Skip to main content
This page is a highlights reel, not a complete log. Each entry covers a release window, and it carries what a user or an operator would want to know about: new capabilities, anything that changes behaviour on upgrade, and anything that needs a decision before deploying. Plenty of good work is deliberately not here — a gap between two dates means nothing was worth your attention, not that nothing shipped.The complete, per-change record is CHANGELOG.md in the repository. That file is the release-note source of truth and every user-visible pull request is required to add to it.
​
featuresupdatesfixes

​
A provider is now a credential

The sidecar’s LLM proxy routed on a hardcoded three-arm switch. It now routes on a descriptor table, and a credential carries its provider end to end — so adding a backend is a row rather than a branch. Two arrive with it: OpenRouter and OpenAI-compatible endpoints (LiteLLM, vLLM, anything serving the OpenAI wire format), both created like any other credential. crewship credential create gains --base-url for the compatible kind and --auth-token-stdin so a token never reaches the process table, and crewship provider route list shows the whole routing table with no server running. The three existing paths — /v1, /openai, /gemini — are byte-for-byte unchanged. See Credentials and Multi-provider LLM configuration.
A credential PATCH that re-interprets the stored value is now refused. An endpoint-backed credential holds a {baseURL, apiKey, headers} object; every other kind holds an opaque value. Moving a credential across that line — changing provider to or from OPENAI_COMPAT, or type between ENDPOINT_URL and API_KEY — now returns 400 unless value is sent in the same request, instead of silently re-reading bytes it was never given. A PATCH that carries a value also validates the endpoint URL for the first time, so one that used to accept a link-local or metadata address now refuses it.Two smaller edges: provider is normalised to its canonical uppercase spelling on write (a client that sends github reads back GITHUB), and several crewship credential create argument errors moved from exit 1 to exit 2. A script that branches on exit 1 needs updating.

​
One shell for every create surface

The twelve create dialogs that had each grown their own layout are now one kit — consistent widths, a bottom sheet on a phone, ⌘↵ to submit, and a discard guard so Esc never throws away typed input. Three things became possible from the browser for the first time: importing a crew manifest into New crew, granting per-agent tools and notification channels on New agent, and creating a label from the issue modal. The crew wizard is four steps instead of five.
New crew now pre-selects free network mode, not restricted. Only the wizard’s default selection moved — anything that creates a crew without stating a mode (a manifest, the API, a seed) still gets restricted. If you rely on operators being handed the restricted default in the UI, say so in your own onboarding, or set the crew’s network policy explicitly. See Container isolation.

​
Start and stop a crew on purpose

crewship crew start <crew> builds the image if needed and brings the container up, verifying it actually came up rather than assuming; crewship crew stop <crew> takes it and its sidecars down, keeping volumes and the image. Until now the remedy several error messages recommended was crewship crew provision, which only builds the image and starts nothing — so following the advice reproduced the error. Those messages now name crew start, and say what provision does and does not do. crewship apply also stops claiming success on a failed run — it now names the item that failed and everything after it that was never attempted — and gains --no-delete, which refuses any run whose plan would destroy something. See crewship crew and crewship apply.

​
Run a routine from a slash command

A routine can opt in to appearing as /<slug> in chat and in crewship shell, with a typed form built from the inputs it declares. A new routine.run capability lets a MEMBER invoke routines without being promoted to MANAGER. The run is synchronous and its output goes to the run records, not to the chat. See Slash commands and Routines.

​
Onboarding builds working things, owned by the crew they belong to

First-run setup is now a conversation with a permanent Crewship Guide crew. The important part is invisible: a routine or page the Guide builds for you is now attributed to your crew, not to the Guide — which decides whose egress policy gates it, whose container runs it, and whose roster its panels can see. See Onboarding.
Backups taken before this release may be missing rows. The backup’s workspace scope was derived by walking foreign keys without checking whether the column it landed on was nullable, and a filter on a nullable column omits every row where it is NULL. Unclaimed mission tasks, crew-owned MCP servers, human-saved page versions and several binding tables were affected — and because the walk depended on Go map order, two runs of the same binary against the same schema could omit different tables.It is fixed, but crewship backup verify cannot detect a short bundle: it checks the payload checksum, and the manifest records no per-table row counts. Treat bundles taken before this release as unverified, and take a fresh one. crewship backup restore --replace was deleting through the same faulty filter, so restoring an old bundle over a live workspace was doubly affected. See Backup.
A crew whose mise shims do not resolve will now fail to provision. mise reshim exits 0 whether or not the shims point at anything, and a dangling symlink is skipped silently by PATH lookup — so a crew pinned to terraform 1.9 could run whatever the base image shipped, with nothing logged. Provisioning now verifies the shims and fails loudly instead.Crews created before 2026-08-07 carry stale shims and do not self-heal. Expect their next provision to fail; re-provision them from a current image. Crews that declare no mise tools are unaffected. See Devcontainers.

​
An integration’s audience is stored, not counted

An MCP server used to be available to every agent for exactly as long as no agent was bound to it: “available to all” was inferred from a binding count of zero, so the first binding anywhere in the workspace flipped the server to opt-in and revoked it from every other agent — silently, with nothing on the integration’s page saying so. Every MCP server now carries default_access (all or bound-only) and resolution reads it. Binding an agent attaches a credential, a config override or an opt-out for that agent and changes nobody else’s access; narrowing a server is a deliberate act: crewship integration access <id-or-name> bound-only, --access on integration add / integration crew create / integration crew update, or default_access on the API. integration list gained an ACCESS column and the integration’s detail panel names its audience.
Upgrading does not move anybody’s access. The migration freezes each existing server at the audience it effectively had: servers that already carried an agent binding become bound-only, everything else becomes all. Nothing is granted and nothing is revoked at upgrade time — but from then on, only an explicit change alters who can use a server. If you were relying on the old side effect to keep a server private, it is now written down as bound-only and will stay that way.
Same pass: mcp_tool_bindings had no referential integrity, so deleting an integration stranded its per-tool toggles forever. They now follow their server, an insert naming a server that does not exist is rejected, and the rows already orphaned are swept. See Integrations and crewship integration.

​
Updates

  • An evaluator slot follows the key you actually have. Auxiliary slots now default to the first provider whose API key is set, instead of six slots hardcoded to Anthropic that each failed at first use on an OpenAI-only instance. See Keeper.
  • Two Keeper aux controls that did nothing now do what the console claimed. Memory consolidation reads the curator slot — it was hardwired to Ollama at boot, so an instance with an Anthropic key and no Ollama silently ran no consolidation at all while the card showed the slot healthy. And run_summary’s timeout now actually bounds the verdict call; its shipped default moves 15s → 20s so the first real deadline is not tighter than what those calls had been running under.
  • Crew template names are unique per workspace. Two workspaces can each have a backend-team template. A workspace template shadows the built-in of the same name, for that workspace only — and a built-in whose slug a user had taken can be seeded again, which it previously never could.
  • An OpenAI-compatible credential can be tested. It was the only LLM provider with no connectivity test, and it returned a green tick without dialling anything. The probe checks reachability, not authentication — it deliberately never sends the stored key, because whoever can edit the credential can also repoint its URL.
  • Pages can be published, webhooked, exported, imported and deleted from the browser. All of that was CLI-only. See Pages.

​
Fixes

  • A page’s public panels were silently unpublished by reading them. The public flag was not echoed on any read path, so crewship page export | crewship apply, a hand-edited page get -f json, or the editor’s own save cleared it. The published link kept resolving and rendered an empty page, and the next page publish then blamed the page for having no public panels.
  • The mission timeline’s “Restore” restored nothing and said it had. The endpoint computes a preview by design — it rewinds nothing — and the UI reported success and discarded the response, including the list of later events a real restore would have to abandon. The action is now labelled Preview restore and says what it found.
  • The Add-MCP wizard’s “Test” could not fail. It was a timer that returned success, with no failure path at any input. It is gone; connectivity is tested on the server’s row after it exists, or with crewship integration crew test.
  • One unrenderable chat message no longer takes down the page. A single bad turn used to replace the whole conversation with an error screen, discard every turn’s state, lose a half-typed draft and drop the live WebSocket. Now only that message is replaced, and it heals itself as the next token arrives.
  • Pinned memory could be read empty. pins.md and the day’s learned rules were created before they were written, so an agent reading its own rules in that window saw nothing rather than the previous contents — reproducibly, on a tick that runs every six hours. They are written atomically now.
  • Forking a mission from the timeline 404’d, and the 404 was rendered as “not yet wired to backend” — so a broken call looked like an unbuilt feature.
  • Accessibility. Page tabs are now linked to the panels they reveal and the strip is keyboard-navigable with arrow keys; crew and agent canvas tabs are a real tab set rather than buttons claiming to be one; the admin console’s content pane can be scrolled by keyboard; New routine has a Cancel button on every screen.
​
featuresfixes

​
Multi-provider LLM configuration

The three-arm provider switch is now a registry: one row per provider, read by the aux-slot builder, the Keeper validator, the console picker and the error message that tells an operator what they may type. The two hand-written HTTP clients behind it became configurable codecs, so any OpenAI-compatible backend (DeepSeek, vLLM, llama.cpp, Ollama’s /v1 shim, OpenRouter) is a config value rather than a new file. Evaluator slots now default to the first provider whose key you actually have, so an instance holding only an OPENAI_API_KEY stops demanding an Anthropic one. A trimmed models.dev snapshot ships embedded and prices 621 models across eight providers offline, as a third step in the rate lookup below the hand-verified table. Two new local commands read those tables with no server: crewship provider list and crewship model price. See Multi-provider LLM configuration and Paymaster.

​
Proxied agent calls start billing for real

Read this before deploying if you use budget limits. Every LLM call an agent made through the sidecar proxy has been recording zero tokens and $0 since the proxy was built. The usage parser switched on a lowercase provider name ("anthropic") while the proxy handed it an uppercase one ("ANTHROPIC"), so it never matched and every response body went unparsed.It is fixed, and the consequence lands on the first deploy: crews whose agent traffic goes through the proxy will begin posting real token counts to cost_ledger. Budget warnings and hard stops that have never fired on those crews can now fire immediately — not because anything got more expensive, but because the spend was always there and was being recorded as nothing.Before deploying, check budget_limits for any crew that runs proxied agents and confirm the ceilings were set against real usage rather than against the $0 these rows have been reporting. A limit that looked generous against zero may be below a normal day.

​
Fixes

  • OpenAI cached tokens were billed twice. OpenAI’s prompt_tokens includes the prompt-cache read, and the codec stored it verbatim alongside the cached count — so an 80%-cached 1500-token prompt billed 2.67× the invoice. The codec now records fresh input only, matching what the sidecar proxy path has always done. cost_ledger.input_tokens changes meaning for OpenAI-family rows and historic rows are not migrated, so a rollup spanning the change is not comparable across it. See Paymaster.
  • Long-context models were billed at their base rate. 76 catalog models publish a second rate card above a context threshold, up to 6.7× base. They are now priced at that ceiling — a deliberate over-estimate, because under-billing weakens the budget signal exactly when it matters.
​
fixes

​
Updates

  • Grandfathered crews tightened to restricted egress. Existing crews still on the legacy network_mode=free default are backfilled to restricted on upgrade, so they stop getting unrestricted outbound access. The column default itself is also flipped to restricted, so any crew created without an explicit network mode — a raw insert, a seed, a future migration — is now restricted by construction rather than defaulting open. A restricted crew still reaches all built-in LLM/CLI provider domains plus any it explicitly allowlists; if a crew genuinely needs open egress, re-open it to free (or add the domains it needs) from its network policy. See Container isolation.
​
featuresupdatesfixes

​
Slash commands and per-user capabilities

End users now get a server-driven slash palette in chat and CLI for /routine, /issue, /skill, and /credential. Each action is gated by a per-user capability, so admins can grant a single MEMBER permission to author routines or rotate credentials without promoting them to the MANAGER tier. Capabilities are managed inline from Workspace Settings → Members (with a preview diff before bulk preset changes), or via crewship workspace member capabilities. See Slash commands and RBAC.

​
Streamlined first-run bootstrap

The setup-token gate is gone. The /bootstrap form now takes name, email, and password — submit and you’re in. Bootstrap stays open until the first admin account exists, then returns 410; set CREWSHIP_BOOTSTRAP_WINDOW (any Go duration, e.g. 5m) to opt into a finite deploy-race window that closes that long after crewship start — for instances reachable from the internet before anyone bootstraps them. Both browser and headless (crewship init) paths hit the same endpoint and share the same gates. See Quickstart.

​
Disaster-recovery backup rewrite

crewship backup restore adds a --replace mode for the canonical “nuke and restore preserving original IDs” flow. The restore pipeline now discovers workspace-scoped tables at runtime, reconciles users by email so an admin with the same address on source and target doesn’t orphan FK references, and applies section-aware symlink policy so workspaces containing node_modules (or any project with relative-target symlinks) restore cleanly. See Backup and crewship backup.

​
Declarative apply for crews, agents, skills, integrations, and issues

crewship apply now understands five additional top-level kinds — Skill, Crew, Agent, Integration, and Issue — so a workspace can be provisioned end-to-end from a single manifest bundle. Built-in seed catalogues moved from Go literals to embedded YAML, so the same shapes round-trip through export/apply. See Manifests and crewship apply.

​
Mission outcomes feed crew memory

When a mission completes, its outcome and provenance now flow into crew memory automatically — agents can recall what they shipped and why on the next mission without an operator re-priming the context. See Episodic memory and Agent memory.

​
Workspace switcher

The sidebar workspace switcher is now real: list every workspace you belong to, switch with one click, persist the selection across reloads, and create a new workspace from the same menu. The selected workspace is honored by every component that reads it. See Onboarding.

​
Profiling and tracing setup

Two opt-in observability surfaces landed: a pprof endpoint for CPU/heap snapshots and a Pyroscope push exporter for continuous profiling. The OpenTelemetry service.name is now configurable via env so multiple deployments tag their traces distinctly. See Telemetry and the OTLP setup guide.

​
Updates

  • Destructive CLI commands prompt before acting. Six commands now ask for confirmation and accept --yes for scripted use.
  • Manifest validate catches duplicate slugs. crewship apply --dry-run now fails fast when two documents share the same metadata.slug within a kind, instead of silently overwriting on apply. See Manifest schema.
  • crewship apply gains --skip-test-gate. Routines that depend on PENDING credentials can now be applied without the pre-flight test invocation, and type: code steps surface a plan-time warning so the gap is visible before the cron fires. See crewship apply.
  • Go toolchain bumped to 1.26.3. Picks up eight stdlib CVE fixes; no API or behaviour change.
  • SQLite busy timeout raised 5s → 30s. Eliminates the spurious “Invalid email or password” login error that surfaced on moderately loaded instances after a backup restore.
  • CLI hardening pass. Security tightening across the CLI binary. See CLI overview.

​
Fixes

  • crewship workflow create --help no longer panics from a flag-shorthand collision with the root --format flag. See AI workflows.
  • Persona commands crashed on every invocation; now fixed.
  • CLI typo’d subcommands are rejected with a clear error instead of being silently dispatched to crewship ask.
  • crewship now / me / today now exit non-zero when every fetch fails with session_invalid, so wrapper scripts notice the missing login.
  • /metrics loopback bypass now checks the true client IP, closing a path where a misconfigured proxy could expose the endpoint externally. See Metrics.
  • Create-workspace dialog now resets when closed via Cancel, Escape, or overlay click — stale values no longer persist across reopens.
  • MCP registry page size is now capped at 100 to prevent unbounded responses.
  • Example manifest (examples/manifests/full-complete.yaml) had two invalid tool_profile values that failed validation for anyone copying it as a starter — corrected to the documented enum.
​
featuresupdatesfixes

​
Agent Evolution lands

The full Agent Evolution release rolled out across seven coordinated changes. Highlights:
  • Native memory tools. Agents now have first-class memory read/write tools wired across all MCP-capable adapters. Memory is scanned before it’s persisted and consolidated automatically — see Agent memory and Memory observability.
  • Autonomy slider + auxiliary model slot. Each crew now exposes a per-crew autonomy slider and a separate slot for an auxiliary (smaller / cheaper) model. Tune how often an operator gets pulled in, and route routine sub-tasks to a different model. See Autonomy and self-learning.
  • Keeper Phase 2. Keeper now reviews skills, evaluates per-crew behavior mode, tracks memory health, and applies negative learning from rejected actions. See Keeper and Keeper reviews panel.
  • Ephemeral agents. Hire an agent with a TTL, let it ghost when the TTL elapses, rehire if the work isn’t done — with a full audit trail of when it was active. See Ephemeral agents.
  • PERSONA + peer cards. Per-user agent personas and peer cards land alongside new GDPR primitives for user-scoped data export and deletion. See GDPR.

​
RBAC v2

Role-based access control gets a major overhaul:
  • Per-crew role editor inline on the crew membership table.
  • Agent owner badges on every agent card, with API exposure of the owner field.
  • Token issuance dialog now shows tier, scopes, and expiry; listing exposes the same fields. CLI bootstrap and pair-redeem tokens are now 256-bit.
  • Per-agent ownership gates on agent create, update, and delete, plus per-crew role elevation honored at create time.
  • Structured 403 responses with denial audit logging.
See RBAC.

​
Pipeline webhooks: signed by default

  • HMAC signature required on every webhook dispatch.
  • Signing secret auto-generated when a pipeline webhook is created — no more silent unsigned deliveries.
  • Replay protection via synthetic idempotency keys; duplicate replays are now auto-deduped.
  • Rate-limit floor and reserved-key inputs hardened on the webhook endpoint.

​
Updates

  • OpenAI provider now mirrors the Anthropic retry/backoff behavior — flaky upstreams get the same treatment regardless of provider. See Providers.
  • X-RateLimit-* headers are now returned on every 429 response so clients can back off intelligently.
  • CREWSHIP_FORCE_SECURE_COOKIES env override lets you force secure cookies in front of an HTTPS-terminating proxy. See Environment.
  • Sidecar hardening. The production sidecar baseline got a security pass, and the prod Docker socket is now brokered through a filtering proxy. See Container isolation.
  • Memory scanner now blocks invisible-format (Unicode Cf) codepoint evasion in addition to existing checks. See Memory observability.

​
Fixes

  • Keeper cross-tenant defense. Workspace context is now correctly wired onto Keeper routes — previously the defense was unreachable.
  • Sidecar memory startup. The agent memory base directory is now set even when the full-text search engine fails to initialize, so agents stay usable in degraded mode.
  • OAuth state and session IDs bumped to 256-bit randomness. See Auth.
  • Path-traversal hardening. .. segments are rejected before the router normalizes them; /_next/* directory autoindex is blocked; every ID interpolated into internal URLs is now path-escaped.
  • Permission gates. Agent files, downloads, and logs now require the read permission; nine pipeline mutating handlers are gated on per-role checks.
  • Log redaction. Raw token values are now logged as fingerprints instead of full tokens, and structured logs are routed through the Lookout redactor.
  • Payload limits. The auth credential callback body is now capped at 16 KiB to bound memory use on hostile clients.
  • Backup integrity. Table identifiers are validated before being used during foreign-key introspection. See Backup.
  • Devcontainer safety. Cumulative tar extraction is capped at 500 MB to prevent decompression-bomb scenarios. See Devcontainers.
  • ETHOS refusals no longer leak tool, directory, or sibling-agent enumeration data in error messages.
  • Orchestrator context propagation. Request context is now correctly threaded through background work spawned by handlers, including five mission-engine call sites that previously dropped it.