Cloud

For the visual release feed, see ara.so/news.

August 8, 2026: Ephemeral preview environments can run full agent sessions

• A cloned preview deployment of the platform (an environment named preview-*) now routes model-inference grant redemption to its own API origin instead of the shared production endpoint, so agent chats in a preview environment complete end to end against that environment’s own isolated database. Production and staging routing are unchanged, and a preview origin is only ever the deployment’s own platform-provided domain.

August 8, 2026: The queue only appears when messages are actually stacking

• A message sent while the agent is working now goes straight to the agent when nothing else is waiting, and appears in the conversation like any other message. The queue was holding every mid-run message, so a single reply sat above the message box with Steer and remove controls around it, waiting for a step to finish, before dropping into the chat seconds later.
• The queue still does its job the moment it has one: send a second message while the first is still on its way and it waits, in order, one per finished step. Steer still jumps a waiting message to the front, and removing one before the agent reaches it still takes it out entirely.
• Releasing, cancelling, or reordering a queued message now updates every open view of the session immediately. Those changes were previously only recorded, so a browser could keep showing a message as queued after it had already gone to the agent.

August 8, 2026: The sidebar follows the page you opened

• Opening a saved session keeps that session selected in the sidebar. Moving back to New Task or to a top-level page such as Repositories or Automations transfers the shared highlight to that destination instead.
• The previous resting highlight can no longer remain on New Task after you open a session, so the sidebar now always reflects the page currently open.

August 8, 2026: /compact always works, including on finished sessions

• Compacting a session no longer requires a live run. On a finished session, /compact now summarizes the whole conversation in the background, and your next follow-up starts from that summary instead of only the tail of the last turn. Triggering it again when nothing new has happened answers “already compact” instead of showing a red error card.
• The toast reports what actually happened - requested for the next model step, queued for a run that has not started, running in the background, already compact, or out of credit - instead of announcing “Context compacted” before anything had run.
• A compaction request made while a run was starting up used to be silently dropped after the toast said it was accepted; it now applies at the run’s first opportunity, and a request that arrives just as a run finishes says so in the transcript instead of vanishing.
• The transcript now shows a “Context compaction” row while a summary is being generated and when it completes.
• On workspaces that bring their own model keys, Ara never starts model calls on your credentials: /compact on a finished session answers “already compact” there, and follow-ups still start from a compact summary of the prior turn.

August 8, 2026: Compact context from the composer’s slash menu

• The session composer’s / menu now lists Compact context as a dedicated entry beside your skills. Picking it summarizes the older part of the conversation to free up context, exactly like typing /compact, and the entry only appears while the session has a live run that can be compacted.

August 8, 2026: Sessions can move between a cloud workspace and your Mac again

• The “Continue on” picker in a session works again. Choosing a new location used to fail with a raw harness1_target_handoff_required error for every session; picking a fresh cloud workspace or one of your paired devices now continues the session there. The moved session keeps its conversation context, model settings, and pull request, starts from the session’s branch, and the picker’s promise holds: a cloud move lands in a genuinely fresh sandbox, never a reused one. Only pushed work travels; the original session is stopped once the new one is safely queued.

August 8, 2026: Workspace controls now follow one interaction system

• Settings, Automations, Templates, analytics, the command palette, Ara API, and Review now use the same compact animated controls: two-option mode choices use a segmented squircle; peer views and filters use a pill tab group with one moving active surface. The Review’s Overview, Discussion, and Commits group sits in the Review header, above the divider that separates it from the checks and changed files.
• Settings and automation lists share one resting hover/selection surface across grouped rows. Repository and automation configuration now use the same spring-open sections, while non-expandable groups use the matching quiet rounded surface rather than a one-off card treatment.
• Choosing a model and thinking level when starting a task is now two explicit controls below the message box. Trigger selection follows the same nested source-to-event menu pattern, so dependent options appear beside the choice that revealed them.

August 8, 2026: The agent can ask for a missing plugin or secret right in the chat

• When the agent hits a service it cannot reach (an unconnected plugin, or a missing API key), it can now surface an inline card in the session chat: Connect adds a plugin with one-click OAuth, and Add secret takes the value without it ever appearing in the conversation. This restores a capability that had been dark since the runtime cutover in early August.
• The cards never block the run. The agent keeps working on what it can, a saved secret is injected into the live sandbox for the agent’s next turn, and a newly connected plugin takes effect on the next session.
• A secret the agent asks for also appears immediately as a to-fill row in the repository’s Environment tab, so you can add it from there instead if you prefer.

August 8, 2026: Bring your own model server as a provider

• Settings -> Models gains a Custom endpoint provider: point it at any OpenAI-compatible server you host yourself (vLLM, SGLang, Ollama behind a proxy, a LiteLLM gateway) with a base URL and an API key, and its models appear in the session composer’s model picker alongside the other providers you have connected.
• On connect, Ara asks the server for its model list automatically; if your server does not expose one, list the model IDs yourself in the form. The wire format defaults to OpenAI Chat Completions, with OpenAI Responses and Anthropic Messages available for servers that speak those instead.
• Runs on these models call your server directly and are billed by nobody: like other connected providers, usage happens on your own infrastructure and never spends Ara credits. The base URL must be a public https address; keys are stored encrypted and are never shown back.

August 8, 2026: Queued messages start their turn the moment the agent answers

• A queued message now begins its turn immediately when the agent finishes the previous one, in the same live session. Before, the message released from the queue could miss the closing run and restart the agent from scratch, which showed up as the message sitting in the queue for several seconds before it entered the chat.
• The session now also waits for a message that is mid-delivery before wrapping up, so a reply sent in the instant the agent finishes is picked up live instead of restarting it.

August 8, 2026: Mid-run messages queue up and go in one per finished step

• Sending a message while the agent is working now adds it to a queue instead of interrupting the current step. The agent finishes what it is doing, and Ara hands it exactly one queued message each time it settles a step, so a burst of thoughts arrives as a sequence of clean instructions rather than all at once mid-task. Previously every mid-run message was injected at the next turn boundary regardless of what else was waiting.
• The queue sits above the message box, and each entry can be reordered by dragging, edited (which returns it to the message box), or removed before the agent ever sees it.
• Steer on a queued message is the override: it skips the queue and goes into the agent’s very next turn boundary, the way every mid-run message behaved before.
• The queue now lives with the session rather than in your browser, so queued messages survive a reload, are visible to everyone watching the session, and are never lost if you close the tab. If the run finishes while messages are still queued, they start a continuation run instead of being dropped.

August 8, 2026: More credential types are masked in what an agent writes out

• Pull request titles, issue titles, and issue comments written by an agent are checked for the run’s own secret values before they leave for GitHub or GitLab. That check now also covers connector credentials and workspace MCP server secrets, not just the secrets you set under Secrets and Environment.
• Redaction is also more resilient: if one source cannot be read, the others are still masked, where previously a single failure fell back to pattern matching alone.

August 8, 2026: Agents answer without waiting for their sandbox

• An agent now replies as soon as it has something to say, whether or not its sandbox has finished starting. Previously, if the agent reached for a command before the sandbox was ready, the whole reply waited behind repository cloning and toolchain setup, so a question that needed no commands at all could sit silent for a minute.
• If the agent does run a command before the sandbox exists, it now waits a couple of seconds and is then told the sandbox is still starting, rather than blocking indefinitely. Nothing is executed and nothing changes on disk, so the agent answers with what it knows and picks the command back up once the sandbox is there.

August 8, 2026: The same secret name can differ per workspace

• If you belong to several workspaces you can now save a secret under the same name in each one, holding a different value per workspace. Until now the name had to be unique across your whole account, which was the last piece of making personal secrets workspace-scoped.
• Nothing changes for a single workspace, and no existing secret is affected.

August 8, 2026: Screenshot and recording links serve verified media only

• Images and recordings attached to a pull request by an agent are now checked in full before Ara serves them, and Ara serves the checked bytes rather than redirecting to the stored file. Previously only the first few bytes were inspected, which was not enough to tell a real screenshot from another kind of file wearing an image header.
• Comment and metadata segments are removed from what gets served. Those sections exist to hold arbitrary text, so a picture can look perfectly valid and still carry something in them. Real captures are unaffected apart from the encoder’s own padding.
• Anything that does not parse as a complete image or video is not served at all. A capture that failed to upload cleanly now returns not-found instead of a broken file.

August 8, 2026: Credit held for a model request that failed is always given back

• When a model request failed before the provider reported anything about it, the credit reserved for that request could stay held indefinitely: the workspace’s available credit was lower than its balance implied, and nothing was ever charged for the failed request. Those holds are now released within minutes of the failure, and a failed request that can never be priced is never billed. The holds that had already been stranded before this change have been returned as well.

August 8, 2026: Your personal secrets belong to one workspace

• A secret you save under Secrets is now scoped to the workspace you saved it in. Previously a personal secret was attached to your account, so if you belonged to more than one workspace it was injected into every run you started in any of them.
• If you work in a single workspace nothing changes: the same secrets, in the same place, behaving the same way.
• If you belong to several workspaces, each one now keeps its own set. You can hold a different value under the same name per workspace, and adding or removing one no longer affects the others. Existing secrets were moved to their owner’s workspace, so nothing was lost.
• Every other kind of secret in Ara (project secrets, connectors, MCP servers, API keys) was already scoped this way; personal secrets were the exception.

August 7, 2026: The command palette opens instantly, and dragging stays smooth

• Opening the command palette with Cmd/Ctrl+K no longer plays an entrance animation. The palette is there on the next frame, so typing immediately can never race the surface sliding in; only the backdrop still fades so the page behind it does not hard-cut.
• Swiping the mobile sidebar open, and sweeping the pointer down a list of sessions, automations, repositories, or settings entries, now stay smooth under load. Both used to move their highlight and their drawer by changing layout on every frame of the gesture.
• On touch devices, cards and buttons that lift when a mouse hovers no longer stay stuck in the lifted state after a tap. Their color, border, and shadow feedback is unchanged, on touch and with a mouse alike.
• The pointer and highlight the agent draws while it works in a browser no longer force the page it is working in to relayout as they move between elements.

August 7, 2026: Scheduled automation runs start again

• A run started by a schedule failed a couple of seconds after it began, without doing any work, and its history showed a billing error even though the workspace had credit and minutes available. Only scheduled runs were affected; runs you started yourself, and runs triggered from GitHub, were not. Scheduled runs now start normally, and no billed minutes were consumed by the failed attempts.

August 7, 2026: /compact now compacts short conversations, and says so when there is nothing to compact

• Typing /compact in a session summarized earlier history only once the conversation had grown past the automatic keep-recent budget; below that it silently did nothing. A manual request now summarizes the older half of the conversation and keeps the recent half, so it does visible work at any length.
• When a request genuinely has nothing to fold, or the summary could not be produced, the session says so in the transcript instead of leaving you guessing.

August 7, 2026: Secrets are masked in run error messages, and API-key expiry fails loudly

• When a run fails, the error shown on the session, sent in notifications, and carried into the next turn is now redacted before it is stored. A failed git clone used to be able to surface the credentialed URL Ara clones with; that value is masked now. Ordinary failures are unchanged and stay fully readable.
• Redaction also recognizes Ara’s own credential formats (Ara API keys, per-run agent tokens) and GitHub fine-grained and GitLab tokens, so those are masked anywhere Ara shows agent output.
• Creating an API key with an unsupported expiry now returns a clear error instead of quietly creating a key that never expires. The supported values are unchanged — never, 30 days, 90 days, and 1 year — so the picker in Settings behaves exactly as before; this only affects scripted calls that passed some other number.

August 7, 2026: Follow-up messages start much faster

• Replying to a session no longer rebuilds the workspace from scratch. When the previous turn’s sandbox is still warm, the follow-up reattaches to it and reuses the repository that is already checked out, instead of provisioning a new machine and re-cloning. On a large repository that removes the great majority of the wait before the agent starts working, and the saving grows with repository size.
• A follow-up only reuses a workspace belonging to the same repository, and only after confirming the checkout is intact. Anything else falls back to the ordinary fresh setup, which behaves exactly as before.
• The speed-up holds for the whole conversation, not just the first reply. A warm workspace is now held from the most recent turn that used it, so a long back-and-forth keeps reusing it instead of losing it partway through and rebuilding.
• Separately, an internal network self-check that ran before every session now runs alongside the setup work instead of ahead of it, removing a few seconds of waiting from every session start, including the first one.

August 7, 2026: Opening a session puts the caret in the message box

• Opening a session now focuses its message box immediately, so you can start typing your next instruction without clicking into it first. The sessions list already behaved this way; the session page now matches. Session previews and embedded thumbnails still leave focus where it is.

August 7, 2026: Fixing a failed payment is now one click, from the email or the banner

• The “Update payment method” link in a failed-payment email, and the same action in the paused-workspace banner, now open Stripe’s payment-method flow directly instead of leaving you on the billing settings page to find it. If the workspace is signed out, you sign in first and then land in the same flow.
• Re-buying the package a workspace already sits on no longer reports a portal error before it succeeds. The purchase behaved correctly either way; only the reporting was wrong.
• Trial card verification no longer fails on a card whose bank asks for extra confirmation. Verification could not complete for those cards at all, and the trial now proceeds as it does whenever verification cannot reach a verdict.

August 7, 2026: Motion polish across lists, tabs, settings, and async buttons

• Hovering a list now moves one shared highlight that glides between rows instead of each row lighting up on its own. This applies to the session list in the sidebar, the built-in and custom automation lists, the repository list under Codebase, the settings navigation, and every dropdown/picker menu built on the shared select.
• Tab strips (execution history, codebase sections, dashboard activity, the Ara CLI setup targets) animate one indicator between tabs rather than switching instantly.
• Async actions give live feedback: Connect/Save on MCP server setup, Create automation, and the billing spend-limit Save now show a spinner while working and morph back when done, instead of appearing to do nothing.
• The team spend-limit dialog on Billing smoothly resizes between limit types instead of jumping.
• Audit Log groups each month into a rounded, spring-animated collapsible section; the newest month starts open.
• Personal Preferences now groups collapsed sections into quiet rounded surfaces; opening one setting separates it with the same spring motion, without changing any existing controls.
• Counters (execution history stats), status badges, checkboxes (API key scopes), and toggles (MCP enable, memory enable) animate their state changes. All motion respects the reduced-motion system preference.

August 7, 2026: Ara subscription inference now runs on a single provider gateway

• Every model in your Ara subscription is now served through one inference gateway instead of two. The selectable models, their context and output limits, your published per-model prices, and workspace credit behavior are unchanged.
• Your charge is still computed from Ara’s published price for the model you picked, independently of what the gateway costs Ara. A request that cannot produce authoritative evidence of what it served holds its exposure and reconciles rather than creating a guessed charge.
• A request stays bound to one route and one price for its whole lifetime, and models are withdrawn or restored one at a time, so an operational change never affects a generation already in flight.
• This lane covers subscription usage only; supplying your own provider API keys is not part of it.

August 7, 2026: Tool activity shows the real command that ran, and memory search results are now clickable

• A repl or bash tool call’s activity row now always shows the real, verbatim command or code that ran, as its own line — immediately once the call starts, not only once it finishes. Previously, some calls (particularly file search and Ara capability calls like memory or skills) either paraphrased this into a generic label or, for a narrow but real class of calls, showed the raw JSON payload the tool actually received instead of the code itself.
• That command line now reads at full text strength, while its result stays at the activity pane’s normal muted tone — the same contrast a terminal keeps between a live command and dimmed scrollback.
• A completed call’s Success or Failed badge now shows next to the pane’s header for every kind that has one, not only shell commands.
• ara.memory.search results render as a real list of matches (title and snippet) instead of raw JSON, and each match links directly to that file on the organization’s Memory settings page.

August 7, 2026: The provider list is now visible on Model settings

• Model settings now shows the providers Ara’s agent runtime can authenticate, under Ara’s own row. Providers are grouped by whether you would connect them with an existing subscription or with an API key.
• Connecting your own provider is still not available, so the entries are shown but not selectable and the reason is stated inline. No credential is requested or stored, and nothing about billing or model selection changes.

August 7, 2026: A session no longer fails because its own title was being generated

• A new session names itself with a short model call while the environment starts. That call shared the session’s single model channel with the agent’s first reply, so the two could collide and the whole session failed immediately with a message about a reached AI usage budget — even on workspaces with their full budget available.
• The naming call now yields the channel on a deadline, and a first reply that arrives during naming waits its turn instead of failing.
• If a collision ever does surface, the session now says the model channel was briefly busy and to retry, instead of pointing at a budget that was never involved.

August 7, 2026: Short model answers no longer fail on the second inference route

• A request with a small output budget, such as the one that names a new session, asked for reasoning it could never fit and failed outright on the newly staged route. Those requests now run without extended thinking instead of failing, so session titles and other short answers come back as expected.

August 7, 2026: Model settings show which providers Ara’s runtime can talk to

• The Providers card under Model settings now lists the providers Ara’s agent runtime can authenticate, grouped by whether you would connect them with an existing subscription or with an API key. The list comes from the runtime itself, so it stays accurate as the runtime adds providers.
• Ara stays first in that list and is included with your workspace, exactly as before. Nothing about how your sessions are billed or which models you can pick has changed.
• Connecting your own provider is not available yet. The list is there so you can see what is coming; no credential is requested or stored.

August 7, 2026: Memory, skill, and plugin activity icons now cover the raw tool-call path too

• A memory, skill, or plugin call now shows its dedicated icon in session activity even when the model reaches it through the generic tool-call bridge (ara_memory_manage, ara_skill_manage, ara_plugin_call, ara_plugin_tools, ara_plugin_list) instead of the shortcut method. Previously only the shortcut form got the specific icon; the raw form fell back to a generic badge.

August 7, 2026: MCP servers and merge guardrails are owner/admin settings

• Installing, editing, connecting, or removing a workspace MCP server now requires the owner or admin role. An MCP server is workspace-wide execution config: it runs inside every agent run in the workspace, including runs other people start. Members still see the installed list and the marketplace, and the controls now say so instead of failing when used.
• Changing a repository’s Merge Bot guardrails — enabling auto-merge and its “CI green”, “Ara verify”, and “no blocking findings” requirements — likewise requires owner or admin. These decide whether agent-authored pull requests can reach your default branch unreviewed.
• Both settings were already owner/admin-only through the public API; the web app now matches. Nothing changes for owners and admins.

August 7, 2026: Sessions are named by the agent, and session actions moved onto the title

• A new session is now named by a short call to the same harness that runs it, so the title describes what you asked for instead of repeating the first line of your message. Naming happens while the environment is still starting, so it never delays the first reply, and an unusable answer falls back to the previous behavior. Renaming a session yourself always wins, and follow-up turns never re-name a session you already named.
• The session header now leads with that title, and the ⋯ menu sits beside it rather than off in the top-right controls.
• That menu gains Send feedback, Copy session ID, Archive, and Delete alongside Rename, and still shows the session’s model usage and runtime. Delete asks for confirmation and cannot be undone.
• Workspaces that paused title generation under Automations are unaffected: their sessions keep the name derived from your message.

August 7, 2026: A second inference route can be staged behind the same spend controls

• Ara’s inference plane can now hold more than one aggregation route per model. A route is staged disabled, enabled per model by an operator, and disabled again to roll back; the enabled route keeps serving in the meantime. Model choice, pricing, and workspace credit behavior are unchanged.
• A request is bound to one route for its whole lifetime, so a route change never affects a generation already in flight.
• Whichever route serves a request, the customer charge is still computed from Ara’s published model price. A route that cannot produce authoritative evidence of what it served holds its exposure and reconciles instead of creating a guessed charge.

August 7, 2026: Replies are plain prose, and quoted or tabular text is never rendered faded

• Ara’s replies no longer use markdown tables or emoji. Content that used to land in a table now reads as plain prose with inline references and hyperlinks instead.
• Text inside a blockquote or a markdown table (for older messages, or content a connected tool returns) no longer renders in a dimmed secondary color — it matches the same text color as the rest of the answer.

August 7, 2026: Reasoning reads at full strength and can show its own headline

• Reasoning text in the live work history no longer renders at a dimmed, secondary text color once expanded — it now matches the full-strength text tool rows already use when opened, and its left indent (which did not align with any icon) is removed.
• When a model’s reasoning arrives as a short headline followed by a detailed paragraph, Ara now shows that headline as the row’s label instead of the generic word “Thinking”. Reasoning that has no distinct headline keeps the previous “Thinking” label.

August 7, 2026: Organization memory adds AGENTS.md and SOUL.md, and session activity shows real icons for memory, skill, and plugin calls

• Organization memory’s always-loaded L1 briefings now include AGENTS.md and SOUL.md alongside USER.md and MEMORY.md for hard operating rules and persona/tone.
• Session chat activity rows for ara.memory.*, ara.skills.*, and ara.plugins.* calls now show a dedicated icon per capability instead of a generic tool glyph: a memory mark for memory calls, the same skill mark used in the / composer menu for skill calls, and the connected plugin’s own favicon for plugin calls (falling back to a generic plug mark for unrecognized plugins).

August 7, 2026: Follow-up messages always get picked up

• Replying to a session whose previous turn had already finished could leave the new message waiting forever, showing a spinner that never resolved. The queue entry those replies create was routed to a retired runtime lane with nothing left to pick it up. That lane is removed, and follow-ups are now claimed by the ordinary session worker like any other work.
• Queue ordering, per-workspace concurrency limits, and change-request serialization are unchanged. Starting a brand new session was never affected.

August 6, 2026: Security hardening for IP allowlists, label triggers, and webhooks

• An organization’s IP allowlist now applies to the web application, not only the public API. Previously a workspace that restricted access to specific IPs was still reachable from any address through the web app; the same allowlist is now enforced on both surfaces.
• Starting an agent run by applying a trigger label to an issue now requires the person who applied the label to have write access to the repository, matching the existing rule for “@ara” mention requests. Someone who can only apply labels (for example a triage role or an outside collaborator) can no longer kick off a run.
• Repeated (replayed) GitHub and Linear webhook deliveries are now detected and ignored, so a captured delivery cannot be replayed to trigger duplicate work.

August 6, 2026: The unified capability plane is the only MCP surface for sessions

• The legacy connector gateway route is retired after a week of zero usage. Sessions reach Ara capabilities and connected plugins through the single unified endpoint, and the temporary migration shim is removed rather than left dormant.
• No connected integration changes; existing connections keep working through the unified plane.

August 6, 2026: Complete skill bundles, not just SKILL.md

• On-demand skill fetches now include the whole bundle: companion references, scripts, and assets beside SKILL.md travel with it, each with its own digest and a bundle-level digest over the set. Bundles with unsafe paths, symlinks, or excess files or bytes are refused rather than served partially.

August 6, 2026: Read-only review runs can call provably read-only plugin tools

• A review run no longer needs write-capable plugin authority for a tool that is provably safe: a call proceeds only when the provider’s own negotiated tool annotations mark it read-only AND the tool is named in Ara’s curated per-plugin allowlist. Anything unannotated, destructive-marked, or unlisted still requires write authority, and every decision is recorded in telemetry.
• Provider annotations alone never grant access: they are untrusted data until Ara’s own policy agrees.

August 6, 2026: Skill adherence is judged, not assumed

• A run that was offered a skill is now evaluated on whether the agent actually read the skill before doing other tool work. Only a dedicated read operation counts — mentioning the path does not. Delivery, read, and behavior are separate evidence: the run log records which skill files reached the sandbox, which bodies were fetched, and a deterministic oracle judges the ordering on the real trajectory.
• This is verification tooling. Session behavior is unchanged.

August 6, 2026: Package-bundled skills are readable on demand

• Plugin skills whose bodies ship inside the sandbox image are no longer read-only names in the catalog: when a skill carries a pinned package source, Ara fetches its full instructions on demand through the capability plane, with the same host allowlist and size guards used at image-build time. The response reports where the body came from and whether it was served from the short-lived read cache.
• A skill with no resolvable source still says so plainly instead of pretending to be readable, and a failed fetch returns a typed error rather than a fabricated body.

August 6, 2026: The agent runtime gains a zero-cost end-to-end proof lane

• Ara’s agent runtime can now be exercised end to end, from run claim through sandbox tool execution to the final transcript, against a deterministic scripted model instead of live inference. Deploys of the runtime are verifiable without spending model credits and without depending on provider availability.
• The runtime’s sandbox tool layer (shell and browser REPL) is now also proven in continuous integration on every commit, using the exact production code paths rather than stand-ins.
• This release adds test and operator tooling only. The proof lane is disabled by default, has no user-facing controls, and does not change how ordinary sessions run.
• Follow-up: the internal session surface now accepts the proof lane’s sentinel model for explicitly allowlisted internal workspaces, so operators can start a proof run at all, and the sentinel survives enqueue-time model resolution instead of silently falling back to the workspace default. The public API and every ordinary workspace continue to reject it.

August 6, 2026: The Ara plugin now speaks the Agent Plugins standard

• Ara’s self-authored plugin now ships a standard root plugin.json and mcp.json in the vendor-neutral Agent Plugins 1.0.0 layout, so any compatible agent client can discover its skill and connect to Ara’s capability plane over Streamable HTTP. Existing supported client installations continue to work through their native manifest.
• A conformance test now validates the package against the published schemas on every change, so the layout cannot silently drift.
• This changes packaging only. No session, connector, or API behavior changes.

August 6, 2026: One skill catalog across personal, workspace, plugin, and built-in skills

• Ara’s skill listing is now a unified, metadata-only catalog spanning your personal skills, workspace skills, plugin-bundled skills, and built-ins. Every entry carries a stable qualified id, its source, a content digest, and its activation keywords, and the full body is fetched on demand by id instead of occupying the prompt.
• Name collisions no longer resolve silently: the catalog reports which entry won and why, and equal-priority ties return explicit choices.
• Skills whose bodies ship inside the sandbox image are now listed with an honest availability state instead of disappearing from view.
• No existing skill management behavior changes; create, update, and delete work exactly as before.

August 6, 2026: A published security contact for reporting vulnerabilities

• Ara now publishes a security contact at ara.so/.well-known/security.txt, the standard location security researchers check. Reports go to security@ara.so, which is a monitored address. Previously the reporting policy lived only in a private repository, so there was no way for someone outside the company to find out how to reach us.

August 6, 2026: Connector plugins gain a repeatable acceptance proof

• The new provider-acceptance contract makes a connected plugin prove discovery, returned-schema use, exactly one provider dispatch, duplicate refusal through invocation identity, and matching run evidence before it graduates beyond the current rollout boundary.
• Context7’s resolver is the reference fixture. Production proof remains a human-visible session transcript plus exact-run observability; the repository script only prints the contract and runs the deterministic test fixture.
• This release adds test and operator tooling only. It does not change production capability gates or connector behavior.

August 6, 2026: Repository secret values are owner/admin only

• Viewing, exporting, editing, or removing a repository’s stored secret values (the reveal, the “.env” export, and Save/delete on the Environment page) now requires the org owner or admin role. Members still see which secrets are configured (their names), just not the values, and can no longer overwrite a value they cannot see.
• Every reveal and export is now recorded in the organization audit log, so a bulk disclosure of repository credentials is always attributable to one person.

August 6, 2026: Messages sent mid-run now steer the working agent

• Sending a chat message while the agent is working now delivers it into the live run: the agent picks it up at its next turn boundary, without abandoning the work in progress. The transcript acknowledges the message as queued and then confirms “Steered into the active turn.” once the agent has seen it. Previously the composer held mid-run messages locally and they only reached the agent as a fresh follow-up run after the current one finished, which is why follow-ups always felt like cold starts.
• Several messages sent in quick succession are delivered together at the same turn boundary instead of one per turn, so a burst of corrections lands as one update.
• Attachments on a mid-run message now reach the agent too. Files are staged into the run’s workspace and the agent is told their exact paths; previously a screenshot pasted mid-run was silently dropped.
• A message that arrives too late to join the current run, or that hits a run being cancelled, is rerouted into a continuation run automatically, and its acknowledgement explains that instead of claiming delivery.
• Holding messages in the composer while the agent works remains available as an opt-in behavior.

August 6, 2026: Reasoning appears before the first tool call

• Provider-generated reasoning summaries now stream inside the session’s live work history as soon as they arrive. Previously Ara kept them behind a plain “Thinking” row until the agent used a tool, which made the same reasoning appear or disappear depending on what the agent did next.
• The live work history stays open while the agent is active and collapses after the turn finishes, alongside its tool calls. Completed reasoning starts collapsed at both the outer work rail and its nested disclosure. Models that do not provide a reasoning summary continue to show the ordinary “Thinking” placeholder until visible work begins.
• Once a reasoning summary is visible, Ara also stops measuring that turn as placeholder-only thinking, including during the brief handoff where the original placeholder can still coexist with streamed reasoning.

August 6, 2026: Session read-file rows use an open-book icon

• When Ara reads a file during a session, the transcript chip and tool row now use an open-book icon instead of a closed book, so read actions read more clearly as looking something up.

August 6, 2026: Workspace switching works everywhere and creating a workspace is one step

• The workspace menu’s flyout no longer disappears under the page on settings screens. It previously opened clipped to a sliver at the sidebar’s edge, leaving the workspace list unusable there; it now pops out over the content on every surface and follows its trigger while the rail scrolls or the window resizes.
• The menu rows are now named for what they do: “Switch workspace” and “Create new workspace”, matching the Workspace naming used everywhere else, instead of the old “Switch account” and “Create new account”.
• Creating a workspace is a single step: pick a name and optionally invite people. The repository-access step is gone; the new workspace’s onboarding offers repository connection right after creation, so nothing is lost by removing the fork.
• The create dialog submits from the keyboard: Cmd+Enter (Ctrl+Enter on Windows and Linux) anywhere in the dialog, or plain Enter from the name field. Enter in the invites box still adds a newline, and confirming text through an input method never creates a workspace.

August 6, 2026: A failed payment is now visible everywhere in the workspace

• When a workspace’s subscription payment fails, every page now shows a banner explaining that cloud agents are paused, with a direct path to update the payment method. Previously the only signals were a message when a run was refused and a single line on the billing settings page, so a workspace could sit paused without anyone understanding why.
• The banner disappears on its own once the updated card’s payment goes through.

August 6, 2026: Inference route failures raise an alert instead of passing quietly

• Ara’s model catalog now exposes only the reviewed current model families; retired provider choices are removed from new tasks and saved preferences.
• The inference database now rejects direct or operator attempts to re-enable a retired model or one of its routes, while retaining historical prices solely for settlement reconciliation.
• A model route whose gateway credential is missing or unusable now pages Ara’s operators. That condition returns an error for every request on the affected model, and until now nothing alerted on it.
• Requests that lose their provider cost report, and grants bound to a route the model registry no longer recognizes, now alert as well, so a settlement gap is caught at the time it happens rather than found later during reconciliation.
• Routes that ship disabled on purpose, ahead of being switched on, no longer register as tripped safety breakers. A real trip stays visible instead of being buried under a permanent alert for an intended state.

August 6, 2026: Legacy inference cleanup preserves workspace credits

• Ara now records every remaining ambiguous request from the retired inference broker in an append-only reconciliation journal before deleting that old authority. Those amounts were internal provider-exposure controls, not workspace-credit charges, so reconciliation never creates a retroactive debit or blanket credit.
• Cleanup runs in small operator-confirmed batches and records only aggregate telemetry. A missing or inconsistent row blocks deletion, while a retry cannot charge or reconcile the same request twice.

August 6, 2026: Curated model catalog

• GLM 4.7 and Qwen3 Coder are no longer offered in the new-task model picker or Models settings. Existing saved selections fall back to the default Ara model instead of attempting a disabled route.
• Ara now admits only reviewed models through its managed inference service. Database guards prevent retired model identities, legacy providers, or unapproved routes from being re-enabled, while historical pricing and settlement records remain available for reconciliation.

August 6, 2026: The Browser tab keeps working after a session finishes

• A session’s sandbox is now held for a short window after the run ends instead of being torn down within seconds of it, so the Browser (Preview), Terminal and Display tabs still work on what the session just produced. Previously the machine was released almost immediately and those tabs went blank the moment the work finished, which is exactly when there is something to look at.
• The hold applies whether the session succeeded or failed. A run that went wrong is often when you most want to open the preview and see what the dev server is doing.
• It is a short window, not a reservation: the sandbox is still released promptly, and sending another message continues the session as before.

August 6, 2026: Queued messages match the composer width

• The bar that stacks above the session composer, used for queued messages and run setup, no longer stretches most of the page. It sits a little narrower than the composer it stacks on, as intended.
• Opening or closing the session summary now slides the transcript to and from its side position instead of jumping.

August 6, 2026: A redirect can no longer downgrade an outbound connection

• Every request Ara makes to a service outside itself — a connected MCP server, an integration, a webhook you configure — now stays encrypted for the whole chain of redirects, not just the address it started from. A server that answers with a redirect to a plain http:// address, or to an address inside Ara’s own network, is refused instead of followed, and credentials are dropped when a redirect crosses to another origin. A chain of more than five redirects is refused as well.
• This changes nothing for a server that redirects within https, which is followed as before, and nothing for the built-in MCP catalog.

August 6, 2026: Session sandboxes are released on schedule

• A sandbox kept for a short while after a session ends, so a follow-up message can pick the workspace back up, is now released on Ara’s own schedule. Previously nothing enforced that window and the only limit was the hosting provider’s 24 hour cap, so those machines stayed reserved far longer than intended. The workspace still remains available for the same period you could already rely on.
• A sandbox left behind by an interrupted session is now cleaned up by the routine sweep instead of waiting for that same 24 hour cap.

August 6, 2026: More permission checks on GitLab triggers and repo start-up scripts

• Starting an agent run from a GitLab issue (issue opened, or a trigger label applied) now requires the actor to have write access to the project, matching the rule already applied to “@ara” mentions and merge-request reviews. A user who can only open issues or apply labels can no longer kick off a run.
• Editing a repository’s session-start or preview script (the repo-level environment blueprint) now requires the org owner or admin role, because those scripts run with the repository’s secrets available. Members can still edit build-time setup that never sees secrets. Each secret-capable edit is recorded in the organization audit log.

August 7, 2026: Further agent and workspace security hardening

• The agent can no longer read or post into another teammate’s session, or create workspace-wide connectors, from inside a run: those actions are now restricted to your own sessions and to a real signed-in owner/admin, so a run driven by untrusted repo or issue content cannot reach a colleague’s work.
• A repository’s environment blueprint can no longer define reserved inference variable names (such as OPENAI_API_KEY), matching the rule already applied to stored secrets, and baked build values are scrubbed from stored build artifacts.
• The public avatar image link now only serves genuine avatar images, not arbitrary files.

August 7, 2026: Defense-in-depth hardening across agent runs and workspace access

• Text an agent writes to a pull request, an issue, a comment, or a commit message now has secret-shaped values and any of the workspace’s own stored secrets stripped out before it is published, so a run driven by untrusted repository or issue content cannot leak your credentials into a public artifact.
• Several internal safeguards were tightened with no change to normal use: session tokens now require a dedicated signing key and are only accepted where they are issued; a shared “open access” workspace grants read-only browsing rather than a write-capable role; the connector gateway enforces each agent’s allowed-plugin list; and a preview feature that is off by default now refuses to turn on without its full access check in place.

August 5, 2026: Live Preview finds your dev server again

• A repository that declares a dev server in its Blueprint (preview: with a command and a port) now has that server started and kept running for the session. Previously the declaration was read when the environment was built but never acted on during a session, so the server was stopped again as soon as the step that started it finished, and the Browser tab usually found nothing to show.
• The port list no longer offers Ara’s own internal connection to the sandbox as though it were your dev server. Only servers you actually started are listed.
• When a session has finished, the Browser tab now explains that the sandbox was released along with the dev server, and that sending a message continues the session and starts a new one. It previously showed an internal error code, and showed it in red as though something had broken.
• The Browser tab no longer invites you to start a dev server in the same breath as telling you the sandbox is gone. It shows one status line rather than two that contradict each other.

August 5, 2026: Custom MCP servers must be reachable at a public address

• Connecting a custom MCP server with OAuth now fails when the server URL, or an OAuth endpoint it advertises, resolves to a private or reserved address such as localhost, a 10.x or 192.168.x host, or a cloud metadata address. A server that is only reachable inside a private network could never have completed a connection anyway; attempting it now stops before any request is sent.
• OAuth discovery no longer follows redirects. A server that answers its .well-known discovery documents with a redirect will fail to connect instead of being followed to another origin. Every server in Ara’s built-in MCP catalog serves those documents directly, so connections made through the catalog are unaffected.

August 5, 2026: Session branch and target read below the composer

• The row showing a session’s working branch and where it runs is no longer part of the composer card. The card ends at the input box and that row sits under it as plain text, so it reads as information about the session rather than a control inside the input.

August 5, 2026: Groundwork for connector tools in cloud sessions

• Connector tools are not yet available in cloud sessions. This entry describes preparatory work only, and the behavior below is switched off by default.
• When it is switched on, Ara will reach a connected MCP server from its own backend rather than from inside the sandbox running your code. A connector’s access token is applied server-side and is never written into that machine, so a session can use a connector without ever holding its credential.
• Connectors that run as a local process, such as the Postgres and Supabase servers, will keep running inside the session sandbox, where they stay isolated to your own workspace.
• Requests to a connected server are refused if its address resolves to a private or internal network, including cloud metadata addresses.

August 5, 2026: Long sessions compact their context instead of failing

• A session whose conversation grows past the model’s context window now summarizes its older history automatically and keeps working. The transcript shows “Compacted earlier context to stay within the model’s window” when this happens. Previously the next model request failed outright once the window filled.
• The full conversation history is still kept for the transcript and for crash recovery; only what is sent to the model is condensed, and the summary work is billed and metered like any other model request.
• Typing /compact in the chat while a session is running now compacts that session’s context on its next model step, instead of returning “capability unavailable”. A finished session still declines: it compacts automatically on its next turn if needed.

August 5, 2026: Uploads report their real staging outcome

• Once file staging finishes, the agent is now told exactly which uploaded files landed in its workspace, including any that could not be transferred (for example, files too large to stage). It stops waiting for a file that will never arrive and tells you it could not open the upload instead of guessing at its contents.

August 5, 2026: Card verification when a free trial starts

• Starting a free trial now places a temporary $1 authorization hold on the card, released immediately and never charged. A card the bank declines for that hold, or a prepaid card, can no longer start a trial: the subscription is cancelled at signup and the workspace returns to the Free plan, instead of the first invoice failing a week later. Cards that require additional authentication (3D Secure) are not affected by this check.
• A card that already redeemed a free trial under a different account now ends the new trial at the end of its period instead of only being flagged internally.

August 5, 2026 — Safer, more reliable sessions

• Ara now uses one managed execution path with task-scoped access and workspace credit settlement. Provider credentials remain server-side and are never exposed to a session environment, transcript, artifact, browser, or command line.
• Session recovery, cleanup, and historical archiving now use fail-closed ownership checks. Active work and unresolved billing are preserved instead of being retired; completed history remains available.
• Operator maintenance reports expose only aggregate safety and billing counts, never session contents, identifiers, or secret values.

August 5, 2026: Sessions run to completion instead of stopping after a minute

• Sessions started from Slack, GitHub events, and pull request reviews now hold their run authority for as long as the work takes. Previously a session of roughly 45 seconds or longer could stop mid-task with an authorization error, because only some of the ways a session can start kept renewing the permission that lets it reach the model.
• Recovery startup now rejects an incomplete process-lease handoff instead of silently replacing it, so deploy-skewed workers cannot bypass the same ownership checks.
• Every runner-owned lease heartbeat now emits its start marker, so production telemetry shows which worker is actively renewing a session before any lease loss or renewal failure. A telemetry sink failure cannot interrupt the session or its lease cleanup.
• A session whose worker hands it off during a deploy is now recorded as a planned handoff rather than an unexplained loss, so routine deploys are distinguishable from genuine lease failures.
• When a session is recovered after its worker is replaced, a model request that failed with a transient provider error is now retried instead of ending the session. Cancelling a session still stops it immediately.

August 5, 2026 — Steadier session starts when many sessions recover at once

• When a batch of sessions recovers together, for example after a deploy or an unexpected restart, Ara now paces how many sandboxes it asks the provider to create at the same time instead of requesting all of them in one burst. Sessions that wait their turn start a moment later rather than failing outright.
• Provisioning retries now use a randomized delay, so a group of sessions recovering in lockstep no longer retries in lockstep and collides again on the same schedule.

August 5, 2026 — One workspace credit limit

• Long tool-using sessions now renew their run-bound process lease from every production launch path, preventing a healthy session from being reclaimed and invalidating its own short-lived access grant.
• Model use now reserves directly from the workspace’s shared credit balance. The temporary per-request, per-run, per-user/day, per-workspace/day, and global/day dollar caps are retired.
• Legacy per-group dollars/day settings are ignored and no longer returned by the Team page. Groups may still carry non-monetary daily run limits.
• Small remaining balances stay usable: Ara lowers the maximum output to the amount the workspace can afford, while exact token usage settles and releases the unused hold.
• Sandbox runtime leases each billable minute from that same balance before it starts, preventing simultaneous model and sandbox work from overspending workspace credits.
• System-credential fallback now trips the credential breaker, raw provider errors are sanitized, and service-owned inference secret names cannot be created, listed, exported, or injected into a sandbox.
• Token and cost settlements now appear in workspace model-usage history as soon as they debit the same shared credit balance.
• The retired inference broker’s database authority now fails closed before archival: it can be sealed only when no live grant, open request, or dollar hold remains, and the operation never adjusts workspace credits.

August 4, 2026 — Managed model execution

• Ara sessions use a task-scoped managed inference service. The API holds service credentials; sandboxes receive only a short-lived grant restricted to one session and model, and usage settles against the workspace credit balance.
• Usage settlement records the provider, model, credential type, input, cache, reasoning, output tokens, and cost. Provider or accounting failures remain visible and never use an unapproved fallback.
• Repository wiki generation is temporarily unavailable while that background job moves onto normal queued sessions.

August 4, 2026 — Office address in the marketing footer

• The marketing footer now lists Ara’s office address, Gaustadalléen 21, 0349 Oslo, Norway, alongside the copyright line. It reads the same in every language, as postal addresses should.

August 3, 2026 — Cancelling a past-due subscription stops collection immediately

• Cancelling a subscription whose renewal payment has failed now voids the outstanding invoice and ends the plan right away, so automatic payment retries can no longer charge your card after you cancel.

August 3, 2026 — Clear usage budget messaging

• A run that stops because an Ara AI usage budget is used up now says so: the chat shows a dedicated “AI usage budget reached” card explaining that one retry is worth attempting and that a repeat failure means the daily budget, which resets at midnight UTC, instead of a raw “429 Too Many Requests” error.
• The Founding Engineer listing no longer states a San Francisco, in-person location or a monthly rate, on both the Careers index and the role page.
• Hovering the “N files changed” segment of the composer plan pill now opens a card listing each changed file with its own additions and deletions. Clicking the segment still opens Review.

August 3, 2026 — Automatic environment optimization is one feature

• The per-repo “Automatically optimize the environment” setting (Codebases page, Environment section) is now the single gate for every automatic environment process. It stays off by default; nothing runs on a repository until its owner opts in.
• For opted-in repositories, Ara now also sweeps daily: a repository with recent sessions whose environment is unanalyzed, or whose Session Start Script keeps failing, gets one automatic setup session, bounded by a 24-hour per-repo cooldown and a per-workspace daily cap.
• The automatic repair that fires after three consecutive Session Start Script failures now counts against the same per-workspace daily cap as the sweep, so every automatic environment session draws from one budget. Automatic environment sessions remain visible in the session list like any other session.

August 2, 2026 — Safer cloud execution rollout

• A staged rollout verified the normal workspace, authentication, session list, composer, and chat surfaces under the updated execution service before promotion.
• Model requests start while the sandbox, repository, uploads, and browser tools are prepared. Tool calls wait for verified sandbox readiness before they can execute.
• The rollout gates fail closed on authentication, ordering, reconnection, cleanup, and ownership failures. A failed gate retains the previous serving version instead of silently bypassing safety controls.
• Recovery preserves the existing session history and replays only safe pending work. It retries bounded transient infrastructure failures, respects cancellation, and never creates a duplicate execution target.

August 2, 2026 — Faster composer actions

• Ara web and docs now use Helvetica Now Display throughout, with Geist Mono for code and file references and medium-weight links and mentions in chat.
• The composer + menu now opens searchable Skills, Plugins, and Shortcuts sidecars in both full and compact session composers. Each shows up to five results, with connected plugins first, while Attach file keeps the existing multi-file picker behavior.
• Device references in the composer now use the same blue treatment as skill references, showing a device icon and name instead of the raw quoted @ token. Device, plugin, and skill labels all render at medium weight.
• The model sidecar now hugs short lists instead of leaving empty space below the available models.
• Models & credentials now lists the three included Ara models and keeps availability guidance as a single note below the roster.
• Error notifications now inherit the active light or dark theme and keep their dismiss control in the top-right corner.
• Pending repository setup is now highlighted in orange, and its copy-prompt dialog explains cloud setup more directly.
• Session turn rails are slimmer at rest while keeping their full hover expansion.
• New Ara runs can initialize connected GitHub repositories with no commits, then continue through the normal branch and pull-request flow.
• The project picker now offers Empty project for an explicit repo-less scratch workspace instead of sending New project clicks to GitHub.
• Retrying a completed or failed task now preserves its original instructions, and tasks can continue after a local tool returns a structurally bounded static PNG without weakening the block on provider-hosted media or remote fetches.
• Immediate follow-ups keep the same visible session context when it is safe, so chat stays on Thinking instead of returning to Preparing environment. Ara deliberately starts a fresh workspace when it cannot prove the active run lease or cleanup.
• The composer now states its run context in two places. Above a new task, one row holds the repository, the branch it will start from, and the location — Cloud, or Cloud plus one of your connected devices — and each control drops its icon once it holds a value. Plugins moved into the + menu. Beneath the input in a session, a separate row names the session’s own work branch (click to copy it), whether it is computing in the cloud or on your device, and how much of the model’s context is spent, with the token and cost detail on hover.
• The location control keeps naming the device an unsent draft targets even after that device becomes unreachable or the page reloads, and the location menu shows the attached device as the current selection rather than implying the task will run in the cloud.
• A session can now continue somewhere else. The location chip in the session status row opens Continue on, offering a fresh Ara Cloud sandbox or a folder on one of your connected devices. Ara starts a linked session at the destination from the session’s branch and stops the original, so only committed work travels. Choosing a device checks the branch out into the folder you picked, reusing an existing checkout instead of cloning again. Devices that are offline or running an older Ara release stay listed but unselectable, with the reason shown and a link to Settings → Devices.

August 1, 2026 — Workspace picker in the sidebar

• The sidebar top-left now holds a workspace picker instead of the Ara wordmark. Its menu shows the current organization and member count, opens Settings or Invite members in one click, and lists your other workspaces under “Switch account” alongside Create new account and Log out.
• Sidebar highlights are lighter: the picker matches the height of a navigation item, and session rows keep a gap so a hovered row no longer merges into the one next to it.
• Dialog footer buttons are now pills and stay legible on the dark theme.

July 31, 2026 — Cleaner workspace navigation

• Updated GPT-5.6 Luna and Terra usage metering to their latest lower provider rates, so the same Ara credit balance now covers more model usage.
• “Add repositories” in the composer project menu now opens the Ara GitHub App’s repository-access settings instead of the read-only Codebase list, and Codebase carries the same action in its heading.
• Selected Automation, Codebase, and Customize options now use a compact pill, while inactive options stay as muted text.
• Notifications now match session turn previews, stay centered at the top on phones, and the turn rail sits clear of the workspace sidebar.
• Component previews now stay pinned to one production deployment during releases, avoiding mixed frontend bundles.

July 7, 2026 — Cloud coding agent

• Added the cloud coding agent flow for managing repository work from the web.
• Added scoped sessions from connected repositories.
• Added live progress in the workspace.
• Added pull request and diff review without leaving Ara.

August 6, 2026 — Workspace-scoped harness profiles

• Internal runtime experiments can now be selected by an operator-managed workspace profile instead of a separate hostname.
• Ara persists the profile version and digest on each run so retries and continuations remain reproducible.