn, and a newly connected plugin takes effect on the next session.
A secret the agent asks for also appears immediately as a to-fill row in the repository’s Environment tab, so you can add it from there instead if you prefer.

August 8, 2026: Bring your own model server as a provider

Settings -> Models gains a Custom endpoint provider: point it at any OpenAI-compatible server you host yourself (vLLM, SGLang, Ollama behind a proxy, a LiteLLM gateway) with a base URL and an API key, and its models appear in the session composer’s model picker alongside the other providers you have connected.
On connect, Ara asks the server for its model list automatically; if your server does not expose one, list the model IDs yourself in the form. The wire format defaults to OpenAI Chat Completions, with OpenAI Responses and Anthropic Messages available for servers that speak those instead.
Runs on these models call your server directly and are billed by nobody: like other connected providers, usage happens on your own infrastructure and never spends Ara credits. The base URL must be a public https address; keys are stored encrypted and are never shown back.

August 8, 2026: Queued messages start their turn the moment the agent answers

A queued message now begins its turn immediately when the agent finishes the previous one, in the same live session. Before, the message released from the queue could miss the closing run and restart the agent from scratch, which showed up as the message sitting in the queue for several seconds before it entered the chat.
The session now also waits for a message that is mid-delivery before wrapping up, so a reply sent in the instant the agent finishes is picked up live instead of restarting it.

August 8, 2026: Mid-run messages queue up and go in one per finished step

Sending a message while the agent is working now adds it to a queue instead of interrupting the current step. The agent finishes what it is doing, and Ara hands it exactly one queued message each time it settles a step, so a burst of thoughts arrives as a sequence of clean instructions rather than all at once mid-task. Previously every mid-run message was injected at the next turn boundary regardless of what else was waiting.
The queue sits above the message box, and each entry can be reordered by dragging, edited (which returns it to the message box), or removed before the agent ever sees it.
Steer on a queued message is the override: it skips the queue and goes into the agent’s very next turn boundary, the way every mid-run message behaved before.
The queue now lives with the session rather than in your browser, so queued messages survive a reload, are visible to everyone watching the session, and are never lost if you close the tab. If the run finishes while messages are still queued, they start a continuation run instead of being dropped.

August 8, 2026: More credential types are masked in what an agent writes out

Pull request titles, issue titles, and issue comments written by an agent are checked for the run’s own secret values before they leave for GitHub or GitLab. That check now also covers connector credentials and workspace MCP server secrets, not just the secrets you set under Secrets and Environment.
Redaction is also more resilient: if one source cannot be read, the others are still masked, where previously a single failure fell back to pattern matching alone.

August 8, 2026: Agents answer without waiting for their sandbox

An agent now replies as soon as it has something to say, whether or not its sandbox has finished starting. Previously, if the agent reached for a command before the sandbox was ready, the whole reply waited behind repository cloning and toolchain setup, so a question that needed no commands at all could sit silent for a minute.
If the agent does run a command before the sandbox exists, it now waits a couple of seconds and is then told the sandbox is still starting, rather than blocking indefinitely. Nothing is executed and nothing changes on disk, so the agent answers with what it knows and picks the command back up once the sandbox is there.

August 8, 2026: The same secret name can differ per workspace

If you belong to several workspaces you can now save a secret under the same name in each one, holding a different value per workspace. Until now the name had to be unique across your whole account, which was the last piece of making personal secrets workspace-scoped.
Nothing changes for a single workspace, and no existing secret is affected.

August 8, 2026: Screenshot and recording links serve verified media only

Images and recordings attached to a pull request by an agent are now checked in full before Ara serves them, and Ara serves the checked bytes rather than redirecting to the stored file. Previously only the first few bytes were inspected, which was not enough to tell a real screenshot from another kind of file wearing an image header.
Comment and metadata segments are removed from what gets served. Those sections exist to hold arbitrary text, so a picture can look perfectly valid and still carry something in them. Real captures are unaffected apart from the encoder’s own padding.
Anything that does not parse as a complete image or video is not served at all. A capture that failed to upload cleanly now returns not-found instead of a broken file.

August 8, 2026: Credit held for a model request that failed is always given back

When a model request failed before the provider reported anything about it, the credit reserved for that request could stay held indefinitely: the workspace’s available credit was lower than its balance implied, and nothing was ever charged for the failed request. Those holds are now released within minutes of the failure, and a failed request that can never be priced is never billed. The holds that had already been stranded before this change have been returned as well.

August 8, 2026: Your personal secrets belong to one workspace

A secret you save under Secrets is now scoped to the workspace you saved it in. Previously a personal secret was attached to your account, so if you belonged to more than one workspace it was injected into every run you started in any of them.
If you work in a single workspace nothing changes: the same secrets, in the same place, behaving the same way.
If you belong to several workspaces, each one now keeps its own set. You can hold a different value under the same name per workspace, and adding or removing one no longer affects the others. Existing secrets were moved to their owner’s workspace, so nothing was lost.
Every other kind of secret in Ara (project secrets, connectors, MCP servers, API keys) was already scoped this way; personal secrets were the exception.

August 7, 2026: The command palette opens instantly, and dragging stays smooth

Opening the command palette with Cmd/Ctrl+K no longer plays an entrance animation. The palette is there on the next frame, so typing immediately can never race the surface sliding in; only the backdrop still fades so the page behind it does not hard-cut.
Swiping the mobile sidebar open, and sweeping the pointer down a list of sessions, automations, repositories, or settings entries, now stay smooth under load. Both used to move their highlight and their drawer by changing layout on every frame of the gesture.
On touch devices, cards and buttons that lift when a mouse hovers no longer stay stuck in the lifted state after a tap. Their color, border, and shadow feedback is unchanged, on touch and with a mouse alike.
The pointer and highlight the agent draws while it works in a browser no longer force the page it is working in to relayout as they move between elements.

August 7, 2026: Scheduled automation runs start again

A run started by a schedule failed a couple of seconds after it began, without doing any work, and its history showed a billing error even though the workspace had credit and minutes available. Only scheduled runs were affected; runs you started yourself, and runs triggered from GitHub, were not. Scheduled runs now start normally, and no billed minutes were consumed by the failed attempts.

August 7, 2026: `/compact` now compacts short conversations, and says so when there is nothing to compact

Typing /compact in a session summarized earlier history only once the conversation had grown past the automatic keep-recent budget; below that it silently did nothing. A manual request now summarizes the older half of the conversation and keeps the recent half, so it does visible work at any length.
When a request genuinely has nothing to fold, or the summary could not be produced, the session says so in the transcript instead of leaving you guessing.

August 7, 2026: Secrets are masked in run error messages, and API-key expiry fails loudly

When a run fails, the error shown on the session, sent in notifications, and carried into the next turn is now redacted before it is stored. A failed git clone used to be able to surface the credentialed URL Ara clones with; that value is masked now. Ordinary failures are unchanged and stay fully readable.
Redaction also recognizes Ara’s own credential formats (Ara API keys, per-run agent tokens) and GitHub fine-grained and GitLab tokens, so those are masked anywhere Ara shows agent output.
Creating an API key with an unsupported expiry now returns a clear error instead of quietly creating a key that never expires. The supported values are unchanged — never, 30 days, 90 days, and 1 year — so the picker in Settings behaves exactly as before; this only affects scripted calls that passed some other number.

August 7, 2026: Follow-up messages start much faster

Replying to a session no longer rebuilds the workspace from scratch. When the previous turn’s sandbox is still warm, the follow-up reattaches to it and reuses the repository that is already checked out, instead of provisioning a new machine and re-cloning. On a large repository that removes the great majority of the wait before the agent starts working, and the saving grows with repository size.
A follow-up only reuses a workspace belonging to the same repository, and only after confirming the checkout is intact. Anything else falls back to the ordinary fresh setup, which behaves exactly as before.
The speed-up holds for the whole conversation, not just the first reply. A warm workspace is now held from the most recent turn that used it, so a long back-and-forth keeps reusing it instead of losing it partway through and rebuilding.
Separately, an internal network self-check that ran before every session now runs alongside the setup work instead of ahead of it, removing a few seconds of waiting from every session start, including the first one.

August 7, 2026: Opening a session puts the caret in the message box

Opening a session now focuses its message box immediately, so you can start typing your next instruction without clicking into it first. The sessions list already behaved this way; the session page now matches. Session previews and embedded thumbnails still leave focus where it is.

The “Update payment method” link in a failed-payment email, and the same action in the paused-workspace banner, now open Stripe’s payment-method flow directly instead of leaving you on the billing settings page to find it. If the workspace is signed out, you sign in first and then land in the same flow.
Re-buying the package a workspace already sits on no longer reports a portal error before it succeeds. The purchase behaved correctly either way; only the reporting was wrong.
Trial card verification no longer fails on a card whose bank asks for extra confirmation. Verification could not complete for those cards at all, and the trial now proceeds as it does whenever verification cannot reach a verdict.

August 7, 2026: Motion polish across lists, tabs, settings, and async buttons

Hovering a list now moves one shared highlight that glides between rows instead of each row lighting up on its own. This applies to the session list in the sidebar, the built-in and custom automation lists, the repository list under Codebase, the settings navigation, and every dropdown/picker menu built on the shared select.
Tab strips (execution history, codebase sections, dashboard activity, the Ara CLI setup targets) animate one indicator between tabs rather than switching instantly.
Async actions give live feedback: Connect/Save on MCP server setup, Create automation, and the billing spend-limit Save now show a spinner while working and morph back when done, instead of appearing to do nothing.
The team spend-limit dialog on Billing smoothly resizes between limit types instead of jumping.
Audit Log groups each month into a rounded, spring-animated collapsible section; the newest month starts open.
Personal Preferences now groups collapsed sections into quiet rounded surfaces; opening one setting separates it with the same spring motion, without changing any existing controls.
Counters (execution history stats), status badges, checkboxes (API key scopes), and toggles (MCP enable, memory enable) animate their state changes. All motion respects the reduced-motion system preference.

August 7, 2026: Ara subscription inference now runs on a single provider gateway

Every model in your Ara subscription is now served through one inference gateway instead of two. The selectable models, their context and output limits, your published per-model prices, and workspace credit behavior are unchanged.
Your charge is still computed from Ara’s published price for the model you picked, independently of what the gateway costs Ara. A request that cannot produce authoritative evidence of what it served holds its exposure and reconciles rather than creating a guessed charge.
A request stays bound to one route and one price for its whole lifetime, and models are withdrawn or restored one at a time, so an operational change never affects a generation already in flight.
This lane covers subscription usage only; supplying your own provider API keys is not part of it.

August 7, 2026: Tool activity shows the real command that ran, and memory search results are now clickable

A repl or bash tool call’s activity row now always shows the real, verbatim command or code that ran, as its own line — immediately once the call starts, not only once it finishes. Previously, some calls (particularly file search and Ara capability calls like memory or skills) either paraphrased this into a generic label or, for a narrow but real class of calls, showed the raw JSON payload the tool actually received instead of the code itself.
That command line now reads at full text strength, while its result stays at the activity pane’s normal muted tone — the same contrast a terminal keeps between a live command and dimmed scrollback.
A completed call’s Success or Failed badge now shows next to the pane’s header for every kind that has one, not only shell commands.
ara.memory.search results render as a real list of matches (title and snippet) instead of raw JSON, and each match links directly to that file on the organization’s Memory settings page.

August 7, 2026: The provider list is now visible on Model settings

Model settings now shows the providers Ara’s agent runtime can authenticate, under Ara’s own row. Providers are grouped by whether you would connect them with an existing subscription or with an API key.
Connecting your own provider is still not available, so the entries are shown but not selectable and the reason is stated inline. No credential is requested or stored, and nothing about billing or model selection changes.

August 7, 2026: A session no longer fails because its own title was being generated

A new session names itself with a short model call while the environment starts. That call shared the session’s single model channel with the agent’s first reply, so the two could collide and the whole session failed immediately with a message about a reached AI usage budget — even on workspaces with their full budget available.
The naming call now yields the channel on a deadline, and a first reply that arrives during naming waits its turn instead of failing.
If a collision ever does surface, the session now says the model channel was briefly busy and to retry, instead of pointing at a budget that was never involved.

August 7, 2026: Short model answers no longer fail on the second inference route

A request with a small output budget, such as the one that names a new session, asked for reasoning it could never fit and failed outright on the newly staged route. Those requests now run without extended thinking instead of failing, so session titles and other short answers come back as expected.

August 7, 2026: Model settings show which providers Ara’s runtime can talk to

The Providers card under Model settings now lists the providers Ara’s agent runtime can authenticate, grouped by whether you would connect them with an existing subscription or with an API key. The list comes from the runtime itself, so it stays accurate as the runtime adds providers.
Ara stays first in that list and is included with your workspace, exactly as before. Nothing about how your sessions are billed or which models you can pick has changed.
Connecting your own provider is not available yet. The list is there so you can see what is coming; no credential is requested or stored.

August 7, 2026: Memory, skill, and plugin activity icons now cover the raw tool-call path too

A memory, skill, or plugin call now shows its dedicated icon in session activity even when the model reaches it through the generic tool-call bridge (ara_memory_manage, ara_skill_manage, ara_plugin_call, ara_plugin_tools, ara_plugin_list) instead of the shortcut method. Previously only the shortcut form got the specific icon; the raw form fell back to a generic badge.

August 7, 2026: MCP servers and merge guardrails are owner/admin settings

Installing, editing, connecting, or removing a workspace MCP server now requires the owner or admin role. An MCP server is workspace-wide execution config: it runs inside every agent run in the workspace, including runs other people start. Members still see the installed list and the marketplace, and the controls now say so instead of failing when used.
Changing a repository’s Merge Bot guardrails — enabling auto-merge and its “CI green”, “Ara verify”, and “no blocking findings” requirements — likewise requires owner or admin. These decide whether agent-authored pull requests can reach your default branch unreviewed.
Both settings were already owner/admin-only through the public API; the web app now matches. Nothing changes for owners and admins.

August 7, 2026: Sessions are named by the agent, and session actions moved onto the title

A new session is now named by a short call to the same harness that runs it, so the title describes what you asked for instead of repeating the first line of your message. Naming happens while the environment is still starting, so it never delays the first reply, and an unusable answer falls back to the previous behavior. Renaming a session yourself always wins, and follow-up turns never re-name a session you already named.
The session header now leads with that title, and the ⋯ menu sits beside it rather than off in the top-right controls.
That menu gains Send feedback, Copy session ID, Archive, and Delete alongside Rename, and still shows the session’s model usage and runtime. Delete asks for confirmation and cannot be undone.
Workspaces that paused title generation under Automations are unaffected: their sessions keep the name derived from your message.

August 7, 2026: A second inference route can be staged behind the same spend controls

Ara’s inference plane can now hold more than one aggregation route per model. A route is staged disabled, enabled per model by an operator, and disabled again to roll back; the enabled route keeps serving in the meantime. Model choice, pricing, and workspace credit behavior are unchanged.
A request is bound to one route for its whole lifetime, so a route change never affects a generation already in flight.
Whichever route serves a request, the customer charge is still computed from Ara’s published model price. A route that cannot produce authoritative evidence of what it served holds its exposure and reconciles instead of creating a guessed charge.

August 7, 2026: Replies are plain prose, and quoted or tabular text is never rendered faded

Ara’s replies no longer use markdown tables or emoji. Content that used to land in a table now reads as plain prose with inline references and hyperlinks instead.
Text inside a blockquote or a markdown table (for older messages, or content a connected tool returns) no longer renders in a dimmed secondary color — it matches the same text color as the rest of the answer.

August 7, 2026: Reasoning reads at full strength and can show its own headline

Reasoning text in the live work history no longer renders at a dimmed, secondary text color once expanded — it now matches the full-strength text tool rows already use when opened, and its left indent (which did not align with any icon) is removed.
When a model’s reasoning arrives as a short headline followed by a detailed paragraph, Ara now shows that headline as the row’s label instead of the generic word “Thinking”. Reasoning that has no distinct headline keeps the previous “Thinking” label.

August 7, 2026: Organization memory adds AGENTS.md and SOUL.md, and session activity shows real icons for memory, skill, and plugin calls

Organization memory’s always-loaded L1 briefings now include AGENTS.md and SOUL.md alongside USER.md and MEMORY.md for hard operating rules and persona/tone.
Session chat activity rows for ara.memory.*, ara.skills.*, and ara.plugins.* calls now show a dedicated icon per capability instead of a generic tool glyph: a memory mark for memory calls, the same skill mark used in the / composer menu for skill calls, and the connected plugin’s own favicon for plugin calls (falling back to a generic plug mark for unrecognized plugins).

August 7, 2026: Follow-up messages always get picked up

Replying to a session whose previous turn had already finished could leave the new message waiting forever, showing a spinner that never resolved. The queue entry those replies create was routed to a retired runtime lane with nothing left to pick it up. That lane is removed, and follow-ups are now claimed by the ordinary session worker like any other work.
Queue ordering, per-workspace concurrency limits, and change-request serialization are unchanged. Starting a brand new session was never affected.

August 6, 2026: Security hardening for IP allowlists, label triggers, and webhooks

An organization’s IP allowlist now applies to the web application, not only the public API. Previously a workspace that restricted access to specific IPs was still reachable from any address through the web app; the same allowlist is now enforced on both surfaces.
Starting an agent run by applying a trigger label to an issue now requires the person who applied the label to have write access to the repository, matching the existing rule for “@ara” mention requests. Someone who can only apply labels (for example a triage role or an outside collaborator) can no longer kick off a run.
Repeated (replayed) GitHub and Linear webhook deliveries are now detected and ignored, so a captured delivery cannot be replayed to trigger duplicate work.

August 6, 2026: The unified capability plane is the only MCP surface for sessions

The legacy connector gateway route is retired after a week of zero usage. Sessions reach Ara capabilities and connected plugins through the single unified endpoint, and the temporary migration shim is removed rather than left dormant.
No connected integration changes; existing connections keep working through the unified plane.

August 6, 2026: Complete skill bundles, not just SKILL.md

On-demand skill fetches now include the whole bundle: companion references, scripts, and assets beside SKILL.md travel with it, each with its own digest and a bundle-level digest over the set. Bundles with unsafe paths, symlinks, or excess files or bytes are refused rather than served partially.

August 6, 2026: Read-only review runs can call provably read-only plugin tools

A review run no longer needs write-capable plugin authority for a tool that is provably safe: a call proceeds only when the provider’s own negotiated tool annotations mark it read-only AND the tool is named in Ara’s curated per-plugin allowlist. Anything unannotated, destructive-marked, or unlisted still requires write authority, and every decision is recorded in telemetry.
Provider annotations alone never grant access: they are untrusted data until Ara’s own policy agrees.

August 6, 2026: Skill adherence is judged, not assumed

A run that was offered a skill is now evaluated on whether the agent actually read the skill before doing other tool work. Only a dedicated read operation counts — mentioning the path does not. Delivery, read, and behavior are separate evidence: the run log records which skill files reached the sandbox, which bodies were fetched, and a deterministic oracle judges the ordering on the real trajectory.
This is verification tooling. Session behavior is unchanged.

August 6, 2026: Package-bundled skills are readable on demand

Plugin skills whose bodies ship inside the sandbox image are no longer read-only names in the catalog: when a skill carries a pinned package source, Ara fetches its full instructions on demand through the capability plane, with the same host allowlist and size guards used at image-build time. The response reports where the body came from and whether it was served from the short-lived read cache.
A skill with no resolvable source still says so plainly instead of pretending to be readable, and a failed fetch returns a typed error rather than a fabricated body.

August 6, 2026: The agent runtime gains a zero-cost end-to-end proof lane

Ara’s agent runtime can now be exercised end to end, from run claim through sandbox tool execution to the final transcript, against a deterministic scripted model instead of live inference. Deploys of the runtime are verifiable without spending model credits and without depending on provider availability.
The runtime’s sandbox tool layer (shell and browser REPL) is now also proven in continuous integration on every commit, using the exact production code paths rather than stand-ins.
This release adds test and operator tooling only. The proof lane is disabled by default, has no user-facing controls, and does not change how ordinary sessions run.
Follow-up: the internal session surface now accepts the proof lane’s sentinel model for explicitly allowlisted internal workspaces, so operators can start a proof run at all, and the sentinel survives enqueue-time model resolution instead of silently falling back to the workspace default. The public API and every ordinary workspace continue to reject it.

August 6, 2026: The Ara plugin now speaks the Agent Plugins standard

Ara’s self-authored plugin now ships a standard root plugin.json and mcp.json in the vendor-neutral Agent Plugins 1.0.0 layout, so any compatible agent client can discover its skill and connect to Ara’s capability plane over Streamable HTTP. Existing supported client installations continue to work through their native manifest.
A conformance test now validates the package against the published schemas on every change, so the layout cannot silently drift.
This changes packaging only. No session, connector, or API behavior changes.

August 6, 2026: One skill catalog across personal, workspace, plugin, and built-in skills

Ara’s skill listing is now a unified, metadata-only catalog spanning your personal skills, workspace skills, plugin-bundled skills, and built-ins. Every entry carries a stable qualified id, its source, a content digest, and its activation keywords, and the full body is fetched on demand by id instead of occupying the prompt.
Name collisions no longer resolve silently: the catalog reports which entry won and why, and equal-priority ties return explicit choices.
Skills whose bodies ship inside the sandbox image are now listed with an honest availability state instead of disappearing from view.
No existing skill management behavior changes; create, update, and delete work exactly as before.

August 6, 2026: A published security contact for reporting vulnerabilities

Ara now publishes a security contact at ara.so/.well-known/security.txt, the standard location security researchers check. Reports go to security@ara.so, which is a monitored address. Previously the reporting policy lived only in a private repository, so there was no way for someone outside the company to find out how to reach us.

August 6, 2026: Connector plugins gain a repeatable acceptance proof

The new provider-acceptance contract makes a connected plugin prove discovery, returned-schema use, exactly one provider dispatch, duplicate refusal through invocation identity, and matching run evidence before it graduates beyond the current rollout boundary.
Context7’s resolver is the reference fixture. Production proof remains a human-visible session transcript plus exact-run observability; the repository script only prints the contract and runs the deterministic test fixture.
This release adds test and operator tooling only. It does not change production capability gates or connector behavior.

August 6, 2026: Repository secret values are owner/admin only

Viewing, exporting, editing, or removing a repository’s stored secret values (the reveal, the “.env” export, and Save/delete on the Environment page) now requires the org owner or admin role. Members still see which secrets are configured (their names), just not the values, and can no longer overwrite a value they cannot see.
Every reveal and export is now recorded in the organization audit log, so a bulk disclosure of repository credentials is always attributable to one person.

August 6, 2026: Messages sent mid-run now steer the working agent

Sending a chat message while the agent is working now delivers it into the live run: the agent picks it up at its next turn boundary, without abandoning the work in progress. The transcript acknowledges the message as queued and then confirms “Steered into the active turn.” once the agent has seen it. Previously the composer held mid-run messages locally and they only reached the agent as a fresh follow-up run after the current one finished, which is why follow-ups always felt like cold starts.
Several messages sent in quick succession are delivered together at the same turn boundary instead of one per turn, so a burst of corrections lands as one update.
Attachments on a mid-run message now reach the agent too. Files are staged into the run’s workspace and the agent is told their exact paths; previously a screenshot pasted mid-run was silently dropped.
A message that arrives too late to join the current run, or that hits a run being cancelled, is rerouted into a continuation run automatically, and its acknowledgement explains that instead of claiming delivery.
Holding messages in the composer while the agent works remains available as an opt-in behavior.

August 6, 2026: Reasoning appears before the first tool call

Provider-generated reasoning summaries now stream inside the session’s live work history as soon as they arrive. Previously Ara kept them behind a plain “Thinking” row until the agent used a tool, which made the same reasoning appear or disappear depending on what the agent did next.
The live work history stays open while the agent is active and collapses after the turn finishes, alongside its tool calls. Completed reasoning starts collapsed at both the outer work rail and its nested disclosure. Models that do not provide a reasoning summary continue to show the ordinary “Thinking” placeholder until visible work begins.
Once a reasoning summary is visible, Ara also stops measuring that turn as placeholder-only thinking, including during the brief handoff where the original placeholder can still coexist with streamed reasoning.

August 6, 2026: Session read-file rows use an open-book icon

When Ara reads a file during a session, the transcript chip and tool row now use an open-book icon instead of a closed book, so read actions read more clearly as looking something up.

August 6, 2026: Workspace switching works everywhere and creating a workspace is one step

The workspace menu’s flyout no longer disappears under the page on settings screens. It previously opened clipped to a sliver at the sidebar’s edge, leaving the workspace list unusable there; it now pops out over the content on every surface and follows its trigger while the rail scrolls or the window resizes.
The menu rows are now named for what they do: “Switch workspace” and “Create new workspace”, matching the Workspace naming used everywhere else, instead of the old “Switch account” and “Create new account”.
Creating a workspace is a single step: pick a name and optionally invite people. The repository-access step is gone; the new workspace’s onboarding offers repository connection right after creation, so nothing is lost by removing the fork.
The create dialog submits from the keyboard: Cmd+Enter (Ctrl+Enter on Windows and Linux) anywhere in the dialog, or plain Enter from the name field. Enter in the invites box still adds a newline, and confirming text through an input method never creates a workspace.

August 6, 2026: A failed payment is now visible everywhere in the workspace

When a workspace’s subscription payment fails, every page now shows a banner explaining that cloud agents are paused, with a direct path to update the payment method. Previously the only signals were a message when a run was refused and a single line on the billing settings page, so a workspace could sit paused without anyone understanding why.
The banner disappears on its own once the updated card’s payment goes through.

August 6, 2026: Inference route failures raise an alert instead of passing quietly

Ara’s model catalog now exposes only the reviewed current model families; retired provider choices are removed from new tasks and saved preferences.
The inference database now rejects direct or operator attempts to re-enable a retired model or one of its routes, while retaining historical prices solely for settlement reconciliation.
A model route whose gateway credential is missing or unusable now pages Ara’s operators. That condition returns an error for every request on the affected model, and until now nothing alerted on it.
Requests that lose their provider cost report, and grants bound to a route the model registry no longer recognizes, now alert as well, so a settlement gap is caught at the time it happens rather than found later during reconciliation.
Routes that ship disabled on purpose, ahead of being switched on, no longer register as tripped safety breakers. A real trip stays visible instead of being buried under a permanent alert for an intended state.

August 6, 2026: Legacy inference cleanup preserves workspace credits

Ara now records every remaining ambiguous request from the retired inference broker in an append-only reconciliation journal before deleting that old authority. Those amounts were internal provider-exposure controls, not workspace-credit charges, so reconciliation never creates a retroactive debit or blanket credit.
Cleanup runs in small operator-confirmed batches and records only aggregate telemetry. A missing or inconsistent row blocks deletion, while a retry cannot charge or reconcile the same request twice.

August 6, 2026: Curated model catalog

GLM 4.7 and Qwen3 Coder are no longer offered in the new-task model picker or Models settings. Existing saved selections fall back to the default Ara model instead of attempting a disabled route.
Ara now admits only reviewed models through its managed inference service. Database guards prevent retired model identities, legacy providers, or unapproved routes from being re-enabled, while historical pricing and settlement records remain available for reconciliation.

August 6, 2026: The Browser tab keeps working after a session finishes

A session’s sandbox is now held for a short window after the run ends instead of being torn down within seconds of it, so the Browser (Preview), Terminal and Display tabs still work on what the session just produced. Previously the machine was released almost immediately and those tabs went blank the moment the work finished, which is exactly when there is something to look at.
The hold applies whether the session succeeded or failed. A run that went wrong is often when you most want to open the preview and see what the dev server is doing.
It is a short window, not a reservation: the sandbox is still released promptly, and sending another message continues the session as before.

August 6, 2026: Queued messages match the composer width

The bar that stacks above the session composer, used for queued messages and run setup, no longer stretches most of the page. It sits a little narrower than the composer it stacks on, as intended.
Opening or closing the session summary now slides the transcript to and from its side position instead of jumping.

August 6, 2026: A redirect can no longer downgrade an outbound connection

Every request Ara makes to a service outside itself — a connected MCP server, an integration, a webhook you configure — now stays encrypted for the whole chain of redirects, not just the address it started from. A server that answers with a redirect to a plain http:// address, or to an address inside Ara’s own network, is refused instead of followed, and credentials are dropped when a redirect crosses to another origin. A chain of more than five redirects is refused as well.
This changes nothing for a server that redirects within https, which is followed as before, and nothing for the built-in MCP catalog.

August 6, 2026: Session sandboxes are released on schedule

A sandbox kept for a short while after a session ends, so a follow-up message can pick the workspace back up, is now released on Ara’s own schedule. Previously nothing enforced that window and the only limit was the hosting provider’s 24 hour cap, so those machines stayed reserved far longer than intended. The workspace still remains available for the same period you could already rely on.
A sandbox left behind by an interrupted session is now cleaned up by the routine sweep instead of waiting for that same 24 hour cap.

August 6, 2026: More permission checks on GitLab triggers and repo start-up scripts

Starting an agent run from a GitLab issue (issue opened, or a trigger label applied) now requires the actor to have write access to the project, matching the rule already applied to “@ara” mentions and merge-request reviews. A user who can only open issues or apply labels can no longer kick off a run.
Editing a repository’s session-start or preview script (the repo-level environment blueprint) now requires the org owner or admin role, because those scripts run with the repository’s secrets available. Members can still edit build-time setup that never sees secrets. Each secret-capable edit is recorded in the organization audit log.

August 7, 2026: Further agent and workspace security hardening

The agent can no longer read or post into another teammate’s session, or create workspace-wide connectors, from inside a run: those actions are now restricted to your own sessions and to a real signed-in owner/admin, so a run driven by untrusted repo or issue content cannot reach a colleague’s work.
A repository’s environment blueprint can no longer define reserved inference variable names (such as OPENAI_API_KEY), matching the rule already applied to stored secrets, and baked build values are scrubbed from stored build artifacts.
The public avatar image link now only serves genuine avatar images, not arbitrary files.

August 7, 2026: Defense-in-depth hardening across agent runs and workspace access

Text an agent writes to a pull request, an issue, a comment, or a commit message now has secret-shaped values and any of the workspace’s own stored secrets stripped out before it is published, so a run driven by untrusted repository or issue content cannot leak your credentials into a public artifact.
Several internal safeguards were tightened with no change to normal use: session tokens now require a dedicated signing key and are only accepted where they are issued; a shared “open access” workspace grants read-only browsing rather than a write-capable role; the connector gateway enforces each agent’s allowed-plugin list; and a preview feature that is off by default now refuses to turn on without its full access check in place.

August 5, 2026: Live Preview finds your dev server again

A repository that declares a dev server in its Blueprint (preview: with a command and a port) now has that server started and kept running for the session. Previously the declaration was read when the environment was built but never acted on during a session, so the server was stopped again as soon as the step that started it finished, and the Browser tab usually found nothing to show.
The port list no longer offers Ara’s own internal connection to the sandbox as though it were your dev server. Only servers you actually started are listed.
When a session has finished, the Browser tab now explains that the sandbox was released along with the dev server, and that sending a message continues the session and starts a new one. It previously showed an internal error code, and showed it in red as though something had broken.
The Browser tab no longer invites you to start a dev server in the same breath as telling you the sandbox is gone. It shows one status line rather than two that contradict each other.

August 5, 2026: Custom MCP servers must be reachable at a public address

Connecting a custom MCP server with OAuth now fails when the server URL, or an OAuth endpoint it advertises, resolves to a private or reserved address such as localhost, a 10.x or 192.168.x host, or a cloud metadata address. A server that is only reachable inside a private network could never have completed a connection anyway; attempting it now stops before any request is sent.
OAuth discovery no longer follows redirects. A server that answers its .well-known discovery documents with a redirect will fail to connect instead of being followed to another origin. Every server in Ara’s built-in MCP catalog serves those documents directly, so connections made through the catalog are unaffected.

August 5, 2026: Session branch and target read below the composer

The row showing a session’s working branch and where it runs is no longer part of the composer card. The card ends at the input box and that row sits under it as plain text, so it reads as information about the session rather than a control inside the input.

August 5, 2026: Groundwork for connector tools in cloud sessions

Connector tools are not yet available in cloud sessions. This entry describes preparatory work only, and the behavior below is switched off by default.
When it is switched on, Ara will reach a connected MCP server from its own backend rather than from inside the sandbox running your code. A connector’s access token is applied server-side and is never written into that machine, so a session can use a connector without ever holding its credential.
Connectors that run as a local process, such as the Postgres and Supabase servers, will keep running inside the session sandbox, where they stay isolated to your own workspace.
Requests to a connected server are refused if its address resolves to a private or internal network, including cloud metadata addresses.

August 5, 2026: Long sessions compact their context instead of failing

A session whose conversation grows past the model’s context window now summarizes its older history automatically and keeps working. The transcript shows “Compacted earlier context to stay within the model’s window” when this happens. Previously the next model request failed outright once the window filled.
The full conversation history is still kept for the transcript and for crash recovery; only what is sent to the model is condensed, and the summary work is billed and metered like any other model request.
Typing /compact in the chat while a session is running now compacts that session’s context on its next model step, instead of returning “capability unavailable”. A finished session still declines: it compacts automatically on its next turn if needed.

August 5, 2026: Uploads report their real staging outcome

Once file staging finishes, the agent is now told exactly which uploaded files landed in its workspace, including any that could not be transferred (for example, files too large to stage). It stops waiting for a file that will never arrive and tells you it could not open the upload instead of guessing at its contents.

August 5, 2026: Card verification when a free trial starts

Starting a free trial now places a temporary $1 authorization hold on the card, released immediately and never charged. A card the bank declines for that hold, or a prepaid card, can no longer start a trial: the subscription is cancelled at signup and the workspace returns to the Free plan, instead of the first invoice failing a week later. Cards that require additional authentication (3D Secure) are not affected by this check.
A card that already redeemed a free trial under a different account now ends the new trial at the end of its period instead of only being flagged internally.

August 5, 2026 — Safer, more reliable sessions

Ara now uses one managed execution path with task-scoped access and workspace credit settlement. Provider credentials remain server-side and are never exposed to a session environment, transcript, artifact, browser, or command line.
Session recovery, cleanup, and historical archiving now use fail-closed ownership checks. Active work and unresolved billing are preserved instead of being retired; completed history remains available.
Operator maintenance reports expose only aggregate safety and billing counts, never session contents, identifiers, or secret values.

August 5, 2026: Sessions run to completion instead of stopping after a minute

Sessions started from Slack, GitHub events, and pull request reviews now hold their run authority for as long as the work takes. Previously a session of roughly 45 seconds or longer could stop mid-task with an authorization error, because only some of the ways a session can start kept renewing the permission that lets it reach the model.
Recovery startup now rejects an incomplete process-lease handoff instead of silently replacing it, so deploy-skewed workers cannot bypass the same ownership checks.
Every runner-owned lease heartbeat now emits its start marker, so production telemetry shows which worker is actively renewing a session before any lease loss or renewal failure. A telemetry sink failure cannot interrupt the session or its lease cleanup.
A session whose worker hands it off during a deploy is now recorded as a planned handoff rather than an unexplained loss, so routine deploys are distinguishable from genuine lease failures.
When a session is recovered after its worker is replaced, a model request that failed with a transient provider error is now retried instead of ending the session. Cancelling a session still stops it immediately.

August 5, 2026 — Steadier session starts when many sessions recover at once

When a batch of sessions recovers together, for example after a deploy or an unexpected restart, Ara now paces how many sandboxes it asks the provider to create at the same time instead of requesting all of them in one burst. Sessions that wait their turn start a moment later rather than failing outright.
Provisioning retries now use a randomized delay, so a group of sessions recovering in lockstep no longer retries in lockstep and collides again on the same schedule.

August 5, 2026 — One workspace credit limit

Long tool-using sessions now renew their run-bound process lease from every production launch path, preventing a healthy session from being reclaimed and invalidating its own short-lived access grant.
Model use now reserves directly from the workspace’s shared credit balance. The temporary per-request, per-run, per-user/day, per-workspace/day, and global/day dollar caps are retired.
Legacy per-group dollars/day settings are ignored and no longer returned by the Team page. Groups may still carry non-monetary daily run limits.
Small remaining balances stay usable: Ara lowers the maximum output to the amount the workspace can afford, while exact token usage settles and releases the unused hold.
Sandbox runtime leases each billable minute from that same balance before it starts, preventing simultaneous model and sandbox work from overspending workspace credits.
System-credential fallback now trips the credential breaker, raw provider errors are sanitized, and service-owned inference secret names cannot be created, listed, exported, or injected into a sandbox.
Token and cost settlements now appear in workspace model-usage history as soon as they debit the same shared credit balance.
The retired inference broker’s database authority now fails closed before archival: it can be sealed only when no live grant, open request, or dollar hold remains, and the operation never adjusts workspace credits.

August 4, 2026 — Managed model execution

Ara sessions use a task-scoped managed inference service. The API holds service credentials; sandboxes receive only a short-lived grant restricted to one session and model, and usage settles against the workspace credit balance.
Usage settlement records the provider, model, credential type, input, cache, reasoning, output tokens, and cost. Provider or accounting failures remain visible and never use an unapproved fallback.
Repository wiki generation is temporarily unavailable while that background job moves onto normal queued sessions.

The marketing footer now lists Ara’s office address, Gaustadalléen 21, 0349 Oslo, Norway, alongside the copyright line. It reads the same in every language, as postal addresses should.

August 3, 2026 — Cancelling a past-due subscription stops collection immediately

Cancelling a subscription whose renewal payment has failed now voids the outstanding invoice and ends the plan right away, so automatic payment retries can no longer charge your card after you cancel.

August 3, 2026 — Clear usage budget messaging

A run that stops because an Ara AI usage budget is used up now says so: the chat shows a dedicated “AI usage budget reached” card explaining that one retry is worth attempting and that a repeat failure means the daily budget, which resets at midnight UTC, instead of a raw “429 Too Many Requests” error.
The Founding Engineer listing no longer states a San Francisco, in-person location or a monthly rate, on both the Careers index and the role page.
Hovering the “N files changed” segment of the composer plan pill now opens a card listing each changed file with its own additions and deletions. Clicking the segment still opens Review.

August 2, 2026 — Safer cloud execution rollout

A staged rollout verified the normal workspace, authentication, session list, composer, and chat surfaces under the updated execution service before promotion.
Model requests start while the sandbox, repository, uploads, and browser tools are prepared. Tool calls wait for verified sandbox readiness before they can execute.
The rollout gates fail closed on authentication, ordering, reconnection, cleanup, and ownership failures. A failed gate retains the previous serving version instead of silently bypassing safety controls.
Recovery preserves the existing session history and replays only safe pending work. It retries bounded transient infrastructure failures, respects cancellation, and never creates a duplicate execution target.

August 8, 2026: Local chat follows the running API port

When the local development launcher selects a different API port because its default is already occupied, secure model requests now follow that selected port. Local sessions no longer fail inference by sending their grants to an unrelated process on the default port.

August 2, 2026 — Faster composer actions

Ara web and docs now use Helvetica Now Display throughout, with Geist Mono for code and file references and medium-weight links and mentions in chat.
The composer + menu now opens searchable Skills, Plugins, and Shortcuts sidecars in both full and compact session composers. Each shows up to five results, with connected plugins first, while Attach file keeps the existing multi-file picker behavior.
Device references in the composer now use the same blue treatment as skill references, showing a device icon and name instead of the raw quoted @ token. Device, plugin, and skill labels all render at medium weight.
The model sidecar now hugs short lists instead of leaving empty space below the available models.
Models & credentials now lists the three included Ara models and keeps availability guidance as a single note below the roster.
Error notifications now inherit the active light or dark theme and keep their dismiss control in the top-right corner.
Pending repository setup is now highlighted in orange, and its copy-prompt dialog explains cloud setup more directly.
Session turn rails are slimmer at rest while keeping their full hover expansion.
New Ara runs can initialize connected GitHub repositories with no commits, then continue through the normal branch and pull-request flow.
The project picker now offers Empty project for an explicit repo-less scratch workspace instead of sending New project clicks to GitHub.
Retrying a completed or failed task now preserves its original instructions, and tasks can continue after a local tool returns a structurally bounded static PNG without weakening the block on provider-hosted media or remote fetches.
Immediate follow-ups keep the same visible session context when it is safe, so chat stays on Thinking instead of returning to Preparing Hands. Ara deliberately starts a fresh workspace when it cannot prove the active run lease or cleanup.
The composer now states its run context in two places. Above a new task, one row holds the repository, the branch it will start from, and the location — Cloud, or Cloud plus one of your connected devices — and each control drops its icon once it holds a value. Plugins moved into the + menu. Beneath the input in a session, a separate row names the session’s own work branch (click to copy it), whether it is computing in the cloud or on your device, and how much of the model’s context is spent, with the token and cost detail on hover.
The location control keeps naming the device an unsent draft targets even after that device becomes unreachable or the page reloads, and the location menu shows the attached device as the current selection rather than implying the task will run in the cloud.
A session can now continue somewhere else. The location chip in the session status row opens Continue on, offering a fresh Ara Cloud sandbox or a folder on one of your connected devices. Ara starts a linked session at the destination from the session’s branch and stops the original, so only committed work travels. Choosing a device checks the branch out into the folder you picked, reusing an existing checkout instead of cloning again. Devices that are offline or running an older Ara release stay listed but unselectable, with the reason shown and a link to Settings → Devices.

The sidebar top-left now holds a workspace picker instead of the Ara wordmark. Its menu shows the current organization and member count, opens Settings or Invite members in one click, and lists your other workspaces under “Switch account” alongside Create new account and Log out.
Sidebar highlights are lighter: the picker matches the height of a navigation item, and session rows keep a gap so a hovered row no longer merges into the one next to it.
Dialog footer buttons are now pills and stay legible on the dark theme.

Updated GPT-5.6 Luna and Terra usage metering to their latest lower provider rates, so the same Ara credit balance now covers more model usage.
“Add repositories” in the composer project menu now opens the Ara GitHub App’s repository-access settings instead of the read-only Codebase list, and Codebase carries the same action in its heading.
Selected Automation, Codebase, and Customize options now use a compact pill, while inactive options stay as muted text.
Notifications now match session turn previews, stay centered at the top on phones, and the turn rail sits clear of the workspace sidebar.
Component previews now stay pinned to one production deployment during releases, avoiding mixed frontend bundles.

July 7, 2026 — Cloud coding agent

Added the cloud coding agent flow for managing repository work from the web.
Added scoped sessions from connected repositories.
Added live progress in the workspace.
Added pull request and diff review without leaving Ara.

August 6, 2026 — Workspace-scoped harness profiles

Internal runtime experiments can now be selected by an operator-managed workspace profile instead of a separate hostname.
Ara persists the profile version and digest on each run so retries and continuations remain reproducible.

August 9, 2026: Persistent cloud sessions can push their branches

August 9, 2026: Concurrent sessions keep their shared workspace alive

August 9, 2026: “Cost by provider” no longer lumps most spend under “Other”

August 9, 2026: Revert and Dream now move next to Open session

August 9, 2026: Faster first commands in persistent workspaces

August 9, 2026: Memory’s sidebar is a single Settings/History/Files accordion

August 9, 2026: Memory History skips empty runs and folds diffs into an accordion

August 9, 2026: Persistent workspaces provision and prepare repositories again

August 9, 2026: The sidebar support button opens the Ara Discord

August 9, 2026: Runtime notices are visible in the transcript

August 9, 2026: Memory moves to the home screen, with a real History panel and Revert

August 9, 2026: Pool multiple provider subscriptions, and a smoother sign-in

August 9, 2026: Analytics no longer lists a model name as a provider

August 9, 2026: One Ara control plane, with Hands only when connected

August 9, 2026: The Analytics time range applies to the whole page, and member usage breaks down by provider

August 9, 2026: See usage broken down by member on the Analytics page

August 9, 2026: The sidebar’s hover preview stays open while other parts of the page scroll

August 9, 2026: Skills & Plugins opens every category up front

August 9, 2026: A subagent’s transcript is its own conversation

August 9, 2026: The model picker’s trigger shows its provider logo

August 9, 2026: The review composer follows you down the thread

August 9, 2026: Persistent workspaces (early access)

August 9, 2026: The sidebar’s hover highlight stays where your pointer is

August 8, 2026: The agent can see which machines and repositories you have connected

August 8, 2026: A finished subagent’s report reads as a system notification

August 8, 2026: Merge Bot gets its own page

August 8, 2026: Configure Merge Bot’s policy from the automation page

August 8, 2026: Merge Bot’s risk assessment is back online

August 8, 2026: Merge Bot gains protected paths, a size limit, and branch cleanup

August 8, 2026: Merge Bot honors human vetoes and demands real CI evidence

August 9, 2026: Review is two surfaces, and the conversation is one of them

August 8, 2026: Session headers lead with the session, not the repository

August 9, 2026: Sessions get their hands sooner

August 8, 2026: A session picks its tools up the moment its workspace is ready

August 8, 2026: Session machines sleep the moment your run ends

August 8, 2026: The model picker keeps up with the pointer

August 8, 2026: A roomier model picker, and a branch that stays under the composer

August 8, 2026: Branch and device act like the controls they are, and providers show their logos

August 8, 2026: See when a session’s model, provider, or thinking level changes

August 8, 2026: The agent says something before it starts working

August 8, 2026: The branch and execution target are visible again under the composer

August 8, 2026: A session no longer claims it cannot do something while its workspace is still starting

August 8, 2026: Subagents wait for their workspace before answering

August 8, 2026: Subagents start correctly in enabled workspaces

August 8, 2026: See what a compacted session’s follow-ups will inherit

August 8, 2026: Skills & Plugins now stays compact while you browse

August 8, 2026: Images and videos the agent touches now appear in chat automatically

August 8, 2026: The agent replies first when its sandbox is still starting

August 8, 2026: Cleaner results from self-verifying sessions

August 8, 2026: Ephemeral preview environments can run full agent sessions

August 8, 2026: The queue only appears when messages are actually stacking

August 8, 2026: The sidebar follows the page you opened

August 8, 2026: /compact always works, including on finished sessions

August 8, 2026: Compact context from the composer’s slash menu

August 8, 2026: Sessions can move between a cloud workspace and your Mac again

August 8, 2026: Workspace controls now follow one interaction system

August 8, 2026: The agent can ask for a missing plugin or secret right in the chat

August 8, 2026: Bring your own model server as a provider

August 8, 2026: Queued messages start their turn the moment the agent answers

August 8, 2026: Mid-run messages queue up and go in one per finished step

August 8, 2026: More credential types are masked in what an agent writes out

August 8, 2026: Agents answer without waiting for their sandbox

August 8, 2026: The same secret name can differ per workspace

August 8, 2026: Screenshot and recording links serve verified media only

August 8, 2026: Credit held for a model request that failed is always given back

August 8, 2026: Your personal secrets belong to one workspace

August 7, 2026: The command palette opens instantly, and dragging stays smooth

August 7, 2026: Scheduled automation runs start again

August 7, 2026: /compact now compacts short conversations, and says so when there is nothing to compact

August 7, 2026: Secrets are masked in run error messages, and API-key expiry fails loudly

August 7, 2026: Follow-up messages start much faster

August 7, 2026: Opening a session puts the caret in the message box

August 7, 2026: Fixing a failed payment is now one click, from the email or the banner

August 7, 2026: Motion polish across lists, tabs, settings, and async buttons

August 7, 2026: Ara subscription inference now runs on a single provider gateway

August 7, 2026: Tool activity shows the real command that ran, and memory search results are now clickable

August 7, 2026: The provider list is now visible on Model settings

August 7, 2026: A session no longer fails because its own title was being generated

August 7, 2026: Short model answers no longer fail on the second inference route

August 7, 2026: Model settings show which providers Ara’s runtime can talk to

August 8, 2026: `/compact` always works, including on finished sessions

August 7, 2026: `/compact` now compacts short conversations, and says so when there is nothing to compact