Runlayer Release Notes

Improvements

• Gateway API: Publish a Runlayer instance with Kubernetes Gateway API, keep using Ingress, or run both. See Runlayer operator.
• Your own agent IDs on Claude Code sessions: Claude Code sessions sent over OpenTelemetry now keep sidekick.* attributes, such as sidekick.agent_id and sidekick.session_key set through OTEL_RESOURCE_ATTRIBUTES. They show as External metadata on the session, so you can tie a session back to your own agent. See Claude Code OTLP monitoring.
• Sessions: see which agent ran a session: Runlayer agent runs in Sessions now show the agent's avatar and name instead of a generic Runlayer label, and the session panel links straight to the agent. See Sessions.
• Rename artifacts from the viewer: Editors can double-click an artifact's title, or edit it while Edit text is open, to rename it. Renaming doesn't create a new version, and a blank title falls back to the file name. Agent updates that don't set a title now keep a title someone chose instead of resetting it to the file name.
• Teams: Admins can now open any team from the Teams page and see its members and shared assets without joining it. The page is read-only until they join.
• Agent chat on redacted runs: Opening a teammate's agent run in chat now says why its messages are hidden instead of showing a wall of REDACTED. People who can view unredacted content can reveal the messages right there, as they already could in the run timeline; each reveal is recorded in the audit log.
• Agent spend caps via Runlayer MCP: The Runlayer Assistant and MCP clients can now read an agent's spend and run limits, including current usage and reset times, and set or remove daily and weekly spend caps. Only agent managers can change limits.
• Redesigned Security Scanners settings: Settings → Security Scanners now opens with tabs for Scanners, Security Response, Scan budgets and Overrides, a scanner list grouped by category with a detail pane for each scanner, and one page per connector or client override so you can see every rule that applies to a caller in one place. See ToolGuard Models.

Security & governance

• Suggestion policies: Admins can steer agents toward the tools your organization prefers without blocking them. For example, an agent that deploys through Vercel can be told to publish with Runlayer's create_app next time. A suggestion policy lets the tool call run unchanged and adds your message to its result, once per session or on every call.

Fixes

• Agent chat: a chat tab left open across a Runlayer update keeps rendering code blocks normally. Code blocks no longer depend on a file that loads on demand, so an update can't strip their formatting.
• Uploaded icons: Agent, connector and organization icons you uploaded no longer flash to a loading placeholder when you switch back to the Runlayer tab.
• Runlayer CLI on macOS: The CLI deployment profile now allows the skill-sync scheduler and the hourly updater, so macOS no longer blocks them after install. If you already deployed com.runlayer.cli.mobileconfig, download it again from Settings → MDM configuration and re-deploy it. See Deploy the CLI on macOS.
• AI Watch browser extension on macOS: After a restart or an MDM profile update, AI Watch now restores the browser extension's tenant settings within a minute, so the extension no longer falls back to asking for setup for up to 15 minutes. See Browser extension.
• AI Watch browser extension in Google Admin: The Chrome setup steps now tell you to set the extension's Update URL to Installation URL. With Google Admin's default, Chrome takes updates from a global Runlayer URL and ignores your Client Updates version. If you deployed the extension from Google Admin, change this setting. See Browser extension.
• AI Watch browser extension: The extension now keeps its tenant settings for up to 30 minutes when the managed browser policy briefly disappears, such as after a macOS restart or an MDM profile update, instead of falling back to asking for setup. The popup shows when it is using the last copy. See Browser extension.

{/* build: 1.28.2282 */}

Improvements

Kubernetes operator checks topic-cpu memory against the current model set: The Runlayer operator now requires at least 4096 MiB of memory per slow-pool worker on components.topicCpu (previously 2048 MiB), matching the ECS module, so a RunlayerInstance cannot pass validation and then run out of memory once the ToolGuard CPU image loads the session-topic model. The default shape (1 worker, 8192Mi) and 2 workers are unaffected. An instance that set topicCpu.gunicornWorkers to 3 or more without a matching resources memory override fails validation after the operator upgrade, and a failed instance is not reconciled at all (no backend, worker or frontend updates, including version bumps) until the memory is raised or the worker count lowered; check those instances before upgrading. See Runlayer operator.

Edit artifacts directly: edit doc, CSV/TSV and HTML artifacts in place from the artifact page, without asking an agent. Untouched content is kept exactly as it was, and an agent's search-and-replace edit (edit_artifact) that would overwrite your newer save is refused.

Procedures: Runlayer now benchmarks a procedure draft on its own by replaying the agent runs it was built from, so the draft is ready to approve (or goes live, if your org skips approval) without anyone running the benchmark by hand. The review panel shows whether the benchmark is queued, running or failed, and why.

Tunnel connector health checks: Kubernetes deployments can use optional liveness and readiness probes to distinguish a responsive connector from one with an established tunnel session.

Tunnel connector metrics: Monitor connector readiness, endpoint connectivity and connection failures through an optional Prometheus-compatible metrics endpoint.

Tunnel connector logs: Enable optional JSON logs with timestamp, severity and message fields for your log collector. Text remains the default and now uses key=value fields.

Model per schedule or trigger: A scheduled task or trigger can run on its own model instead of the agent's, for example a cheaper model for an hourly check and a stronger one for a weekly report. Pick it in the task or trigger dialog; it lists the models the agent's AI provider serves. See Agents.

API keys: The Organization API keys page now links to Personal API keys, so you can find a key tied to your own account without hunting through Settings.

Security & governance

Regex length limits: Custom PII rule patterns can now be at most 1,000 characters, and a policy regex condition can be at most 500 characters when you edit a policy, the same as when you create one. Existing longer patterns keep working and stay editable.

Policies on Runlayer-managed agents: Only an admin who manages security policies can now grant or restrict access to Runlayer-managed agents such as the Runlayer Assistant. The agent's owner can no longer give anyone edit or View all runs access to it, which would show every employee's Assistant runs. See Policies.

Fixes

OAuth connect: Connecting a server no longer fails when the identity provider returns token expiry as an absolute timestamp instead of a lifetime in seconds.

Agent names: Detections and Agent accounts now show an agent by the same name as the Agents page (Adrian Bot, not agent-Adrian Bot).

AI Watch on macOS: The macOS deployment profile now allows AI Watch's background items, so macOS no longer blocks its scan agents or keeps the setup service from starting at boot. If you already deployed the profile, download it again from Settings → MDM configuration and re-deploy it, or change the Login Items rule in your own profile to the Runlayer team ID. See Troubleshooting.

Usage overview: the ROI estimate on Usage → Overview now prices every session topic at the benchmark for the kind of work it describes. Topics that previously fell back to the default one-hour rate (for example debugging, deployments and document updates) are priced by their own bucket, and greetings, automated health checks and unclear sessions count as no saved work instead of an hour each.

ChatGPT capture when signed out: AI Watch in the browser extension now records ChatGPT conversations when the user isn't logged in to ChatGPT.

Gemini prompt capture: The AI Watch browser extension now records each Gemini prompt once, instead of repeating its text twice in the session.

Microsoft Copilot in the browser extension: AI Watch captures Copilot chats again now that copilot.microsoft.com redirects to copilot.com.

AI Watch on v0: AI Watch now records v0's full reply in browser sessions, not just its first word.

Agent runs on some models: When a model such as Kimi K3 ends its turn without an answer, the agent now asks it to continue once, and the run fails with a clear error if it comes back empty again, instead of showing Succeeded with no reply.

Sessions: separate records for Cursor tool calls: when Cursor reuses one tool call ID for different calls, each call now gets its own scan record, so one call's findings and block label no longer show up on the others. Applies to calls recorded from this release on.

Agent schedules and connector triggers: A user an org policy denies from using agents no longer has scheduled runs or connector-event trigger runs fire on their behalf.

{/* build: 1.28.2250 */}

Breaking changes

• Agent run traces: get_agent_run_trace no longer returns a total count with a run's raw events. Page with the new events_after_seq input instead: pass each page's next_after_seq back until has_more is false.
• Agent runs API: While a run is still running, the run list and timeline (GET /agents/{agent_id}/runs and GET /agents/{agent_id}/runs/timeline) return its event_count as null, and its token counts and total_cost_usd as null until its usage is recorded. Treat null as not known yet: the event count is filled in after the run ends.

Improvements

• Policies: Conditions can now read fields inside object arguments with payload.<arg>.<field>, for example payload.folder.id, so a Deny rule can keep an agent's writes inside one folder.
• Agent runs: The run list no longer reads a running run's events to count them, and get_agent_run_trace reads one page of events at any events_after_seq instead of every event before it.
• Manage agent GitHub access from Runlayer MCP: Workspace admins can read, grant and revoke an agent's GitHub access from any AI client with get_agent_github_access, grant_agent_github_access and revoke_agent_github_access. See GitHub access for agents.
• Agent connector cards: when you own a connector, one click on Connect account signs you in and adds its tools to the agent. You no longer approve a second card.
• Agents: Deleting an agent can't be undone, so the delete confirmation now suggests turning the agent off instead when you want to keep it for later. A turned-off agent keeps its setup, schedules and history, stops running, and can be turned back on anytime.
• Secret stores, agent webhooks and agent notification routes in Terraform: The next Terraform provider release adds runlayer_secret_store, runlayer_agent_webhook and runlayer_agent_notification_route, so you can manage external secret stores, an agent's inbound webhooks and where its failures are posted as code. Secret stores and agent notification routes need those features turned on for your organization. See Terraform Provider.
• Agents: People without the Manage agents permission now see the agent's Limits button greyed out on the Monitor tab, with a note that changing limits needs that permission, instead of no button at all.
• Runlayer Plugin: Claude, Claude Code, Cowork, Cursor, VS Code, ChatGPT and Codex now see connector tools directly by default, instead of searching for them through search_tools and execute_tool. Send X-Runlayer-Tool-Exposure: force-initial to keep a client on search. Self-hosted operators can turn this off with FF_DISABLE=plugins-flat-mode (deployments still on WorkOS feature flags turn it on with FF_ENABLE=plugins-flat-mode). See How connector tools are presented.
• Artifact design: HTML reports and dashboards that agents build read more clearly: figures line up in columns, numbers and their units stay together, status badges fit their label, and small accent labels and negative deltas now use text colors that meet WCAG AA contrast.
• Runlayer MCP whoami: The response now includes the actor making the call, so an agent acting on a user's behalf can see both its own identity and the user's.
• Spend map: The Analytics Spend tab now shows a treemap of spend by department, agent, model or user. Click a tile to drill in, and the last level opens that entity's spend details.
• Session SIEM export event types: The session SIEM export docs now list every event_category and event_type value, with meanings and example events. See Event types.
• Agent Monitor: The Tokens tile now shows cache reads and cache writes separately, so you can see what an agent's cost went to.

Security & governance

• Hint action for scanners: Set a scanner to Hint to let a flagged tool call go through while warning the agent that the output may be unsafe. Runlayer puts a warning in front of the tool output telling the agent to treat it as untrusted, then logs and notifies admins like Alert. Cursor, Codex, and Gemini CLI can't replace tool output, so they get the warning as extra context beside it (update the Runlayer CLI; older versions follow the Hint fallback instead). MCP results also carry it in _meta["com.runlayer/hint"]. You can rewrite the warning under Edit security messaging. See Violation Actions.
• Choose Block or Alert where Mask or Hint can't apply: Some clients can't apply a Mask or Hint to tool output, such as Anthropic Inference hooks, Goose, and the TypeScript SDK. Two new settings under Security Scanners → Settings → Clients that can't apply Mask or Hint decide what happens there. Block, the default, withholds the output. Alert lets the original output through and records an alert. The tool call's audit record shows which one happened.
• TypeScript SDK blocks output it can't mask: afterTool and runTool in @runlayer/hooks-sdk now throw RunlayerBlockedError when a Mask or Hint scanner would rewrite the tool output and the fallback is Block, because the SDK can't apply the rewrite. Before, the original, unmasked output went through.
• Customer web gateways: Agent internet traffic can now pass through your HTTPS web gateway, applying its filtering and logging alongside Runlayer's network policy.

Fixes

• Past conversations: Switching agents resets the conversation filter so the next agent's history remains visible.
• Agent creation policies: a policy that denies creating agents now blocks only creating them. People it names can still open, run and chat with the agents they have access to. To block agent use as well, deny use_agents.
• Connector cards: Agents can no longer ask you to approve connector tools that don't exist. A card now only offers tools the connector really has, and an agent whose approved tools were renamed or never existed says so and proposes the right ones, instead of asking you to refresh.
• Agent sidebar tab: Resuming a run from Chat no longer switches the sidebar back to the Agent tab, so you stay on Monitor or whichever tab you had open.
• AI Watch Detect on Linux: Running AI processes now appear once, under the account that runs them, instead of once for every account on the machine (including system accounts like root and daemon).
• Procedures: Procedure tools with nullable inputs now show the right input type to the agent and reject a missing required nullable argument up front, instead of failing later with "missing required argument".
• Agent thinking effort: Agents set to "Extra high" or "Max" thinking effort now use that level on the Pi harness instead of falling back to medium.
• Slack search triggers: A message whose text contains a line such as Permalink: ... no longer overwrites the real message's details, so new matching messages are detected and dispatched reliably.
• Agent timeline: With Slack skips shown, a redelivered Slack message no longer appears as a skip next to the run it already started, so the count no longer double-counts it.
• Microsoft Teams: Code blocks render correctly when messages include inline backticks or nested code fences.
• Poll trigger account picker: A connector renamed to another connector's name no longer shows up in that connector's account picker; triggers bind to the server created from the right catalog entry.
• Agent follow-up runs: Fixed follow-up messages and scheduled wake-ups failing to start when the conversation's idle session was shutting down.
• Single approval when an agent adds a subagent: When an agent proposes adding a subagent to itself, you now approve it once, in Runlayer's approval prompt for that exact subagent, instead of being asked in the conversation first and then again.
• Top Tasks counts: An agent conversation now counts once in Top Tasks, however many follow-up messages it has, and agent runs that stopped before doing any work (for example, refused by a daily run limit) are no longer counted. This applies to past tasks too, once a background update finishes after the upgrade. Task counts for agents can drop, and ROI and per-task averages shift with them; spend is unchanged.
• Claude Desktop and LLM routing: AI Watch no longer switches Claude Desktop users who are signed in to Claude.ai into gateway mode. Gateway mode doesn't show their Claude.ai chats and connectors, so the switch looked like lost data. Users AI Watch already switched return to Claude.ai sign-in at Desktop's next launch, with nothing lost. AI Watch still adds a Runlayer gateway option that users can pick in Claude Desktop. To move users to the gateway, deploy the documented Claude Desktop MDM profile.
• Codex config on Windows: runlayer setup sync no longer corrupts ~/.codex/config.toml with doubled carriage returns on its second run, which stopped the ChatGPT desktop app from starting and made later syncs fail. The next sync repairs affected files, and configs saved with a UTF-8 BOM now sync.
• Agent cards stay clickable while the agent works: You can answer a card in the agent playground (approve a connector, pick an option) while the agent is still replying. Your choice saves right away and the agent picks it up as soon as its current reply finishes.
• Agents: Agents no longer schedule an empty follow-up after a plain answer and then tell you to ignore it. A follow-up now needs a note saying what to check, and agents are told to cancel one they don't need.
• Agents: Connecting an OAuth connector from chat works again. After you approve "Connect account" and sign in, the agent can see the connector's tools and propose them, instead of getting stuck on "auth required".
• Chrome extension updates on macOS: Chrome on Macs managed by AI Watch can now take Runlayer extension updates from your organization's update URL instead of staying on an older version. Turn on Chrome updates from your update URL in Settings → AI Watch → Manage settings → Browser extension (off by default). AI Watch then also sets Chrome's ExtensionSettings policy on each Mac, which hides any ExtensionSettings you set in Google Admin or a per-user MDM profile, such as extension blocklists: if you set it there, leave the option off and use Chrome extension installed by your policy instead (in Google Admin, also set Runlayer's Update URL to Installation URL). See Browser extension.
• Agents can attach files in the Slack thread they were asked in, with outbound messaging off: The Direct messages to people and Channel posts switches no longer block an agent's say reply, files included, in the conversation that started its run. They still block every other DM and channel post, and blocked or unapproved channels stay off-limits.
• Microsoft Teams: a deleted agent no longer stays in Settings → Microsoft Teams → Connected Agent Apps, where its Manage link led to "Agent not found".
• Microsoft Teams: deleting an agent now also removes its Teams bot, instead of leaving it registered after the agent is gone.
• ChatGPT web sessions: Replies captured by the browser extension on chatgpt.com are stored in full again. Sessions had been keeping only the first few words of each reply.
• ChatGPT web sessions: A new ChatGPT conversation now stays one active session from its first prompt, instead of ending right after it starts and leaving a session stuck as active.
• Chrome extension on Google Admin-managed Macs: on Macs where Chrome is enrolled in Google Admin (Chrome Browser Cloud Management) at the machine level, AI Watch now leaves Chrome's extension policy to Google Admin instead of overriding it, so your Google Admin extension settings no longer get replaced on those Macs. Before updating, force-install Runlayer from Google Admin, or Chrome removes the extension from those Macs; the device health check then shows Chrome as managed by Google Admin. If you enroll Chrome with user-level profiles only, AI Watch keeps its force-install; turn on Chrome extension installed by your policy instead. See Install the Chrome extension from your own policy.
• ChatGPT web sessions: A new ChatGPT conversation now keeps its conversation link when the session ends, instead of reverting to the ChatGPT home page.
• Slack assistant pane: replies sent with say in the assistant pane no longer appear twice. The say tool's default destination now points at the run's conversation channel (the pane DM) instead of the viewed channel.

{/* build: 1.28.2200 */}

Improvements

• New icon set: The app now uses one consistent icon style throughout, with clearer icons for Shadow AI and Policies.
• Session search: On Runlayer-hosted deployments, search your organization's agent sessions from the Sessions page, and let agents search them through the Runlayer MCP tools. Results cover sessions from October 29, 2026 onward; earlier sessions aren't searchable. Self-hosted deployments: search needs the session search indexer running in write mode; until you enable it, set SESSIONS_SEARCH_API_ENABLED=false on the backend so users don't see an empty search. See Sessions.
• Agent configuration policies: Settings are now grouped under Memory, Capabilities, Network and Slack, and the Slack channel setting is renamed Slack outside approved channels to say what it controls: whether an agent may answer in channels not on its approved list.
• Microsoft 365 file reads: onedrive_read_file and sharepoint_read_file can now return a file's exact bytes (format: "raw") and read files up to 50 MB (allow_large_file). Redeploy the connectors to pick this up. See Microsoft 365.

Security & governance

• Migrated connector deployments: Only admins with server management permissions can now edit, redeploy or delete the deployment behind a migrated stdio connector. Developers and organization API keys get a permission error, as they already did on the connector before migration.

Fixes

• AI Watch hooks for VS Code and Copilot CLI: The Runlayer hook no longer runs twice per tool call when both VS Code and GitHub Copilot CLI are set up on one machine. VS Code's hook file now lives in its own directory, and the old copy is cleaned up on the next sync.
• Agent accounts: An agent acting on behalf of a user could list a connector's tools, resources and prompts through the Runlayer MCP tools without holding a session grant for that connector, using the user's own connection. Those listings now require the same session grant as a tool call, and report the agent's own policy status.
• Procedures: Agents no longer fail every code and procedure tool call when one procedure's namespace contains a dot and another procedure's name matches its first part.
• Procedures: Saving a procedure that reads inputs through rest destructuring (const { a, ...rest } = input) no longer fails validation with "declared parameter is never read".
• Procedures: Procedures that use structuredClone now pass validation instead of failing with "Cannot find name 'structuredClone'".
• MCP Apps in local connectors: Interactive MCP App widgets now render for connectors run with runlayer run. Before, those tools showed text only.
• Artifact formatting: Bold and italic text in a document artifact's table now stays at the table's size, italics show as italic, and underlines text.
• Fewer email false positives: PII detection no longer flags SSH git remotes such as [email protected]:org/repo.git, placeholder addresses on reserved example domains such as example.com, or the co-author addresses coding agents add to commits ([email protected], [email protected], GitHub Copilot). See PII Detection.
• Fewer auth token false positives: Credential detection no longer flags placeholder token values from docs and sample payloads, such as "token": "token-value" or auth_token=your_auth_token_here.
• Agent run limits in settings search: searching settings or the command palette for "agent limit" or "run limit" now finds the workspace's Agent Run Limits card and jumps to it, and the card says where to change one agent's limits. See Usage limits.

{/* build: 1.28.2125 */}

Improvements

Agent DNS filtering: Self-hosted deployments that resolve agent destinations through their own DNS filter can list the filter's block answers. The proxy then refuses a blocked name immediately and reports in its response and audit logs that your organization's DNS filter blocked it. Deployments without a DNS filter are unchanged. See Sandbox egress proxy inputs.

Claude Desktop through the LLM Gateway: With LLM routing on, AI Watch now also routes eligible users' Claude Desktop through your LLM Gateway, with short-lived per-device tokens, budgets, and Sessions like Claude Code and Codex. To stop users from switching back to Claude.ai sign-in, deploy the documented Claude Desktop MDM profile.

Spend breakdowns via the Runlayer MCP: Agents and MCP clients can now read the same Spend tab numbers you see on the Usage page: spend per provider and model (get_spend_cost_breakdown), the All users list (get_spend_people_usage), and spend by department (get_spend_department_usage). Each needs View company metrics. See Runlayer MCP.

Runlayer Plugin: In nested mode, search_tools results now include the connector's tool hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) as annotations, so an agent can pick read-only tools without listing every connector first.

Security & governance

Agent run session shares: A share on an agent run's session stops granting access while the user who made it is deactivated, and works again if they are reactivated.

Fixes

Session sharing for agent runs: The person who started an agent run can now share its session, including runs that execute as an agent account. Before, sharing those sessions failed with "not found".

ROI cost for custom date ranges: ROI no longer counts an extra day of spend when a custom range ends on a past day, so ROI cost now matches Spend for the same range.

Spend for Claude Sonnet 5.5: Cache reads on Claude Sonnet 5.5 now cost $0.10 per million tokens, matching Anthropic's October price cut. Spend had been showing them at twice that.

Runlayer Plugin memory growth: Self-hosted backends no longer grow steadily in memory and restart workers under Runlayer Plugin MCP traffic.

Strict MCP servers: Tool calls through Runlayer no longer fail with HTTP 400 on MCP servers that check request headers against the request body, such as UserVoice.

Audit Logs: Session stop and stop cleared rows now show the stopped session's AI client in the Client column instead of N/A, and stop applied rows show the client of the denied call.

Agent tool images: Agents using OpenAI can continue after a tool returns an image with line-wrapped, URL-safe, unpadded or data URL-prefixed base64.

Agent wake-ups: When an agent re-schedules a follow-up (a reminder, a check-in) from a later message in the same conversation, it now replaces the one it scheduled earlier instead of adding a second, so the follow-up arrives once.

{/* build: 1.28.2098 */}

Improvements

Share skills over the Runlayer MCP: the new update_skill_shares tool shares a skill with teams or people, changes their permission, or removes their access, under the same rules as the skill's Share dialog, and list_skill_shares shows who has access today. Grants show in the dialog and in list_skills share counts. As in the dialog, sharing an organization-wide skill makes it private to its owner and the people and teams you name.

Metric definitions: every number card on Control and Usage now has an ⓘ that says what it counts, and the trend arrow says what it compares to (for example "vs previous 7 days"). "Tasks completed" on Control is now "Actions", and "Tasks" on Usage is now "Agent runs".

Fixes

Spend for Cursor effort and thinking levels: Cursor usage on models with an effort or thinking level in the name (for example Claude Opus 5.5 at high effort, or Claude Fable 5.1 with thinking) now shows an estimated cost at the base model's rate instead of Not priced. Fast variants stay separate.

New connectors

AWS: Connect the remote AWS MCP Server from the catalog and sign in with your AWS account through Runlayer's OAuth broker.

{/* build: 1.28.2048 */}

Improvements

• Shadow AI inventory for VS Code: Detect now finds MCP servers in every VS Code profile and edition (Insiders, Exploration, VSCodium, portable, and remote-server installs), the servers VS Code forwards to its agent host, including ones contributed by extensions, and user-installed agent plugins. See Detect.
• Shadow AI inventory for GitHub Copilot CLI: Detect now reads Agent Plugins mcp.json, MCP servers declared in custom-agent frontmatter, and the bundled Computer Use and Browser Use plugins. Plugins switched off in Copilot's config, bundled or installed, show as disabled instead of as live servers. See Detect.
• AI Watch Enforce for GitHub Copilot CLI: The hook now resolves MCP servers the way the Copilot runtime loads them, including Agent Plugins, MCP servers declared by custom agents, plugin-root placeholders, and VS Code workspace and home variables in forwarded VS Code configs, so those calls get a policy decision instead of being blocked as unregistered. Process environment variables in server URLs are expanded only when the hook runs inline; on daemon-served devices they stay unresolved and Runlayer decides on the configured text. Disabled plugins no longer count as live servers. Copilot's bundled Browser Use plugin and IDE bridge are now on the default built-in allowlist alongside Computer Use. See Enforce policy.
• Agents: Handing a task to another agent returns in about a second instead of about 20 seconds.
• Kubernetes audit consumer leases its Kinesis shards: if you wrote your own {instance}-audit-consumer IAM policy instead of using the published sample, make sure it allows dynamodb:Query and dynamodb:UpdateItem on the checkpoint table, and dynamodb:DeleteItem scoped to dynamodb:LeadingKeys = workers#*. A consumer missing Query or UpdateItem logs kinesis_consumer_missing_permissions at startup, naming the action, and exits. A missing DeleteItem only leaves lapsed worker registrations behind, and is logged once as kinesis_lease_cleanup_access_denied. See Workload identity.

Security & governance

• Approve agent changes made from chat: When an agent tries to change its own setup from a conversation (connectors, skills, instructions, subagents, schedules, triggers, webhooks, Slack settings or channel monitors) or to add a connector to your workspace, Runlayer now asks the person in the conversation to approve that exact change first. The agent then resumes to apply the approved change. Deleting the agent itself, starting evaluations and listing deployments or reading their details (which can repair stored deployment history) also require approval; removing individual connectors, skills or automation still applies right away. When a change is too long to show in full on the approval card, Inbox also sends you to the full request in Runlayer before approval; Slack and Teams runs then resume in the original conversation. In Slack, request agent changes through a direct message, app mention, assistant thread or follow-up in an invoked thread; ambient messages and channel-join introductions do not receive these controls. See Changes an agent makes to itself.
• Legacy macOS MDM scripts: The script-based AI Watch and Hooks scripts for macOS now run uv and the Runlayer CLI as the signed-in user instead of root, and keep the enrollment key off the command line. If you still deploy these scripts, regenerate them and redeploy. On a Mac where an earlier run was interrupted and left the Runlayer config file owned by root, the script removes that file and re-adds only its own key, so a Mac running both scripts re-enrolls on the other script's next run.
• AI Watch Enforce in VS Code: MCP calls made from VS Code's legacy Local chat harness are now blocked under Enforce and shown in Shadow AI Activity as an unidentified MCP server, because that harness gives the hook no trustworthy server identity: the tool name carries a prefix the server itself chooses. VS Code's default GitHub Copilot harness is fully supported and gets the normal allow or block decision per server. See Enforce.
• Per-run LLM spend limit for agents: Agent runs that send their LLM traffic through the Runlayer LLM gateway now stop once they have spent $250, or whatever is left of the agent's daily or weekly cost budget if that is lower, so one runaway run can no longer burn through the budget. The run fails with an error naming the limit, and the agent's owner gets a Slack DM when Budget alerts are on. See Cost budgets.

Fixes

• Agent conversation recovery: Follow-up messages recover automatically when the conversation's runtime is unavailable, instead of failing the run.
• AI Watch Enforce in VS Code: MCP servers configured in VS Code (profile mcp.json, extension-contributed, or discovered) are now recognised when VS Code chat runs on the GitHub Copilot harness, so they get the same allow or block decision as any other server instead of a silent on-device deny. A server the hook cannot identify is still blocked, and the call now appears in Shadow AI Activity as an unidentified MCP server instead of failing silently on the device. See Enforce.
• Agents: Runs stopped by the session lifetime limit now show the correct shutdown reason in reused conversations. Shutdown messages explicitly identify the session's age.
• Managed Slack apps: Agent owners whose Slack app was created through a teammate's Slack connection are now added as collaborators on it when they connect Slack, so they can manage and delete their agent's app with their own account.
• Plugin setup screenshots open full size: In the Runlayer Plugin "Add to Organization" guide, clicking a setup screenshot now opens it full size in a new tab, so the Claude and ChatGPT steps are readable.
• Agent conversations: An unanswered retry for a turn that failed to start no longer interrupts another turn running in the same conversation.
• Skill editing in chat: Agents can create and update skills directly in conversation without requiring an explicit Runlayer connector or handing you a ZIP file to upload. Existing skill editing permissions still apply.
• Agents in Slack: when an agent's reply @mentions a person or a Slack user group, they now get a Slack notification, not just a blue tag.
• Agent model picker: An agent's page now shows its current model after the model is changed in another tab, by an upgrade, or through the API, instead of the model the page opened with.
• Agent description: the fullscreen description editor now shows a saved description in Preview instead of an empty "Add a description..." field.
• Session safety chart: The Safety over Time chart in the session details panel shows again. It had rendered empty after the last release.

{/* build: 1.28.2040 */}

Breaking changes

Kubernetes Deploy enable_db auth: The operator no longer injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or AWS_CA_BUNDLE on MCP pods. ExtendDB SigV4 uses AWS profile extenddb via EXTENDDB_AWS_PROFILE (credentials under /etc/extenddb-aws, CA on the profile). Custom enable_db images must build the DynamoDB client from that profile when the env var is set; Runlayer connector images pick this up via the mcps-by-runlayer release paired with this operator bump. IRSA on the same MCP ServiceAccount is allowed again for other AWS APIs. ECS and local Docker are unchanged. See Deploy auth and Workload identity.

Security & governance

Client IP can no longer be chosen by the caller: Rate limits, the ip_address on audit events and the meta.request.ip policy field now use the address your own proxy appended to X-Forwarded-For, never an earlier entry a caller sent. Behind a corporate forward proxy that address is the proxy's egress, so IP-range policies and per-IP rate limits (including device enrollment) now see one address per office or fleet rather than per workstation. See Platform policies.

Self-hosted client-IP settings: Deployments with more than one appending proxy set PRE_AUTH_TRUSTED_PROXY_HOPS (Terraform trusted_proxy_hops) to match, and CLIENT_IP_HEADER is honoured only when it carries a single IP address.

Session block and stop: A tool call that sends someone else's session ID (in a hook payload or the x-runlayer-session-id header) can no longer block that session through "Block later tool calls when any scanner blocks", add its scan results or security events to that session's history, or mark an operator's Stop as having taken effect. Hook events that name someone else's session aren't recorded into it either, even after that session has gone idle. This holds for Runlayer Agents runs too, which belong to the person who started them (or the agent account they run as). The scanner still blocks and audits the call itself, and an operator's Stop still denies every call that names the stopped session. See AgentGuard.

Fixes

Managed Slack apps: When you delete an agent's or your organization's managed Slack app, or add a collaborator to it, Slack now shows you as the one who did it, instead of the teammate whose Slack connection originally created the app.

Claude Haiku 5.5 on AWS Bedrock: Agents on Claude Haiku 5.5 through an AWS Bedrock provider no longer fail on their first message with "thinking.type.enabled is not supported for this model".

Spend for Cursor Grok models: Cursor usage on Grok 4.7 at high effort, Grok 4.7 Fast at high or xhigh effort, and Grok 4.5 now shows an estimated cost instead of Not priced.

{/* build: 1.28.2000 */}

Improvements

• Schedule delivery: A schedule an agent sets up from a Slack thread now posts each run's result back in that thread, and one set up over iMessage texts you instead. These go out whatever the agent's Slack Run results setting says, since that setting only covers the default DM. Agents can also send results to iMessage, keep the Slack DM, or send nothing and post the results themselves.
• Outlook folders: The Microsoft Outlook connector can now create mail folders, move folders, and move messages between folders, so agents can file mail for you. Redeploy the connector to get the new tools. See Microsoft 365.
• Refreshed colors: Light mode uses warmer neutrals, and badges, charts and status colors share one palette. Severity reads the same everywhere: one color per level on every page, and Critical badges carry an alert icon. Charts, including artifact charts, use a softer fill that fades toward the card.
• LLM budget alerts: Usage rules with a total budget can now email organization settings administrators when spend reaches chosen percentages, once per percentage per budget window. Set them in Email alerts under Settings → LLM Gateway → Usage rules.
• ToolGuard score API: Tool Call Guard and IO Guard score responses now include model_version, the model version this release expects to score the request. Include it when reporting scan results to Runlayer. See Runlayer ToolGuard.

Fixes

• Agent accounts: When an agent account acting on behalf of a user calls a connector it has no access grant for, the reply now links the agent account page and gives the right fix: sign in to the connector again when it's on the agent account, or ask an admin to add it when it isn't.
• Sessions: Session length now reads 1m 23s instead of a clock-like 01:23, and hovering it explains that it measures time from start to end. See Sessions.
• Agent account activity: The Activity section on an agent account now says when you only see your own events, and that admins with org audit-log access see the calls the account makes, instead of looking empty.
• Time zones: Dashboards, including Shadow AI, and agent schedules work again for users and schedules set to older time zone names such as Asia/Calcutta, Europe/Kiev or Asia/Saigon. Dashboards no longer fail with an internal server error, and those schedules run on time again.

{/* build: 1.28.1983 */}

Improvements

• Google Docs templates and comments: Copy existing templates with native formatting preserved, inspect document structure and styles, and attach comments to specific text ranges. Redeploy existing Google Docs connectors to receive these capabilities. See Google Workspace.
• Keep agent harnesses on compact tool discovery: Send X-Runlayer-Tool-Exposure: force-initial from any client to keep Runlayer Plugin on search_tools / execute_tool instead of listing every connector tool. Use it for agent harnesses that load all tool definitions up front. See How connector tools are presented.
• Skills in Terraform: The next Terraform provider release adds runlayer_skill, so you can manage a skill and its complete set of files as code. Changes made in the app show up as a plan diff, and a file set your skill risk policy blocks fails the apply. Changing namespace or path replaces the skill. See Terraform Provider.
• Buttons and form controls: Buttons have cleaner edges, subtler shadows and consistent hover and pressed states across every style, in light and dark mode. Checkboxes, radios and switches follow the same hover states, have larger click areas, and checkboxes are dark instead of blue. Inputs show a stronger focus edge and a hover state. Segmented tabs slide between options.
• Table pagination: Pagination looks the same on every list page, and on full-page tables like Users, Groups, Policies, Connectors and Skills it stays pinned at the bottom of the table while you scroll.
• Page headers: Page titles, tabs and actions now share one header row on every page, with Refresh, Filter and the date range always on the right in that order. Policies, User mapping and Endpoint configuration show their tabs in the header too.
• Catalog filters: Connectors, Skills, Agents, Plugins and Artifacts filter through one Filter menu, like Incidents, and show each active filter as a removable chip.
• Security API Usage: The page uses the same date range picker as other pages, so you can pick custom dates as well as the last 7, 30 or 90 days.
• Artifact cards: Titles now show on two lines instead of one, and every card in the catalog grid is the same height.
• Clearer agent account access: The agent account access page and the sign-in approval screen now show the agent account's name instead of an opaque ID. Both also say the agent acts with your identity, not a shared or service account, and stays limited to what your policies allow. The access page now shows Revoke access even before any connectors are added. See Agent accounts.
• Slack artifact links: HTML artifacts no longer open as an interactive preview inside Slack. Slack link cards still show an artifact's details to people with access; open the link to view the artifact in Runlayer. See Link previews.
• Agent accounts: After you tap Grant access on an agent account's access page, the page now says access is granted and that you can close the tab and go back to your agent.
• Agent account owner: Each agent account page now shows who owns it, with a link to their user page in Settings → Users.

Security & governance

• Caller-sent identity headers are dropped: Runlayer now drops X-Runlayer-User-Email, X-Runlayer-Identity-Token and the other identity-forward headers when a client sends them, so an upstream server only ever sees the ones Runlayer injects. Other custom headers, like a correlation id, still pass through on each call. See Per-request headers from the caller.
• Skill risk policy on API writes: Creating or updating a skill's files through the API (for example from Terraform) now runs the security scan first and is rejected when your skill risk policy blocks the content, the same as uploads in the app. Nothing is saved when a write is blocked.
• Deactivated users on managed devices: A tool call that AI Watch allowed just before an admin deactivated the device's user can no longer be retried under the same request for up to 15 minutes: Protect and Enforce now block the retry as soon as the user is deactivated, and Monitor keeps recording it.
• Redacted session timeline: When content redaction hides a session, the API and the Runlayer MCP get_session tool now still return its event timeline (times, event types, tool names, model, tokens), with REDACTED in place of prompts, responses, tool input and output, and page URLs. In the session drawer, viewers who can unredact see the placeholder timeline blurred; everyone else still sees the redaction notice. Redacted session list and search rows in the API and the MCP list_sessions and search_session_events tools no longer include the first prompt or generated title. Redacted agent run details, in the API and the MCP get_agent_run_trace tool, keep their steps the same way, with placeholder text. See Sessions.
• Kubernetes Deploy enable_db + IRSA: The operator now rejects MCP servers that combine enable_db with an IRSA annotation (eks.amazonaws.com/role-arn) on the MCP ServiceAccount (ExtendDBReady=False / IRSAConflict) and leaves ExtendDB AWS env off the pod. GKE Workload Identity is unchanged. See Deploy auth and Workload identity.
• Server OAuth secrets redacted in Terraform: manual_oauth_client_secret and broker_vendor_client_secret on runlayer_server are now marked sensitive, so Terraform hides them in plan and apply output. Module outputs that reference them need sensitive = true. Needs the next Terraform provider release. See Terraform Provider.

Fixes

• Server config env vars: Pasting a .env file into a server's environment variables no longer deletes existing secret values.
• Claude Code spend: Analytics no longer counts a Claude Code session's earlier usage again when the session is resumed or forked, so Spend totals match what Claude Code actually used. A resumed or forked session now shows only the work done in it. See Analytics.
• Usage: Token totals for Cursor sessions metered by Runlayer's tokenizer now include reasoning tokens, so Usage matches billing for those sessions.
• Agent instructions: Keep your draft open while saving, so a failed save doesn't lose your edits.
• Agent account auth failures are errors: When an agent account's tool call fails because the connector needs authorization or rejects its credentials, the agent now gets a machine-readable error, including whether a retry can succeed, instead of an "authorize this connector" message, and the audit log records a tool call failure.
• VPC peering in the ECS Terraform module: vpc_peering_connections now works with the Terraform CLI. Before, any peering connection failed terraform plan with "Call to unknown function". See VPC peering.
• Agent runs: Runs that cannot create their working directory now fail promptly with a clear error instead of waiting for a startup timeout.
• Usage page on busy organizations: Opening the same Usage view again within a minute now loads at once, and a date range too large to total quickly now shows a "narrow the date range" message after about twenty seconds instead of loading for half a minute and failing.
• Tool call approvals: When a tool call needs approval in Claude Code, Cursor, Codex, or VS Code, the prompt and the approval page now tell you to come back to your AI client and retry once it's decided.
• Terraform provider plan drift: terraform plan right after apply is now empty for runlayer_policy, runlayer_agent, and runlayer_agent_account (unless identity_attributes is left unset; set it to {} instead). A runlayer_agent with memory_scopes can now be created, and removing enable_memory from its configuration no longer turns Memory off: set memory_scopes = [] to turn it off.
• Runlayer Assistant model: A model and provider an admin picks for the Runlayer Assistant now stay in place across Runlayer updates instead of reverting to the default. If that provider is removed or stops serving the model, the Assistant goes back to your organization's default.
• Read-only policies from the policy assistant: Asking the assistant to make connectors read-only now drafts a policy that blocks every tool the connector doesn't mark as read-only, instead of granting every tool. Tools with no read-only mark are treated as writes.
• Token masking: Microsoft Graph pagination cursors ($skiptoken, $deltatoken) in nextLink/deltaLink URLs should no longer be masked as credentials, which was breaking paginated Teams/Graph reads after page 1. Credential keys such as skip_auth_token are still masked.
• Sessions list connector icons: A connector used in a session now shows once, with its icon, even when its name has spaces.
• Security dashboard names: The Denied Actions and Security Violations cards now show a connector's or user's current name within minutes of a change, instead of the old name for past days. The shared Runlayer connector and built-in connectors also show their name and icon on the connector usage cards.
• Dashboard names: The AI Watch activity, blocked agent hooks, most active users, top skill creators and top plugin users cards now show a user's or connector's current name within minutes of a change, instead of the old name for past days.
• Dashboard Connectors count: The Connectors count now includes the shared Runlayer connector and your organization's built-in connectors, matching the Connectors page.
• Spend for Cursor models: Cursor usage on Grok 4.7, Kimi K3, Gemini 4 Argon and GLM 5.3 Flash now shows its provider and an estimated cost instead of landing under Unmapped.
• Spend by vendor for IDE and CLI usage: Cursor, Claude Code, and Codex usage whose model has no list price now appears under its vendor in Spend instead of "unmapped". Cursor's Auto mode shows as "Cursor Auto".
• Artifact embed view: Notifications such as the new-version notice no longer appear on top of an artifact opened through its chromeless embed link, so screen shares and wall displays stay clean.
• Artifact participants: Avatars in an artifact's participant list now fill their circle, and initials fit inside avatars at every size.
• Agent connectors: Signing in to a connector you added before connecting your account now gives the agent its tools, and the confirmation says how many. A connector with no tools selected is flagged on the agent with a Choose tools action.
• Audit Logs: Skill events now say what they are. "Skill Read via Runlayer" is a skill read through Runlayer or a plugin, "Skill Found on Device" is AI Watch finding a skill on a device, and "Skill Invoked" is a client's own skill tool. See Audit Logs.
• Claude Desktop connectors under Enforce: Claude.ai connectors used from Claude Code inside Claude Desktop (including the Runlayer connector) are now recognized as connectors instead of being blocked as unknown built-in MCP servers, and are audited under the connector's display name. Claude Desktop's ccd_turn plan and wrap-up server joins the Claude Code safe defaults. See Enforce policy.
• Catalog toolbar: The sort dropdown shows a hover state in dark mode, and the search field now matches the height of the filter buttons beside it.
• Tooltips: Tooltips fade and scale in place instead of sliding in, and fade out when they close, so moving between buttons feels smooth.
• Cursor Auto spend: When Cursor names the model Auto picked for a turn, Spend now prices that turn at the model's rate instead of listing it as Cursor Auto with no cost. Turns where Cursor doesn't name the model still show as Cursor Auto.
• Claude Code org-library plugins under Enforce: Plugins your Claude organization pushes to members' Claude Code, including the Runlayer plugin, are now recognized, so their tools run under Enforce instead of being blocked as unregistered MCP servers. Detect also inventories these plugins and their MCP servers. See Enforce policy.
• Agent runs stuck on a failing tool call stop early: When an agent makes the same tool call with the same arguments and it fails five times in a row, the run now stops with an error naming the tool and its last error, instead of retrying until the runtime limit hours later and running up model cost.
• Agent schedules: When a schedule stays off because its agent is still an unpublished draft, the Runlayer MCP create_agent_schedule and update_agent_schedule tools now say how to publish the agent and turn the schedule on, instead of returning a bare draft_disabled_by_gate flag.
• Apps: App owners can update their app's page again; publishing a new page no longer fails with "Access denied".

{/* build: 1.28.1972 */}

Improvements

Kubernetes Deploy enable_db auth: Docs cover how MCP pods reach ExtendDB today (SigV4 via env-injected keys + AWS_CA_BUNDLE on the default AWS SDK chain — do not combine with IRSA on the same MCP ServiceAccount in v1; GKE Workload Identity is fine) and the planned Kubernetes profile-scoped path (EXTENDDB_AWS_PROFILE selects the named profile; ECS/local stay on the default chain). See Deploy auth and Workload identity.

Connector tool lists: A policy change in one workspace no longer refreshes cached connector tool lists in other workspaces, and policy changes in different workspaces no longer wait on each other.

Sessions topic filter: For organizations on the Clio v1.0 session-topic model (session-topics-clio feature flag), the topic filter on the Sessions page now also lists the Clio topics (63 subtopics, for example Research and prepare for sales engagements) next to the existing ones, so sessions labelled with either topic set can be filtered by name; other organizations see the filter unchanged. See Sessions.

Session compaction self-heals after upgrades: A session whose background compaction repeatedly failed used to stay parked until support reset it by hand. Each upgrade now retries parked sessions automatically (at most once a day, and up to three retries per session), so in most cases deploying a release that contains the fix is enough. A session that still fails after its three retries stays parked until support resets it.

Session block setting: The "Session kill-switch" toggle in Security Scanners is now called "Block later tool calls when any scanner blocks", and its description says what it does: later tool calls in the session are denied while the agent keeps running. Sessions whose only block is one nothing enforces (the toggle is off) now show "Flagged" instead of "Blocked". See AgentGuard.

Faster incident activity: The events and sessions of a security incident no longer load slower the longer the incident has been active. Through the API or the Runlayer MCP incident tools, a time range longer than 7 days now returns the 7 days ending at its end date. To cover a longer range, request it in 7-day steps. See Incidents.

GPT-6.1 Terra for agents: OpenAI's GPT-6.1 Terra is now in the agent model picker for OpenAI providers, with reasoning, image input and Spend pricing. See Agents.

Waterfall view for agent runs: The agent run drawer now has a Timeline / Waterfall switch for everyone. Waterfall charts each tool call as a bar at its real offset from the run start, with subagent steps nested under their call, so slow steps stand out at a glance.

Artifact auto-delete policies for every workspace: Admins with Manage Agents can now open Settings → Artifacts in any workspace to set a workspace-wide auto-delete rule and per-folder overrides (for example Keep forever for Reports). Idle artifacts are archived first and deleted 30 days later unless someone restores them; nothing changes until an admin saves a policy. See Archived artifacts.

Security & governance

Artifacts: Publishing an artifact whose content holds an obvious API key, access token or private key is now refused, so an agent can't accidentally share one through an artifact link. The agent is told to redact it and publish again.

Rate-limit policies: Admins can cap how often tool calls run on a connector, such as 100 calls per hour per user or 30 calls per minute per session. Pick Rate limit as the policy's action or start from one of the two rate-limit templates; the policy list shows each limit as a badge, and calls over the limit are refused and appear in the audit log as Tool Call Rate Limited.

Deactivated users on managed devices: When an admin deactivates a user, AI Watch hooks on that user's MDM-managed devices now block tool calls in Protect and Enforce instead of letting them through (Claude Code's interactive AskUserQuestion prompt stays allowed, as it is for stopped sessions); Monitor keeps recording them. Devices Runlayer can't match to a user now get the organization's Enforce tool-type blocklist.

Org-scoped install and connector metrics: The plugin and skill install cards on the Metrics page and a connector's most-active-users list now count only your organization's activity. The active-users list also rejects date ranges older than 90 days, like the other audit-backed metrics, and no longer comes back short when agents are among a connector's busiest callers.

Fixes

Approved tool calls after a handoff: After you approve a blocked tool call, the agent now retries that exact call instead of asking for approval again when the call's arguments are long, such as a detailed handoff to another agent.

Approvals in agent chats: Approving a blocked Runlayer action, such as creating an agent schedule, in the agent chat now finishes it. Before, the run that resumed after your approval could no longer reach the approved tool.

Agents that hand off work can check other agents' runs: With "Can hand work to other agents" on, an agent can now list the recent runs of the agents you can see, so it can report a run's status and result instead of saying it can't see the history. See Agents.

Custom PII rules in Terraform: Custom PII rules created in the app no longer make every plan show an update when your Terraform config doesn't set pii_custom_rules. Needs the next Terraform provider release. See Terraform Provider.

Connector tags on create: Tags sent when creating a connector through the API or Terraform are now saved. Before, they were dropped until the next update.

Back to app from an artifact: Back to app on an artifact's page now returns to the page you opened it from, such as the agent, instead of always landing in the Artifacts list.

{/* build: 1.28.1872 */}

Improvements

Connector badges: Connector cards show fewer, quieter badges: small gray icons for hosting (Local, Remote, Runlayer Deploy) and interactive tools, plus a Beta chip. The Official badge is replaced by a Third-party icon that marks connectors not built by the service's vendor. The Secure badge was based on catalog metadata, not a security scan result; it has been removed.

Hosting filter: On the Connectors page, filter connectors by hosting type: Local, Remote, or Runlayer Deploy.

Security & governance

Cookie masking in approvals: Approval requests in the web app, Slack, and Microsoft Teams now apply the same cookie masking to every cookie field, including names such as auth_cookie and session_cookie.

Federated agent accounts: Agent accounts that sign in through an identity provider now always enforce server scoping, so their tokens only work on the servers they were issued for. The setting shows as on and locked for these accounts, and existing API keys on them are refused. The keys are not revoked: if an account is later unbound from its identity provider and an admin turns the setting off, its old keys work again, so revoke any you no longer need.

Connector URL redirects: Runlayer now follows a connector's redirects only within the server's own origin. A connector whose URL redirects to another host (for example apex → www., or a different domain), to another port, or from https:// down to http:// reports that address at connect time instead of following it; a same-host http:// → https:// upgrade is still followed. Enter the final URL as the connector URL. See Connectors.

MCP request size: Requests sent to Runlayer's MCP endpoints with a body larger than 36 MiB are rejected with HTTP 413. The limit is sized so a full 25 MB artifact upload through create_artifact / update_artifact still fits.

Local stdio servers: Runlayer no longer starts a local stdio server on its own servers when it's called through the proxy URL. Local servers run only on your machine through the Runlayer CLI.

Stop blocks skill access: Stopping a session now also blocks skill reads through a skill's MCP endpoint that carry the stopped session's ID. See Sessions.

Fixes

Connector sign-in from AI clients: After you sign in to a connector mid-conversation, your AI client is told the connector is connected instead of getting an error or another sign-in prompt.

Plugin, skill and agent lists: Filters such as Editable by me and Full access no longer miss items or include items based on outdated settings right after a workspace's access settings are first set up or upgraded. After this upgrade, each workspace's filters use the previous access check until the next background sweep reaches the workspace and recomputes its access. A list can still trail an access change by a few seconds while it is recomputed.

Sharing lists: the "Editable by me" and "Full access" filters no longer show a plugin, skill or agent to its former creator once ownership moves to someone else. Items a team owns now follow changes to the team's owners, and leave the lists when the team or the item is deleted, without waiting for an unrelated change.

Skill access through plugins and agents: linking or unlinking a skill on a shared plugin or agent with the Runlayer MCP tools now updates who can use that skill, as the web app already did. People the plugin or agent is shared with can use newly linked skills and lose use of unlinked ones. Skill access inherited through earlier unlinks of this kind stays in place for now, and skills linked this way before this release are still not shared with those people; a later release reconciles both.

Connector tools right after sign-in: If your AI client still shows a connector's sign-in tool after you sign in, calling it now lists the connector's tools and, for a day, runs its read-only tools for you, so you don't have to restart the conversation first.

Connectors page loading: On large screens, the next connectors now load in place inside the grid instead of under a separate block of loading cards, and cards fade in smoothly as they arrive.

Agent tool calls with structured inputs: Agents now call connector tools whose inputs include nested objects, such as previewing an artifact in chat, instead of failing with "must be object".

Scheduled agents: A schedule no longer fires twice for the same run when many schedules are due at once.

Artifacts that save edits in the browser: Artifact pages can't keep data in your browser. When a page tries to, it now shows a notice that edits won't be saved, instead of failing silently and losing your changes on reload. Agents are also told to build an app when a page needs to save input.

{/* build: 1.28.1825 */}

Improvements

Owned by me tabs: The personal tab on the Agents, Skills, Plugins and Artifacts pages is now called Owned by me and lists the items you own. See Agents.

Delete a connector from its page: Admins can now delete a connector from the ⋯ menu on its connector page, not only from Manage connectors. The confirmation makes clear it removes the connector for everyone in your organization. See Connectors.

Agent triggers in Terraform: The next Terraform provider release adds runlayer_agent_trigger, so you can manage an agent's event and poll triggers as code. It needs agent triggers turned on for your organization. Changing trigger_type, event_key or account_id replaces the trigger. See Terraform Provider.

Fixes

MCP resource templates: Clients can now list a connector's resource templates (resources/templates/list) through Runlayer. Previously the gateway answered "Method not found", so templates from upstream servers never reached the client.

Agent schedules: scheduled agents no longer run in a workspace where Agents is turned off. They pick up again on their next scheduled time once Agents is back on.

{/* build: 1.28.1798 */}