What we shipped, week by week. Subscribe to get it in your inbox.
When you upload HTML content without specifying a title, we now automatically use the document's <title> tag instead of showing "Untitled document". This means decks, emails, and other HTML bundles show meaningful names in apps like presentation-hub, even if the title field was forgotten during upload.
Clickable links and images inside ingested HTML content (like presentation decks and emails) previously did nothing when clicked. Links with target="_blank" now properly open in a new tab as expected.
The ingest payload's `metadata` field has always round-tripped from an inbound POST to your app code, but wasn't documented — and the SDK JSDoc previously referenced the wrong field names (`meta`/`receivedAt` instead of the actual `metadata`/`createdAt`). Docs and the system prompt now correctly describe `metadata`, `createdAt`, and a recommended versioning pattern for callers.
Ingestion records now include an `attachments` array (with mime type, size, dimensions, original name, and a ready-to-use URL) on `get()`, and an `attachmentCount` on `list()`. The studio's Ingest diagnostics tab renders image thumbnails and download links for each attachment inline with the body preview.
Multipart bundles between 10 and 25 MB were being silently truncated by the underlying request body limit, causing the endpoint to return a confusing "400" error. The body ceiling has been raised so valid bundles up to the documented 25 MB cap now reach the route and succeed.
The reference inbound-ingest inbox example now displays a paperclip badge with the attachment count on each row, and lists downloadable files (with name and size) alongside the sandboxed body preview on the detail view.
The inbound API now accepts multipart bundles, so you can push an HTML email along with its images and file attachments in a single request. Inline `cid:` image references in the HTML are automatically rewritten to served URLs, and non-inline files show up as downloadable attachments on the ingestion record. Bundles up to ~25 MB are supported.
The Inbound API card in studio settings has been simplified into a single copyable brief written for an AI coding agent, including a runnable multipart curl example that demonstrates sending attachments. "Copy instructions" is the primary action; rotating the token is still one click away.
Deleting an ingestion row — or using "Clear all" — from the studio diagnostics Ingest tab now also removes the underlying attachment files from storage, matching the SDK delete behavior. Previously these deletes cleared the database rows but left the stored bytes behind.
The runtime UI components used by generated apps (Button, Badge, Alert, Tabs, Skeleton, Separator, and more) had drifted from the platform's source components in subtle ways — missing focus rings, missing press animations, missing states, wrong padding. All shimmed components are now reconciled with their source, and a drift guard covers roughly 60 style slots so they stay in sync going forward.
The homepage hero has a cleaner headline treatment with the violet accent applied intentionally rather than mid-word, the background aurora is now fully on-brand violet instead of clashing coral, and on large screens the hero fills the viewport so the fold lands on it rather than clipping the next section.
Edits made in diff mode used to skip the post-generation correction pass entirely, meaning lint issues in patched files went unfixed and, in older incidents, raw SEARCH/REPLACE markers could be written straight to disk. The correction pass now speaks the same dialect as the run — full-file rewrites in legacy mode, patches in diff mode — and any issues that remain after correction are reported in chat so you know what still needs attention.
A RadioGroupItem placed inside a wrapping element (for example next to its Label in a div, the standard shadcn composition) never showed its checked state. Radio groups now share state through React context so items are found and updated at any nesting depth.
The code linter now catches a common generation error where a prop is declared in the TypeScript type but never destructured, which used to crash the app at runtime with a ReferenceError as soon as the code path ran. The post-generation correction pass also now receives the integration manifest, so hallucinated app.<namespace> calls and unregistered workflow names are caught and fixed before reaching preview instead of only when the model happened to run validation itself.
Shared decks using auto-fit sizing could measure their container before it had been laid out — especially inside the anonymous share shell with its marketing header, banner, and cookie bar — and get pinned to a collapsed ~24px height for the rest of the session. Sizing is now measured more reliably, viewport-relative decks are deterministically pinned to a single screen from the start, and the heal path survives re-renders (such as a comment overlay arriving asynchronously) instead of clinging to a stale, detached element.
Apps that receive content via inbound APIs (like Presentation Hub) can now reveal their endpoint and bearer token directly from the studio preview. Previously the in-app settings button was a silent no-op in the editor, forcing creators to publish before they could test ingestion. The dialog is also hardened against stalled requests with a 15-second timeout, an actionable error message, and a retry button instead of an infinite spinner.
When generated code throws during render, viewers used to see a completely blank page. Apps are now wrapped in an error boundary that shows a 'Something went wrong in this app' card with a retry button and collapsible technical details, while still reporting the error back to the studio.
Because pinned decks scroll internally, comment pins and other overlays positioned in the parent app used to sit fixed on screen while the deck scrolled underneath — detaching from the content they were attached to. The renderSandboxed SDK now exposes an onScroll reporter and a documented document-space anchoring pattern so overlays can move with the content beneath them.
Boot-time token lookups for anonymous share-link viewers could return a 500, causing every uploaded image on the shared app to 404. Non-UUID strings collected from granted rows are now filtered out before being used in the upload lookup query.
Workspace owners can now set a primary color from a new Appearance settings page, and every app rendered inside that workspace picks it up automatically. Foreground text is chosen automatically for readability, and the built-in swatch presets are tuned dark enough that button labels always stay legible in white.
Comment pins, annotations, and other draggable UI layered over sandboxed content (like presentation decks) previously broke because pointer events were swallowed the instant the cursor left the drag handle — pins would trail the cursor forever without dropping. The SDK now documents the pointer-capture pattern needed to make these drags work reliably, with an annotation-pins example the code generator can follow.
Share links you create inside the studio editor now open the draft version of your app for anyone with the link, so you can get feedback before publishing. Grants made in the editor stay isolated to your dev environment (they won't leak into your live app), default to a 7-day expiry, and open in a dedicated read-only preview view. Visitors see only the rows your access rules allow.
The chat toolbar now has an effort selector. Default runs on our fast, cost-effective model and stays there — no more surprise escalations. High switches to our most capable model for tougher tasks. The icon fills more bars as you raise the effort, and a short explainer sits at the top of the popover. Your selection isn't persisted between sessions.
A malformed VAPID key no longer breaks every notification send — it degrades gracefully and is logged once. Batch sends no longer fail if pruning a stale subscription hits an error, and the push toggle now surfaces an inline hint when the browser blocks permission or the unsubscribe request fails.
Confirming an AI change batch is now race-safe: two concurrent confirms can no longer double-apply the same steps (the loser gets a clean conflict response). Unchecking every step cancels the batch instead of marking an empty batch confirmed, and writes to mirror collections are now refused in code rather than relying on prompt instructions alone.
GLM edits now benefit from prompt caching on the new upstream provider (Z.ai), so long tool-loop conversations no longer bill full uncached input on every step. Pricing has been updated to match: cache hits are billed at the reduced cached-input rate.
When you receive a share invitation, the notification bell now shows your own workspace context rather than the sender's app workspace, so multi-workspace users see the right label. Invite and share URLs are also hardened against Host-header spoofing that could otherwise embed an attacker's origin in a link.
The built-in booking page example incorrectly reported "Couldn't submit booking" when a signed-in user booked, because the confirmation email helper only accepts anonymous rows. Submitter confirmations and reminders are now gated to anonymous visitors, and the core booking save is separated from best-effort side-effects so a follow-up failure never marks a saved booking as failed. Since the AI uses this example as a template, the pattern propagates to new apps.
The onboarding checklist (referral progress, first app, newsletter opt-in) is a personal first-value flow, but it was rendering on team workspace dashboards — so a member could see their own referral progress on a shared workspace. It now only appears on personal workspaces.
Embedded apps using viewport-height sections (like slide decks with 100vh slides) could enter a runaway height-growth loop on larger screens, causing content to stretch into invisibility or freeze the tab. The sandbox renderer now detects and stops this feedback loop, so presentations and similar embedded apps display correctly.
Server-side handlers that make network requests are now protected against server-side request forgery. Outbound URLs are validated, redirects are checked, and connections are pinned to the vetted IP addresses to prevent DNS-rebinding attacks from reaching internal services.
Reordering apps in the sidebar now uses a dedicated grip handle next to the overflow menu, so you can click anywhere on an app row to open it without accidentally starting a drag. The clickable area also now spans the full row, matching the hover highlight.
Server call actions in published apps are now included in the 50% creator revenue share, matching every other runtime action. Previously these debits were paying out 0% to creators.
Corrected a metering issue where input tokens for GLM-5.2 generations were being under-counted, so credit usage now reflects the real cost of each generation.
Fixed an issue where popovers, date pickers, and filter menus built with the standard trigger pattern wouldn't visibly open in generated apps. Triggers now correctly anchor their content the first time.
Links shared from Feldova (/s/ short links) now show a rich preview when posted in Slack, iMessage, WhatsApp, Discord, X, and other apps. Instead of a generic preview, recipients see the app's name, description, icon, and workspace details right in the message.
Fixed an issue where information saved in one part of your app (like a name entered in a welcome prompt) wouldn't show up in other places (like a profile badge) until you refreshed the page. Updates now sync immediately between components on the same page.
Share pages now handle invalid route URLs gracefully and properly guard writes from scoped share child contexts, preventing errors and unintended writes in edge cases.
Workflows are now returned in a stable order when assembling the generation context. This prevents unrelated edits from reshuffling the workflow list between turns, which improves cache hit rates on the generation prompt and makes results more consistent across runs.
Fixed a regression where scheduled handler runs were silently capped at 10 seconds after a runtime refactor. Schedules once again get the full 30-second wall-clock budget, while interactive calls use the shorter interactive default.
The Data Assistant can now run your app.server handlers as part of a batch, with a preview that shows the handler name, input, and any side effects. Email and notification side effects are listed with toggles (on by default) so you can suppress them per call, while locked effects like payments, fetches, and schedules are clearly shown as 'this will also: …'. Multi-step batches let you include or skip each handler step individually before confirming.
The POST /api/apps/{appId}/server/{handlerName} endpoint now actually executes your handler instead of returning 501. Each call is billed as a server_call (10mc), with automatic refund if the handler errors. Requests must include a valid installation context, and the route verifies that the installation belongs to the requested app and that the caller has access before charging or running anything.
Before answering, the Assistant studies each app's published code to learn its collections, fields, and — now — its input surfaces and mirror collections. That means it knows the difference between an app's primary inbox and a downstream mirror, so when you ask about your data it looks in the right place. Comprehension is cached per published version, so it stays fast as you iterate.
The Assistant can now propose writes — updates, inserts, and deletes — and surface them in a preview card before anything happens. Nothing is committed until you click Confirm, and every confirmed batch can be undone in one click. Confirmed writes are broadcast in real time, so any app you have open updates immediately without a reload.
A new AI assistant lives in a dock at the bottom-right of every workspace. Ask it questions about your apps' data in plain language and it will read across collections to answer — respecting each app's existing access rules so it can only see what you could see yourself. Open multiple conversations side by side, switch between them, and pick up where you left off; every chat is saved per workspace.
When you ask the Assistant to add something — like a new deck in the Presentation Hub — it now routes the request through the app's actual input surface instead of writing to a downstream mirror collection. The result shows up exactly where the app expects it, so what the Assistant says it did matches what you see in the app. Adds still go through the preview/confirm/undo flow.
Fixed a display bug where Assistant-proposed content additions rendered as "write undefined:undefined" in the confirm card. Ingest steps now show a clear label and icon alongside regular write steps.
The Data Copilot is now the Data Assistant across the product — launcher, API, and internals. The user-facing label was already "Assistant"; this aligns the rest of the experience.
You can now delete an Assistant conversation from the window's overflow menu. A confirmation step prevents accidents, and deleting removes the conversation and all of its messages, runs, and history.
Switching workspaces and reopening the Assistant no longer leaves the conversation list spinning forever — it now refetches on open and on workspace change.