The Cyber Toolchain — issue 045, August 14, 2026

dirsearch adds a Rust-based native backend selectable via --request-backend native and --wordlist-backend native (also configurable as the request-backend, default python, and wordlist-backend, default auto, keys in config.ini), with --sync to fall back to the legacy threaded stack. The native backend now supports HTTP proxying, follows HTTP redirects during enumeration, bounds response body memory to prevent unbounded consumption on large scans, and ships with parity guardrails and CI integration to keep its behaviour aligned with the standard backend.

$ dirsearch -u https://target -e php,html,js --request-backend native --wordlist-backend native -w /path/to/wordlist

output-formats in config.ini supports simple, plain, json, xml, md, csv, html, and sqlite, writable together in a single run; output-file accepts template variables {extension}, {format}, {host}, {scheme}, {port}, {date}, and {datetime} for dynamic naming. New mysql-url and postgres-url keys write scan results directly to MySQL or PostgreSQL, with the destination table controlled by output-sql-table (default {scheme}_{host}:{port}).

# config.ini
output-formats = html
output-file = reports/{host}/{date}.{extension}
postgres-url = postgres://user:password@localhost/dirsearch

--wordlist-categories selects category-based bundled wordlists (PHP, Python, Java, .NET, Node, ColdFusion, and infrastructure), matched by the wordlist-categories key in config.ini (e.g. common, conf, web). --wordlist-status and --wordlist-max-size (config key wordlist-max-size, default 500000) control size, and wordlist-backend (config default auto, values auto/python/native) selects the generation engine. Template wordlists support placeholders %SUBJECT%, %CRUD_OP%, %AUTH_OP%, %DATE%, %API_VERSION%, %CATEGORY:name%, and %EXT%.

$ dirsearch -u https://target -e php,js --wordlist-categories php,node

config.ini and the CLI gain ffuf/wfuzz-style opt-in matching via matcher-mode and filter-mode (value or), plus match-status, filter-status, match-size, filter-size, match-words, filter-words, match-lines, filter-lines, match-regex, filter-regex, match-time, and filter-time keys for fine-grained response filtering. Additional keys filter-threshold, exclude-redirect, exclude-response, and exclude-texts (e.g. 'Not found', '404') filter by numeric threshold, redirect pattern, reference response file, or response body text.

# config.ini
matcher-mode = or
match-size = 100-2000
match-words = 10-100
filter-size = 0

config.ini adds skip-on-status (default 429) to auto-skip rate-limited targets, target-max-time for a per-target time cap, and auto-calibration to force extra wildcard calibration up front. Recursive scans gain recursion-status (default 200-399,401,403) and max-recursion-depth (default 0); other new keys are network-interface (e.g. eth0) to bind scans to a NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link., replay-proxy to forward matches through a secondary proxy, and log-file/log-file-size for persistent capped logging. Release v0.5.0 adds the --disable-cli flag, Nmap XML target import, and --verbose output showing response elapsed time and content type.

# config.ini
skip-on-status = 429
target-max-time = 120
auto-calibration = True

Optional MySQL and PostgreSQL report dependencies are now explicit extras — dirsearch[mysql], dirsearch[postgresql], and dirsearch[db] — instead of mandatory runtime dependencies, so existing installs relying on auto-installed DB drivers must reinstall with the appropriate extra. The old dependency installer path was removed.

Resumable scan sessions now store JSON controller state instead of pickle, with --list-sessions to enumerate saved sessions and resume by ID. Legacy pickle sessions are no longer loaded directly and produce a warning on upgrade.

Adds a Python API with FuzzerConfig, DirsearchFuzzer, structured results, wordlist helpers, and template wordlist support, plus a python -m dirsearch entrypoint for running scans without the standalone CLI.

PyInstaller release builds now cover Windows x64, Linux x64, Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., macOS Intel, and macOS Apple Silicon across async, threaded, and native-rust stack variants. Linux x64 Docker images are published to GitHub Container Registry for each release stack, and portable CPython archives with compiled dependencies are offered as an alternative for users hit by PyInstaller antivirus false positives.

dalfox server now blocks browser-driven cross-site and DNS-rebinding requests by validating the Origin, Sec-Fetch-Site, and Host headers, rejecting Sec-Fetch-Site: cross-site or same-site requests with 403 while leaving non-browser clients (curl, CLI, CI) unaffected. The --allowed-hosts <names> flag lists extra hostnames accepted in the Host header beyond the bind host, localhost, and IP literals (for reverse-proxy setups), while --allowed-origins permits specific web UI origins through the cross-site gate without disabling CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. enforcement. The server also prints a startup warning when JSONP is enabled without an API key, since JSONP bypasses the cross-site gate and would let any site launch scans and read results, and --max-retained-scans caps how many finished scan results are retained to prevent unbounded memory growth.

$ dalfox server --allowed-hosts "dalfox.internal,scan.corp.example"

$ dalfox server --allowed-origins "https://app.example.com"

$ dalfox server --max-retained-scans 200

dalfox payload gains selectors for payloadbox (fetches remote payloads from PayloadBox), all (prints every local selector under # name headers, remote excluded), event-handlers (DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. event handler attributes like onclick, onmouseover), useful-tags (tags like script, img, svg), uri-scheme (scheme-based payloads like javascript:, expanded from 5 to 11 entries), dom-clobbering, mxss (mutation-XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session./sanitizer-bypass), blind (skeletons where {} is substituted with an OOB callback URL), a special-characters/encoded-variants selector (also expanded), a visibly-confirmable-sinks selector with filter-surviving variants, and a polished alert(document.domain) PoC selector for screenshots. The command also gained per-selector item counts in its summary output and closest-selector suggestions (Levenshtein distance ≤ 2) when an unknown selector name is given.

$ dalfox payload all

$ dalfox payload blind

Introduces an INTERNAL_ERROR status code on target_summary entries so a scanner panic is reported as skipped rather than silently falling through to clean.

Wiz Red Agent, described as an AI-powered attacker, actively tests whether an exposed credential found in a personal repo is live and what it can reach, going beyond traditional validity checks.

Findings from personal repositories surface the exact commit, GitHub user, and email that pushed a secret, enabling immediate owner-assigned remediation without manual investigation.

Released Tags Only rejects Go module resolutions at commit hashes, branch names, and pseudo-versions such as v0.0.0-20241114170450-2d3c2a9cc518, permitting only published release tags. Cooldown Period holds newly published Go module versions for a configurable window, with per-module exemptions scoped to the full module path. Compromised Packages blocks Go module versions flagged by StepSecurity's SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. or the wider security community. Custom Block List bans a Go module or version range org-wide using module@version form with glob support.

A new Proxy Checksum Database setting under Go Registry Settings relays sum.golang.org requests through Secure Registry, removing the need to disable GOSUMDB when runners cannot reach the default checksum database.

Secure Registry now proxies Go modules (Beta) at https://registry.stepsecurity.io/go, joining existing npm, PyPI, Maven, and NuGet proxying; every module request is evaluated against your Go policy before a response is returned. Integration paths for Go proxy support cover JFrog Artifactory, Sonatype Nexus Repository, and Direct.

⤢ ⤢

The FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. build of VPN Client 3.0.2 requires the VPN gateway's UserVPN CA to use an RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key of at least 2048 bits. Gateways on Controller versions earlier than 8.2, or Controller 8.2 gateways whose UserVPN CA has not been rotated since upgrade, may still use a 1024-bit CA (common on Controllers originally initialized on Aviatrix 7.1 or earlier) and will fail client certificate verification; operators must rotate the UserVPN CA to RSA 2048-bit before upgrading.

New Cloud Routes feature at CoPilot > Diagnostics > Cloud Routes gives a central view of routing across the Aviatrix transit network, multicloud and on-prem Site2Cloud connections, without logging into individual cloud consoles. It includes a Gateway Routes tab (tunnel info, route state up/down, routing tables, filterable by gateway name, subnet, or IP), a VPC/VNet Routes tab (routing tables per VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules./VCN, filterable by route table name, subnet, or IP), an External Connections tab (data center tunnel status, connected gateway, remote IP, tunnel type, linked to Topology and FlowIQ), and a BGP Info tab (advertised/learned routes, connection map with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and IP). A gateway diagnostics panel adds PING, TRACEROUTE, TRACEPATH, TRACELOG (uploads directly to Aviatrix Support), Test Connectivity (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. to a host and port), ACTIVE SESSIONS (filterable by port), INTERFACE STATS, PACKET CAPTURE (filter by host, port, time, address, protocol, flags; download as pcap for Wireshark), and SERVICE ACTIONS (check/restart gateway services).

New Security > Egress > Overview tab (requires Controller 8.0 and DCF feature enabled) shows an Egress Security Score card with a score-calculation explainer dialog and a Manage VPC/VNets link to the Egress VPC/VNets tab, plus a Protected VPC/VNets card breaking cloud-account VPC/VNets into Unprotected, Monitored, Partially Protected, Protected, No Egress, and Unknown states.

⤢ ⤢ ⤢

FIPS 140-3 compliant encryption is now supported in the VPN Client 3.0.2, with SAML-based authentication (Okta, Duo, and other SAML identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.) available across Windows, macOS, and Ubuntu.

Administrators can reset MFA for individual user accounts using the Admin-level MFA reset option on the User Accounts page, eliminating the need to open a support case when a user loses their MFA device or recovery code. After the reset, the user is prompted to set up MFA again at their next sign-in.

A new Apps button appears in the upper-right corner of every Cribl screen, giving access to pre-built apps that add new views, processes, workflows, and capabilities built around existing Cribl data. Users can also build custom apps through an AI-driven conversational flow, while Cribl handles the underlying hosting, identity, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., and data access/governance layers.

Tines published a full REST API covering 369 endpoints across 71 areas, each supporting create, read, update and delete operations. The largest areas are Actions (22 endpoints), Stories > Notes (12), Stories (11), Teams (v1) (11), Admin > Users (10), Global Resources (v1) (10), Cases (v1) > Case Templates (9) — which specifically enables managing case templates programmatically — and Admin > Sync Destinations (8), plus 63 additional areas spanning Cases, Records, Admin, Scim, Audit Logs, Workbench, Reporting, Folders (v1), Run Script Environments and more.

Cases can now trigger published Tines 3B workflows directly as case actions. After configuring a 3B service account connection, users can select a published 3B workflow when adding a case action.

Response schemas changed for GET /v1/otCollectors/otCollectorsByName, GET /v1/otCollectors/{id}, GET /v1/plan/pendingUpdateRequest, and POST /v1/otCollectors. A new dryRun query parameter was added to POST /v1/sourceTemplate and POST /v1/sourceTemplates.

Twingate introduces six admin roles — DevOps, Helpdesk, Support, Access Reviewer, Billing, and full admin — each scoped to specific Admin Console pages and actions. DevOps admins are limited to the Network tab (Resources, Connectors, Remote Networks, Group-to-Resource assignments, Access Requests); Support admins get all pages except Internet Security > Secure DNS and Internet Security > Client Configuration; Billing admins are restricted to the Settings > Billing page for plan changes and payment details. The Helpdesk role gives read-only access to selected areas plus targeted actions — resetting MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., verifying/unverifying devices, and managing trusted serial numbers — so support staff can troubleshoot without full admin rights. DevOps, Helpdesk, Support, Access Reviewer, and Billing admins see a role badge next to the Twingate logo (hover reveals access details), and any attempt to edit settings outside a role's scope is blocked with an inline error message.

⤢ ⤢ ⤢ ⤢ ⤢

New PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/ endpoint lets operators set is_skipped: true to exempt a frozen KYB Key People party from verification — immediately recomputing KYBKeyPeopleCheck and the parent KYB session status — or is_skipped: false to restore it to scope; requires the write:businesses permission via API key or console user token. The endpoint also surfaces new party-level status signals kyc_session_deleted and kyb_sub_session_deleted to explain why a party is frozen.

$ curl -X PATCH 'https://api.didit.me/v3/session/sess_abc123/kyb/parties/0a3f1e2c-7c2f-4a1b-9d55-2f8d2a5d6b41/' \
  -H 'Authorization: Bearer <api_key>' \
  -H 'Content-Type: application/json' \
  -d '{"is_skipped": true}'

$ curl -X PATCH 'https://api.didit.me/v3/session/sess_abc123/kyb/parties/0a3f1e2c-7c2f-4a1b-9d55-2f8d2a5d6b41/' \
  -H 'Authorization: Bearer <api_key>' \
  -H 'Content-Type: application/json' \
  -d '{"is_skipped": false}'

New kyb_registry_provider_unavailable error code (with code, summary, and detail fields) is returned as HTTP 502 on POST /v3/kyb/search/ when the KYB registry provider is temporarily unavailable — the search is not billed, and Didit's hosted flow plus Web, iOS, and Android verification flows automatically offer manual company entry instead. A parallel phone_provider_unavailable error code is returned as HTTP 502 on POST /v3/phone/send/ and POST /v3/phone/check/ when Prelude is unavailable; nothing is billed on send and the attempt budget is only consumed by completed checks.

if response.status_code == 502 and response.json().get('code') == 'kyb_registry_provider_unavailable':
    prompt_manual_company_entry()

Retrieve-session responses now include id_verifications[].barcodes, with type, position, data, data_raw, and side fields per entry (empty array if the document has no barcode output), and face-step payloads now always include face_liveness_method, defaulting to PASSIVE when a workflow doesn't set it explicitly.

$ GET /sessions/{session_id}

// Response excerpt:
// {
//   "id_verifications": [{
//     "barcodes": [
//       { "type": "PDF417", "side": "back", "data": "...", "data_raw": "...", "position": {...} }
//     ]
//   }]
// }

kyc.marital_status is now a usable OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. field in conditional branches and custom status rules within the workflow builder; when the source document omits marital status the field is empty and the fallback branch applies.

{
  "condition": "kyc.marital_status == 'married'",
  "then": "enhanced_due_diligence_step"
}

A new Dashboards > Passkey usage dashboard shows org-wide passkey adoption rate, top apps used with passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., and a per-provider storage breakdown with a toggle between number of passkeys and number of users. It also surfaces device-loss survivability and login-verification status for each detected passkey, and adds per-employee passkey usage detail on each user's user details page.

The browser extension now detects PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., secrets, or financial info typed into AI conversations and prompts employees to redact in one click or justify sending, configurable at Settings > In-browser nudges. An optional enforcement mode, configured at the same settings path, makes redaction the only way to send, preventing unredacted sensitive data from leaving the browser.

Switches the credential store to per-installation encryption entropy, replacing a previously shared value; a new ECSM.entropy file is created in the install directory and should be backed up alongside ECSM.settings.

Adds env: prefix support in ConfigCLI arguments so sensitive values can be resolved from environment variables instead of the command line, keeping them out of process creation logs.

Enables certificate revocation checking on the appliance connection and enforces size limits on protocol and HTTP reads; CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live./OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. endpoints must be reachable from the ECM host before upgrading.

The ECM service and Configurator automatically detect and repair a missing or stale configuration file at startup and during installation, preserving appSettings, proxy, and log configuration while refreshing only version-driven sections.

Log appenders now fail closed rather than falling back to an unprotected credential value; plaintext credential values in log appender configuration must be re-encrypted before upgrading.

Plugin load diagnostics now log assembly load failures with full detail, replacing the opaque Found 0 plugins message seen when tools such as WDAC, AppLocker, or EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. solutions block plugin loading; plugin loading is also hardened to load from the install directory rather than the process working directory.

/authorize endpoints on custom authorization servers now accept multiple resource parameters, letting a single refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. cover multiple resources; each grant_type=refresh_token exchange then mints a precisely scoped, single-aud access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for one resource, eliminating the need for one refresh token per resource. This is GA in Preview and requires an Okta for AI Agents subscription with agent-to-agent connections enabled.

$ # Step 1: Authorize with multiple resource parameters
GET /oauth2/{authorizationServerId}/v1/authorize?client_id=<client_id>&response_type=code&scope=openid offline_access&resource=https://api.example.com/service-a&resource=https://api.example.com/service-b&redirect_uri=<redirect_uri>

# Step 2: Exchange the refresh token for a single-audience access token
POST /oauth2/{authorizationServerId}/v1/token
  grant_type=refresh_token
  &refresh_token=<refresh_token>
  &resource=https://api.example.com/service-a
  &client_id=<client_id>

Adds okta.users.behaviors.manage, okta.users.behaviors.read, and okta.users.behaviors.reset custom admin permissions for fine-grained control over user behavior detection.

Adds optional reconciliation that closes RegScale issues whose findings have aged out of Wiz's retention window, enabled via wizRetentionReconciliation and tuned with additional w… settings.

wizRetentionReconciliation: true

Adds the artifactsDir setting to configure the base directory where scanner and integration output files are written, replacing the default location.

artifactsDir: /var/regscale/artifacts

Adds organization-level SSO/identity-provider CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and testing via POST /organizations/{organizationId}/identity-providers, GET /organizations/{organizationId}/identity-providers, GET /organizations/{organizationId}/identity-providers/{id}, PATCH /organizations/{organizationId}/identity-providers/{id}, DELETE /organizations/{organizationId}/identity-providers/{id}, and POST /organizations/{organizationId}/identity-providers/test-connection, plus POST /organizations/{organizationId}/sso-enabled to toggle SSO. User-facing pending SSO link handling is added via GET /users/me/pending-sso-links, DELETE /users/me/pending-sso-links/{id}, and POST /users/me/pending-sso-links/{id}/confirm.

Adds a force query parameter to DELETE /admin/runners/{id} and DELETE /runners/{id}, and a sourceSandboxId query parameter to GET /snapshots for filtering snapshots by their originating sandbox.

Bugbot now reviews Azure DevOps Services pull requests, posting review comments, inline comments, and build statuses under the cursor-bugbot/review context. On-demand reviews can be triggered with cursor review or bugbot run comments, restricted to users whose Azure DevOps sign-in address matches a Cursor account on the team. Repository settings let you disable Run for All Authors and configure 'Only Review PRs by...' or 'Skip PRs by...' using sign-in addresses (e.g. taylor@contoso.com) found under Organization settings → Users. A Microsoft Entra service principal is provisioned per tenant for all Bugbot actions so reviews survive role changes; service hooks install automatically when a repo is enabled under Bugbot in Automations and are removed when disabled or disconnected. Cloud Agents can also clone, push, commit, and open PRs on Azure DevOps using the connected identity. The integration is limited to team-scope repositories (personal-scope unsupported), and Auto-Enable for New Repositories, Automatically Learn Rules, Personal Bugbot settings, and Autofix are not supported — repo-level settings apply to all authors instead.

$ bugbot run

Adds shareable deeplinks using the cursor://anysphere.cursor-deeplink/ protocol or the cursor.com/link/ web base URL: prompt deeplinks via cursor://anysphere.cursor-deeplink/prompt?text=... (also cursor.com/link/prompt?text=...) share pre-filled chat prompts the recipient must confirm before execution; command deeplinks save shared custom commands into the recipient's .cursor/commands/ directory pending review; rule deeplinks save shared custom rules into .cursor/rules/ pending review. All deeplink URLs support a maximum encoded length of 8,000 characters.

$ cursor://anysphere.cursor-deeplink/prompt?text=Research%20and%20find%20one%20bug%20in%20this%20codebase

Cloud Agents can now boot into Builds — pre-baked copies of the dev environment (repos cloned, dependencies installed, install script run) — instead of setting up from scratch each session, delivering 10x faster internal environment boot and 3x faster time to first tokentime to first tokenTime to first token, the wait between submitting a request and receiving the first generated token. It includes delays such as queuing and processing the prompt. at no additional cost. A Builds tab in the Cloud Agents dashboard shows build status, logs, commit SHAs, and which build each agent run used; builds can be triggered manually, debugged with an agent, and automatically fall back to the last successful build when a bad commit or dependency update breaks the environment. A configurable threshold controls how stale builds get refreshed, and agents can inspect and manage builds using built-in tools.

⤢

cline doctor fix now reports honestly: processes that survived a kill are separated from ones that appeared during the fix, a live parent respawning a daemon is named, and a startup lock held by a running process is reported as held rather than leaked.

Adds a web_search model tool, off by default and enabled in settings, letting supported models search the web during a turn; search calls and their results are persisted in session history for replay on reload.

Auto-updates no longer install while a CLI is attached to the Hub; the update is recorded at startup and installed on exit, preventing a background update from killing a live session (previously surfacing as Hub connection closed with code=1006). cline update still installs immediately and now reports that the update applies on next start.

Adds a dedicated Cline provider for the Cline gateway, replacing the generic OpenAI-compatible path, so extended thinkingextended thinkingIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens. budgets and other gateway options now apply to both cline and cline-pass models.

Adds oauth.callback_port to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server configuration so each server can use its own OAuth callback port instead of the global mcp_oauth_callback_port; also accepts oauth.callbackPort from plugin MCP declarations and skill dependency metadata.

oauth:
  callback_port: 9005

Skill frontmatter now supports an optional model field (e.g. model: luna) letting a skill declare a preferred model; unrecognized values are ignored without blocking the skill. A new SkillModelDelegationInstruction routes skills requesting Luna while running on Sol or Terra to Luna when available in the current provider namespace, with bounded and validated model identifiers and instruction size limits.

Adds the built-in amazon-bedrock-runtime provider for regional bedrock-runtime OpenAI-compatible endpoints, with SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. auth, per-provider AWS profile, region, and transport overrides, global and US cross-region GPT-5.6 model variants; web search is disabled since it is unsupported on Bedrock.

Client-authored developer messages are now preserved across context compactioncontext compactionCondensing an AI conversation or working history to free space in the model's context window. A summary preserves useful information, but details can be lost. when retain_client_developer_messages is enabled.

Bare gitlab.com repo URLs (including nested subgroups) now clone like github.com URLs for plugin marketplaces. Settings now accept additionalMarketplaces and allowedMarketplaces as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces. An enterprise-policy url-typed blockedMarketplaces entry for a bare repo URL continues blocking that URL even when the CLI classifies it as a git clone.

{
  "blockedMarketplaces": [
    { "type": "url", "value": "gitlab.com/my-org/internal-plugins" }
  ]
}

{
  "allowedMarketplaces": [
    "gitlab.com/my-org/approved-plugins"
  ]
}

Typing @ in the prompt now mentions another Claude session by name, using SendMessage to reach that session directly; SendMessage also delivers to a bare name that exactly matches one live session without a confirmation step. New /config rows for Dialog expiry and Messages from your other sessions let you set per-session inbound messaging to accept, hold, or refuse. Interactive sessions on one machine now keep unique names — renaming to a name already in use generates a name-word-word variant and notifies the user.

The desktop: overlay now accepts every released Desktop setting (previously limited to 11 hand-listed keys), validated at boot against Desktop's own schema, with unknown or invalid keys now failing boot. Empty managed.policies[].match.groups / admin.admin_groups entries and malformed email_domain values (empty, or containing @, whitespace, or commas) now fail at boot instead of silently matching no one or granting admin access.

Adds secret redaction for GitLab token families glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, and glffct-; fully redacts routable glpat- and gldt- tokens; extends the same sandbox and credential-path protection to the glab CLI config store.

The managed settings approval dialog now shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. options, and requires explicit approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep).

sandbox.ripgrep is now honored only from user, managed, and --settings settings; project settings can no longer override the sandbox's ripgrep binary.

Fable 5 is offered again as an advisor in /advisor for organizations with Fable access, with usage-credits consent set up through /model fable.

/plugin install plugin@marketplace now refreshes the marketplace first, so newly published plugins install without a manual marketplace update.