Patch notes

What's new in Masterforce.

Updates, fixes, and improvements as we build the operating system. Follow along via RSS.

About Me, and Files from Gmail and Drive

Keep short facts about yourself that the assistant can use, and the assistant can now read PDFs and other files it fetches from Gmail and Drive.

New

  • About Me — keep short facts about yourself in Settings, such as the days you don't work, and the assistant uses them in your chats
  • The assistant can offer to remember something you mention, and nothing is saved until you choose to keep it private or share it with your team

Improved

  • The assistant can read PDFs and files it fetches from Gmail and Drive, and each file is saved in the conversation so you can open it later
  • The live connection indicator is now a labelled pill, and its popover explains in one sentence what is happening and what you can do about it
  • A read-only page now says View Only instead of looking disconnected
  • Long breadcrumb trails fold to the first and last item with an ellipsis between them
  • The detail panel's toolbar row and trail have more room
  • Edit Record Shape is now called Edit Properties, and it says where your change will apply
  • Approvals open as a list that shows who asked and how long ago, with the table still available

Fixed

  • Codex chats show readable tool names, filing a result works again, and each open Codex chat keeps its own fresh session

Documents That Keep Their Address

Documents and apps now keep one permanent address, so renaming one can no longer break a link or touch another entry. Trash also follows your access to each entry.

Improved

  • Links to documents and apps keep working when you rename them, because every entry now has one permanent address
  • A skill keeps its identity and its links when you rename it
  • Trash shows the entries you can edit, including ones shared with you directly, and the preview shows your real access level
  • Delete Now appears only when you have Full access
  • Built-in connections no longer show vendor logos

Fixed

  • Renaming a document can no longer overwrite another one, because a title no longer decides where a document is stored
  • Creating a child node now rejects names that could reach outside the workspace

Isolated Browsers and Uploads from the Sandbox

Every browser the assistant opens is now walled off from the others and from the sandbox, the assistant can hand you files it makes in the sandbox, and folders turn up in search.

New

  • Files the assistant makes in the sandbox or on a computer, like a chart or a report, can be uploaded straight into your workspace
  • Tools connected to Masterforce from outside, like Claude Code, can upload files to your workspace directly
  • Folders appear in the command palette and when you type [[ to link something

Improved

  • Every browser the assistant opens now runs on its own, cut off from other browsers and from the sandbox and computers, so one conversation's browser can never be reached from anywhere else
  • A chat only ever shares the context of entries you yourself can see
  • Linking with [[ uses one list everywhere, in documents and in plain text fields alike
  • Backspace and Tab in lists work the way they do in Notion, and images can be dropped into columns

Fixed

  • Links to a row in an app open on the right database tab, every time
  • Comment highlights in a document appear and clear for everyone who has it open, as they happen
  • Edits to a document keep saving after its file has been moved or renamed
  • The assistant finds an app whether you name it by its title or its id
  • Reply puts your cursor in the message box
  • Files with non-English names open correctly

Folders for the Assistant and Safer Document Titles

The assistant can now work with your folders, uploaded files can move between nodes, and giving a document the same title as another one no longer replaces it.

New

  • The assistant can create, rename, move and delete folders in Files, the same way you can
  • A file attached in chat can be filed straight into a folder in Files
  • Uploaded files can move to another node with Move To Node

Improved

  • Moving or deleting a folder stops before anything changes if there's a document inside you can't edit, and deleting one follows the same approval rules as deleting a document

Fixed

  • Giving a document the same title as another one in its folder no longer replaces that document, and the same goes for new Untitled documents, duplicates and documents moved into a folder

Shared Folders and Long Sandbox Runs

Share a whole folder at once, shape a record from its own panel, set up connections just for yourself, and let long sandbox work run past five minutes.

New

  • Folders can be shared. Everyone you share a folder with sees every document inside it, however deep, and a folder can have a public link
  • Adding a connection asks one question about where it goes, and a Marketplace connection can be installed just for you. A personal connection can be saved as a template or published to the Marketplace
  • Edit mode in a record's panel is now the one place to shape an app: rename and retype properties in place, add a property where it will live, and create relation, formula and attachment properties without editing files. A relation can point at another app
  • Archiving or pinning a direct message or group is now yours alone, and you can leave a group. Replying to the assistant's message asks it again, and the composer shows which entry you have open so the assistant can use it
  • Tasks, documents and other entries an agent creates start from your workspace's templates, so they arrive with the sections your team expects

Improved

  • Long work in the sandbox no longer stops at five minutes
  • Codex can use its tools when it works in the sandbox
  • The sandbox works when Masterforce runs on a Windows machine
  • The sandbox and computer software now ships as its own versioned release, groundwork for running computers on machines you own
  • Attachments look the same everywhere: in the composer, in sent messages, in a record's panel and in table cells
  • Typing in long documents is smoother, emoji shortcodes like :tada: work, and Backspace at the start of a heading or quote works the way it does in Notion
  • Gmail, Google Calendar and Google Drive show their real logos

Fixed

  • The assistant now reads long earlier messages in full. Before, a long message was cut short when the assistant read back the conversation, and it could think its own earlier reply had been cut off

Computers at Home Run in Full

A computer hosted on a machine you own now runs an agent's work in full, the same as a computer on the instance, and Runs On tells you when the machine needs an update.

New

  • A computer at home, hosted on your own machine through a runner, now runs an agent's work in full, the same way a computer on the instance does. Before, work sent to a computer at home restarted in a sandbox instead
  • Runs On now says Update Needed when the machine hosting a computer runs a runner too old to carry full runs, and Not Connected when it is offline, with what to do about each. The list of computers at home says Update Needed too

Improved

  • Work on a computer now reaches Masterforce over its own connection instead of a network route back to the app. Nothing secret is placed on the command that starts it, and the computer no longer needs any way to reach the instance

One Way to Add a Connection

Installing a connection from the Marketplace now opens the same Add Connection wizard you use in the app, links your agents share work from anywhere, newer Codex and Claude models appear in the model list, and the interface uses Title Case throughout.

New

  • Links an agent gives you now open in a browser. When an agent or an external client reports a task, document, app row or conversation, its reply ends with a web address you can share with someone outside Masterforce, and copying an agent's message turns its Masterforce links into web addresses too
  • Newer Codex models, including gpt-6.1-sol, gpt-6-sol and gpt-6-luna, now appear in the model list. The model picker also describes Fable as the tier for the hardest problems and long-running projects

Improved

  • After you press Continue on a Marketplace connection, you get the same Add Connection wizard as in Abilities, with the listing already chosen. It no longer asks whether the connection is personal, and if you can only propose connections, your request goes to an approver instead of being refused
  • The install dialog for a connection asks how you would like to use it, either Use Now or Save As Local Template, and then which node. Saving a template stays on the page and offers an Open link to that node's connections
  • Links in a message that point to a node, a file or a settings tab now work from the web too, and bold text inside a link keeps the link's colour
  • Buttons, menus, tabs, field labels and filter options now use Title Case throughout, for example Show As Badges, Try Again and Oldest First

Fixed

  • Opening an install link from the Marketplace could land you on the Overview tab instead of Abilities. Deep links that carry a tab now keep it
  • AI work that moved into a sandbox could not use Masterforce's own tools, such as reading entries, apps and files, and could not read scanned PDFs. It can now do both

Every Computer Runs in Full

Light mode is gone and every computer now runs in full, the assistant can read PDFs again inside the sandbox, and an agent's terminal shows what its computer ran.

Improved

  • Light mode is gone. Every computer now runs in full, so the Default, Full and Light choice no longer appears on an agent's panel or on My computer. Nobody had picked Light on either of our instances, so nothing changes for anyone. If a computer cannot take a run, the run restarts in a sandbox and is told why
  • An agent's terminal now shows the commands its computer ran, with passwords and keys removed before anything is written

Fixed

  • The assistant can read PDFs again inside the sandbox, including scanned ones made of images. It could not save the file it needed to look at, so it reported finding nothing

Agents That See What They Open

Codex models can now see images they open, an agent that switches to a sandbox stops what it was doing and tells you what it already changed, and a chat notification takes you straight to its conversation.

Improved

  • Opening a chat notification takes you to that conversation, even when it is in another workspace or arrives as a push notification on your phone
  • You can delete a conversation from the list as soon as it appears, and the unread count shows the full total instead of a partial one

Fixed

  • Codex models can now see images they open, such as a scanned document attached to an app. Before, they received the picture but could not look at it
  • When an agent moves its work into a sandbox partway through, it stops what it was doing first. If it had already changed something, such as saving a value or sending a calendar invitation, its reply now says so instead of reporting that nothing happened

Computers That Work in Full by Default

Agents' computers now run in full mode by default with every model your workspace uses, heavier work goes to the computer instead of a throwaway sandbox, you can register a computer at home, and each tab now keeps its own saved views.

New

  • An agent's computer now works in full mode by default, with Claude, Codex, DeepSeek, Grok and Ollama alike. The real API key never reaches the computer. Light is still available, and you choose it per agent from the agent's panel (Default, Full or Light)
  • When a node has a computer switched on, an agent's heavier work now runs there instead of in a throwaway sandbox. An agent can still pick a sandbox for one-off or untrusted work, and you can ask for one in chat
  • My computer can now run on a computer at home that you register yourself, using "Runs on" and "Add a computer at home". Only you can use it. On a home computer it works in light mode for now
  • Your own assistant can now work in full mode on your own computer. Choose it under "Assistant mode" on My computer. While it runs, other programs on that computer can act as you through it, so pick Light if you want to avoid that
  • Each tab now keeps its own saved views. Saving a table on People no longer changes Agents, and going back to the built-in views on one tab leaves the others alone
  • An objective's Linked tab shows its key results as a data view, with a Link button to add more, the same way tasks are shown

Improved

  • Signing in through a stored login stays protected when full mode is on: the password is only typed into the site it was saved for, and not in a seat on a computer that has run in full mode, until that computer goes to sleep
  • Changing views for the whole workspace now requires full access at the top of the workspace, and built-in panel and view names are written consistently in sentence case

Fixed

  • Runs in a sandbox or on a computer had no Masterforce tools for about a day after the previous release. They have them again

A Trash You Can Restore From

Deleted documents, tasks, objectives, apps and skills now wait in a Trash for 30 days so you can bring them back, you can add and change an app's properties yourself, relations can show their linked records as a live table, and connections set to Restricted stay hidden from people without access.

New

  • Deleting a document, folder, task, objective, app or skill now moves it to a Trash instead of erasing it. It stays there for 30 days, keeps its shares and favorites, and brings them all back when you restore it
  • A Trash page in the sidebar and a "Recently deleted" item in each node's menu list what was deleted, with a preview and Restore or Delete forever; every delete also shows an Undo you can use right away
  • Add, rename, reorder, delete and change the type of an app's properties from the app itself, with a preview of what a type change will do to your existing data, instead of editing the app's files by hand
  • Choose which properties appear in a row's detail panel, which are pinned at the top, and which sit under their own tabs
  • A relation can show the records it links to as a small table with their status, owner and dates, instead of only name chips, and you can switch between the two on any relation. A person with full access can set which one an app's relation starts with
  • A task's blocked-by and blocking lists, and an objective's linked tasks, now show as a table. Items you do not have access to are counted ("3 linked items you don't have access to") rather than shown
  • Task and objective panels are laid out from the same property lists the Plan tab uses, and anyone with full access to the workspace can save their own layout for them (pinned properties and tabs) or go back to the built-in one
  • "Use the shipped views" at the bottom of a view's + menu drops your workspace's customised views and goes back to the built-in ones, including every improvement to them in later releases
  • Open a Marketplace link to a connection and your workspace takes you straight to setting it up, with the choice of installing it for the workspace or just for you; nothing is created until you continue

Improved

  • A connection published to the Marketplace that signs in with OAuth, such as Notion, now keeps that sign-in, so people installing it are asked to sign in instead of being told no credentials are needed
  • Publishing a connection is refused, with the reason, if it holds a stored login or a password typed in as plain text; a publish also keeps the headers you withheld from earlier versions
  • Setting up a connection warns you when the node already has one installed from the same Marketplace listing
  • The public link field now turns what you type into a valid link as you go, shows what is wrong or already taken under the field, keeps what you typed if a link is refused, and uses the title when you clear it

Fixed

  • A connection set to Restricted was visible, together with its settings, to people at its node who had no access to it. It is now hidden from them in lists, counts and connected tools
  • Claude Opus 5.5 no longer fails with an error in chat and for agents

Sign In Without Showing the Password

An agent can now sign in to a site with a login you stored and granted it, without ever seeing the password, and asks you to take over its screen only for a code or a CAPTCHA — plus shares that end on a date, live updates for people shared one view, and links you can open from a phone.

New

  • An agent can sign in to a site with a Login connection you granted it: Masterforce types the password into the agent's browser itself, the agent never sees it, and the form is cleared afterwards
  • When a site asks for a code or a CAPTCHA, the agent pauses and asks you to take over its screen on that site; the tabs it had open are closed first, and nothing you type there comes back to it
  • Give a share an end date. After it, the share grants nothing, for people, teams, agents and public links alike; expired shares stay in your list marked Expired, with Renew and Remove
  • Tap a link in a document on your phone to see where it goes and open it

Improved

  • If a stored login covers the site, the agent has to try it before asking you to sign in, and every request for a code or a CAPTCHA reminds you never to type a password there
  • People shared one view of a database see its changes live, and a public link narrowed to a view no longer receives anything about rows outside it
  • Line breaks written by agents show as line breaks in documents and rich-text cells, the same as in chat
  • On a phone, selecting text in a table cell shows the formatting bar, and editing a link opens a drawer that stays above the keyboard
  • Notifications keep one width, end long text with an ellipsis, and the whole notification card opens what it is about
  • Self-hosted instances: Google and Microsoft connections that use the instance's own sign-in client now return through the Masterforce relay on every non-local address. If you host on your own domain, add https://app.masterforce.ai/oauth/relay to that client's redirect URIs, or move the client into the connection's own OAuth client setting. Only the hostname and a one-time code pass through the relay; tokens never do
  • An app's computed values only draw on other apps' data the reader can see

Fixed

  • An agent asked to change an app's columns now finds the way to do it instead of saying it can't

Computers of Their Own

Each agent now gets its own seat on its node's computer, with a screen and browser you can watch and take over, full coding tools that never see your sign-in, and the option to run that computer on your own machine at home — plus comments on exact words, a Copy link on everything, and shares narrowed to one database that stop there.

New

  • Sandboxes now work for workspaces that sign in to Claude or ChatGPT with a subscription — your sign-in stays on the server, and the sandbox only holds a pass that expires when the run ends
  • Each agent gets its own seat on its node's computer, with its own screen you can watch from the run and take over
  • An agent's browser on its computer stays signed in to the sites it uses between runs, and can open the dev server the agent started
  • Set an agent to work on its computer with its full Claude Code or Codex coding tools — your sign-in never reaches the computer
  • Run a node's computer on your own machine at home: choose "Add a computer at home" in node settings, and agents get their own seats there too
  • Choose where a computer runs with "Runs on", and move it between hosts — the disk is checked after the move and the old one is kept until you remove it
  • A new Login connection stores a site's username and password and can be granted to an agent; the password is never shown back
  • Select words in a document, task or OKR and comment on exactly those words — the comment follows them through edits, and says so if they are deleted
  • People who can comment but not edit can comment on selected text too, and a mention jumps to the paragraph it was made in
  • Copy link on every entry and conversation — in the header, row menus and the share dialog, or with a keyboard shortcut — and pasting into a rich editor gives a titled link
  • Date properties can show a live stopwatch that counts up and stops at another date, and relative dates update every minute
  • Gallery and ungrouped board views lay cards out like a masonry wall, so short cards leave no gaps and the sort order reads left to right
  • Agents and connected tools with edit access can read an entry's history and undo or roll back its changes
  • Agents can message anyone in the workspace, and the daily digest posts to the team channel

Improved

  • A message with photos or files appears the moment you press Send, with each upload's progress, and Retry or Edit if one fails
  • The unread count moves when a reply finishes, a finished reply never reopens as still typing, and the collapsed rail shows when a reply is being written
  • The live status dot explains what it is doing and can reconnect or reload, switching views no longer drops your last sentence, and a server restart no longer overwrites anyone's edits
  • Every property shows an icon for its type in table headers and the detail panel, and Status columns show the status icon
  • Shortcut hints read Ctrl, Shift and Alt on Windows and Linux and ⌘ only on a Mac, and the shortcut list matches what the keys actually do
  • Posts from connected tools or the assistant show the person who sent them, marked "via MCP" or "via Assistant", instead of an anonymous Agent
  • The relation picker loads its choices in table cells too, shows placeholder rows while loading, never offers Create before the list arrives, and keeps each row's details readable
  • Connected tools are told by name when a field cannot be saved, instead of having it silently ignored, and can upload a file straight into a node's Files
  • A share narrowed to one database or view of an app grants only that, and a view share is read-only and shows only the view's rows and fields
  • Mentions and the Recent feed only reach people who can open the entry or channel they come from
  • Editing a connection can no longer change its kind or the credential it uses, and a connection test never sends a stored credential to a site the connection was not created for
  • Agents sharing a computer cannot read each other's files or take control of each other's browsers
  • Comments and questions stay inside their own workspace, and a new entry can no longer take an id another entry already holds

Fixed

  • A renamed app, a new favourite or a changed permission no longer reverts to its old value after you navigate away and back
  • Attachments move with their entry or conversation when it moves to another node
  • A list that mixes bullets and checkboxes keeps every item
  • Following a link out of the chat minimizes it so you can see where you landed, and minimizing keeps your conversation open
  • Breadcrumbs in a narrow detail panel no longer overlap, and on a phone the node shortens to its initial so the entry's name stays visible
  • The date editor no longer invents a midnight time for a date-only value
  • Number prefixes such as "Lv." show in tables and cards
  • Messages appear on the Marketplace page, a new connection no longer offers to update a key it does not have, and finishing an install opens the new connection

The First Rows Are the Right Rows

A view now opens already filtered, sorted and grouped the way you left it, instead of reshuffling a moment later — plus questions can be pinned to the property they are about, and adding a connection saves once and asks for the key it actually needs.

New

  • Ask about one property — the due date, the owner — and the question stays attached to it, so a thread about the deadline is not mixed in with everything else
  • A question stays open until a person marks it resolved; nothing closes it on your behalf
  • Adding a connection from a template or the Marketplace saves once, when you press Continue — browsing templates leaves nothing behind
  • A connection that still needs its API key says "Not connected" and offers Finish setup
  • Open a file you have attached in the composer before you send it
  • Presence avatars in a detail panel open the party popover

Improved

  • A view's first screen already obeys its filters, sort and grouping, so the rows you see are the rows that belong there — no reshuffle once the rest loads
  • An app that is still loading no longer looks like an empty app
  • Long titles wrap to a second line instead of being cut off
  • Publishing a connection to the Marketplace sends the name and description you typed, and records which key an installer has to provide
  • Back closes the file viewer instead of leaving the page, and a link to a file reopens it
  • Moving a task, OKR or document between nodes no longer rewrites the file, and a move or delete that only partly succeeds now tells you
  • A connection can only be reached from the workspace it belongs to, and a connection shared with you is checked against that share rather than the folder it sits in
  • Instances come back on their own after the computer restarts

Fixed

  • DeepSeek conversations run again instead of being refused
  • Archiving returns you to the list with an Undo, and deleting always asks first and stops the run
  • A reply shows who wrote it, and a new profile picture appears everywhere at once
  • Nested bullets can be dragged again, and the floating menus stay out of the way while you select text
  • Panel views end where their rows end, instead of leaving empty space below
  • Buttons, cards and menu items show the pointer cursor and answer the keyboard the way they look like they should

Moves That Keep Their Links

Move an entry between nodes and every link, permission, approval and notification that pointed at it follows; delete one and nothing is left behind — plus a node can no longer be deleted over live work, notifications clear when you open what they point at, and formulas learn minutes.

New

  • Formulas gain minutesBetween and minutesSince for time-based columns
  • A notification clears itself the moment you open what it points at

Improved

  • Links to an entry keep working after it moves to another node — old mf:// links and shared URLs resolve to where the entry lives now
  • Moving an entry carries its access policy, pending approvals and notifications with it; deleting one removes its shares and policies everywhere, not just where you were looking
  • A node can no longer be deleted while it still holds tasks, OKRs, documents, agents or chats — move them first, then delete
  • The integration card's toggle now reads "Notify owners"

Fixed

  • Clearing a conversation's name makes it "Untitled" instead of snapping back to the old name
  • An assistant reply that is still starting shows typing dots rather than "No output"
  • The recurrence chip looks like the control it is
  • Container runs can read their workspace again on instances where the folder was owned by root

Every Table Is a View

Every record list in a panel is now a real data view with paging, honest counts, saved views and your own sort and filters — and the editor stops jumping your cursor, an agent that loses its session replays the whole conversation instead of forgetting it, and integration problems reach their owners.

New

  • Your receipts are a data view: page through all of them, see a true total, save your own views, and click a document receipt to open it — which never worked before
  • Connection logs, API keys, registered devices, agent and transcription usage, the access audit and pending approvals are all data views now, at a density that fits a side panel
  • When an integration starts failing its owners are mentioned on the app, once per outage, and once more when it recovers — with an on/off switch per integration
  • A node can switch its own machine on and off, and you can preview an agent's dev server through an authenticated proxy without the machine publishing a port
  • Links can point straight at a settings tab — the assistant can send you to Notifications or API keys with one chip
  • Remove a registered push device from Settings

Improved

  • Pasting long text no longer jumps the cursor, clicking blank space no longer snaps the caret to the top, drag handles behave, and lists inside table cells survive a round trip
  • When a provider declines to resume an agent's session, the agent gets the whole conversation back instead of one message with no memory — and the degradation is recorded on the run, not only in a log
  • The action bar adapts to the panel it sits in, not the window; the node an entry belongs to leads the breadcrumb trail; entries show their own icon, never an initial
  • Shared view edits are committed to the content repo like every other content change, a broken views file falls back to the defaults instead of blanking the tab, and personal view settings are validated on save and cleaned up when a view is deleted
  • Approval rows open the thing being approved
  • The version label shows when the build was made, not a hash, and links to its changelog entry
  • The browser Back button follows the URL, not a lingering selection, and the conversation rail stays right after switching nodes

Fixed

  • Receipt names follow the entry — renamed entries show their current title, deleted ones are marked and no longer dead-click
  • Three styling classes that compiled to nothing are fixed and a guard stops the next one; a tooltip is treated as a description, not the control's name; two React warnings on every task panel open are gone
  • A CI test that raced on a port no longer fails builds at random

One Tree, and Every Provider Runs

A new node shows up everywhere at once instead of flickering, file attachments survive editing a message and actually reach the assistant, and the generic-provider runtime — ollama, OpenRouter, xAI and any OpenAI-compatible model — runs in production again.

New

  • Move a chat channel to another node — its on-disk mirror moves with it, and agents can do it too through the new move_channel tool
  • Web search works on every model adapter, not only the ones that had it built in
  • Agent machines can authenticate to GitHub with the node's own GitHub connection — no credential ever lands on disk
  • Escalating a run to a container gives it the full power the run was granted, instead of a quietly reduced set
  • Restore an earlier body of an entry straight from its history
  • Push notifications carry their own badge glyph so they read as Masterforce at a glance

Improved

  • The org tree now lives in one place — a node you just created no longer vanishes for a frame when you come back to it, and nothing can be ejected to Home mid-switch
  • Granting a share is one path whether a person or an agent does it — duplicates are upgraded in place, the recipient is always told, and a case-mismatched email still reaches them
  • Compose advice now runs from wherever you are standing, not only from the instance directory
  • Your workspace's link preview shows the icon you configured, not a default
  • The assistant's reply bubble no longer sits blank while a provider that speaks only at the end is still thinking
  • Installing a connection from the marketplace lands you in the wizard it prepared, every time

Fixed

  • Attaching a file and then editing the message no longer deletes the attachment — attachments are stored as data now, not as text inside the message — and they actually reach the assistant, which they never did before
  • Ollama, OpenRouter, xAI and other OpenAI-compatible models run in production again: the runtime moved to Node 24, the version the generic-provider engine requires, and the fleet now runs one Node everywhere
  • A test that hangs now fails with its name within seconds instead of stalling the build until a timeout — which is how the provider issue above went unseen
  • A document write from an agent is pinned to the node you named — a filename that exists in two workspaces can no longer send the write to the other one
  • A non-canonical entry id is refused rather than resolved to a first match, and role assignment can no longer mint a roster identity from a raw email address
  • A node whose registration vanished is treated as moved, not duplicated
  • The browser capability's stdio path receives the broker environment it needs
  • Wizard steps show a number and a label, never both glyphs; selected options in pickers drop their redundant bold

Folders First, and Chats That Keep Up

Files open on a folder view with node-wide search and folder import, and existing chats now pick up newly connected tools instead of staying frozen at the day they started.

New

  • The Files tab now opens on a folders view — browse your node the way it's actually organized, with folder import to bring a whole directory tree in at once
  • Search from a folder reaches the whole node, not just the folder you're standing in

Improved

  • Connect a new tool mid-project and your existing chats can use it — conversations no longer keep the tool list from the day they started, and tell you when they've refreshed it
  • The tool and reasoning trail starts collapsed, so answers lead with the answer — open it when you want the working

Fixed

  • Requesting access to a shared item and filtering shared-with-me by type now cover every entry type, driven from one registry instead of hand-kept lists
  • Starting an instance brings the public tunnel up before the readiness wait, so an interrupted start can no longer leave the site down while every container reports healthy

A Machine of Your Own

You get a persistent machine of your own, character sheets gain levels and a voice, and a long sweep closes the ways one workspace's name could reach another workspace's files.

New

  • You now get a machine of your own, not just your agents — a persistent place to work that keeps what you installed and what you stayed signed in to
  • Several people and agents can share one machine at the same time, each in their own lane, instead of queueing behind whoever started first
  • Switch to your machine from the assistant and watch its terminal stream while work happens
  • Character sheets gain levels and a card — your strengths are yours to edit, and the radar reflects what you actually do
  • Three voices for how the workspace talks to you, so the tone fits the moment instead of one register for everything

Improved

  • You can see a run thinking while it works, instead of waiting for the answer to appear all at once
  • Status now looks and behaves like a status everywhere it appears — the same colours in a table, a card and the editor, rather than three different renderings of one value
  • Notification previews read as sentences again — the formatting marks from the original text no longer leak into the toast, the bell and your phone
  • Opening a skill no longer scans every workspace to find it

Fixed

  • Being locked out after failed sign-in attempts now clears when you are issued a new password, instead of keeping you locked out with a working password
  • Agents using DeepSeek or Ollama can sign in again when they escalate to a container — the credentials were not reaching it, so the work failed with an unclear error
  • Agent containers no longer report a false system error on startup
  • The people list for a workspace no longer shows members of a different workspace that happens to share a name

Security

  • A long sweep closed every path where one workspace's name could be read as another's — settings, credentials, the org tree, connections, transcription and live subscriptions each now resolve the workspace they were actually given
  • A connection can no longer be authorised against one workspace and stored against another
  • Where a workspace cannot be identified, the answer is now a refusal rather than a guess — guessing was how one tenant's request could reach another tenant's files

Agents Get a Machine

Agents can now have a machine of their own that persists between runs, so they can install what they need, verify their own work, and let you watch it happen.

New

  • Agents can now have a machine of their own — a persistent place to work that keeps what they installed and what they stayed signed in to, instead of a blank container thrown away at the end of every run
  • An agent can run your project's checks and start a preview on its machine before handing you the work, rather than opening a pull request nothing has verified
  • Watch a machine live — its terminal streams while the work happens, so you can follow what an agent is doing instead of waiting for the summary
  • Each agent on a node gets its own lane, so several can share one machine at the same time without queueing behind each other

Fixed

  • Adding people to a conversation is now offered only where it actually works — on a node's chat it silently did nothing, and the person was removed again the next time anyone opened it
  • Tapping the chat composer or an inline text cell on iPhone no longer zooms the page in

Security

  • Any signed-in person could read another workspace's orchestrator settings, OKR health and agent spend by naming it; all three now require Co-Creator like the rest of that surface
  • Two workspaces claiming the same name now both fail closed, instead of one of them quietly resolving to the other's files and secrets
  • Sign-in credentials can no longer be written into a guessed folder when a workspace name cannot be resolved
  • Permission answers are now anchored to the entry's own folder, so the interface can no longer be told you have access that you do not have

Answers Arrive Once

Replies stopped doubling, switching an agent's model mid-conversation stopped breaking the thread, and the assistant can now act on the entry it's commenting in instead of only describing what it would do.

New

  • Ask an agent for a change in an entry's activity feed and it makes the change, rather than replying that it will. It was being told to keep its comment short, and read that as a reason not to act at all
  • Tool steps performed by a sub-agent are indented under the work that delegated them, so you can tell what was handed off from what the main agent did itself
  • When the assistant gives you a link to an entry, it is a real link. It used to invent an address that looked plausible and opened nothing

Fixed

  • Claude replies arrived twice, the whole answer repeated. Any reply that began with reasoning was affected
  • Switching an agent to a different model mid-conversation broke the thread permanently — every retry failed with the same error. The conversation was being resumed against the previous provider
  • Codex replies sometimes arrived completely empty. The answer is now recovered, or you get an error you can retry instead of a blank message
  • A reply that failed could show an unrelated warning about API keys, which read like the cause and never was

Security

  • Closed five holes in the sharing surface. The most serious let any signed-in person read another person's list of shared items, including email addresses, across workspaces
  • Sharing an entry now checks your permission on that entry, not on a folder you name in the request
  • Tightened the boundary that decides which workspace an AI run can see, and the cache in front of it now notices a workspace being renamed

Chat Answers Again

Fixes a regression from 0.47.0 where every assistant and agent reply failed immediately, before the model was ever reached.

Fixed

  • Asking the assistant anything failed instantly with an internal error — on every model. The run crashed while saving its placeholder message, before your question ever reached the AI. Replies work again

Notifications That Find You

The assistant's replies now reach you even when you've looked away, chats can be administered after they're created, and transcription can run entirely on your own device.

New

  • Chats can be administered after they exist: move a node chat to a different node, add people to a conversation already underway, and give it a description — all from a menu on the chat header
  • When the assistant finishes answering you, you get a notification — so you can ask something, switch away, and find out when it's done instead of checking back
  • Transcription can run entirely on your own device: audio never leaves the browser, and there's no per-minute cost

Improved

  • The bell badge is live the moment a page loads. It previously stayed blank until you opened the panel once, which meant it never told you anything you didn't already know
  • When the assistant mentions someone by name, that person is notified — the same as being mentioned by a colleague
  • Starting a conversation is simpler: Personal or Group, each saying what it's for. A DM is just a group with one other person, so there's no third thing to choose between
  • Team and Everybody now explain who they include when you pick between them
  • Shared with me lists your most recent shared items directly, instead of a single row you had to open to see anything
  • Recording breaks at natural pauses rather than fixed intervals, and the transcriber warms up in advance so the first words aren't clipped

Fixed

  • A chat's unread count could miss the assistant's reply and never correct itself; mentions written as "@Name!" or "@Name's" now match; and a short name like "@Al" no longer notifies everyone whose name starts the same way
  • Mentions are now bounded to people who can see the message, so a name shared across workspaces can't reach someone outside it
  • Editing and creating people is properly authorized, a delete bypass is closed, and a role change takes effect in sessions that are already open
  • Dragging a just-added favorite no longer makes it flash or vanish from the sidebar
  • The setup checklist stays put above the footer instead of scrolling out of sight, and avatar changes appear without signing out
  • The folder bar shows which folder you're actually in, with the path a tap away
  • You no longer appear in the member picker when starting your own group, and the assistant's replies are no longer saved twice
  • Routines can be created and managed through agent tools again, and an agent can act on the entry it's commenting in

Numbers You Can Trust

Counts and totals now refuse to guess when data is still loading, statuses carry real outcomes, and several permission leaks are closed.

New

  • A proper Status column type: pick the stage each option belongs to (to do, active, waiting, done) and boards, colors, and progress tracking all follow the same rules the rest of Masterforce uses
  • Status options can say what reaching them means — finishing is a win, cancelling isn't — so progress tracking stops treating "cancelled" as an achievement
  • An optional stats line on your workspace's shared link preview card

Improved

  • Counts, sums, and empty states no longer show a number computed from a partially-loaded page — they wait, and say so, until the real total is known
  • Collapsed tool sections show the latest activity instead of freezing on the first step, and streamed replies keep their paragraph breaks
  • Agents resolve provider credentials through the same path the assistant uses, so subscription auth works identically for both
  • Table-of-contents jumps land with breathing room above the heading

Fixed

  • A public share link can no longer open other agents on the same node; restricted agents leave the Party roster; Party counts and OKR relations respect what the viewer can see
  • The pending inbox filters by your authority before limiting the list, so approvals you hold can't be pushed off the page
  • Filenames survive publishing and activity — no more attachment chips showing raw ids
  • Disabling a user now revokes their access across every sign-in method immediately
  • The month view stops showing an overflow count it can't yet justify

Your Workspace, Your Timezone

Set a timezone for your workspace so routines, streaks, and daily progress follow your midnight — not UTC's.

New

  • A workspace timezone setting: routine days, streaks, the consistency heatmap, and daily XP windows all follow your workspace's midnight instead of resetting mid-morning
  • Checkbox columns can be marked as an app's completion property — ticking one now earns XP, so checklist-style apps count

Improved

  • The completion toast names what you finished and shows both currencies — "Morning review completed · +30 XP · +6 LP"

Fixed

  • Next occurrence and the heatmap now always agree on what day it is

Routines

Turn any task into a routine — Masterforce creates each day's task for you, tracks your streaks, and shows your consistency at a glance.

New

  • Any task can become a routine: switch its Type, pick a cadence (daily, weekdays, weekly, or custom), and Masterforce generates that day's task for you automatically
  • Streaks and a consistency heatmap show how you've been doing — every square is a day, and clicking one opens that day's task
  • A Routines view in the Plan tab manages your recurring work, while generated tasks flow into your day like any other — marked with a repeat badge so you always know where they came from
  • Missed days quietly clear overnight — recorded in your history, never piling up as overdue guilt
  • On-device transcription with Moonshine and Whisper — voice notes transcribe locally without sending audio to a cloud provider
  • Move, rename, and delete files directly from the attachment viewer
  • Content previews on cards — see what's inside an entry without opening it
  • Images embedded in text cells now render in place, and app columns can be renamed safely in one step

Improved

  • The header scrolls away as you read, tabs stick to the top, and breadcrumbs are cleaner
  • Person columns are now a proper people picker everywhere they appear
  • An agent's autonomous cadence is now called its Schedule, keeping "Routine" for recurring work
  • Statuses show one consistent color everywhere they appear — lists, pickers, and boards finally agree

Fixed

  • Moving an uploaded file no longer risks destroying it
  • The navigation bar stays put when an app is open, and the editor no longer resets your scroll position on focus
  • Microphone capture works again after a permissions header regression, with clearer failure messages when transcription can't run
  • The share dialog targets the right access level and no longer arms a share before you confirm

XP and the Routine Lifecycle

Completing work now quietly earns experience points with a full receipt trail, and routines gain a proper retirement state.

New

  • Finishing tasks, routines, and documents now earns experience points — a quiet toast acknowledges each completion, and every point traces back to the exact piece of work that earned it
  • Your existing history counts: past completions and creations were credited retroactively, so nobody starts from zero
  • Routines can be Retired — a proper way to end a practice that keeps its full history and streak record, unlike deletion
  • A routine's occurrence date and source routine are now real properties you can show in any task view

Improved

  • The daily digest includes a momentum line: experience earned, your strongest area, and streaks alive
  • Routine detail polish — correct icons throughout, cleaner header chip, and dates shown as data rather than squeezed beside the title

Fixed

  • Deleting a routine no longer leaves its generated tasks pointing at a routine that doesn't exist
  • Connection rows show their real service icon and cleaner sync information

More Stable Editing

Editing on mobile and desktop now keeps your cursor and selection where you put them.

Fixed

  • Tapping within a document on a touch device now places the cursor at the tapped text instead of snapping to the beginning or end
  • Using text formatting controls no longer drops the active selection
  • Long labels wrap cleanly instead of running together

Clearer Marketplace Installs, and Assistants That Show Their Work

Marketplace templates now make their destination clear before anything is created, connections are configured where credentials belong, and assistant reasoning can stream alongside the answer.

New

  • Every marketplace listing now begins with one clear choice: use it now or save it as a reusable local template
  • Using a connection template now asks whether it is for you or your workspace, then opens setup to collect credentials securely. Connection templates never carry credentials.
  • Assistant replies can now stream their reasoning summary as they work, so longer runs are easier to follow without waiting for the final answer

Improved

  • The install picker uses the same node and option-card patterns as the rest of Masterforce, including a direct workspace hierarchy picker when a node is actually needed
  • Personal and workspace connection permissions now stay distinct through assistant-created connections and setup handoffs
  • Claude Code and other MCP clients have a clearer connection path into a workspace

Fixed

  • The marketplace detail page no longer presents credential requirements as static listing facts. Provider-specific setup asks only for the information it really needs.
  • Installed workspace connection templates can be removed safely, with authorization checked at the workspace root
  • Container adapter selection now fails closed for an unknown runtime family instead of choosing an unsafe fallback

Transcription Budgets, and One Place to Share

Voice transcription now has real limits — daily, monthly, and per-session — so a forgotten recording can't run all day. Sharing collapses into a single modal, and the mobile editor toolbar stops hovering in your text.

New

  • Transcription now has budgets you can set: a daily cap, a monthly cap, and a maximum length for any single session — the first limits transcription has ever had
  • A session that hits its cap stops cleanly and keeps everything it heard — the transcript is saved and posted exactly as if you'd stopped it yourself, never discarded
  • You get an amber warning as you approach a cap while recording is still running, so a long meeting doesn't end in a surprise
  • Limits are set in minutes, not dollars — audio is billed per hour by one provider and per audio token by another, and minutes is the only measure that's honest across both

Improved

  • One modal is now the single home for every way an entry leaves your workspace — share with people, save as a template, or publish to the marketplace — instead of three separate menu actions in different places
  • The share modal spells out what actually travels with an entry, so you can see what you're handing over before you hand it over
  • The editor toolbar now appears only when it has something to say — when you've selected text — instead of hovering under the cursor the whole time you're writing
  • Type / on any rich-text field to insert blocks — it works in the composer, property fields and message editing now, not just documents
  • Undo and redo moved into the ⋯ menu and are available at every screen width, out of the way of the text you're editing

Fixed

  • Chat bubbles now sit above an open detail panel instead of reserving empty space below it
  • Toolbar items meant for small screens now appear and disappear at the same width the layout itself switches at, instead of a slightly different one
  • The app icon fills its tile properly and keeps a safe margin, so it no longer looks cropped or floating depending on where it's shown
  • Identity glyphs in detail headers always render in the foreground colour, so they stay legible on every surface

Connect Claude Code to Your Workspace — the MCP Server Arrives

Every Masterforce instance now serves an authenticated MCP endpoint, so Claude Code and other MCP clients can search, read, and edit your entries as you — plus a voice transcription tab, smarter mobile editing toolbars, and honest run costs.

New

  • Masterforce now speaks MCP — connect Claude Code (or any MCP client) to your workspace and it can search, read, create, and edit your entries, work with app data, upload files, and leave activity notes, all scoped to exactly what you can see and touch
  • Mint API keys in Settings → MCP Server: each key is tied to you and one workspace, shown once, stored only as a hash, and revocable at any time — the tab shows your server URL and a ready-to-paste Claude Code command
  • External clients get a describe_workspace tool so a freshly connected agent can orient itself — your nodes, what lives in them, and the valid status values — in one call instead of guessing
  • Every external call is audit-logged with the key that made it, and sensitive capabilities — org structure, roles, deletions of nodes — are deliberately not exposed
  • A new voice transcription tab turns recordings into text inside the workspace, with provider usage reported in the provider's own units
  • Text selection on mobile gets a proper toolbar — it fades away while you type and returns when you pause, so it never sits on top of what you're writing

Improved

  • Run costs are now real or absent — a dollar figure only appears when the provider actually reported one for a metered run; subscription-auth runs no longer show fabricated spend
  • Person detail pages present roles as redesigned cards, and sys-admin role counts are accurate

Fixed

  • App rows no longer go stale right after a write — grids reflect your change immediately
  • The bottom navigation stays reachable while a detail panel is open, and the keyboard no longer misjudges its height on fixed-position screens
  • Blank lines you type render at full height everywhere, the chat edit box no longer reserves two empty lines, and task-item checkboxes follow the document's edit permissions
  • Saving a default workspace from the Home screen works again, and the Notifications and MCP Server tabs sit at the same padding as every other tab
  • Individual options in pickers can now be disabled properly instead of merely looking disabled
  • Workspace imports verify that every user reference is remapped, so an import can no longer silently point at users that don't exist

A Network Blip No Longer Looks Like Signing Out

A brief connection drop used to empty the sidebar, disable chat, and flash open documents back to skeletons. The app now tells the difference between 'you signed out' and 'I couldn't reach the server'.

Fixed

  • A failed session check is no longer treated as a sign-out — waking a laptop or losing signal for a moment kept your identity in the sidebar, chat enabled, and open documents on screen instead of collapsing to a signed-out shell
  • Recovery retries on its own until it gets a definitive answer, and probes immediately when you return to the tab, rather than giving up after a single attempt
  • When a live editing session has to be replaced, the document stays readable while the fresh connection syncs, instead of flashing to a skeleton and back

Improved

  • Styling moved to Tailwind v4 — no visual changes intended, but the design tokens and CSS layering are now simpler and faster to build on

Live Updates Everywhere — Including Public Share Links

Open views now stay fresh against agent and teammate writes on every surface — workspace tabs, open apps, shared-with-me, and even public share links viewed without an account. Plus a batch of marketplace, icon-picker and touch-target fixes.

New

  • Public share links are now live — an anonymous visitor watching a shared app or document sees changes appear within seconds, no reload, and revoking the share cuts the stream immediately
  • Shared-with-me surfaces update in real time, including apps shared at the level of a single database — recipients see exactly their database's changes and nothing else

Fixed

  • Opening an app no longer silently stopped live updates for its grid — agent and teammate writes now appear immediately instead of only after a reload
  • Rows now resolve completely in views that don't pin an explicit visible-column list, instead of showing gaps
  • Opening an app occasionally stalled for over a second while the server rebuilt an internal index; that rebuild no longer runs on the read path
  • The realtime event log is now indexed and pruned on a seven-day window, so reconnecting clients catch up quickly instead of scanning an ever-growing table
  • The template wizard preview was missing its description and agent chips; template icons now render through the standard icon component so they match the rest of the app
  • Icon picker: the segmented control is padded correctly, pasted emoji are accepted, and its tabs sit in the picker header on mobile
  • Hover-revealed controls are now reachable and non-overlapping on touch devices
  • Dark-surface styling is usable in light mode, and dark-mode compound rules follow on-dark surfaces correctly
  • Role and title badges no longer appear on every thread message — they are reserved for system administrators
  • Moving an attachment never unlinks the original before the moved copy is durable on disk
  • Sample-payload previews list mapped fields first, then the rest in natural order, so the mapping is easy to scan
  • A stale-body write refusal is now recognised reliably, so the editor's retry path works even when the module is loaded twice by the runtime

Security

  • Anonymous share connections are strictly scoped: only the shared entry's own updates are delivered, internal identifiers are stripped from every event, expired or revoked shares are disconnected within seconds, and per-visitor connection caps bound the anonymous surface
  • Client-supplied address headers are no longer trusted by default when rate-limiting anonymous connections — deployments behind Cloudflare opt in explicitly, and the CLI configures this automatically for tunnel setups

Assistants Read PDFs Directly

Attach a PDF in chat and the assistant reads it straight away — no more waiting for a sandboxed container to spin up first.

New

  • Assistants and agents now read the text of PDF attachments and files directly, on every AI provider — previously any PDF forced a slower sandboxed-container detour

Fixed

  • Reading a scanned, image-only PDF now explains clearly that it needs the sandboxed container, instead of returning unreadable raw data
  • On some server setups, asking the assistant to analyze an attachment failed with a permission error; server startup now prepares the needed workspace directory automatically

Agents Work in Parallel

An agent can now handle assigned work, run its own schedule, and hold a conversation at the same time — each with its own runs, its own costs, and its own tab.

New

  • Work, routines, and chat run at the same time — an agent no longer finishes one before starting another, and each mode tracks its own runs independently
  • Wake on heartbeat and Schedule are now separate settings — an agent can work its assigned queue and run a daily routine, instead of being forced to choose one
  • The agent panel is organised by what an agent does: Details, Work, Routines, and Chat, each showing that mode's live run, history, and spend
  • Run status tells you what an agent will do next and why not sooner — waiting for the heartbeat, no work assigned, next routine run, or orchestrator off
  • Every run records what it actually cost, taken from the provider rather than estimated

Improved

  • Hovering an agent's status dot shows what it is doing right now
  • A crashed or killed run no longer strands an agent as permanently "working" — its claim expires and the agent recovers on its own
  • Pausing an agent's routine no longer stops its assigned work as well

Fixed

  • Successful agent runs were being recorded as failed, which also left the agent stuck in an error state
  • A scheduled routine could silently skip its turn when the agent had also just finished ordinary assigned work
  • Error messages rendered in grey rather than red in around seventy places, including chat alerts and form validation; several hover states and text weights were also being silently overridden

Security

  • Removed three endpoints that returned agent job details, entry locks, and effectiveness data without checking permissions

Mapping Translation Tables

Incoming webhook values can now be translated into your own vocabulary as they arrive, so one endpoint can feed several destinations without a separate integration for each.

New

  • Mapping entries accept a value_map — an exact-match translation table that converts a foreign value into one of your own, so a single webhook can route submissions to different destinations based on what the payload says

Fixed

  • A database-scoped ingest with only-when-empty could create a duplicate row from a single submission; the retry now recognises the row it already wrote
  • Connection links are canonicalised, so the same connection is no longer reachable under more than one form of its address

Safe Concurrent Editing

Two people — or a person and an agent — can now edit the same document at the same time without either one's writing disappearing, and long documents get a table of contents.

New

  • Table of contents block — drops a live outline into any document that updates as you add and rename headings, and jumps to a section when you click it
  • An agent can now run its routine, work its queue, and answer you in chat at the same time instead of taking turns

Improved

  • When someone else edits a different paragraph while you are writing, their change now merges into yours instead of one of you losing work
  • Pasted YouTube and Vimeo links now unfurl into proper bookmark cards
  • Environment-variable and endpoint editors rebuilt for consistent keyboard and selection behaviour

Fixed

  • Editing the same file in two browser tabs no longer silently discards one tab's changes
  • An agent writing to a document no longer overwrites whatever you were typing at that moment
  • Backspace and Delete now actually delete selected blocks
  • Table cell selection survives someone else's edits arriving mid-selection
  • A pasted single word is no longer mistaken for a bookmark URL
  • Table-of-contents links now scroll cleanly to their heading
  • Permission changes now take effect immediately when a node is updated or deleted, instead of waiting for a cache to expire
  • Marketplace publish wizard shows the real connection icons, asks for consent once, and behaves the same on edit as on publish
  • Pinned items in the sidebar now open when clicked

Always-On Scheduling and Agent Run Status

Integration syncs, webhook processing, and cleanup chores now run on an always-on clock — no orchestrator setup required — and every agent shows an honest Run status telling you what it will do next, and why.

New

  • Mechanical clock — integration syncs, webhook event processing, approval expiry, and cleanup sweeps now run automatically on every instance, independent of the orchestrator; turning the orchestrator off no longer stops data delivery
  • Run status — agents show what happens next and why: Next run <time>, Waiting for heartbeat, No work assigned, Manual, Paused, or Orchestrator off — in the agent panel and as a sortable column in the agents view
  • Integration cards now show the next scheduled run time and a badge for unresolved sync conflicts

Improved

  • The orchestrator is now purely the judgment layer — agent wakes, scheduled agent routines, doc review cycles, OKR health, and the daily digest; its manual mode is now a safe default
  • Agent panels show next-wake time and cadence for scheduled agents beside the status controls

Removed

  • The Routines tab — schedule visibility and controls moved to where they belong: integration cards for syncs, the agent panel for agent schedules

Marketplace Bundles: App Suites, OKR Playbooks, and Attachments That Travel

Publish connected sets — an app together with its related apps and data, or an objective with its key results and tasks — and everything rebuilds coherently on install, images and attachments included.

New

  • Ship related apps — publishing an app can now bundle the apps it links to, chosen from a prunable checklist; cross-app relations survive install and point at the installed copies
  • Publish sequence — share an objective together with its key results and tasks as one installable package; dates, statuses, and assignees are always stripped, so installers get the plan, not your progress
  • Attachments and images now travel with templates — document images, app row attachments, and skill folder files ship to the marketplace and re-materialize on install
  • Creating an OKR now opens the template picker (blank, installed packages, or Browse Marketplace), matching how tasks already work

Improved

  • Multi-database app previews render each view with its own database's columns instead of always showing the first database
  • Re-publishing a template with unchanged files uploads nothing — assets are deduplicated by content, and published versions stay installable forever

Security

  • Publishing a bundle checks your access to every included item at its own location — a link to something you can't see never ships it

Live Templates, Member Sign-In Controls, and a Unified Icon Picker

Marketplace templates now stay live and pull-updatable after publishing, admins get direct control over member sign-in, and picking an icon or emoji is one consistent picker everywhere.

New

  • Templates are live entries, not frozen snapshots — publish captures a point-in-time copy, and installs can pull later template updates instead of staying stuck on day one
  • Admins can set a member's sign-in password directly and disable/enable their sign-in — no more invite-link or reset-link workflow
  • One unified icon picker (emoji + Lucide icons) across the app, replacing the mix of separate emoji and icon pickers

Improved

  • Content changed outside the app — imports, direct file edits, external tools — now reaches the running server reliably and can be pushed to open clients instantly with a single refresh command, instead of requiring a restart
  • Cross-app backlinks and self-relations (a database relating to itself) display correctly, including custom labels and parent-chain breadcrumbs

Editable Parent Breadcrumbs

The parent breadcrumb on a nested item is now interactive — reassign, unlink, or link a parent right from the trail, with the same experience across app rows, OKRs, and tasks.

New

  • The parent trail on a nested app row is now interactive — move it under a different parent, unlink it, or link one directly from the breadcrumb, instead of only clicking through to open an ancestor

Improved

  • Parent breadcrumbs now work the same way everywhere — app rows, OKRs, and tasks share one consistent trail, reassignment menu, and picker

Fixed

  • Inline entity icons in rich text no longer sit slightly off-center next to images
  • Opening a date field on mobile no longer pops the keyboard open automatically

Link Directly to a Row in Any App

Portable in-app links now reach individual app rows — mention a specific person, transaction, or record inline from documents and descriptions, and jump straight to it.

New

  • You can now link to a single row inside an app, not just the app itself — type [[ and pick a row to drop a clickable link into any document, description, or note, and clicking it opens that exact row
  • Row links are portable and shareable — they carry the app and database context inline, so the same link works wherever it's pasted and matches the URLs the app already produces

Telemetry & Analytics

Product analytics, session replay, and error tracking arrive on the cloud service, and every instance gains an anonymous, transparent health pulse — default-on, one-switch opt-out, and never a byte of your content.

New

  • Cloud product analytics (PostHog) — feature usage, workspace health, session replay, and automatic error tracking on app.masterforce.ai
  • Anonymous instance pulse on all installations — version, platform, and bucketed usage counts; announced at every boot and disabled with a single MASTERFORCE_TELEMETRY=off
  • Bring-your-own analytics — set POSTHOG_KEY (and optionally POSTHOG_HOST) on your instance to route your users' product analytics to your own PostHog project

Notes

  • Self-hosted user tracking is off by construction — the analytics key only exists where the operator sets it; the pulse carries no names, content, IPs, or domains
  • Full telemetry disclosure in the README and privacy policy, including exactly what the pulse contains and how to switch it off

Remote MCP Servers, Over the Network

Connect Model Context Protocol servers by URL with bearer or API-key auth, and share them as marketplace templates that keep each person's credentials private.

New

  • Connect a remote MCP server over the network by URL with bearer-token or API-key authentication, and test the connection to see exactly which tools it exposes before saving
  • Publish a remote MCP connection as a shareable template and install one from the marketplace, with credentials automatically stripped so each installer supplies their own token

Improved

  • Editors — not just full managers — can now run, pause, resume, and reactivate app integrations and rotate webhook secrets

Fixed

  • Resizing a table column now sticks reliably on content-heavy tables instead of snapping back to its old width
  • Assistant and agent avatars now line up with the sender name instead of drifting below it
  • Model and reasoning-effort badge labels now read in proper sentence case instead of appearing lowercase
  • Hardened authorization for app integrations so every setup and management action is checked against the exact connection, database, and app it affects

Match Keys for Webhook Data

Set a key field on a webhook connection so repeat deliveries update an existing row instead of creating a duplicate.

New

  • Give a webhook connection a match key — a field like an email address or a session ID — so later deliveries carrying the same value update the row they first created instead of adding a duplicate, even when several arrive at once

Improved

  • A connection's field-mapping table now flags the matched field with a "Match key" badge, or notes "Always creates a new row" when none is set, so you can see how incoming events are handled at a glance
  • Retrying a failed message now answers in place — the failed reply is replaced when the retry lands, the retry button sits in the message action row, and failures show the real provider error (like being out of credits) instead of a generic message

Instant Webhooks and Self-Healing Integrations

Integrations now apply incoming webhook data the moment it arrives, gain a provider-ping sync mode, and recover on their own when a sync gets stuck.

New

  • Integrations now handle incoming webhooks instantly — data sent to a webhook integration is applied the moment it arrives, and a new provider-ping mode lets an outside service trigger a sync on demand

Improved

  • Self-hosted instances automatically set up the secret for the backup scheduler trigger, so it works without editing configuration by hand

Fixed

  • Integrations that get stuck mid-sync now recover on their own instead of staying wedged until the server restarts
  • On mobile, turning on "Include time" and choosing an hour or minute now saves right away, even if you swipe the picker closed
  • Rows created or updated by an in-app action no longer briefly flash "Untitled," and add-row actions now include a "View" button to open the new row

Connection Sync: Control, Visibility, and Reliability

Run, pause, and rotate integrations right from chat, see how and when each one syncs, and get a wave of two-way sync fixes.

New

  • Run a sync on demand, turn an integration off, or rotate its webhook secret directly from chat, with the same controls the UI offers
  • Integration cards now show whether each one syncs manually or on a schedule, and the mapping table shows the most recent value synced for poll and two-way integrations
  • Both manual and scheduled sync runs now appear in the Logs tab
  • A new baseUrl() formula helper builds a real, bookmarkable link straight to a row for pushing out to external systems

Fixed

  • Fixed several two-way sync bugs seen with Google Contacts: pulled records are no longer wrongly marked deleted, dates like birthdays sync as real dates, fields with multiple values (like mobile vs. work phone) sync correctly, and editing one field no longer makes every other field look changed on the next run
  • Public app share pages no longer crash, and signed-in visitors now see live updates
  • Images that fail to load now show a placeholder instead of momentarily flashing a broken-image icon

Integration Logs, Defaults, and Polish

See the full raw payload of every webhook event, set select-field defaults from the detail panel, and pick up a round of integration fixes.

New

  • Webhook logs now let you expand and copy the full raw payload of each event, so you can see exactly what was delivered

Improved

  • Integration cards are tidier, with field mappings shown as a clean table and lifecycle actions collapsed into one toggle plus an overflow menu

Fixed

  • The "Set as default" option for select fields now appears in the row detail panel, not just the grid
  • The webhook credentials card link now opens the connected app, and the reveal button toggles to Hide instead of vanishing after one click
  • Error badges now keep showing whether a failure happened while the integration was live or paused
  • Fixed a brief visual flash when opening chat or the image viewer on mobile

Live Model Catalogs, Reasoning Effort, and Rebuilt Integrations

Model pickers now list the real models your account offers and how hard they should think, integrations get a rebuilt card with a true Off switch, and you can retry a failed run in one click.

New

  • Model pickers now list the actual Claude and Codex models your connected account offers — including the latest ones — instead of a fixed built-in list, with clear empty and error states
  • Choose how hard the model thinks with a reasoning-effort setting, from low up to max, shown right next to the model on agents, the assistant, and your default-model settings
  • Webhook connections get a full management surface — see each app's endpoint URL, reveal and rotate its secret, and browse recent incoming events in a Logs tab
  • Integrations gain a real Off switch that pauses one while keeping its setup, cleanly separate from removing it entirely
  • Set a default value on a property so every new row picks it up automatically — whether created by hand, by an agent, or from an incoming webhook
  • Retry a failed agent reply in one click, re-running it from your original message

Improved

  • The redesigned integration card shows a single mapping table of each incoming field, the property it maps to, and its latest value — keeping unmapped fields visible so nothing is silently dropped — with consistent status (Listening, Paused, Processing, Error) everywhere it appears
  • Cleaner model names in the catalog, with friendly aliases replacing dated snapshot IDs
  • The marketplace and other public pages load noticeably faster

Fixed

  • Agent runs interrupted by a server restart or crash no longer spin forever — they end as failed with a clear prompt to resend your message
  • Activating a webhook integration now actually starts processing events instead of letting them pile up unprocessed, and a connection with no active integrations correctly shows as not connected

Container Execution in Production

Agent sandbox execution and the browser capability now actually run in production, not just local development.

New

  • Agent sandbox execution and the browser capability now work in production deployments, not just local dev — agents can escalate to an isolated container and browse the web on your behalf

Fixed

  • Undo/redo in collaborative editing now works reliably, starting each session from a clean history

Marketplace Browse Redesign and Verified-Publisher Trust

Browse the marketplace in a cleaner, faster layout with trust badges tied to verified publishers, plus new ways to share templates and connect external systems.

New

  • Publish a template as Listed so it appears in browse and search, or Unlisted so only people with the link can reach it
  • Add an inbound "Incoming webhook" connection for external systems that send you events, plus API connections that need no authentication
  • Get notified when a document, task, agent, skill, connection, or app is shared with you — and share skills, connections, and agents just like everything else

Improved

  • Marketplace browsing is redesigned with trimmer cards, a type filter, breadcrumb navigation, a polished landing page, and a mobile install sheet
  • "Official" badges now come from the verified publisher, so every template from a trusted creator is marked consistently
  • The home message composer loads instantly on first click instead of briefly flashing a placeholder

Fixed

  • The live browser view streams continuously again instead of freezing on the first frame, so you can watch and take over an agent's browser session in real time
  • Undo works again in collaborative documents, which had stopped capturing changes when you pressed Ctrl+Z

Marketplace Publish States and Template Sharing

Marketplace publishing gets explicit states and a moderation switch, templates get visibility control, and several bundled connections get richer data.

New

  • Explicit publish states — publishing is open by default with a moderation ban switch, replacing a simple visibility toggle
  • Set a template's visibility to listed or unlisted before publishing
  • Google Contacts, Gmail, Calendar, Drive, and Microsoft 365 Mail connections enriched with deeper field coverage (contacts now include birthdays, addresses, and photos)

Improved

  • Sharing a key result now hoists the whole objective as one package; tasks can still be shared solo as shape-only templates
  • Share and listing pages redesigned for a calmer, more consistent presentation

Fixed

  • Modal-open flash fixed — modals now open with an instant shell instead of a visible pop-in
  • Broken-image glyph no longer flashes briefly on deferred thumbnails

Integration Authoring and a Collaborative Editing Fix

Build custom integrations directly in the app, and a data-loss bug in collaborative table editing is fixed.

New

  • Build custom integrations in-app — connect MCP tools or CLI scripts with a dedicated environment-variables editor for secrets and config

Improved

  • Checklist and task-list rows now align with bullet lists, and drag-and-drop preserves list formatting
  • OAuth connection tests no longer report false failures; credentials view redesigned

Fixed

  • Collaborative editing could silently delete table content when a document was opened — fixed
  • Cost readout hidden for free runs, shown only when there's real spend
  • Favorite titles resolve correctly again; sidebar overflow menu is clickable
  • Permission badge no longer shows a misleading "View only" placeholder while loading

Shareable Connections

Connections can now be shared like any other entry, with comments and activity on skills, connections, and agents. Marketplace publishing gets a calmer, in-place workflow.

New

  • Share a connection with your org or specific members at View or Edit level
  • Comment threads and unread badges now work on skills, connections, and agents

Improved

  • Publish wizard reworked — pricing and terms moved to the final step, with an in-modal published-management view showing status, install count, and version
  • Listing detail sidebar redesigned for a calmer layout with proper category badges

Fixed

  • Closed a cross-tenant data leak risk — share-resolution queries now scoped by workspace at the source
  • Detail panels no longer briefly flash the wrong view-only or unfavorited state while permissions load
  • Mobile editor toolbar no longer flashes or crashes on first open on phones

Claude Subscription Sign-In and Live Collaborative Editing

Connect your Claude.ai subscription directly to power the assistant, and edit documents together in real time with live presence and cursors.

New

  • Connect your own Claude.ai subscription to power the assistant, not just an API key, including headless CLI login for servers
  • Live collaborative document editing — multiple people, and AI agents, edit the same document simultaneously with changes merging live
  • Presence — see who else is viewing or editing a document, with live remote cursors and a live status footer
  • Expanded automation actions on rows — set a property, increment a number, add or delete a row
  • Org nodes (teams and departments) can now be moved and reparented in the tree
  • Duplicate an entry directly

Improved

  • Background dispatcher wakes instantly on relevant events instead of polling, so updates propagate near-instantly
  • Login lockout after 5 failed attempts with a 15-minute cooldown, without revealing lockout state to attackers

Fixed

  • Closed a server-side code-execution hole in formula columns — formulas now run through a sandboxed expression grammar instead of raw eval
  • Revoked or expired Claude subscription sign-ins now correctly surface as broken instead of appearing healthy
  • Clearing a document's status no longer incorrectly reverts it to Published

Custom Icons and the Public Marketplace

Documents get custom icons and a reusable Templates shelf, and the Marketplace opens as a central, cross-instance catalog for publishing and installing templates.

New

  • Custom icons per document, inheritable from a template
  • Instance-wide Templates shelf — save any entry as a reusable template, with an inline picker at create time
  • Public marketplace launch — a central catalog for publishing and installing documents, connections, and skills across instances
  • Table toolbar header-column toggle; unified CommonMark-compliant markdown serializer
  • Sysadmin can delete system agents individually and whole system-skill folders

Improved

  • Template rows simplified — click opens edit, direct delete icon

Fixed

  • Board view auto-scrolls to off-screen columns while dragging
  • Publish wizard no longer infinite-loops when selecting a category
  • Newly created child nodes appear immediately; template-copy no longer loses content

Connection Authoring and System-Tier Editing

Admins can now edit system-level agents and skills directly, author new integrations declaratively in-app, and chat automatically knows what you're looking at.

New

  • Sysadmins can promote and edit system-tier agents and skills directly in the UI, previously read-only
  • Author new HTTP API integration connections declaratively, no code required
  • Shared desktop OAuth client with loopback redirect, falling back to bring-your-own credentials
  • Chat automatically passes your current entity as context to the assistant, shown as a dismissible chip
  • Touch improvements — hold-to-drag with visual feedback, drag-to-reschedule on calendar and gallery views

Improved

  • Reduced AI token usage via smarter context and history accounting
  • Escape key closes the detail panel from sidebar and full-page modes

Fixed

  • Hardened Microsoft OAuth PKCE flow and closed path-traversal/secret-leak issues in connection templates
  • Wide tables now scroll within their own block instead of scrolling the whole page
  • Crash when moving a document between org nodes

Chat as a Persistent Rail

Chat moves from a modal overlay to a persistent side rail so you can converse while viewing records. Tables, mobile editing, and file uploads all get a pass, and agent budgets ship as a first-class control.

New

  • Chat promoted to a persistent top-level rail alongside detail panels, replacing the modal overlay
  • Table editing overhaul — table menu, slash command, column alignment, drag-to-reorder rows
  • Mobile editor redesigned for hold-to-drag interactions with the native keyboard
  • Drag-and-drop file upload; Files tab folder counts now include binaries
  • Approvals v1 — review and approve pending actions from a dedicated panel
  • Agent budget controls — workspace-wide spending pool plus per-agent limits
  • In-app feedback launcher with keyboard shortcuts

Improved

  • Faster data view first paint via optimized row windowing
  • Floating date pill while scrolling a conversation thread

Fixed

  • Mismatched internal IDs and filenames could silently break deleting OKRs and tasks
  • Production update/refresh reliability — no more getting stuck in a refresh loop
  • OAuth token refresh issues for Codex-based agents

Marketplace

Publish, discover, and install app templates from the Marketplace. Matrix board adds two-axis layouts for data views. Unified provider registry redesign with accordion management UI.

New

  • Marketplace — publish, discover, and install app templates across workspaces
  • Matrix board with sub-grouping support for two-axis board layouts
  • Cross-app relations — relation columns can reference rows in a different app or node
  • Checkbox properties supported in group-by; relation property grouping
  • Unified provider registry redesign with accordion layout and per-model management
  • @mention in message edit triggers AI; Enter saves edited message

Improved

  • Favorites star added to all layouts and topbar breadcrumb
  • App view settings hydrated from bootstrap; first data window planning shared across views
  • Currency display via Intl.NumberFormat; column ordering respected in table view

Fixed

  • Accent text derived correctly from workspace color; model selector loading and empty states
  • Date grouping in table view; group direction toggle; calendar mode default; title column ordering
  • Workspace chat context isolation; stale message content on edit prevented

Security and Performance

Comprehensive security hardening across every API surface. Stable persistent entity IDs. Startup warmup bootstraps your workspace before the first click.

New

  • CLI init, stop, and status commands with Cloudflare Tunnel sidecar support
  • Stable entity IDs read from content files with migration runner and startup integrity log
  • Startup warmup — shell data bootstrapped before interactive chrome, conversation rail preloaded, search palette prefetched

Improved

  • Node bootstrap collapsed to a single request; home bootstrap unified
  • Dynamic OG image generation for workspace cards; per-instance database isolation

Fixed

  • 15 hardening fixes — JWT session lifetime, auth redirect allowlist, unauthenticated API routes, signout cookie clearing, response headers, OAuth callback HTML escaping, assistant run authorization, file path containment, SVG upload validation, and more
  • App ref index thrashing on unknown IDs; multi-workspace realtime scoping; hardcoded org slug fallbacks removed
  • Preference hydration stability; permission-gated action stability

Files, Artifacts, and Advanced Filters

Files tab rebuilt with gallery view, folder grouping, and drag-and-drop uploads. Apps gain a central artifact storage layer. Filter any data view with relative dates, user-aware operators, and relation lookups.

New

  • Files tab rebuilt on data views — gallery layout, folder grouping, drag multi-select, drop upload, and folder reparenting
  • Artifact storage system with UUID-served uploads and sidecar metadata
  • Advanced filters with relative date ranges, contains_me and is_me operators, and relation display value resolution
  • Grouping by relation properties and view layout switching via context menu
  • Deployment CLI with setup wizard, backup/restore, and WebSocket merged onto app port

Improved

  • All views unified onto canonical view procedures with real-time invalidation
  • App databases now route through the shared data-view surface
  • Tool exposure ladder — AI sees only tools appropriate to its permission scope

Fixed

  • Stop Generating reliable across processes; orphaned thread run recovery
  • Rich-text copy-paste preserves formatting; drag/drop reliability
  • Document block drag selection; editor auto-save skips unchanged content
  • View ID collision prevention; board drag-and-drop optimistic cache update

Orchestrator, Connections, and Multi-Provider AI

The Orchestrator gives you a command centre for all AI activity. Connect external services via MCP. Multi-provider AI adapter supports Anthropic and OpenAI. Trigger the assistant and agents directly from chat.

New

  • Orchestrator modal with Agents, Assistant, Logs, and Usage tabs
  • Per-agent budget bars, cost tracking, and configurable daily limits
  • Connect external services to your workspace via MCP servers
  • Microsoft email OAuth and OpenAI Codex auth with org-scoped credentials
  • System agents surfaced in Party tab and @mention autocomplete
  • Domain tools for creating, updating, and deleting entries and nodes — all permission-enforced
  • Notification panel redesign with archive UX and hierarchy walk
  • Clickable entity links in messages; @AI mention replaces raw model list

Improved

  • SDK session resumption replaces manual conversation history loading
  • Agent config moved fully to YAML files; model badge replaces skills/tools UI
  • Thread streaming refactored with entity linker for cross-entity navigation

Fixed

  • Agent delete now removes entry from YAML file
  • MCP permission enforcement, streaming line-break concatenation, and read_file path resolution
  • Auth redirect allowlist hardened; org mutations require org admin

Apps, Data Views, and Sharing

Apps bring custom databases to any node. View and organize tasks, OKRs, and apps across table, board, calendar, and list layouts with inline editing. Share any node with granular permissions.

New

  • Custom databases on any node with configurable properties and views
  • Table, board, calendar, and list layouts with a shared toolbar
  • Inline single-click cell editing with auto-sizing
  • Calendar date field selector, week view toggle, and today indicator
  • Agent detail panel with system prompt display, Active Work list, and context file sharing
  • People detail panel with Active Work navigation
  • Access Audit modal showing all role assignments across org and node levels

Improved

  • Properties panel with reorderable columns and description field selector
  • Share Modal redesigned with side-by-side options and grouped access list

Fixed

  • Member role assignment and removal reliability
  • Agent autocomplete scoped to node access only
  • Unread tracking and dividers

Tasks, OKRs, Documents, and Chat

The core workspace: create and track tasks with statuses and priorities, set OKRs linked to key results, write YAML-backed documents, and chat with your team in threaded conversations.

New

  • Create tasks with statuses, priorities, owners, due dates, and dependency tracking
  • Set objectives and key results with progress tracking and task linkage
  • Rich document editor backed by YAML with auto-save
  • Workspace chat with threaded conversations and unread tracking
  • Authentication with role-based access control across workspaces