Cloud - Ara Documentation

For the visual release feed, see ara.so/news.

August 15, 2026: Actionable session machine restart notice

Replaced the passive retry control on disconnected session surfaces with an actionable Restart button wired to session runtime restarts.
Unified hover details, icon spinning indicators, and accessibility labels across panel notices and navigation machine status pills.

August 15, 2026: Multi-repo workspace sessions and status-first session list

Sessions now operate as workspace-centric conversations in /work rather than single-repository containers, allowing agents to clone or attach connected repositories dynamically and open pull requests against explicit target repositories without session restarts or sub-session splits.
Harmonized device and repository attachment guidance across cloud runtime prompts so multi-repo and repository-neutral workspaces use consistent workspace delivery.
The session navigation sidebar now supports dynamic repository grouping with multi-repo projection across all touched repositories, connected workspace repositories with case-insensitive filtering in the submenu, zero-repo scratch organization under General, and status/people grouping.

August 15, 2026: Sandbox execution and credential hardening

Package installs in the cloud sandbox now skip lifecycle scripts by default (npm_config_ignore_scripts, YARN_ENABLE_SCRIPTS=false), so untrusted repository content can no longer trigger install-time code execution.
The repository clone URL exported into the sandbox no longer embeds the source-control credential; authentication flows through the git credential helper instead, keeping the token out of environment dumps.
Session steering messages now emit a caller-identity audit event, attributing each follow-up that continues a run to the user or API key that sent it.

August 15, 2026: Consolidated high-throughput CI/CD pipeline

Consolidated CI shards into a unified 2-shard execution model running concurrent Vite builds, typechecks, and 978 unit tests on 16 vCPUs.
Direct test IPC and temporary state to Linux in-memory filesystems (TMPDIR=/dev/shm), cutting PR gate wall-clock down to sub-40 seconds.
Standardized shallow Git checkouts across all build and test jobs.

August 15, 2026: Accelerated production builds and streamlined API container image

Streamlined the backend API container image to run directly from source with Bun, cutting redundant frontend bundling and typechecking from API service deployments.
Parallelized web application and component preview builds to run concurrently, reducing frontend deployment and preview build times.
Optimized replica draining windows and asset compression checks for faster rollouts across staging and production.

August 15, 2026: Sandbox egress proxy routing and destination allowlist policies

MicroVM sandboxes now support platform egress proxy routing, enforcing that sandbox outbound traffic routes through the platform relay and preventing workspace secret overrides.
Introduced destination allowlist policy filtering covering developer package registries, SCM hosts, and curated connector endpoints in observe and enforce modes.
Added support for brokered secret exposure modes, withholding credentials from the sandbox environment while retaining host-side tool access.

August 15, 2026: Guarded pull request creation and chat privacy

Interactive web chat sessions no longer automatically open unsolicited backstop pull requests when reviewing code or exploring branches.
Workspace finalization now tracks per-turn commits, pushing branches only when new commits were explicitly authored during that turn.
Code review, bug audit, and informational questions now remain strictly inside the Ara chat thread by default and never mirror conversational analysis onto GitHub pull requests or issues.

August 15, 2026: Accelerated web application type compilation and localization loader

Optimized localization catalog dynamic loaders to stream locale definitions on demand, accelerating frontend compilation and type checking.

August 15, 2026: Database connection pool scaling and claim backpressure

Raised default production and development database connection pool capacities to prevent connection slot starvation under high concurrency.
Worker queue dispatch now debounces transient database waiter spikes before pausing worker claims, keeping background agent scheduling responsive during bursty traffic.

August 15, 2026: Mobile session source logos stay contained

MCP client logos in the mobile session sidebar now stay inside their 12px origin badge instead of expanding over nearby session titles.

August 15, 2026: Production Pulse has a native always-on view

The six production reliability graphs are available across ara.engineer/production and ara.engineer/prod2, protected by the same one-time-code access as the founder dashboard.
Every graph keeps a compact color-to-series key visible inside the graph frame without hovering, refreshes every 60 seconds, and connects sparse samples across missing buckets like Grafana’s always-on null handling. Telemetry freshness remains an explicit independent signal. User latency stays pinned to a stable 0–10 second axis so a slowdown cannot visually rescale itself away. The message, run, and inference volume graphs scale tightly to the maximum observed in the selected window, making their full dynamic range visible.
Each wall’s window switch moves its graphs together between the last 72, 24, 6, or 1 hour and requests an appropriately sampled snapshot for that window. Short views now expose 1–5 minute inference, queue, latency-component, and production-pressure detail instead of stretching 15–60 minute buckets.
The always-on view uses a slimmer utility bar with only the ara.so wordmark, range controls, refresh, and sign-out actions, leaving more room for telemetry.
The production wall is now split for multi-screen monitoring: ara.engineer/production keeps panels 01–04 in a fixed 2×2 grid, while ara.engineer/prod2 stacks constraint pressure and canary health as two full-width rows.
Both walls preserve a 1920×1080 logical canvas and scale proportionally—equivalent to 50% browser zoom on a 960×540 monitor—instead of collapsing their grids.

August 14, 2026: Fast isolated test execution

Test execution across backend and frontend suites now runs through a native TypeScript worker pool with longest-processing-time (LPT) scheduling, eliminating process fork overhead and core tail starvation while preserving per-file isolation.
Test-mode backoff and retry sleeps are truncated across all internal relay, API, and gateway drivers, and frontend test suites are partitioned to fan out across available worker cores concurrently.

August 14, 2026: Production recovery is standardized

Ara’s release process now separates immediate traffic restoration from the durable source fix, so a known-good frontend or API deployment can restore service without waiting for a rebuild.
Rollback checks now preserve later commits and already-applied migration history, verify the exact affected customer path, and prevent ordinary code regressions from triggering an unsafe database restore.
A protected-main incident workflow can now collect the live frontend/API identities, retained pre-change candidates, migration and later-commit risk, plus current canary evidence into one #alerts recommendation. It can prepare a draft source-revert PR when explicitly requested, but cannot merge, deploy, switch traffic, or touch data.

August 14, 2026: Site failures can be reproduced from the affected network

Production monitoring now compares independent recursive DNS providers and retains cross-region TLS-certificate and TCP-path history, making a resolver-, ISP-, or CDN-specific failure distinguishable from a global outage.
A failed cloud-browser run now preserves its available logs, trace, screenshot, video, report, and network diagnostics with the scheduled run instead of leaving only a red check.
Support can give an affected Mac a no-install capture that tests every current JavaScript and stylesheet, or temporarily run the same browser and HTTP test through that exact network. The temporary probe key and location are removed after the incident.

August 14, 2026: Continuous production-path verification

Ara now continuously checks the same production path a real authenticated session uses: API access, a warm reply, cold start, inference settlement, cloud-machine tools, and a connected GitHub repository read. Each check verifies the exact result as well as its latency instead of treating an HTTP success as proof that the product works.
Queue age, database waiting, event-loop responsiveness, active-run pressure, machine quota, host limits, and user-visible latency now share one 72-hour operational view. Repeated failures, exhausted latency headroom, or missing check telemetry alert independently so a silent observer cannot look green.
That operational view now renders as six always-on Grafana graphs backed by Ara’s production telemetry, with every colored series, latest value, maximum value, and 80%/100% canary reference line visible without hovering.
The daily reliability run now also completes exact direct-answer and cloud-tool sessions through the ordinary production API, attaches a deterministic 24-hour summary of queueing, latency, host pressure, database waiting, and sandbox headroom, and reports through an independent heartbeat.
Manual canary runs now execute only from the reviewed main branch, so an arbitrary branch cannot receive the production observer’s Infisical token.
Production runtime, public user-path, pull-request review, and model-response probes now run only in one dedicated canary-box workspace. Their reusable history and alerts are scoped to that workspace. Staging toolbelt and compaction probes stay isolated on the synthetic ara-staging database and stable staging API, and cannot resolve production or customer rows. Shared target guards and CI contract tests reject an accidental customer-org or cross-environment override before a probe starts.

August 14, 2026: Landing-page asset recovery is deployment-safe

Generated JavaScript filenames now include the deployment identity whenever their bytes contain deployment-pinned imports, preventing two releases from publishing different module graphs under one cached pathname.
Browser caches now revalidate generated assets instead of retaining a transient missing-file response as immutable. Ara still retries failed bootstrap files and displays a self-contained recovery screen if the network remains unavailable.
The daily reliability suite now fault-injects every required bootstrap script and stylesheet, while CI verifies the complete emitted dependency graph carries one consistent deployment pin.

August 14, 2026: Product analytics returned to PostHog

PostHog is again Ara’s single product-analytics destination across the web client and API. Events now include environment, service, release, workspace grouping, and retry-safe billing identifiers while operational telemetry remains on its separate reliability path.
The Revenue dashboard now centers the current cash-backed MRR split, its seven-day history, and the current paying-customer table. Older revenue dashboards remain recoverable but have been archived out of the active list.
Ara’s founder-only revenue surface is now a read-only duplicate of the canonical PostHog Revenue dashboard. The TV surface now strips away the pie, cards, borders, metadata, and explanatory copy so only the current MRR and its full-width history line remain, refreshed automatically.

August 14, 2026: Retired experimental iMessage and applicant scoring paths

The unreleased iMessage connection flow and its Photon runtime have been removed. Ara’s supported messaging integration remains Slack.
Career applications are still recorded and sent to the hiring team, but Ara no longer assigns automated candidate scores or exposes repair tooling for those scores.

August 14, 2026: Repository Wiki is retired

The retired AutoWiki and DeepWiki pages, settings, background-agent option, marketing page, and internal app endpoints have been removed.
Existing Wiki links continue to open Codebases so old bookmarks do not strand users. Repository-native runbooks and organization memory remain the supported sources of durable context.

August 14, 2026: Free is the full product, subscriptions start immediately

Every Ara feature is now available on Free when you connect your own model provider. A first workspace also receives a one-time $5 Ara-hosted inference balance, shown in the left sidebar.
Ara Pro is a straightforward $20 monthly subscription with$ 20 of hosted inference spend. It is charged immediately; free subscription periods and free-month promotions have been removed.
Billing now speaks in dollars throughout. Paid workspaces can configure an automatic reload amount and monthly cap, while exhausted Free workspaces see a direct Ara Pro card instead of a trial offer.

August 14, 2026: Cloud machines clear space before they run out, not after

A machine now clears its old process logs once it crosses 90% file usage, instead of waiting until it is completely full. Recovering an already-full machine buys back only enough room to start a single process, so acting early is what gives the real cleanup room to work.
Every cleanup pass now reports how full the machine was, so pressure building on a machine is visible as a trend rather than only becoming apparent once sessions on it start failing.

August 14, 2026: Daily cross-region landing-page verification

Ara now discovers the landing page’s current JavaScript and stylesheet files every day at 6:07 AM Pacific and verifies their status, type, cache policy, deployment pin, DNS, and TLS from independent probes around the world. The check follows each deployment’s live asset names instead of relying on hashes that go stale after the next release.
Real browsers also load the home, pricing, and contact pages, verify that every application script and stylesheet succeeds, and confirm that the final page is styled rather than merely returning HTTP 200. The same core check runs after frontend deployments, while the lightweight worldwide DNS and HTTPS check continues every ten minutes.
The ten-minute check now deliberately samples consumer ISP networks as well as datacenters, matching failures that affect only one resolver or access network. A pre-application sentinel and browser Network Error Logging also preserve evidence when required page files fail before Ara’s normal analytics can start.
Every site check now enters through www.ara.so, verifies its DNS, TLS, and canonical redirect before validating the resulting page and assets, and uses a Checkly heartbeat to alert if the scheduled daily suite itself stops running.
The browser check now resolves one Playwright runtime consistently in both scheduled CI and Checkly-enabled development installs, preventing the monitor itself from failing before it tests the public pages.

August 14, 2026: Product analytics telemetry cutover to Mixpanel

Internal product analytics telemetry across the web client and API server has been migrated to Mixpanel.
Browser session replay is configured with strict client-side masking for credentials, secrets, and authorization fields.

Staging branch previews now send sign-in callbacks and client telemetry only to non-production APIs. Relative fallback requests also stay in staging, while each API and sign-in callback keeps an exact inbound origin allowlist, so preview traffic cannot fall through to production.

August 14, 2026: Clearer error when a macOS or Windows machine can’t start

Starting a macOS or Windows cloud machine could fail with an unrelated-looking error when its underlying runtime was misconfigured, instead of saying what was actually wrong.
The machine now checks that its runtime is reachable before attempting to start, and reports plainly when it is not, rather than failing partway through with an opaque error.

August 13, 2026: Cloud sessions wait safely at dependency limits

The cloud worker now pauses new session claims when its foreground database pool has a waiter or reaches 80% utilization. Sessions already running keep going, while new work stays durably queued until database headroom returns.
If the sandbox fleet reaches its account-wide machine quota, a session now returns to the durable queue and retries after a spread delay instead of ending as Interrupted. A rejected sandbox admission does not consume a run recovery attempt.
A completed inference stream now releases its per-session concurrency slot immediately, even if the upstream provider leaves the connection open. This prevents the session’s own recovery attempt from being rejected behind an already-finished request.
Operators receive an immediate alert when the sandbox fleet limit causes a requeue, alongside the existing database-pool and fleet-headroom warnings.

August 13, 2026: A full cloud machine can now clean itself up

A machine that filled up could not recover on its own. Cleaning up finished workspaces requires starting a process, starting a process requires writing a log file, and a full machine cannot write one, so cleanup failed and the machine stayed full. Every session assigned to it then failed within about a second.
Cleanup now clears the machine’s own process logs first, using a path that does not need to start a process, which frees just enough room to run the real cleanup that reclaims the space.
This only ever removes logs of processes that already finished. Your work is never touched, and if the space cannot be freed the machine is reported as still full rather than reported as cleaned.

August 13, 2026: Cloud machines keep reclaiming space after a machine is recycled

Recycling a machine could leave its per-session workspaces marked as still needing cleanup forever. The cleanup sweep checked that the machine was alive, the recycle then removed it, and the cleanup failed against a machine that was already gone, so it retried the same workspace on every later pass.
A workspace on a machine that is confirmably gone is now retired, because the workspace went with it. A machine that is merely unreachable for the moment is left alone and retried, so a temporary blip can never make a live machine’s workspace look reclaimed.

August 13, 2026: Landing pages recover from interrupted asset downloads

If a required landing-page script or stylesheet is interrupted, Ara now retries that exact version before attempting a bounded page reload.
If the browser still cannot retrieve the files, the homepage stays readable and shows a clear Try again action instead of a blank page.
Terminal failures now alert the team with the deployment and exact asset path, while transient failures and successful recoveries remain queryable.

August 13, 2026: Worldwide landing-page reachability monitoring

Ara now checks www.ara.so DNS resolution and HTTPS reachability every ten minutes from independent probes around the world. A missing successful check also alerts the team, so a failed monitoring provider cannot silently remove regional coverage.
Every browser bootstrap now has one recovery-safe load identifier. Interrupted assets, successful recovery, exhausted recovery, the exact deployment, and the eventual page load can be measured as one sequence instead of unrelated error counts.
Recovered loads are linked to PostHog sessions when analytics becomes available, while pre-application failures continue reporting independently of the application bundle.

August 12, 2026: A warm workspace is reused only by the person who left it

Ara keeps a member’s cloud workspace warm so a follow-up starts fast instead of cloning again. Reuse matched on the workspace, the repository and the machine’s state, but not on who the earlier session belonged to. A follow-up sent by a different member of the same workspace could therefore start inside a machine another member had been working in, and see the files left there.
Reuse now also requires the same person. A follow-up from someone else starts a fresh workspace, which is slower for that one start and sees nothing of the other session’s work.
The check refuses whenever it cannot confirm both sides belong to the same person, so an incomplete record costs a cold start rather than granting access.
Nothing about your own follow-ups changes.

August 12, 2026: Lighter marketing-page image loading

The marketing homepage no longer downloads every inactive product-carousel screenshot as soon as the page starts. The currently shown screenshot still loads immediately, while later slides load when the carousel reaches them.

The mobile app bar now keeps its full navigation height instead of compressing in constrained viewport layouts.

August 12, 2026: A persistent badge for goal-driven sessions

Sessions started with @goal now show a persistent Goal badge on the message that started them, so you can tell later which sessions are goal-driven even after @goal itself has been stripped out of what’s shown.

August 12, 2026: Faster answers when many sessions start together

Concurrent scratch sessions now share identical startup lookups instead of repeating them for every session, and persistence work that is not required for the first answer runs after the agent finishes.
In a controlled 50-session staging comparison, median send-to-first-answer latency fell from 8.8 seconds to 6.2 seconds and p90 fell from 17.6 seconds to 12.4 seconds. All 50 sessions completed in both runs.
Dispatch now emits one structured timing event with each database-backed startup stage, so future regressions can be attributed without adding logs throughout the latency-sensitive path.

August 12, 2026: A machine could be out of space while the panel read healthy

The machine panel now reports Files alongside Storage. A machine’s filesystem has two independent limits, total bytes and total files, and either one running out stops it writing. Showing only bytes meant a machine sitting at 57% storage but 90% files looked completely healthy right up to the point every session on it began failing in about a second.
The Files row uses the same colour thresholds as the others, so file-count pressure turns amber and then red on its own instead of staying invisible until it is fatal.
The machine capacity response gained an inodes object (total, used, available, usage_percent). Where a machine’s platform cannot report it the values are null, and the storage figures are unaffected.

August 12, 2026: Session pages load without jumping

Opening an uncached session now shows a shimmer shaped like the final header, transcript, and message composer instead of a centered loading mark.
Review details, changed files, and workspace files now reserve their final layout while they load. Session information that is already available stays visible rather than flashing back to a placeholder.

August 12, 2026: PR-review interruptions retain their real cause

PR Review no longer collapses unavailable proposers, incomplete proposer coverage, diff-fetch trouble, and posting trouble into one generic diagnostic reason. Interrupted attempts now retain the exact stage and cause so a continuation or operator can act on what actually stopped.
Historical review attempts remain intact. Where the old stored message only says the review swarm stopped, Ara labels it as a legacy swarm interruption instead of guessing a more specific cause.

August 12, 2026: Late repository discovery stays in the same Session

A repository-neutral coding Session now attaches the exact connected repository and continues the original task in the same chat. It no longer reports success by creating and linking a second Session.
When a fresh checkout is required, Ara uses a successor execution only after the original execution has securely stopped. The transition preserves the original input and attachments, model and reasoning settings, connector thread, and visible Session identity.
Live output keeps a distinct internal stream key for each execution even while both are presented under the stable Session ID, so output from the repository-neutral and repository-backed executions cannot be combined.
Generic Session creation is no longer available to a live run. Explicit, bounded subagents remain available for genuinely independent parallel work; discovering or attaching a repository is not delegation.

August 12, 2026: Session context expands from the top bar

Session status now appears as compact tabs for queued messages, plan progress, subagents, changed files, and recent edits. Opening a tab expands the existing top bar in place, so context stays aligned with the conversation instead of covering the composer. A desktop pointer previews a tab on hover and collapses it on leaving the bar; touch screens continue to open tabs with a tap.
The @ mention browser now uses that same expanding surface, with categories and matching results side by side. The composer’s add button opens the same browser, while file attachments remain available at the bottom of the list.
Skills are discoverable through @ alongside repositories, devices, files, plugins, secrets, automations, and sessions; / remains focused on commands.

August 12, 2026: A safer foundation for sessions with multiple resources

Ara now has an additive internal data foundation that separates a durable Session from its requests and execution attempts. Repository context is represented as attachable Resources, while working and delivery targets stay task-local and separate from access authority.
The foundation also defines exact, short-lived Capability records for later point-of-effect enforcement. It does not change existing sessions, APIs, worker claiming, or repository behavior yet; runtime dual-writing, measured backfill, and reader cutover ship as separately verified changes.
The target contract treats a repository discovered after work starts as a continuation of the same Session and Turn. The current execution Attempt continues when safe; otherwise a successor Attempt resumes after teardown. A separate Session is reserved for explicit independent delegation. Runtime behavior changes only after the attachment service and regression gates land.

August 12, 2026: Measure session recovery before automating it

Ara now measures how often Interrupted sessions are continued, how often the continuation eventually reaches Done, how long recovery takes, and its added cost. The measurement follows the full continuation chain and does not add work to message delivery or session startup.
This does not automatically retry Interrupted sessions. The data establishes which narrowly defined infrastructure interruptions benefit from recovery without repeating expensive or user-actionable failures.
Sessions blocked by a missing GitHub App installation now appear as Needs input and are excluded from the Interrupted recovery funnel.

August 12, 2026: Sessions can inspect and repair pull-request failures

Coding sessions can now read the complete state of their pull request, including commits, checks, reviews, inline comments, discussion, and every changed-file patch through bounded pages that also support very large PRs.
When CI fails, a session can inspect the exact check output, annotations, failed GitHub Actions step, and a bounded redacted log excerpt, then push a repair and re-check the pull request instead of stopping at the aggregate required-check name.

August 12, 2026: Automation catalog removes redundant trigger label

The Automations page no longer shows the visible “Last triggered” label above the automation list.

Ara docs are now available through Mintlify at ara.so/docs and docs.ara.so, with one compact top bar for Documentation, API reference, and Changelog.

Session rows that require a response now say Needs input instead of Needs you, making the next action explicit.

August 11, 2026 — Stable conversation history loading

Sessions now identify when earlier messages are still loading, keep the latest exchange usable, and insert the completed history without moving the reader’s visible message. A compact retry state preserves the current conversation when older history cannot be fetched.

Opening a session’s three-dot actions menu now keeps the full menu above neighboring session titles and status details, including in project-grouped views.

August 12, 2026: A repository-name case mismatch could silence an automation

A GitHub automation (including PR Review) matched an incoming webhook’s repository name against its trigger with an exact, case-sensitive comparison, so Owner/repo and owner/repo were treated as different repositories even though GitHub itself treats them as the same one. An automation configured this way never ran, with no error surfaced anywhere. Matching is now case-insensitive.

August 12, 2026: Preview chat images before downloading them

Clicking an image attached to a chat message now opens the in-app preview instead of allowing the browser to download it immediately. Download remains available as an explicit action in the preview.

August 11, 2026: Run PR Review on your connected ChatGPT subscription

The PR Review automation’s Provider control now offers a connected ChatGPT Plus/Pro subscription alongside Anthropic, OpenAI (API key), Google, and GitHub Copilot.

August 12, 2026: Earlier cloud-capacity warnings

Ara Cloud now measures the agent worker’s CPU, memory, process, and concurrent session headroom every minute and warns operators before the shared service reaches its cloud compute limits. This does not change session admission or impose a new customer concurrency limit; it gives the team time to protect active sessions and add capacity before resource pressure becomes a user- visible queue or failure.
CPU is now reported both as a share of the full cloud-compute allowance and as actual core-equivalents. Separate event-loop warnings detect when the shared Bun process becomes slow even though its multi-core host percentage still appears low.
Separate fleet warnings now track the external sandbox-provider quota. This catches the boundary where new cloud machines would be rejected even though the shared worker still has ample CPU and memory.
The worker now admits at most 50 simultaneous sessions per replica, the highest staging band that completed without a runtime failure. Additional sessions remain durably queued instead of amplifying database and Device pressure into failed runs.

August 11, 2026: Transcripts stop masking ordinary configuration values

Every workspace secret’s value was masked as *** wherever it appeared in a session transcript, streamed output, error log, or pull-request body. When a secret held a deployment value rather than a credential, that masked ordinary words: a workspace with NODE_ENV=production saw every mention of production replaced, and one with a branch or port stored as a secret lost those too.
Masking now skips values shorter than eight characters, which cannot hold a credential, and skips values whose variable name shows it is not one: framework-published names (NEXT_PUBLIC_*, VITE_*, REACT_APP_*, EXPO_PUBLIC_*, PUBLIC_*) and deployment coordinates (NODE_ENV, PORT, *_REGION, *_PORT).
A name that still indicates a credential keeps its masking even with a published prefix, so NEXT_PUBLIC_STRIPE_SECRET_KEY is unchanged, while NEXT_PUBLIC_SUPABASE_ANON_KEY is not masked.
Credential detection by shape is unchanged: provider tokens, API keys, JWTs, private-key blocks, credentialed URLs, and any long opaque token are still masked whatever they are named. Storage is unchanged too. Every workspace secret stays encrypted at rest and reaches the session exactly as before, and there is nothing to configure.

August 11, 2026: Sessions no longer end in a failed state

Sessions are durable conversations you can continue, so an attempt that stops unexpectedly is now Interrupted, not Failed. Continue the session to resume from the work and context already there.
Session status filters now use one consistent set of states: Working, Done, Needs you, Interrupted, and Stopped. The exact cause stays attached as a diagnostic reason and remains available in Logs.
Existing historical failed attempts automatically appear as Interrupted; no session history or recoverable work is removed.

August 11, 2026: Execution-target controls use product language

The internal session endpoint and web component that report whether work is running in Ara Cloud or on an Ara Device now use the product-domain name execution target.
Existing browser deployments remain compatible during rollout; this naming change does not alter where work runs or how target handoff is authorized.

August 11, 2026: Runtime errors use plain language

Session startup and failure messages now describe what happened and what to do next without exposing internal runtime names or diagnostic identifiers. Raw technical details remain available in Logs for troubleshooting.

August 11, 2026: Control how much the review bot filters away

The PR Review automation’s detail page now has a Sensitivity control: Low posts every finding (higher recall), High posts only the most severe (higher precision), and Medium is balanced. Previously this was a single platform-wide setting with no way to adjust it per workspace.

August 11, 2026: A simpler Ara home

The signed-out Ara home brings together Google sign-in, email verification, CLI installation, plans, and docs links in one compact surface.
The CLI command is always visible and copyable. Product and footer links lead to customer-facing documentation rather than separate marketing pages.

August 11, 2026: Review bot findings now default to high severity and above

Workspaces that haven’t set an explicit Sensitivity now default to High instead of Medium. A benchmark sweep showed High more than triples precision over Medium (26.7% -> 52.2%) for less than double the recall cost, so it’s the new out-of-the-box setting; switch to Medium or Low on the automation’s detail page for more findings.

August 11, 2026: See the instruction a one-click action sent on your behalf

Some buttons send the agent a longer, more specific instruction than the short line that appears in the chat. The Review panel’s fix actions work this way, so a row could read Make ready: fix conflicts while the agent received several paragraphs of detail.
Those messages now carry a View instruction toggle that expands to show exactly what was sent. Nothing new is recorded to make this work; the full text was always part of the message and simply was not shown.
Ordinary messages you type yourself are unchanged and show no toggle.

August 11, 2026: Live machine capacity in session actions

Open a cloud session’s actions menu to see a live snapshot of its storage, memory, and CPU use, plus its operating system, architecture, provider, and CPU count.
The snapshot refreshes while the menu is open. A warm machine refreshes less often. Retained sandboxes are checked before being shown as offline, so a reachable machine reports Warm even after its run has ended. If the retained sandbox is gone, the card settles on the offline state instead of presenting a capacity error.
Storage and memory bars call out elevated use at 75% and critical use at 90%, making capacity pressure visible before a repository operation runs out of room. On macOS, available memory includes reclaimable purgeable pages. The probe is on demand and never runs in the message or cold-start path.

August 11, 2026: Start a goal-driven session with @goal

Typing @goal when you start a session, or picking Goal from the @ menu, keeps the agent working until the task is verifiably done rather than until the model decides it has finished. Your message becomes the objective.
An independent reviewer, which reads your changes but cannot edit or run anything, writes the acceptance criteria from that objective and judges each one against the evidence in the diff. The checklist decides when the session is complete, so a criterion that later work breaks goes back to unmet.
The @goal token is not sent to the agent: it configures the session, and the objective is the rest of your message.
Available where your workspace has goal mode enabled, and offered when starting a session rather than on a reply, because a follow-up turn continues the existing run instead of opening a new goal.

August 11, 2026: Track how often @goal is actually used

Starting a session with @goal now records that the directive was used, separately from ordinary sessions that happen to be long-running. This is internal usage measurement only and changes nothing about how a session behaves.

August 11, 2026: Review bot uses your own connected model provider

The PR review bot now prefers a provider your workspace has connected at Settings → Models (Anthropic, OpenAI, Google, or GitHub Copilot) over Ara’s own model, when one is connected. It falls back to Ara only when nothing is connected.
The PR Review automation’s detail page now shows which model is actually in use, and lets you explicitly pick a connected provider (or Ara) instead of the automatic choice.

August 11, 2026: One set of actions for a pull request that cannot merge

The Review panel had two separate ways of offering to fix an unmergeable pull request: one that appeared from the pull request’s state before you clicked merge, and one that appeared after a merge was refused. They used different wording and gave the agent different instructions for the same problem.
They are now one. Whether a problem is spotted up front or reported by GitHub or GitLab after a refused merge, the panel names it the same way and hands the agent the same instruction.
The action now says what it will do — Fix conflicts, Fix checks, Resolve review, Mark ready for review — instead of a single generic label. Conflict instructions still match your chosen merge method, so a squash or rebase pull request is rebased and a merge-commit pull request has the base merged in.
Every one of these actions now sends its instruction straight into the session chat. Previously some filled in the message box and waited for you to press enter, and others sent it immediately.

August 11, 2026: A draft pull request offers Mark ready for review instead of a merge that cannot succeed

A draft pull request can never be merged, but the Review panel still showed an enabled merge button. Merging returned a provider error, and the failure was reported as a generic problem whose only offered action was Retry merge — which re-sent the identical request and failed again. This was the single most common merge failure.
The Review panel now recognises a draft. Instead of the merge button it shows Mark ready for review, which marks the pull request ready in place, in one click. The merge button returns once the pull request is out of draft.
A draft is also refused before the request reaches GitHub or GitLab, and it is now reported as its own condition rather than as an unknown failure, so the agent gets the same accurate reason a person does.
A draft PR that also has conflicts leads with the draft, because resolving the conflict alone would still not allow a merge.

August 11, 2026: Review panel actions are measured, including why a merge was refused

Every action button in the Review panel is now recorded: merge, the merge method you pick, changing the base branch, creating a pull request, Make ready, and the actions offered when a merge is refused. Previously only the merge button was counted, so there was no way to tell which of the others people actually reach for.
Each action also records how it resolved. A refused merge now carries a classified reason, such as a conflict with the base branch or a required check that is still failing, rather than only the fact that a button was pressed.
What is recorded is the action, the repository and pull request it applied to, the merge method, and the pull request’s mergeability and check state at the moment of the click. Reasons are recorded as fixed codes, never as raw provider error text.
No change to how any of these buttons behave.

August 11, 2026: Review bot findings default to medium severity and above

The PR review bot now keeps findings at medium severity and above by default, so routine style and naming remarks no longer show up alongside correctness and security findings.

August 10, 2026: Goal sessions stop failing on criteria nobody could check

A long-running session in goal mode is judged against acceptance criteria written by an independent reviewer. That reviewer reads your changes but cannot run anything, so criteria like “the test suite passes” could never be satisfied and held back sessions whose work was actually finished.
Criteria are now written in terms the reviewer can decide from the changes in front of it, such as which cases the tests cover, rather than results that would require running the code. Where a command’s output is available to the reviewer, it can still require that command to pass.
Criteria are also no longer written for committing or opening a pull request. Those happen after the session finishes, so they were never true while the work was being judged, and a single one could deny an otherwise complete task.

August 10, 2026: Goal-session criteria stay out of diagnostics

Long-running sessions running in goal mode derive acceptance criteria from your prompt. That wording is now kept out of platform diagnostics by default, because criteria are model-generated from your own text and a prompt carrying a credential could otherwise have it repeated back into a log line.
The number of criteria and how many are met are still recorded, so progress and adoption remain measurable. Only the wording is withheld, and it travels only when an operator explicitly enables it for a measurement window.
No change to how any session behaves or to what a goal session accepts.

August 10, 2026: The Developers page install command is copyable again

The curl install command on the Developers page now has a copy button, so the recommended way to install Ara CLI takes one click.
“Download Ara” now explains what to do with the saved file. Browsers save the installer without the execute bit, so opening it returned only permission denied. The page now says to run it with bash, and how.

August 10, 2026: Cloud machine resets now replace the machine

Session actions include a guarded Reset machine escape hatch for cloud sessions. Resetting now advances the machine identity before Ara creates the linked session, so the replacement cannot reconnect to the same unhealthy persistent machine. The old machine drains only after every active session has left it. Worktree cleanup also safely fences legacy sessions that do not yet carry generation metadata.

The transcript and pushed branch or pull-request context move to the replacement. Uncommitted or unpushed files remain on the old machine.
Completed persistent worktrees are removed after their inspection window, including both the directory and Git’s worktree/ref metadata. Cleanup and new session startup use an exclusive lease so they cannot race on the same branch.
Resetting a cloud session refreshes the session list before opening the fresh linked session. Local-device sessions continue to use their existing device controls.

August 10, 2026: More precise run timing under the hood

Ara now measures each stage of a session’s startup and wrap-up (workspace attach, tool readiness, and the moment a queued follow-up can begin) individually instead of as one total. Nothing changes in how sessions run; this is the measurement groundwork for upcoming latency improvements to session startup and queued follow-up turns.

August 10, 2026: Mention pills in the composer

@ mentions typed into the session composer (repositories, files, skills, plugins, sessions, secrets, automations) now render as a rounded pill with their icon leading the label, instead of plain colored text.
Repository mentions show the repository’s actual GitHub or GitLab mark.
Session mentions use the same pencil glyph as “New chat” elsewhere in the product, and the “New side chat” action uses it too.

August 10, 2026: Staged files survive leaving the composer

Files attached to a message but not yet sent are now kept with the draft text, so navigating away from a session and back restores both instead of only the typing.
A draft made of attachments alone, with no text yet, is now kept as well.
Drafts stay per workspace and session, and are still held only in the browser. A very large attachment that will not fit in browser storage is dropped so the typed text is kept.

August 10, 2026: A calmer Merge Bot policy page

The Merge Bot merge policy now folds into a single accordion stack: Risk tolerance, Safeguards, Maximum change size, Protected paths, Merge guidelines, plus the Always-on safeguards and Under the hood reference sections, all collapsed by default.
Sections whose values differ across connected repositories show a Mixed badge on the folded header, so cross-repository drift stays visible without opening anything.
The “How it decides” overview now reads as four one-line steps, with the full runtime explanation moved into Under the hood.

Rename, Send feedback, Jump to, and Copy session ID now lead the session actions menu, ahead of the branch, execution device, and context window details.
Copying the session’s branch name now swaps its icon to a checkmark, the same feedback Copy session ID already gives, instead of a separate text notice.
Model usage and Runtime are now shown together on one line instead of two.

August 10, 2026: Secrets move into workspace settings

Secrets now have a dedicated Settings -> Secrets page instead of living inside each repository page.
Workspace secrets are available across the workspace, not stored per repository. An optional note gives Ara and teammates usage context; include a repository name there when a secret is intended for one codebase.
Secret values remain masked and write-only. Owners and admins can manage them, while other workspace members can see names, notes, and whether a value is configured.

August 10, 2026: A calmer session handoff

Opening a session now holds the content pane with a centered Ara-logo shimmer until the session snapshot is ready, instead of briefly showing an empty or partially stale chat frame.
The loading mark follows the active theme and becomes a quiet static mark when reduced motion is enabled.
The session title is now the actions-menu trigger. It uses the same faded title and rotating chevron treatment as More/Less, replacing the separate three-dot button; title and chevron share one divider-free hover highlight.
A new-chat icon beside the session title returns directly to the empty workspace composer, without opening the sidebar first.
Mobile navigation remains available during the loading handoff without being announced as loading status, and assistive technology reads the visible session title as the heading and menu trigger.

August 10, 2026: Search inside every session

Command-palette session search now searches the full workspace session history, including archived sessions and transcript text beyond the recent sidebar window.
Matches come only from customer-visible session titles, user messages, and assistant answers. System prompts, reasoning, tool calls and tool output stay outside search results.
Ordinary assistant answers are searchable whether or not their stored message carries optional delivery metadata.
Search runs on the organization-scoped API with a short input debounce and partial database indexes for visible conversation rows, keeping hundreds of sessions responsive without downloading every transcript to the browser.

August 10, 2026: New chat controls stay in the composer

New chat now keeps the model and thinking controls inside the composer, matching their placement in an active chat instead of showing a detached row beneath the input.
The former Dashboard destination is now named Settings, uses the settings gear, and sits last in the sidebar shortcut picker. Devices and Developers now use their dedicated Central Devices and Code Brackets icons.

August 10, 2026: Tool call trace polish

The expanded list of individual calls inside a grouped tool row (e.g. “Read a file and searched files, used browser”) is now spaced tighter, so a long trace reads as one list instead of loosely separated rows.
The browser tool’s icon now matches the sizing of every other tool icon in the trace; it previously rendered from a different icon set at a visibly smaller size.
A tool call’s +N -N line-count badge no longer appears for plain command output that merely resembles a diff (e.g. --- section --- log banners or a package manager’s + name@version install listing). It now only shows for an actual unified diff.

August 10, 2026: Settings account page reorganized

The Settings account panel drops the Legal (Privacy Policy / Terms of Service) and Devices sections, and the display-language subtext under Language.
Feedback is renamed Notifications.
Profile is followed by the workspace photo, name, and ID controls directly on Settings. The redundant General page and its localhost plan switch are removed; old General links return to Settings.
Preference sections stay open instead of behaving like accordions. Appearance shows the active light or dark icon, Notifications uses a bell, and the redundant System-theme explanation is removed.
Audit Log remains its own workspace page with the full searchable, filterable, monthly-grouped activity feed instead of being folded into the Settings accordion.

August 10, 2026: Developer setup in one place

Ara CLI is now Developers in the workspace navigation, with a compact setup page for downloading the CLI, connecting Ara MCP, and installing the shared Ara Agent Skill.
ara mcp handles both the MCP connection and the skill installation for detected supported coding clients. The page also provides target-specific commands and keeps API-key management below the setup guide.
Developers and the other workspace settings pages share the same compact title treatment and a content column capped at 750px.
Ara Devices now starts with the workspace’s managed sandbox and any connected Macs, followed by the direct Terminal setup for adding a Mac. Developers stays focused on CLI, MCP, skills, and API keys; the redundant “Copy Ara CLI setup” prompt actions are removed.

The main sidebar keeps Plugins and Automations at the top. More expands Memory, Repositories, and the workspace shortcuts, with Settings kept last, so the default list stays focused while every destination remains directly reachable. Hovering More opens the sidebar picker: checked destinations stay pinned above it, and the choice is remembered on that browser. Selected shortcuts use compact black checkbox markers, and the picker waits briefly on hover so clicking More or Less never competes with it.
Only the New chat row now stays pinned at the top of the sidebar. The rest of the navigation and the session list below it scroll together as one region, so a long or expanded session list no longer squeezes the navigation into its own separately scrolling box.
The Workspace shortcuts now match New chat in label size, row height, horizontal alignment, and the full-width hover or selected highlight. The two sections also meet without an extra gap, reading as one continuous list; expanding More uses the same quick unfold treatment as Ara’s selects.
The account row at the bottom of the sidebar now opens a compact menu instead of navigating immediately. It shows the signed-in email, then keeps Settings, the region-labeled Language picker, Community, plan upgrades, the changelog, and log out together. Settings opens the account page and reveals the existing More section, while the active interface language stays checked.
Settings, Billing, Audit Log, and the other former Settings destinations now open in the main workspace without replacing the sidebar. The same workspace navigation, width, projects, and recent chats remain visible while moving between them.

August 10, 2026: Ara’s own mark shows in Models & Model router

The Models list and Model router in Models & credentials now show Ara’s logo next to Ara’s own models, matching the mark already shown on the Providers row above them. Both surfaces previously fell back to a blank dot for Ara specifically.
Hitting a run with no inference connected now opens Models & credentials instead of the upgrade checkout page, since that’s the section that can actually fix it (subscribe to Ara or connect a provider).

August 9, 2026: Dashboard’s Connect buttons skip the Plugins page

Connect on the Dashboard’s getting-started checklist now opens GitHub’s or Slack’s own authorization screen directly. It previously routed through the Plugins page first, adding an extra click before the actual connection step.

When a provider’s terms don’t allow using its subscription outside its own apps, connecting that subscription in Models & credentials now shows a brief notice with a link to the provider’s policy, so it’s an informed choice. Providers without such a restriction are unaffected.

August 9, 2026: Pooled subscriptions fail over when one runs out

When a workspace has connected more than one account of the same provider, a run now falls over to the next account if the active one hits its usage limit mid-request, instead of failing. It’s a transparent retry on the next pooled subscription before any output is produced; once a response has started streaming, that attempt is kept as-is.

August 9, 2026: Connecting a Git provider lands on the Plugins section

Opening Plugins from a workspace with no Git provider connected now opens the Plugins section, where the GitHub and GitLab rows live. It previously opened Installed whenever any built-in skill was enabled, which is the default for a new workspace, so the connect rows stayed collapsed.
Plugins accepts a ?section= link (installed, plugins, or skills) to open a specific section on arrival. The composer’s Connect Git provider link uses it.
Connect GitLab during setup now opens GitLab’s authorization page. It previously reported that it was opening and then did nothing.

August 9, 2026: No stray warning while a session continues a turn

Continuing a turn onto a new run no longer flashes a “no assistant text” warning in the transcript. The reply streams on the continuation run, so the turn it belongs to is no longer reported as silent.
Session messages always name Ara rather than an internal runtime identifier.
Copy session ID now copies the session id shown in the address bar for every session, including one that has continued onto later runs. It previously copied the most recent continuation run, which did not match the session URL.

August 9, 2026: Docs open the Ara Discord

The docs header and footer support link is now a Discord mark pointing at the Ara Discord instead of X DMs, matching the button at the bottom of the app sidebar.

August 9, 2026: Persistent cloud workspaces are available to every workspace

Eligible cloud sessions now reuse a private persistent workspace across runs in every organization, while each concurrent session keeps its own Git worktree, branch, development port, and processes.
A production canary outside the original early-access workspaces completed a dependency install, build, real framework-server lifecycle, push, and open pull request on the general-availability path.
Runtime telemetry now distinguishes local plan and control tools from physical Brain and Hands dispatches, preserves that classification across worker recovery, and avoids false tool-rejection signals.

August 9, 2026: A repository page of Secrets and Runbook

The Environment variables section on a repository is now called Secrets, matching the name used everywhere else Ara stores credentials. The editor, its import pill, and its messages all follow the same wording. Stored values are unchanged.
The repository page no longer repeats a Plugins section. Plugin connections are shared by the workspace and are managed in Skills & Plugins, so a repository now shows just Secrets and Runbook.

August 9, 2026: Ara is marked in the Providers card

The Models & credentials Providers card now places Ara’s own mark beside the included Ara inference row, matching the provider marks used for connected model providers.

August 9, 2026: Collaboration tools are available to every workspace

Presence, side chats, and bounded read-only subagents are now available in eligible cloud sessions across Ara workspaces.
Organization memory is available in Settings → Memory for every workspace. Teams can disable memory use or automatic generation whenever they choose.

August 9, 2026: Concurrent sessions get separate development ports

Each persistent cloud session now receives a product-assigned ARA_DEV_PORT. The assignment is protected by a shared lease and skips ports that are already listening, so parallel agents can run repository servers in one workspace without all choosing the same default port.
A finished session releases its lease only after the port is actually free. If a server is still listening, Ara retains the lease so a later session cannot collide with that process.
Bash already starts inside the session’s isolated Git worktree. Agent guidance now tells it to use that current directory rather than retrying commands with a guessed or redacted checkout path.
The linked worktree now checks out the session’s real ara/agent/... branch instead of an internal filesystem key, so push and pull-request creation use the same branch without a compensating second push.
Long-running Bash commands now keep the secure Hands connection alive with a protocol heartbeat. Repository builds and server checks can run past the preview edge’s idle window without disconnecting and retrying the command.

August 9, 2026: Side chats are full session tabs

Select New side chat from a session’s side-panel + menu to start a focused conversation alongside the parent. Each side chat has its own run, transcript, composer, tools, and planning workflow rather than acting as a restricted subagent.
Side chats inherit the parent session’s workspace, branch, pull-request lane, harness profile, and execution settings. Their tabs remain mounted while you move between conversations, so returning to one preserves its live context.
Parent and side-chat composers now share the same aligned footprint. A new side chat starts with a compact, fixed system notification instead of an expandable prompt bubble.

August 9, 2026: Bash-ready sessions no longer wait for a browser

Ara now opens the Hands REPL socket immediately and starts its headless browser only when a session first uses REPL. Normal replies and Bash-only work no longer pay the browser launch cost, while the first REPL call still receives the same isolated browser, context, page, and persistent session state.

August 9, 2026: Persistent cloud sessions can push their branches

Git credentials and commit identity now remain available to each isolated session process after its persistent workspace is prepared. Concurrent cloud sessions can commit, push their own branches, and open pull requests without writing credentials into the shared repository or global Git configuration.

August 9, 2026: Concurrent sessions keep their shared workspace alive

Finishing or failing one session no longer deletes a persistent cloud workspace that other sessions are still using. Each session stops only its own Hands processes; the shared workspace remains available to sibling sessions and their isolated Git worktrees.

August 9, 2026: “Cost by provider” no longer lumps most spend under “Other”

Usage & analytics → Usage by member attributed a large share of every member’s spend to a provider called Other, often the largest row on the breakdown. It was not a real provider: it was OpenAI and Anthropic usage that failed to resolve.
A run records its model as a bare name (gpt-5.6-sol, claude-opus-4) rather than a vendor-qualified id (openai/gpt-5.6-sol), and only the qualified form carried a vendor Ara could read. The same model could therefore appear as OpenAI on one row and Other on another.
Bare model names now resolve to the vendor they belong to, so each provider’s real dollar cost is shown. Other is now limited to usage with no model recorded at all.

August 9, 2026: Revert and Dream now move next to Open session

Revert and Dream now are now pill-shaped buttons next to Open session on a memory history entry, instead of living in the sidebar’s History list.
A changed file’s diff now uses the same corner rounding as a memory file’s own preview, instead of the accordion’s larger default rounding.

August 9, 2026: Faster first commands in persistent workspaces

Ara now starts the secure Hands relay while it prepares the repository instead of waiting for checkout to finish first. Bash and REPL become available sooner without changing the workspace or tool security model.
Session titles no longer compete with the first answer for the run’s inference lane, removing an avoidable retry from Ara-hosted models.
A first Bash or REPL call in a persistent workspace now waits for its already warming Hands connection instead of returning early and making the agent retry.

August 9, 2026: Memory’s sidebar is a single Settings/History/Files accordion

Settings, History, and Files are now one accordion in the Memory sidebar instead of three separate rows plus a full History panel. Only one section is open at a time, and Files is open by default.
Opening History lists past runs right there in the sidebar; picking one shows its diff in the main area, which is now full width.
The session list in the main sidebar (Projects, recent runs) now stays visible while on the Memory page, matching every other primary page.

August 9, 2026: Memory History skips empty runs and folds diffs into an accordion

Memory History no longer lists runs that produced nothing — a dreaming pass that had no new facts to promote, or a failed run, is skipped instead of cluttering the feed.
The separator lines under the panel heading and the selected entry’s title are gone.
A run’s changed files now expand and collapse as an accordion, matching the rest of the app, instead of separate bordered boxes.

August 9, 2026: Persistent workspaces provision and prepare repositories again

The persistent per-repository workspace could not be created at all: the identifier sent to the sandbox provider was built from the workspace and user identifiers verbatim, which exceeds the provider’s 64-character limit for every workspace. Every attempt failed immediately, before any work started.
The identifier is now the same short, stable digest already used to name the workspace, so provisioning succeeds.
Repository setup now keeps its internal per-session Git ref separate from the optional public API start ref. An empty start ref can no longer erase the fetched commit before Ara creates the session worktree.
Persistent sessions now offer Bash and REPL while Hands is still attaching. Calls wait behind the same bounded startup gate, so a short tool-required task no longer finishes by claiming the workspace is unavailable moments before it becomes ready.
The sandbox device now shuts Hands down before the session becomes terminal. Its completion can no longer be fenced by the finished session and turn an otherwise successful run into a forced persistent-workspace deletion.

The button at the bottom of the sidebar is now a Discord icon and links straight to the Ara Discord instead of opening a menu with Feedback and @aradotso · X DMs.
Feedback is still available inside a session by typing /feedback in the composer.

August 9, 2026: Runtime notices are visible in the transcript

When a session’s workspace finishes starting mid-answer, Ara tells the agent so it can stop saying it has no way to run commands. That message was only ever sent to the agent, so the transcript showed a reply to something the reader could not see (“Noted — the workspace is up…”).
These runtime notices now appear as a collapsed System Notification row, the same one a finished subagent’s report uses. Expand it to read the exact text the agent received, or copy it.

August 9, 2026: Memory moves to the home screen, with a real History panel and Revert

Memory now lives on the home screen next to Skills & Plugins instead of under Settings, since it is a shared, organization-wide surface rather than per-workspace configuration.
Memory History is now its own full panel: a list of past extraction and dreaming runs on the left, and the selected run’s file-by-file diff on the right.
History entries can be reverted. Revert undoes that run’s recorded changes on top of the file’s current content, and records the undo as its own history entry.
The Memory icon changed from a lightbulb to a head-with-spark glyph.

Models & credentials now lets a workspace connect more than one account of the same provider. Connect a second subscription and it appears as its own row alongside the first; the account is identified from the credential itself, so re-connecting the same subscription updates it in place instead of adding a duplicate.
Subscription sign-in is scoped to a single supported provider for now. Other providers remain available by API key.
Connecting a subscription opens the provider’s sign-in page automatically, and the device code has a one-click copy button. The device-code flow completes on its own once you approve, with no callback URL to paste back.

August 9, 2026: Analytics no longer lists a model name as a provider

The cost by provider breakdown under Usage by member could show a model name (such as gpt-5.6-sol) as if it were its own provider. Usage that does not identify a provider now rolls up under Other, and named providers are unaffected.

August 9, 2026: One Ara control plane, with Hands only when connected

Ara’s Brain and external MCP clients now use the same scoped ara_* catalogue, the same /mcp/ara transport, and the same audited handlers. A run-bound token changes authorization, not the tool contract.
Before Hands connects, a session has its scoped Ara controls plus planning and delegation. When Hands is ready, exactly bash and repl appear; disconnecting Hands removes both. Legacy local_* relay operations remain internal and are never advertised.
Repository setup now lives in .ara/runbook.md, and repository secrets are identified by connected repository, provider, and name. The old customer-facing environment, recipe, image-build, and snapshot controls have been retired.

August 9, 2026: The Analytics time range applies to the whole page, and member usage breaks down by provider

The 30 days / 7 days / 24 hours control moved out of the Activity over time card and into the page header, next to the member/team selector. It now filters the whole page, so Usage by member changes with the selected window instead of always showing lifetime totals.
Each member row now also shows PRs shipped and agent minutes for that window, plus a cost by provider breakdown of their spend across Anthropic, OpenAI, Google, and the other models Ara routes to.

August 9, 2026: See usage broken down by member on the Analytics page

The Usage & Analytics settings page now has a scope selector (all members, a configured team, or one member) and a Usage by member section showing each member’s lifetime token usage and real dollar cost. Available to workspace owners and admins.
Copy across the app that referred to change requests now says pull requests, matching the term used everywhere else in Ara.

The floating chat preview that opens when you hover a session row was wired to close on any scroll event anywhere on the page, including the session chat pane auto-scrolling while a run streams. With almost always something streaming somewhere, the preview would vanish out from under the pointer seconds after opening even though you never moved the mouse or touched the sidebar.
It now only closes on a scroll or resize that could actually move it: the window itself, or this sidebar’s own row list. Everything else is ignored.

August 9, 2026: Skills & Plugins opens every category up front

Opening Plugins used to expand only the first category (Git providers) and leave every other one - Communication platforms, Task management, Databases, Observability, and the rest - collapsed, even though they’re short, scannable grids with nothing to hide. They now all open by default.
Searching used to have the same problem: if your query matched entries in more than one category, only the first matching category expanded. Every category with a match now stays open at once.

August 9, 2026: A subagent’s transcript is its own conversation

Opening a subagent now shows its opening instruction. The child view was reusing the parent session’s first message, so every subagent appeared to have been asked whatever you asked the main agent.
A finished subagent’s report now appears inside that subagent’s own thread, where it is the answer, instead of the thread ending on its last tool call with nothing to read.
The header carries the same agent pill the chat does - lit mark, quieter label - and the session title beside it is the way back to the main thread, so the separate back arrow is gone.
The message box stays where it is while you read a subagent, but sending is declined with an explanation: only a subagent’s parent session can steer it.
Plan updates carry the same check mark as the plan itself rather than a generic tool icon.

August 9, 2026: The model picker’s trigger shows its provider logo

The composer’s model selector already showed each provider’s logo inside its dropdown; the closed button (e.g. “Claude Fable 5”) only showed the model name. It now repeats the same provider mark on the button itself, so the active model reads with its provider at a glance without opening the menu.

August 9, 2026: The review composer follows you down the thread

The comment box in Overview now sticks to the bottom of the panel as the discussion scrolls beneath it, so replying never means scrolling to the end first. It also picks up the session input bar’s shape and surface, so the two places you type in Ara look like the same control.
The merge button is a pill, matching the other actions in the review header.
The checks indicator is a progress ring rather than a filled dot - the same meter the composer uses for the context window - so it fills in as checks finish reporting instead of only changing color.

August 9, 2026: Persistent workspaces (early access)

A new workspace model, enabled per organization, keeps one cloud machine per person and repository instead of building a fresh one for every session. It sleeps when idle and wakes in well under a second, so starting a new session on a repository you already use skips the clone and setup entirely. Each session still runs in its own isolated checkout inside that machine. Off by default while it is validated on a dedicated org.

The sidebar session list refreshes its relative timestamps (“3 minutes ago”) every second, and that refresh could snap the row-hover highlight back to your open session if you rested on another row for more than about a second. The row itself and its preview still tracked the mouse correctly, but the highlight visibly jumped, making hover feel broken on a slow, deliberate pass down the list.
The highlight now stays under the pointer regardless of how often the list around it re-renders.

August 8, 2026: The agent can see which machines and repositories you have connected

A session can now ask what machines you have paired with Ara, and gets back each one’s name, operating system and hardware, whether it is reachable right now, which folders you granted it, and what that machine is able to do. This is how the agent learns it has a choice at all, rather than assuming there is only the workspace it happens to be running in.
It is read-only, and it changes nothing about where work happens: a session still runs entirely in its own workspace, and the agent still cannot reach another machine. Filesystem paths are never included, and only your own machines are ever listed.
A session can also now list the repositories connected to the workspace, which are the ones Ara can act on. Previously an agent could work in a repository without being able to check which others existed, so it had to guess at names it had only seen written down. It reads the workspace’s own connection list rather than asking GitHub, so it stays fast and costs no API quota.

August 8, 2026: A finished subagent’s report reads as a system notification

When a subagent finished, its report arrived on the transcript as a bare grey box in the browser’s default control styling, which read as a rendering fault rather than a message.
It now takes the shape of the message it sits beside: the same bubble and right-hand alignment as your own messages, captioned System Notification and marked with the subagent’s own pointer instead of your avatar, so it is clear a subagent wrote it and not you.
The full report is still one click away. Hovering the notification reveals a toggle that expands the raw text, and a copy button.

August 8, 2026: Merge Bot gets its own page

Merge Bot is a decision pipeline, not a prompt-shaped automation, and its page now says so: it opens with a four-step “How it decides” walkthrough (change opened, signals settle, risk report and gates, merge or hold), puts the merge policy front and center, and folds the assessment prompt behind a toggle instead of leading with it.
The repository list on the page grows with its content instead of scrolling inside a small box, which also fixes the page trapping the mouse wheel and refusing to scroll to the bottom.
The always-on safeguards (human vetoes, the contributor guard, fail-closed behavior) have their own section, separate from the configurable policy.

August 8, 2026: Configure Merge Bot’s policy from the automation page

The built-in Merge Bot page gains a Merge policy card: risk tolerance (zero to high), the required gates (passing checks, Ara verification, Ara-authored only, no blocking findings, human approval for protected paths), a maximum change size, branch cleanup, an editable protected-paths list, and the merge guidelines the risk assessment reads as trusted repository configuration.
The policy applies to every repository Merge Bot is enabled for. When repositories currently disagree on a value, the control shows a Mixed badge and the next change aligns them.
Members see the policy read-only; changing it stays owner/admin only, and the page now also explains what the bot does at run time.

August 8, 2026: Merge Bot’s risk assessment is back online

The merge-risk assessment runs again, now on Ara’s own inference lane with a short-lived, run-bound grant (the same mechanism that powers PR reviews). Since the earlier model retirement every audit had been forced to a conservative HIGH-risk hold; unattended merging works again for repositories that enabled it.
The assessment always uses Ara’s platform model, never a workspace’s own BYOK or subscription credentials, and every failure mode (no lane, denied grant, unparseable output) still fails closed to a hold with a visible failed execution in the Automations activity feed.

August 8, 2026: Merge Bot gains protected paths, a size limit, and branch cleanup

The migration gate is now a configurable protected-paths list (auto_merge_protected_paths, newline-separated globs, case-insensitive, rename sources included). Any change touching a matching path requires a standing human approval before an unattended merge. The default list keeps covering database migration directories, so existing behavior is unchanged.
A new size limit (auto_merge_max_changed_lines) holds any pull request whose total changed lines exceed it. 0, the default, disables the limit.
auto_merge_delete_branch deletes the source branch after an unattended merge. Fork branches and branches that other open pull requests target are never deleted. On GitLab the branch is removed atomically with the merge.
The changed-file list is now treated as merge-critical evidence: a failed read retries, and a provider-truncated list counts as touching protected paths instead of silently passing.
All three knobs are settable per repository via the admin CLI and the guardrails API today; workspace settings UI ships separately.

August 8, 2026: Merge Bot honors human vetoes and demands real CI evidence

A standing human “request changes” review now always holds the pull request, no matter what the risk assessment or the repository’s merge settings say. A later approval or a dismissed review lifts the hold.
Adding a do-not-merge label (also dnm, no-merge, dont-merge, hold-merge, or any do-not-merge/... scoped label, in any casing) vetoes unattended merging. Remove the label and push a new commit, or merge manually.
A repository with no CI checks at all no longer counts as “green”. Merge Bot waits up to 45 minutes for a first check to register, then holds with a clear reason. Repositories that genuinely run no CI can disable the green-CI requirement for the repo to keep unattended merges.
Immediately before merging, Merge Bot now re-reads the pull request and its reviews. A head that moved during the assessment aborts the merge (the new commit is assessed fresh), and a veto that arrived mid-assessment is honored.

August 9, 2026: Review is two surfaces, and the conversation is one of them

Review used to spread a change across four tabs. It now has two: Overview is the conversation - demos, description, and the discussion thread - and Code is the file diff together with the commits that produced it. Sections with nothing in them collapse instead of showing a placeholder.
The discussion composer is always open at the bottom of Overview, so leaving a comment no longer starts with finding a button. Reply on any comment aims the composer at that person, and the reply posts with that attribution.
Checks collapsed from a status card into a single dot beside the merge button. Hovering it lists every check, and each one can be copied or opened on GitHub.

August 8, 2026: Session headers lead with the session, not the repository

A session header used to read owner/repo / Session title. A session can span several repositories, or none at all, so leading with one repository described it inaccurately. The header now shows only the session title.
The same repository line is gone from the session preview opened from the sessions list. Repository context is still available on the session itself.

August 9, 2026: Sessions get their hands sooner

The machinery that lets the agent run commands used to be set up strictly after the workspace was cloned, adding a fixed delay to every session start. The half of it that does not need the repository (installing and enrolling the in-machine worker) now runs while the clone is still in progress, so the agent’s first command is available seconds earlier on every cold session.

August 9, 2026: Concurrent canary sessions keep their workspace work isolated

Persistent-workspace canaries now assign every session its own worktree, public pull-request branch, and development port even when several sessions share one machine. A session releases only the port and processes it owns.
Long quiet commands keep their command channel alive, so a build or server probe running past a network idle window does not reconnect halfway through.
Bash calls also tolerate bounded wrapper hints produced by supported models; execution limits remain product-owned, while unknown fields still fail closed.

August 8, 2026: A session picks its tools up the moment its workspace is ready

An agent that started before its workspace was ready did not get the ability to run commands back until its next message, even though the workspace often arrived seconds into the first one. For the rest of that answer it had no way to run anything, so it reported the task as impossible instead of doing it. The workspace’s tools now reach the answer already in progress.
The agent is also told, in the moment, that its workspace is ready, so it stops working from an earlier conclusion that it had no way to run commands.

August 8, 2026: Session machines sleep the moment your run ends

A session’s cloud machine now suspends as soon as its run finishes, instead of being held awake by background helpers (the preview supervisor, the terminal bridge, the recording and browser processes). Only the run’s own worker keeps the machine active, and it is bounded by the run’s time budget, so a machine can no longer stay hot after the work is done.
Nothing you see changes: previews, the terminal, and the file browser wake the machine transparently on the next request (well under a second), and long-lived helpers survive the sleep and resume where they left off.
Follow-up: the process that carries a live run’s commands now also counts as “the run is active”, so a machine can never doze off in the middle of a long model turn; it still sleeps the moment the run actually ends.
The platform now audits the whole machine fleet every few minutes and flags any machine that is awake with no session using it, so a machine that fails to fall asleep is caught by monitoring instead of by a bill.

August 8, 2026: The model picker keeps up with the pointer

Moving between providers in the model picker used to leave the previous provider’s models on screen for a moment before the new ones appeared. The options panel now swaps as soon as you move, so the list always matches the provider you are pointing at.
The provider list scrolls under the Settings link rather than pushing it off the panel, so the route to Models & credentials stays in place however many providers a workspace connects.

August 8, 2026: A roomier model picker, and a branch that stays under the composer

The model picker is wider, drops the rule under its search field, shows each model’s provider logo beside the model name (not just on the provider row), and ends with a Settings link for connecting more providers.
The branch under the composer no longer hangs past the left edge of the input on a long branch name. It now truncates instead, so the device and context ring stay put.

August 8, 2026: Branch and device act like the controls they are, and providers show their logos

Under the composer, the branch and the execution target now read as pills with the same hover and focus treatment as the model and thinking selects beside them, instead of looking like plain text. Clicking the branch still copies it; clicking the execution target still moves the session to another workspace.
The model picker’s provider list now shows each provider’s logo in front of its name, the same marks the Providers settings card uses.

August 8, 2026: See when a session’s model, provider, or thinking level changes

Changing the model partway through a session used to be invisible: later turns looked identical to earlier ones even though they ran on different settings. The transcript now marks the switch inline, between the turns it separates, with a note such as Model changed from GPT-5.6 Sol to GPT-5.6 Terra. The same note appears when the provider changes or when the thinking level changes, so it is clear which settings produced which answer when you look back at a session. This holds for a switch made between turns, which starts a new run behind the scenes: the note still appears above the first turn that used the new setting. Model names in the note match the model picker exactly, so a switch to GPT-5.5 reads as GPT-5.5 rather than splitting the version off the family name.

August 8, 2026: The agent says something before it starts working

On a new session the agent now answers you first and picks up its tools on the next step, instead of running a planning step before it has said anything. That planning step was costing about seven seconds of silence on a typical first message, and nothing was on screen until it finished.
Sessions whose workspace is already warm are unaffected: the agent has its full toolset from the first message, as before.

August 8, 2026: The branch and execution target are visible again under the composer

The row beneath the message box lists the session’s branch, where it runs (Cloud or a connected device) and how much of the context window is spent. The branch and execution target were being painted over by the composer’s own backdrop, leaving that part of the row blank. They now render again.

August 8, 2026: A session no longer claims it cannot do something while its workspace is still starting

A workspace takes several seconds to come up, and a command run in that window did not execute. The agent now retries once the workspace lands instead of reporting the capability as unavailable, so a question like “what time is it in India” gets a real answer rather than an apology.

August 8, 2026: Subagents wait for their workspace before answering

A subagent could finish before its workspace finished starting and report that it had no way to run commands. Subagents now start with their full tool set and wait for the workspace instead of answering without it.

August 8, 2026: Subagents start correctly in enabled workspaces

Delegating to subagents failed immediately in every workspace where it was turned on. The lookup that enforces how many subagents may run at once was querying a table that does not exist, so the request errored before any subagent started. Delegation now works, and the same fix covers cancelling a parent’s subagents when the parent stops.

August 8, 2026: See what a compacted session’s follow-ups will inherit

When a finished session has been compacted, the session’s ··· menu now shows a Context summary section with the summary your next follow-up will start from (plus a short tail of the most recent turn), and when it was generated. Long summaries are collapsed by default with a Show full summary toggle.

August 8, 2026: Skills & Plugins now stays compact while you browse

Skills & Plugins puts connected tools in an open Installed section before the plugin catalog, then groups every remaining plugin category into the same spring-open sections used across Ara settings. Open the group you need and the previous one folds away; the scope choice and search continue to apply. Plugin rows keep their generous click target, but hover now stays on their controls and icon instead of tinting the entire row. The two-option scope choice uses the same segmented control as Automations.
Skills remain their own sibling catalog section, without the old collection cards or visual divider system.
Added skills now sit with connected plugins in the open Installed section, using the same compact icon grid and name-on-hover treatment. The old skills.sh collection browser has been removed; searching now shows public skill results directly in the same responsive two-column rows as plugins.
The Installed skills strip stays to one compact row; its +N tile expands the remaining skill icons inline.
While searching Skills & Plugins, every top-level section with a match opens together; sections without a match stay folded.
The page now uses the same high workspace header as Automations: compact search and activity controls live beside the scope and type pills, and repository-authored skills appear in the workspace catalog instead of behind a repository filter. Skills & Plugins activity records actual skill reads and connected plugin tool calls, linking back to the session without showing tool arguments or results.
Two-option choices on Automations and Skills & Plugins now use the rounded-square segmented control.
Opening a skill now uses Ara’s normal session-style Files sidepanel: the selected SKILL.md is a closable file tab instead of a separate properties view. Curated MCP setup pages now use the same spring-open sections for connection, credentials, endpoint, and skills; connection actions use the shared status badge, switch, and pill buttons.
Organization-authored skills now carry the workspace avatar (or its initial fallback) in the Skills grid. Ara-provided skills carry a small neutral Ara source mark. Their SKILL.md file panel includes copy-reference, copy-path, and direct Pierre editing actions while the normal view remains rendered Markdown.
Organization memory files now use that same rendered Markdown viewer and direct editor instead of a separate raw-text textarea.

August 8, 2026: Images and videos the agent touches now appear in chat automatically

When a command the agent runs saves or references an image or video in its workspace, that file now appears inline in the session chat automatically, the same way a file you attach yourself renders. There is nothing to ask for: a screenshot taken, a chart generated, a diagram written to disk all surface the moment the agent’s command output points at them.
This is a repair, not a new feature: it restores behavior that was live before the runtime change in early August and had gone quiet since.

August 8, 2026: The agent replies first when its sandbox is still starting

While a repository is still being cloned, the agent is no longer offered the commands it cannot yet run. It answers you with what it knows, and the commands become available the moment the sandbox is ready. Previously it reached for a command, was told the sandbox was still starting, and tried again, so nothing appeared on screen until the setup had finished.
Sessions whose sandbox is already warm, including most follow-up messages, are unchanged: the commands are there from the first message as before.

August 8, 2026: Cleaner results from self-verifying sessions

Sessions that run the experimental self-verification loop no longer show the loop’s internal completion marker at the end of the final answer or the session summary. The marker is coordination between the agent and its verifier, not part of the result.
No change for ordinary sessions.

August 8, 2026: Ephemeral preview environments can run full agent sessions

A cloned preview deployment of the platform (an environment named preview-*) now routes model-inference grant redemption to its own API origin instead of the shared production endpoint, so agent chats in a preview environment complete end to end against that environment’s own isolated database. Production and staging routing are unchanged, and a preview origin is only ever the deployment’s own platform-provided domain.

August 8, 2026: The queue only appears when messages are actually stacking

A message sent while the agent is working now goes straight to the agent when nothing else is waiting, and appears in the conversation like any other message. The queue was holding every mid-run message, so a single reply sat above the message box with Steer and remove controls around it, waiting for a step to finish, before dropping into the chat seconds later.
The queue still does its job the moment it has one: send a second message while the first is still on its way and it waits, in order, one per finished step. Steer still jumps a waiting message to the front, and removing one before the agent reaches it still takes it out entirely.
Releasing, cancelling, or reordering a queued message now updates every open view of the session immediately. Those changes were previously only recorded, so a browser could keep showing a message as queued after it had already gone to the agent.

Opening a saved session keeps that session selected in the sidebar. Moving back to New Task or to a top-level page such as Repositories or Automations transfers the shared highlight to that destination instead.
The previous resting highlight can no longer remain on New Task after you open a session, so the sidebar now always reflects the page currently open.

August 8, 2026: `/compact` always works, including on finished sessions

Compacting a session no longer requires a live run. On a finished session, /compact now summarizes the whole conversation in the background, and your next follow-up starts from that summary instead of only the tail of the last turn. Triggering it again when nothing new has happened answers “already compact” instead of showing a red error card.
The toast reports what actually happened - requested for the next model step, queued for a run that has not started, running in the background, already compact, or out of credit - instead of announcing “Context compacted” before anything had run.
A compaction request made while a run was starting up used to be silently dropped after the toast said it was accepted; it now applies at the run’s first opportunity, and a request that arrives just as a run finishes says so in the transcript instead of vanishing.
The transcript now shows a “Context compaction” row while a summary is being generated and when it completes.
On workspaces that bring their own model keys, Ara never starts model calls on your credentials: /compact on a finished session answers “already compact” there, and follow-ups still start from a compact summary of the prior turn.

The session composer’s / menu now lists Compact context as a dedicated entry beside your skills. Picking it summarizes the older part of the conversation to free up context, exactly like typing /compact, and the entry only appears while the session has a live run that can be compacted.

August 8, 2026: Sessions can move between a cloud workspace and your Mac again

The “Continue on” picker in a session works again. Choosing a new location used to fail with a raw harness1_target_handoff_required error for every session; picking a fresh cloud workspace or one of your paired devices now continues the session there. The moved session keeps its conversation context, model settings, and pull request, starts from the session’s branch, and the picker’s promise holds: a cloud move lands in a genuinely fresh sandbox, never a reused one. Only pushed work travels; the original session is stopped once the new one is safely queued.

August 8, 2026: Workspace controls now follow one interaction system

Settings, Automations, Templates, analytics, the command palette, Ara API, and Review now use the same compact animated controls: two-option mode choices use a segmented squircle; peer views and filters use a pill tab group with one moving active surface. The Review’s Overview, Discussion, and Commits group sits in the Review header, above the divider that separates it from the checks and changed files.
Settings and automation lists share one resting hover/selection surface across grouped rows. Repository and automation configuration now use the same spring-open sections, while non-expandable groups use the matching quiet rounded surface rather than a one-off card treatment.
Choosing a model and thinking level when starting a task is now two explicit controls below the message box. Trigger selection follows the same nested source-to-event menu pattern, so dependent options appear beside the choice that revealed them.
The model control now picks a provider first and then its available model, so connected providers can grow without turning the composer into one flat mixed list. Opening it starts with the provider categories; the model panel unfolds only after you choose or focus a provider. If a saved provider model becomes unavailable, it stays visibly named as the current selection until you choose a replacement rather than being represented as a different Ara model. In an existing session, its branch and where it is running remain visible on the left below the composer while the model controls stay on the right.
Opening a repository or an automation now uses the same compact navigator as a session: its source, a /, and the item title sit in the top rail. The existing edit, run, save, and more actions remain exactly where they were.
The redundant session-summary icon has been removed from the session rail; the session menu and panel control remain available there.
The composer summary pill now groups plan progress, changed files, and active subagents in one row, with | dividers and an independent action for each segment. Its active-agent segment opens the full subagent list rather than choosing one worker arbitrarily.

August 8, 2026: The agent can ask for a missing plugin or secret right in the chat

When the agent hits a service it cannot reach (an unconnected plugin, or a missing API key), it can now surface an inline card in the session chat: Connect adds a plugin with one-click OAuth, and Add secret takes the value without it ever appearing in the conversation. This restores a capability that had been dark since the runtime cutover in early August.
The cards never block the run. The agent keeps working on what it can, a saved secret is injected into the live sandbox for the agent’s next turn, and a newly connected plugin takes effect on the next session.
A secret the agent asks for also appears immediately as a to-fill row in the repository’s Environment tab, so you can add it from there instead if you prefer.

August 8, 2026: Bring your own model server as a provider

Settings -> Models gains a Custom endpoint provider: point it at any OpenAI-compatible server you host yourself (vLLM, SGLang, Ollama behind a proxy, a LiteLLM gateway) with a base URL and an API key, and its models appear in the session composer’s model picker alongside the other providers you have connected.
On connect, Ara asks the server for its model list automatically; if your server does not expose one, list the model IDs yourself in the form. The wire format defaults to OpenAI Chat Completions, with OpenAI Responses and Anthropic Messages available for servers that speak those instead.
Runs on these models call your server directly and are billed by nobody: like other connected providers, usage happens on your own infrastructure and never spends Ara credits. The base URL must be a public https address; keys are stored encrypted and are never shown back.

August 8, 2026: Queued messages start their turn the moment the agent answers

A queued message now begins its turn immediately when the agent finishes the previous one, in the same live session. Before, the message released from the queue could miss the closing run and restart the agent from scratch, which showed up as the message sitting in the queue for several seconds before it entered the chat.
The session now also waits for a message that is mid-delivery before wrapping up, so a reply sent in the instant the agent finishes is picked up live instead of restarting it.

August 8, 2026: Mid-run messages queue up and go in one per finished step

Sending a message while the agent is working now adds it to a queue instead of interrupting the current step. The agent finishes what it is doing, and Ara hands it exactly one queued message each time it settles a step, so a burst of thoughts arrives as a sequence of clean instructions rather than all at once mid-task. Previously every mid-run message was injected at the next turn boundary regardless of what else was waiting.
The queue sits above the message box, and each entry can be reordered by dragging, edited (which returns it to the message box), or removed before the agent ever sees it.
Steer on a queued message is the override: it skips the queue and goes into the agent’s very next turn boundary, the way every mid-run message behaved before.
The queue now lives with the session rather than in your browser, so queued messages survive a reload, are visible to everyone watching the session, and are never lost if you close the tab. If the run finishes while messages are still queued, they start a continuation run instead of being dropped.

August 8, 2026: More credential types are masked in what an agent writes out

Pull request titles, issue titles, and issue comments written by an agent are checked for the run’s own secret values before they leave for GitHub or GitLab. That check now also covers connector credentials and workspace MCP server secrets, not just the secrets you set under Secrets and Environment.
Redaction is also more resilient: if one source cannot be read, the others are still masked, where previously a single failure fell back to pattern matching alone.

August 8, 2026: Agents answer without waiting for their sandbox

An agent now replies as soon as it has something to say, whether or not its sandbox has finished starting. Previously, if the agent reached for a command before the sandbox was ready, the whole reply waited behind repository cloning and toolchain setup, so a question that needed no commands at all could sit silent for a minute.
If the agent does run a command before the sandbox exists, it now waits a couple of seconds and is then told the sandbox is still starting, rather than blocking indefinitely. Nothing is executed and nothing changes on disk, so the agent answers with what it knows and picks the command back up once the sandbox is there.

August 8, 2026: The same secret name can differ per workspace

If you belong to several workspaces you can now save a secret under the same name in each one, holding a different value per workspace. Until now the name had to be unique across your whole account, which was the last piece of making personal secrets workspace-scoped.
Nothing changes for a single workspace, and no existing secret is affected.

August 8, 2026: Screenshot and recording links serve verified media only

Images and recordings attached to a pull request by an agent are now checked in full before Ara serves them, and Ara serves the checked bytes rather than redirecting to the stored file. Previously only the first few bytes were inspected, which was not enough to tell a real screenshot from another kind of file wearing an image header.
Comment and metadata segments are removed from what gets served. Those sections exist to hold arbitrary text, so a picture can look perfectly valid and still carry something in them. Real captures are unaffected apart from the encoder’s own padding.
Anything that does not parse as a complete image or video is not served at all. A capture that failed to upload cleanly now returns not-found instead of a broken file.

August 8, 2026: Credit held for a model request that failed is always given back

When a model request failed before the provider reported anything about it, the credit reserved for that request could stay held indefinitely: the workspace’s available credit was lower than its balance implied, and nothing was ever charged for the failed request. Those holds are now released within minutes of the failure, and a failed request that can never be priced is never billed. The holds that had already been stranded before this change have been returned as well.

August 8, 2026: Your personal secrets belong to one workspace

A secret you save under Secrets is now scoped to the workspace you saved it in. Previously a personal secret was attached to your account, so if you belonged to more than one workspace it was injected into every run you started in any of them.
If you work in a single workspace nothing changes: the same secrets, in the same place, behaving the same way.
If you belong to several workspaces, each one now keeps its own set. You can hold a different value under the same name per workspace, and adding or removing one no longer affects the others. Existing secrets were moved to their owner’s workspace, so nothing was lost.
Every other kind of secret in Ara (project secrets, connectors, MCP servers, API keys) was already scoped this way; personal secrets were the exception.

August 7, 2026: The command palette opens instantly, and dragging stays smooth

Opening the command palette with Cmd/Ctrl+K no longer plays an entrance animation. The palette is there on the next frame, so typing immediately can never race the surface sliding in; only the backdrop still fades so the page behind it does not hard-cut.
Swiping the mobile sidebar open, and sweeping the pointer down a list of sessions, automations, repositories, or settings entries, now stay smooth under load. Both used to move their highlight and their drawer by changing layout on every frame of the gesture.
On touch devices, cards and buttons that lift when a mouse hovers no longer stay stuck in the lifted state after a tap. Their color, border, and shadow feedback is unchanged, on touch and with a mouse alike.
The pointer and highlight the agent draws while it works in a browser no longer force the page it is working in to relayout as they move between elements.

August 7, 2026: Scheduled automation runs start again

A run started by a schedule failed a couple of seconds after it began, without doing any work, and its history showed a billing error even though the workspace had credit and minutes available. Only scheduled runs were affected; runs you started yourself, and runs triggered from GitHub, were not. Scheduled runs now start normally, and no billed minutes were consumed by the failed attempts.

August 7, 2026: `/compact` now compacts short conversations, and says so when there is nothing to compact

Typing /compact in a session summarized earlier history only once the conversation had grown past the automatic keep-recent budget; below that it silently did nothing. A manual request now summarizes the older half of the conversation and keeps the recent half, so it does visible work at any length.
When a request genuinely has nothing to fold, or the summary could not be produced, the session says so in the transcript instead of leaving you guessing.

August 7, 2026: Secrets are masked in run error messages, and API-key expiry fails loudly

When a run fails, the error shown on the session, sent in notifications, and carried into the next turn is now redacted before it is stored. A failed git clone used to be able to surface the credentialed URL Ara clones with; that value is masked now. Ordinary failures are unchanged and stay fully readable.
Redaction also recognizes Ara’s own credential formats (Ara API keys, per-run agent tokens) and GitHub fine-grained and GitLab tokens, so those are masked anywhere Ara shows agent output.
Creating an API key with an unsupported expiry now returns a clear error instead of quietly creating a key that never expires. The supported values are unchanged — never, 30 days, 90 days, and 1 year — so the picker in Settings behaves exactly as before; this only affects scripted calls that passed some other number.

August 7, 2026: Follow-up messages start much faster

Replying to a session no longer rebuilds the workspace from scratch. When the previous turn’s sandbox is still warm, the follow-up reattaches to it and reuses the repository that is already checked out, instead of provisioning a new machine and re-cloning. On a large repository that removes the great majority of the wait before the agent starts working, and the saving grows with repository size.
A follow-up only reuses a workspace belonging to the same repository, and only after confirming the checkout is intact. Anything else falls back to the ordinary fresh setup, which behaves exactly as before.
The speed-up holds for the whole conversation, not just the first reply. A warm workspace is now held from the most recent turn that used it, so a long back-and-forth keeps reusing it instead of losing it partway through and rebuilding.
Separately, an internal network self-check that ran before every session now runs alongside the setup work instead of ahead of it, removing a few seconds of waiting from every session start, including the first one.

August 7, 2026: Opening a session puts the caret in the message box

Opening a session now focuses its message box immediately, so you can start typing your next instruction without clicking into it first. The sessions list already behaved this way; the session page now matches. Session previews and embedded thumbnails still leave focus where it is.

The “Update payment method” link in a failed-payment email, and the same action in the paused-workspace banner, now open Stripe’s payment-method flow directly instead of leaving you on the billing settings page to find it. If the workspace is signed out, you sign in first and then land in the same flow.
Re-buying the package a workspace already sits on no longer reports a portal error before it succeeds. The purchase behaved correctly either way; only the reporting was wrong.
Trial card verification no longer fails on a card whose bank asks for extra confirmation. Verification could not complete for those cards at all, and the trial now proceeds as it does whenever verification cannot reach a verdict.

August 7, 2026: Motion polish across lists, tabs, settings, and async buttons

Hovering a list now moves one shared highlight that glides between rows instead of each row lighting up on its own. This applies to the session list in the sidebar, the built-in and custom automation lists, the repository list under Codebase, the settings navigation, and every dropdown/picker menu built on the shared select.
Tab strips (execution history, codebase sections, dashboard activity, the Ara CLI setup targets) animate one indicator between tabs rather than switching instantly.
Async actions give live feedback: Connect/Save on MCP server setup, Create automation, and the billing spend-limit Save now show a spinner while working and morph back when done, instead of appearing to do nothing.
The team spend-limit dialog on Billing smoothly resizes between limit types instead of jumping.
Audit Log groups each month into a rounded, spring-animated collapsible section; the newest month starts open.
Personal Preferences now groups collapsed sections into quiet rounded surfaces; opening one setting separates it with the same spring motion, without changing any existing controls.
Counters (execution history stats), status badges, checkboxes (API key scopes), and toggles (MCP enable, memory enable) animate their state changes. All motion respects the reduced-motion system preference.

August 7, 2026: Ara subscription inference now runs on a single provider gateway

Every model in your Ara subscription is now served through one inference gateway instead of two. The selectable models, their context and output limits, your published per-model prices, and workspace credit behavior are unchanged.
Your charge is still computed from Ara’s published price for the model you picked, independently of what the gateway costs Ara. A request that cannot produce authoritative evidence of what it served holds its exposure and reconciles rather than creating a guessed charge.
A request stays bound to one route and one price for its whole lifetime, and models are withdrawn or restored one at a time, so an operational change never affects a generation already in flight.
This lane covers subscription usage only; supplying your own provider API keys is not part of it.

August 7, 2026: Tool activity shows the real command that ran, and memory search results are now clickable

A repl or bash tool call’s activity row now always shows the real, verbatim command or code that ran, as its own line — immediately once the call starts, not only once it finishes. Previously, some calls (particularly file search and Ara capability calls like memory or skills) either paraphrased this into a generic label or, for a narrow but real class of calls, showed the raw JSON payload the tool actually received instead of the code itself.
That command line now reads at full text strength, while its result stays at the activity pane’s normal muted tone — the same contrast a terminal keeps between a live command and dimmed scrollback.
A completed call’s Success or Failed badge now shows next to the pane’s header for every kind that has one, not only shell commands.
ara.memory.search results render as a real list of matches (title and snippet) instead of raw JSON, and each match links directly to that file on the organization’s Memory settings page.

August 7, 2026: The provider list is now visible on Model settings

Model settings now shows the providers Ara’s agent runtime can authenticate, under Ara’s own row. Providers are grouped by whether you would connect them with an existing subscription or with an API key.
Connecting your own provider is still not available, so the entries are shown but not selectable and the reason is stated inline. No credential is requested or stored, and nothing about billing or model selection changes.

August 7, 2026: A session no longer fails because its own title was being generated

A new session names itself with a short model call while the environment starts. That call shared the session’s single model channel with the agent’s first reply, so the two could collide and the whole session failed immediately with a message about a reached AI usage budget — even on workspaces with their full budget available.
The naming call now yields the channel on a deadline, and a first reply that arrives during naming waits its turn instead of failing.
If a collision ever does surface, the session now says the model channel was briefly busy and to retry, instead of pointing at a budget that was never involved.

August 7, 2026: Short model answers no longer fail on the second inference route

A request with a small output budget, such as the one that names a new session, asked for reasoning it could never fit and failed outright on the newly staged route. Those requests now run without extended thinking instead of failing, so session titles and other short answers come back as expected.

August 7, 2026: Model settings show which providers Ara’s runtime can talk to

The Providers card under Model settings now lists the providers Ara’s agent runtime can authenticate, grouped by whether you would connect them with an existing subscription or with an API key. The list comes from the runtime itself, so it stays accurate as the runtime adds providers.
Ara stays first in that list and is included with your workspace, exactly as before. Nothing about how your sessions are billed or which models you can pick has changed.
Connecting your own provider is not available yet. The list is there so you can see what is coming; no credential is requested or stored.

August 7, 2026: Memory, skill, and plugin activity icons now cover the raw tool-call path too

A memory, skill, or plugin call now shows its dedicated icon in session activity even when the model reaches it through the generic tool-call bridge (ara_memory_manage, ara_skill_manage, ara_plugin_call, ara_plugin_tools, ara_plugin_list) instead of the shortcut method. Previously only the shortcut form got the specific icon; the raw form fell back to a generic badge.

August 7, 2026: MCP servers and merge guardrails are owner/admin settings

Installing, editing, connecting, or removing a workspace MCP server now requires the owner or admin role. An MCP server is workspace-wide execution config: it runs inside every agent run in the workspace, including runs other people start. Members still see the installed list and the marketplace, and the controls now say so instead of failing when used.
Changing a repository’s Merge Bot guardrails — enabling auto-merge and its “CI green”, “Ara verify”, and “no blocking findings” requirements — likewise requires owner or admin. These decide whether agent-authored pull requests can reach your default branch unreviewed.
Both settings were already owner/admin-only through the public API; the web app now matches. Nothing changes for owners and admins.

August 7, 2026: Sessions are named by the agent, and session actions moved onto the title

A new session is now named by a short call to the same harness that runs it, so the title describes what you asked for instead of repeating the first line of your message. Naming happens while the environment is still starting, so it never delays the first reply, and an unusable answer falls back to the previous behavior. Renaming a session yourself always wins, and follow-up turns never re-name a session you already named.
The session header now leads with that title, and the ⋯ menu sits beside it rather than off in the top-right controls.
That menu gains Send feedback, Copy session ID, Archive, and Delete alongside Rename, and still shows the session’s model usage and runtime. Delete asks for confirmation and cannot be undone.
Workspaces that paused title generation under Automations are unaffected: their sessions keep the name derived from your message.

August 7, 2026: A second inference route can be staged behind the same spend controls

Ara’s inference plane can now hold more than one aggregation route per model. A route is staged disabled, enabled per model by an operator, and disabled again to roll back; the enabled route keeps serving in the meantime. Model choice, pricing, and workspace credit behavior are unchanged.
A request is bound to one route for its whole lifetime, so a route change never affects a generation already in flight.
Whichever route serves a request, the customer charge is still computed from Ara’s published model price. A route that cannot produce authoritative evidence of what it served holds its exposure and reconciles instead of creating a guessed charge.

August 7, 2026: Replies are plain prose, and quoted or tabular text is never rendered faded

Ara’s replies no longer use markdown tables or emoji. Content that used to land in a table now reads as plain prose with inline references and hyperlinks instead.
Text inside a blockquote or a markdown table (for older messages, or content a connected tool returns) no longer renders in a dimmed secondary color — it matches the same text color as the rest of the answer.

August 7, 2026: Reasoning reads at full strength and can show its own headline

Reasoning text in the live work history no longer renders at a dimmed, secondary text color once expanded — it now matches the full-strength text tool rows already use when opened, and its left indent (which did not align with any icon) is removed.
When a model’s reasoning arrives as a short headline followed by a detailed paragraph, Ara now shows that headline as the row’s label instead of the generic word “Thinking”. Reasoning that has no distinct headline keeps the previous “Thinking” label.

August 7, 2026: Organization memory adds AGENTS.md and SOUL.md, and session activity shows real icons for memory, skill, and plugin calls

Organization memory’s always-loaded L1 briefings now include AGENTS.md and SOUL.md alongside USER.md and MEMORY.md for hard operating rules and persona/tone.
Session chat activity rows for ara.memory.*, ara.skills.*, and ara.plugins.* calls now show a dedicated icon per capability instead of a generic tool glyph: a memory mark for memory calls, the same skill mark used in the / composer menu for skill calls, and the connected plugin’s own favicon for plugin calls (falling back to a generic plug mark for unrecognized plugins).

August 7, 2026: Follow-up messages always get picked up

Replying to a session whose previous turn had already finished could leave the new message waiting forever, showing a spinner that never resolved. The queue entry those replies create was routed to a retired runtime lane with nothing left to pick it up. That lane is removed, and follow-ups are now claimed by the ordinary session worker like any other work.
Queue ordering, per-workspace concurrency limits, and change-request serialization are unchanged. Starting a brand new session was never affected.

August 6, 2026: Security hardening for IP allowlists, label triggers, and webhooks

An organization’s IP allowlist now applies to the web application, not only the public API. Previously a workspace that restricted access to specific IPs was still reachable from any address through the web app; the same allowlist is now enforced on both surfaces.
Starting an agent run by applying a trigger label to an issue now requires the person who applied the label to have write access to the repository, matching the existing rule for “@ara” mention requests. Someone who can only apply labels (for example a triage role or an outside collaborator) can no longer kick off a run.
Repeated (replayed) GitHub and Linear webhook deliveries are now detected and ignored, so a captured delivery cannot be replayed to trigger duplicate work.

August 6, 2026: The unified capability plane is the only MCP surface for sessions

The legacy connector gateway route is retired after a week of zero usage. Sessions reach Ara capabilities and connected plugins through the single unified endpoint, and the temporary migration shim is removed rather than left dormant.
No connected integration changes; existing connections keep working through the unified plane.

August 6, 2026: Complete skill bundles, not just SKILL.md

On-demand skill fetches now include the whole bundle: companion references, scripts, and assets beside SKILL.md travel with it, each with its own digest and a bundle-level digest over the set. Bundles with unsafe paths, symlinks, or excess files or bytes are refused rather than served partially.

August 6, 2026: Read-only review runs can call provably read-only plugin tools

A review run no longer needs write-capable plugin authority for a tool that is provably safe: a call proceeds only when the provider’s own negotiated tool annotations mark it read-only AND the tool is named in Ara’s curated per-plugin allowlist. Anything unannotated, destructive-marked, or unlisted still requires write authority, and every decision is recorded in telemetry.
Provider annotations alone never grant access: they are untrusted data until Ara’s own policy agrees.

August 6, 2026: Skill adherence is judged, not assumed

A run that was offered a skill is now evaluated on whether the agent actually read the skill before doing other tool work. Only a dedicated read operation counts — mentioning the path does not. Delivery, read, and behavior are separate evidence: the run log records which skill files reached the sandbox, which bodies were fetched, and a deterministic oracle judges the ordering on the real trajectory.
This is verification tooling. Session behavior is unchanged.

August 6, 2026: Package-bundled skills are readable on demand

Plugin skills whose bodies ship inside the sandbox image are no longer read-only names in the catalog: when a skill carries a pinned package source, Ara fetches its full instructions on demand through the capability plane, with the same host allowlist and size guards used at image-build time. The response reports where the body came from and whether it was served from the short-lived read cache.
A skill with no resolvable source still says so plainly instead of pretending to be readable, and a failed fetch returns a typed error rather than a fabricated body.

August 6, 2026: The agent runtime gains a zero-cost end-to-end proof lane

Ara’s agent runtime can now be exercised end to end, from run claim through sandbox tool execution to the final transcript, against a deterministic scripted model instead of live inference. Deploys of the runtime are verifiable without spending model credits and without depending on provider availability.
The runtime’s sandbox tool layer (shell and browser REPL) is now also proven in continuous integration on every commit, using the exact production code paths rather than stand-ins.
This release adds test and operator tooling only. The proof lane is disabled by default, has no user-facing controls, and does not change how ordinary sessions run.
Follow-up: the internal session surface now accepts the proof lane’s sentinel model for explicitly allowlisted internal workspaces, so operators can start a proof run at all, and the sentinel survives enqueue-time model resolution instead of silently falling back to the workspace default. The public API and every ordinary workspace continue to reject it.

August 6, 2026: The Ara plugin now speaks the Agent Plugins standard

Ara’s self-authored plugin now ships a standard root plugin.json and mcp.json in the vendor-neutral Agent Plugins 1.0.0 layout, so any compatible agent client can discover its skill and connect to Ara’s capability plane over Streamable HTTP. Existing supported client installations continue to work through their native manifest.
A conformance test now validates the package against the published schemas on every change, so the layout cannot silently drift.
This changes packaging only. No session, connector, or API behavior changes.

August 6, 2026: One skill catalog across personal, workspace, plugin, and built-in skills

Ara’s skill listing is now a unified, metadata-only catalog spanning your personal skills, workspace skills, plugin-bundled skills, and built-ins. Every entry carries a stable qualified id, its source, a content digest, and its activation keywords, and the full body is fetched on demand by id instead of occupying the prompt.
Name collisions no longer resolve silently: the catalog reports which entry won and why, and equal-priority ties return explicit choices.
Skills whose bodies ship inside the sandbox image are now listed with an honest availability state instead of disappearing from view.
No existing skill management behavior changes; create, update, and delete work exactly as before.

August 6, 2026: A published security contact for reporting vulnerabilities

Ara now publishes a security contact at ara.so/.well-known/security.txt, the standard location security researchers check. Reports go to security@ara.so, which is a monitored address. Previously the reporting policy lived only in a private repository, so there was no way for someone outside the company to find out how to reach us.

August 6, 2026: Connector plugins gain a repeatable acceptance proof

The new provider-acceptance contract makes a connected plugin prove discovery, returned-schema use, exactly one provider dispatch, duplicate refusal through invocation identity, and matching run evidence before it graduates beyond the current rollout boundary.
Context7’s resolver is the reference fixture. Production proof remains a human-visible session transcript plus exact-run observability; the repository script only prints the contract and runs the deterministic test fixture.
This release adds test and operator tooling only. It does not change production capability gates or connector behavior.

August 6, 2026: Repository secret values are owner/admin only

Viewing, exporting, editing, or removing a repository’s stored secret values (the reveal, the “.env” export, and Save/delete on the Environment page) now requires the org owner or admin role. Members still see which secrets are configured (their names), just not the values, and can no longer overwrite a value they cannot see.
Every reveal and export is now recorded in the organization audit log, so a bulk disclosure of repository credentials is always attributable to one person.

August 6, 2026: Messages sent mid-run now steer the working agent

Sending a chat message while the agent is working now delivers it into the live run: the agent picks it up at its next turn boundary, without abandoning the work in progress. The transcript acknowledges the message as queued and then confirms “Steered into the active turn.” once the agent has seen it. Previously the composer held mid-run messages locally and they only reached the agent as a fresh follow-up run after the current one finished, which is why follow-ups always felt like cold starts.
Several messages sent in quick succession are delivered together at the same turn boundary instead of one per turn, so a burst of corrections lands as one update.
Attachments on a mid-run message now reach the agent too. Files are staged into the run’s workspace and the agent is told their exact paths; previously a screenshot pasted mid-run was silently dropped.
A message that arrives too late to join the current run, or that hits a run being cancelled, is rerouted into a continuation run automatically, and its acknowledgement explains that instead of claiming delivery.
Holding messages in the composer while the agent works remains available as an opt-in behavior.

August 6, 2026: Reasoning appears before the first tool call

Provider-generated reasoning summaries now stream inside the session’s live work history as soon as they arrive. Previously Ara kept them behind a plain “Thinking” row until the agent used a tool, which made the same reasoning appear or disappear depending on what the agent did next.
The live work history stays open while the agent is active and collapses after the turn finishes, alongside its tool calls. Completed reasoning starts collapsed at both the outer work rail and its nested disclosure. Models that do not provide a reasoning summary continue to show the ordinary “Thinking” placeholder until visible work begins.
Once a reasoning summary is visible, Ara also stops measuring that turn as placeholder-only thinking, including during the brief handoff where the original placeholder can still coexist with streamed reasoning.

August 6, 2026: Session read-file rows use an open-book icon

When Ara reads a file during a session, the transcript chip and tool row now use an open-book icon instead of a closed book, so read actions read more clearly as looking something up.

August 6, 2026: Workspace switching works everywhere and creating a workspace is one step

The workspace menu’s flyout no longer disappears under the page on settings screens. It previously opened clipped to a sliver at the sidebar’s edge, leaving the workspace list unusable there; it now pops out over the content on every surface and follows its trigger while the rail scrolls or the window resizes.
The menu rows are now named for what they do: “Switch workspace” and “Create new workspace”, matching the Workspace naming used everywhere else, instead of the old “Switch account” and “Create new account”.
Creating a workspace is a single step: pick a name and optionally invite people. The repository-access step is gone; the new workspace’s onboarding offers repository connection right after creation, so nothing is lost by removing the fork.
The create dialog submits from the keyboard: Cmd+Enter (Ctrl+Enter on Windows and Linux) anywhere in the dialog, or plain Enter from the name field. Enter in the invites box still adds a newline, and confirming text through an input method never creates a workspace.

August 6, 2026: A failed payment is now visible everywhere in the workspace

When a workspace’s subscription payment fails, every page now shows a banner explaining that cloud agents are paused, with a direct path to update the payment method. Previously the only signals were a message when a run was refused and a single line on the billing settings page, so a workspace could sit paused without anyone understanding why.
The banner disappears on its own once the updated card’s payment goes through.

August 6, 2026: Inference route failures raise an alert instead of passing quietly

Ara’s model catalog now exposes only the reviewed current model families; retired provider choices are removed from new tasks and saved preferences.
The inference database now rejects direct or operator attempts to re-enable a retired model or one of its routes, while retaining historical prices solely for settlement reconciliation.
A model route whose gateway credential is missing or unusable now pages Ara’s operators. That condition returns an error for every request on the affected model, and until now nothing alerted on it.
Requests that lose their provider cost report, and grants bound to a route the model registry no longer recognizes, now alert as well, so a settlement gap is caught at the time it happens rather than found later during reconciliation.
Routes that ship disabled on purpose, ahead of being switched on, no longer register as tripped safety breakers. A real trip stays visible instead of being buried under a permanent alert for an intended state.

August 6, 2026: Legacy inference cleanup preserves workspace credits

Ara now records every remaining ambiguous request from the retired inference broker in an append-only reconciliation journal before deleting that old authority. Those amounts were internal provider-exposure controls, not workspace-credit charges, so reconciliation never creates a retroactive debit or blanket credit.
Cleanup runs in small operator-confirmed batches and records only aggregate telemetry. A missing or inconsistent row blocks deletion, while a retry cannot charge or reconcile the same request twice.

August 6, 2026: Curated model catalog

GLM 4.7 and Qwen3 Coder are no longer offered in the new-task model picker or Models settings. Existing saved selections fall back to the default Ara model instead of attempting a disabled route.
Ara now admits only reviewed models through its managed inference service. Database guards prevent retired model identities, legacy providers, or unapproved routes from being re-enabled, while historical pricing and settlement records remain available for reconciliation.

August 6, 2026: The Browser tab keeps working after a session finishes

A session’s sandbox is now held for a short window after the run ends instead of being torn down within seconds of it, so the Browser (Preview), Terminal and Display tabs still work on what the session just produced. Previously the machine was released almost immediately and those tabs went blank the moment the work finished, which is exactly when there is something to look at.
The hold applies whether the session succeeded or failed. A run that went wrong is often when you most want to open the preview and see what the dev server is doing.
It is a short window, not a reservation: the sandbox is still released promptly, and sending another message continues the session as before.

August 6, 2026: Queued messages match the composer width

The bar that stacks above the session composer, used for queued messages and run setup, no longer stretches most of the page. It sits a little narrower than the composer it stacks on, as intended.
Opening or closing the session summary now slides the transcript to and from its side position instead of jumping.

August 6, 2026: A redirect can no longer downgrade an outbound connection

Every request Ara makes to a service outside itself — a connected MCP server, an integration, a webhook you configure — now stays encrypted for the whole chain of redirects, not just the address it started from. A server that answers with a redirect to a plain http:// address, or to an address inside Ara’s own network, is refused instead of followed, and credentials are dropped when a redirect crosses to another origin. A chain of more than five redirects is refused as well.
This changes nothing for a server that redirects within https, which is followed as before, and nothing for the built-in MCP catalog.

August 6, 2026: Session sandboxes are released on schedule

A sandbox kept for a short while after a session ends, so a follow-up message can pick the workspace back up, is now released on Ara’s own schedule. Previously nothing enforced that window and the only limit was the hosting provider’s 24 hour cap, so those machines stayed reserved far longer than intended. The workspace still remains available for the same period you could already rely on.
A sandbox left behind by an interrupted session is now cleaned up by the routine sweep instead of waiting for that same 24 hour cap.

August 6, 2026: More permission checks on GitLab triggers and repo start-up scripts

Starting an agent run from a GitLab issue (issue opened, or a trigger label applied) now requires the actor to have write access to the project, matching the rule already applied to “@ara” mentions and merge-request reviews. A user who can only open issues or apply labels can no longer kick off a run.
Editing a repository’s session-start or preview script (the repo-level environment blueprint) now requires the org owner or admin role, because those scripts run with the repository’s secrets available. Members can still edit build-time setup that never sees secrets. Each secret-capable edit is recorded in the organization audit log.

August 7, 2026: Further agent and workspace security hardening

The agent can no longer read or post into another teammate’s session, or create workspace-wide connectors, from inside a run: those actions are now restricted to your own sessions and to a real signed-in owner/admin, so a run driven by untrusted repo or issue content cannot reach a colleague’s work.
A repository’s environment blueprint can no longer define reserved inference variable names (such as OPENAI_API_KEY), matching the rule already applied to stored secrets, and baked build values are scrubbed from stored build artifacts.
The public avatar image link now only serves genuine avatar images, not arbitrary files.

August 7, 2026: Defense-in-depth hardening across agent runs and workspace access

Text an agent writes to a pull request, an issue, a comment, or a commit message now has secret-shaped values and any of the workspace’s own stored secrets stripped out before it is published, so a run driven by untrusted repository or issue content cannot leak your credentials into a public artifact.
Several internal safeguards were tightened with no change to normal use: session tokens now require a dedicated signing key and are only accepted where they are issued; a shared “open access” workspace grants read-only browsing rather than a write-capable role; the connector gateway enforces each agent’s allowed-plugin list; and a preview feature that is off by default now refuses to turn on without its full access check in place.

August 5, 2026: Live Preview finds your dev server again

A repository that declares a dev server in its Blueprint (preview: with a command and a port) now has that server started and kept running for the session. Previously the declaration was read when the environment was built but never acted on during a session, so the server was stopped again as soon as the step that started it finished, and the Browser tab usually found nothing to show.
The port list no longer offers Ara’s own internal connection to the sandbox as though it were your dev server. Only servers you actually started are listed.
When a session has finished, the Browser tab now explains that the sandbox was released along with the dev server, and that sending a message continues the session and starts a new one. It previously showed an internal error code, and showed it in red as though something had broken.
The Browser tab no longer invites you to start a dev server in the same breath as telling you the sandbox is gone. It shows one status line rather than two that contradict each other.

August 5, 2026: Custom MCP servers must be reachable at a public address

Connecting a custom MCP server with OAuth now fails when the server URL, or an OAuth endpoint it advertises, resolves to a private or reserved address such as localhost, a 10.x or 192.168.x host, or a cloud metadata address. A server that is only reachable inside a private network could never have completed a connection anyway; attempting it now stops before any request is sent.
OAuth discovery no longer follows redirects. A server that answers its .well-known discovery documents with a redirect will fail to connect instead of being followed to another origin. Every server in Ara’s built-in MCP catalog serves those documents directly, so connections made through the catalog are unaffected.

August 5, 2026: Session branch and target read below the composer

The row showing a session’s working branch and where it runs is no longer part of the composer card. The card ends at the input box and that row sits under it as plain text, so it reads as information about the session rather than a control inside the input.

August 5, 2026: Groundwork for connector tools in cloud sessions

Connector tools are not yet available in cloud sessions. This entry describes preparatory work only, and the behavior below is switched off by default.
When it is switched on, Ara will reach a connected MCP server from its own backend rather than from inside the sandbox running your code. A connector’s access token is applied server-side and is never written into that machine, so a session can use a connector without ever holding its credential.
Connectors that run as a local process, such as the Postgres and Supabase servers, will keep running inside the session sandbox, where they stay isolated to your own workspace.
Requests to a connected server are refused if its address resolves to a private or internal network, including cloud metadata addresses.

August 5, 2026: Long sessions compact their context instead of failing

A session whose conversation grows past the model’s context window now summarizes its older history automatically and keeps working. The transcript shows “Compacted earlier context to stay within the model’s window” when this happens. Previously the next model request failed outright once the window filled.
The full conversation history is still kept for the transcript and for crash recovery; only what is sent to the model is condensed, and the summary work is billed and metered like any other model request.
Typing /compact in the chat while a session is running now compacts that session’s context on its next model step, instead of returning “capability unavailable”. A finished session still declines: it compacts automatically on its next turn if needed.

August 5, 2026: Uploads report their real staging outcome

Once file staging finishes, the agent is now told exactly which uploaded files landed in its workspace, including any that could not be transferred (for example, files too large to stage). It stops waiting for a file that will never arrive and tells you it could not open the upload instead of guessing at its contents.

August 5, 2026: Card verification when a free trial starts

Starting a free trial now places a temporary $1 authorization hold on the card, released immediately and never charged. A card the bank declines for that hold, or a prepaid card, can no longer start a trial: the subscription is cancelled at signup and the workspace returns to the Free plan, instead of the first invoice failing a week later. Cards that require additional authentication (3D Secure) are not affected by this check.
A card that already redeemed a free trial under a different account now ends the new trial at the end of its period instead of only being flagged internally.

August 5, 2026 — Safer, more reliable sessions

Ara now uses one managed execution path with task-scoped access and workspace credit settlement. Provider credentials remain server-side and are never exposed to a session environment, transcript, artifact, browser, or command line.
Session recovery, cleanup, and historical archiving now use fail-closed ownership checks. Active work and unresolved billing are preserved instead of being retired; completed history remains available.
Operator maintenance reports expose only aggregate safety and billing counts, never session contents, identifiers, or secret values.

August 5, 2026: Sessions run to completion instead of stopping after a minute

Sessions started from Slack, GitHub events, and pull request reviews now hold their run authority for as long as the work takes. Previously a session of roughly 45 seconds or longer could stop mid-task with an authorization error, because only some of the ways a session can start kept renewing the permission that lets it reach the model.
Recovery startup now rejects an incomplete process-lease handoff instead of silently replacing it, so deploy-skewed workers cannot bypass the same ownership checks.
Every runner-owned lease heartbeat now emits its start marker, so production telemetry shows which worker is actively renewing a session before any lease loss or renewal failure. A telemetry sink failure cannot interrupt the session or its lease cleanup.
A session whose worker hands it off during a deploy is now recorded as a planned handoff rather than an unexplained loss, so routine deploys are distinguishable from genuine lease failures.
When a session is recovered after its worker is replaced, a model request that failed with a transient provider error is now retried instead of ending the session. Cancelling a session still stops it immediately.

August 5, 2026 — Steadier session starts when many sessions recover at once

When a batch of sessions recovers together, for example after a deploy or an unexpected restart, Ara now paces how many sandboxes it asks the provider to create at the same time instead of requesting all of them in one burst. Sessions that wait their turn start a moment later rather than failing outright.
Provisioning retries now use a randomized delay, so a group of sessions recovering in lockstep no longer retries in lockstep and collides again on the same schedule.

August 5, 2026 — One workspace credit limit

Long tool-using sessions now renew their run-bound process lease from every production launch path, preventing a healthy session from being reclaimed and invalidating its own short-lived access grant.
Model use now reserves directly from the workspace’s shared credit balance. The temporary per-request, per-run, per-user/day, per-workspace/day, and global/day dollar caps are retired.
Legacy per-group dollars/day settings are ignored and no longer returned by the Team page. Groups may still carry non-monetary daily run limits.
Small remaining balances stay usable: Ara lowers the maximum output to the amount the workspace can afford, while exact token usage settles and releases the unused hold.
Sandbox runtime leases each billable minute from that same balance before it starts, preventing simultaneous model and sandbox work from overspending workspace credits.
System-credential fallback now trips the credential breaker, raw provider errors are sanitized, and service-owned inference secret names cannot be created, listed, exported, or injected into a sandbox.
Token and cost settlements now appear in workspace model-usage history as soon as they debit the same shared credit balance.
The retired inference broker’s database authority now fails closed before archival: it can be sealed only when no live grant, open request, or dollar hold remains, and the operation never adjusts workspace credits.

August 4, 2026 — Managed model execution

Ara sessions use a task-scoped managed inference service. The API holds service credentials; sandboxes receive only a short-lived grant restricted to one session and model, and usage settles against the workspace credit balance.
Usage settlement records the provider, model, credential type, input, cache, reasoning, output tokens, and cost. Provider or accounting failures remain visible and never use an unapproved fallback.
Repository wiki generation is temporarily unavailable while that background job moves onto normal queued sessions.

The marketing footer now lists Ara’s office address, Gaustadalléen 21, 0349 Oslo, Norway, alongside the copyright line. It reads the same in every language, as postal addresses should.

August 3, 2026 — Cancelling a past-due subscription stops collection immediately

Cancelling a subscription whose renewal payment has failed now voids the outstanding invoice and ends the plan right away, so automatic payment retries can no longer charge your card after you cancel.

August 3, 2026 — Clear usage budget messaging

A run that stops because an Ara AI usage budget is used up now says so: the chat shows a dedicated “AI usage budget reached” card explaining that one retry is worth attempting and that a repeat failure means the daily budget, which resets at midnight UTC, instead of a raw “429 Too Many Requests” error.
The Founding Engineer listing no longer states a San Francisco, in-person location or a monthly rate, on both the Careers index and the role page.
Hovering the “N files changed” segment of the composer plan pill now opens a card listing each changed file with its own additions and deletions. The compact summary uses the same muted text treatment as the other session tabs, while clicking the segment still opens Review.

August 2, 2026 — Safer cloud execution rollout

A staged rollout verified the normal workspace, authentication, session list, composer, and chat surfaces under the updated execution service before promotion.
Model requests start while the sandbox, repository, uploads, and browser tools are prepared. Tool calls wait for verified sandbox readiness before they can execute.
The rollout gates fail closed on authentication, ordering, reconnection, cleanup, and ownership failures. A failed gate retains the previous serving version instead of silently bypassing safety controls.
Recovery preserves the existing session history and replays only safe pending work. It retries bounded transient infrastructure failures, respects cancellation, and never creates a duplicate execution target.

August 8, 2026: Local chat follows the running API port

When the local development launcher selects a different API port because its default is already occupied, secure model requests now follow that selected port. Local sessions no longer fail inference by sending their grants to an unrelated process on the default port.

August 2, 2026 — Faster composer actions

Ara web and docs now use Helvetica Now Display throughout, with Geist Mono for code and file references and medium-weight links and mentions in chat.
The composer + menu now opens searchable Skills, Plugins, and Shortcuts sidecars in both full and compact session composers. Each shows up to five results, with connected plugins first, while Attach file keeps the existing multi-file picker behavior.
Device references in the composer now use the same blue treatment as skill references, showing a device icon and name instead of the raw quoted @ token. Device, plugin, and skill labels all render at medium weight.
The model sidecar now hugs short lists instead of leaving empty space below the available models.
Models & credentials now lists the three included Ara models and keeps availability guidance as a single note below the roster.
Error notifications now inherit the active light or dark theme and keep their dismiss control in the top-right corner.
Pending repository setup is now highlighted in orange, and its copy-prompt dialog explains cloud setup more directly.
Session turn rails are slimmer at rest while keeping their full hover expansion.
New Ara runs can initialize connected GitHub repositories with no commits, then continue through the normal branch and pull-request flow.
The project picker now offers Empty project for an explicit repo-less scratch workspace instead of sending New project clicks to GitHub.
Retrying a completed or failed task now preserves its original instructions, and tasks can continue after a local tool returns a structurally bounded static PNG without weakening the block on provider-hosted media or remote fetches.
Immediate follow-ups keep the same visible session context when it is safe, so chat stays on Thinking instead of returning to Preparing Hands. Ara deliberately starts a fresh workspace when it cannot prove the active run lease or cleanup.
The composer now states its run context in two places. Above a new task, one row holds the repository, the branch it will start from, and the location — Cloud, or Cloud plus one of your connected devices — and each control drops its icon once it holds a value. Plugins moved into the + menu. Beneath the input in a session, a separate row names the session’s own work branch (click to copy it), whether it is computing in the cloud or on your device, and how much of the model’s context is spent, with the token and cost detail on hover.
The location control keeps naming the device an unsent draft targets even after that device becomes unreachable or the page reloads, and the location menu shows the attached device as the current selection rather than implying the task will run in the cloud.
A session can now continue somewhere else. The location chip in the session status row opens Continue on, offering a fresh Ara Cloud sandbox or a folder on one of your connected devices. Ara starts a linked session at the destination from the session’s branch and stops the original, so only committed work travels. Choosing a device checks the branch out into the folder you picked, reusing an existing checkout instead of cloning again. Devices that are offline or running an older Ara release stay listed but unselectable, with the reason shown and a link to Settings → Devices.

The sidebar top-left now holds a workspace picker instead of the Ara wordmark. Its menu shows the current organization and member count, opens Settings or Invite members in one click, and lists your other workspaces under “Switch account” alongside Create new account and Log out.
Sidebar highlights are lighter: the picker matches the height of a navigation item, and session rows keep a gap so a hovered row no longer merges into the one next to it.
Dialog footer buttons are now pills and stay legible on the dark theme.

Updated GPT-5.6 Luna and Terra usage metering to their latest lower provider rates, so the same Ara credit balance now covers more model usage.
“Add repositories” in the composer project menu now opens the Ara GitHub App’s repository-access settings instead of the read-only Codebase list, and Codebase carries the same action in its heading.
Selected Automation, Codebase, and Customize options now use a compact pill, while inactive options stay as muted text.
Notifications now match session turn previews, stay centered at the top on phones, and the turn rail sits clear of the workspace sidebar.
Component previews now stay pinned to one production deployment during releases, avoiding mixed frontend bundles.

July 7, 2026 — Cloud coding agent

Added the cloud coding agent flow for managing repository work from the web.
Added scoped sessions from connected repositories.
Added live progress in the workspace.
Added pull request and diff review without leaving Ara.

August 6, 2026 — Workspace-scoped harness profiles

Internal runtime experiments can now be selected by an operator-managed workspace profile instead of a separate hostname.
Ara persists the profile version and digest on each run so retries and continuations remain reproducible.

⌘I

​August 15, 2026: Actionable session machine restart notice

​August 15, 2026: Multi-repo workspace sessions and status-first session list

​August 15, 2026: Sandbox execution and credential hardening

​August 15, 2026: Consolidated high-throughput CI/CD pipeline

​August 15, 2026: Accelerated production builds and streamlined API container image

​August 15, 2026: Sandbox egress proxy routing and destination allowlist policies

​August 15, 2026: Guarded pull request creation and chat privacy

​August 15, 2026: Accelerated web application type compilation and localization loader

​August 15, 2026: Database connection pool scaling and claim backpressure

​August 15, 2026: Mobile session source logos stay contained

​August 15, 2026: Production Pulse has a native always-on view

​August 14, 2026: Fast isolated test execution

​August 14, 2026: Production recovery is standardized

​August 14, 2026: Site failures can be reproduced from the affected network

​August 14, 2026: Continuous production-path verification

​August 14, 2026: Landing-page asset recovery is deployment-safe

​August 14, 2026: Product analytics returned to PostHog

​August 14, 2026: Retired experimental iMessage and applicant scoring paths

​August 14, 2026: Repository Wiki is retired

​August 14, 2026: Free is the full product, subscriptions start immediately

​August 14, 2026: Cloud machines clear space before they run out, not after

​August 14, 2026: Daily cross-region landing-page verification

​August 14, 2026: Product analytics telemetry cutover to Mixpanel

​August 14, 2026: Staging sign-in previews stay inside staging

​August 14, 2026: Clearer error when a macOS or Windows machine can’t start

​August 13, 2026: Cloud sessions wait safely at dependency limits

​August 13, 2026: A full cloud machine can now clean itself up

​August 13, 2026: Cloud machines keep reclaiming space after a machine is recycled

​August 13, 2026: Landing pages recover from interrupted asset downloads

​August 13, 2026: Worldwide landing-page reachability monitoring

​August 12, 2026: A warm workspace is reused only by the person who left it

​August 12, 2026: Lighter marketing-page image loading

​August 12, 2026: Stable mobile navigation height

​August 12, 2026: A persistent badge for goal-driven sessions

​August 12, 2026: Faster answers when many sessions start together

​August 12, 2026: A machine could be out of space while the panel read healthy

​August 12, 2026: Session pages load without jumping

​August 12, 2026: PR-review interruptions retain their real cause

​August 12, 2026: Late repository discovery stays in the same Session

​August 12, 2026: Session context expands from the top bar

​August 12, 2026: A safer foundation for sessions with multiple resources

​August 12, 2026: Measure session recovery before automating it

​August 12, 2026: Sessions can inspect and repair pull-request failures

​August 12, 2026: Automation catalog removes redundant trigger label

​August 12, 2026: Mintlify docs navigation

​August 12, 2026: Sidebar attention states use clearer wording

​August 11, 2026 — Stable conversation history loading

​August 12, 2026: Session actions stay above the sidebar

​August 12, 2026: A repository-name case mismatch could silence an automation

​August 12, 2026: Preview chat images before downloading them

​August 11, 2026: Run PR Review on your connected ChatGPT subscription

​August 12, 2026: Earlier cloud-capacity warnings

​August 11, 2026: Transcripts stop masking ordinary configuration values

​August 11, 2026: Sessions no longer end in a failed state

​August 11, 2026: Execution-target controls use product language

​August 11, 2026: Runtime errors use plain language

​August 11, 2026: Control how much the review bot filters away

​August 11, 2026: A simpler Ara home

​August 11, 2026: Review bot findings now default to high severity and above

​August 11, 2026: See the instruction a one-click action sent on your behalf

​August 11, 2026: Live machine capacity in session actions

​August 11, 2026: Start a goal-driven session with @goal

​August 11, 2026: Track how often @goal is actually used

​August 11, 2026: Review bot uses your own connected model provider

​August 11, 2026: One set of actions for a pull request that cannot merge

​August 11, 2026: A draft pull request offers Mark ready for review instead of a merge that cannot succeed

​August 11, 2026: Review panel actions are measured, including why a merge was refused

​August 11, 2026: Review bot findings default to medium severity and above

​August 10, 2026: Goal sessions stop failing on criteria nobody could check

​August 10, 2026: Goal-session criteria stay out of diagnostics

​August 10, 2026: The Developers page install command is copyable again

​August 10, 2026: Cloud machine resets now replace the machine

​August 10, 2026: More precise run timing under the hood

​August 10, 2026: Mention pills in the composer

​August 10, 2026: Staged files survive leaving the composer

​August 10, 2026: A calmer Merge Bot policy page

​August 10, 2026: Reordered the session actions menu

​August 10, 2026: Secrets move into workspace settings

​August 10, 2026: A calmer session handoff

​August 10, 2026: Search inside every session