v0.8.40: browser agent improvements, permission requests

[waleedlatif1]

• chore(db): drop retired usage columns and compatibility scaffolding (chore(db): drop retired usage columns and compatibility scaffolding #7868)
• fix(browser): improve snapshots, native controls and action reliability (fix(browser): improve snapshots, native controls and action reliability #7872)
• feat(access-requests): request and review permission access (feat(access-requests): request and review permission access #7871)
• fix(access-requests): scope previews and audit events correctly (fix(access-requests): scope previews and audit events correctly #7873)
• fix(sidebar): extend faded labels until row actions appear (fix(sidebar): extend faded labels until row actions appear #7874)
• fix(workspace): hydrate access policy before rendering chat (fix(workspace): hydrate access policy before rendering chat #7875)
• fix(docs): correct db:push backfill description (fix(docs): correct db:push backfill description #7877)
• feat(library): AI Personal Assistant vs. AI Agent Builder: What's the Difference? (feat(library): AI Personal Assistant vs. AI Agent Builder: What's the Difference? #7878)
• fix(access-requests): align permission checks and pending request flows (fix(access-requests): align permission checks and pending request flows #7880)
• fix(credentials): restore scoped Slack bot reconnects (fix(credentials): restore scoped Slack bot reconnects #7879)
• feat(sso): let organizations require single sign-on (feat(sso): let organizations require single sign-on #7881)
• improvement(credentials): allow connecting accounts with different emails (improvement(credentials): allow connecting accounts with different emails #7883)
• fix(credentials): clean up personal secrets in archived workspaces (fix(credentials): clean up personal secrets in archived workspaces #7882)
• improvement(integrations): consolidate generated metadata (improvement(integrations): consolidate generated metadata #7887)
• feat(insights): add organization activity dashboards (feat(insights): add organization activity dashboards #7884)
• fix(security): close fail-open paths found by the integration suite (fix(security): close fail-open paths found by the integration suite #7886)
• feat(credential-groups): allowlist integrations by workspace (feat(credential-groups): allowlist integrations by workspace #7885)
• fix(slack-search): wait for content before starting replies (fix(slack-search): wait for content before starting replies #7891)
• fix(search): bound retrieval and avoid repeated turn admission (fix(search): bound retrieval and avoid repeated turn admission #7888)
• fix(access-control): keep the settings page open while an organization is governed (fix(access-control): keep the settings page open while an organization is governed #7890)
• feat(search-mcp): persist client-attributed tool activity (feat(search-mcp): persist client-attributed tool activity #7892)
• fix(browser): recover stalled screenshots and preserve image coordinates (fix(browser): recover stalled screenshots and preserve image coordinates #7889)
• fix(search): surface Google service account authorization errors (fix(search): surface Google service account authorization errors #7893)
• fix(workflows): resolve finished resume runs on the run status endpoint (fix(workflows): resolve finished resume runs on the run status endpoint #7894)
• chore(auth): diagnose unexpected managed OAuth callback failures (chore(auth): diagnose unexpected managed OAuth callback failures #7896)
• fix(search): preserve Google sync diagnostics and retry transient failures (fix(search): preserve Google sync diagnostics and retry transient failures #7895)
• fix(search): complete sync failure diagnostic context (fix(search): complete sync failure diagnostic context #7898)
• feat(ci): promote Trigger.dev tasks in lockstep with the ECS traffic cutover (feat(ci): promote Trigger.dev tasks in lockstep with the ECS traffic cutover #5725)
• fix(search): retain permission sync failures and clarify progress (fix(search): retain permission sync failures and clarify progress #7897)
• fix(search): preserve indexed vector retrieval and literal source text (fix(search): preserve indexed vector retrieval and literal source text #7899)
• fix(slack): allow installation before organization setup (fix(slack): allow installation before organization setup #7900)
• fix(workspace-fork): scope and batch preview revisions (fix(workspace-fork): scope and batch preview revisions #7901)
• fix(knowledge): bound KB block vector retrieval (fix(knowledge): bound KB block vector retrieval #7903)
• chore(ci): simplify Trigger release workflow (chore(ci): simplify Trigger release workflow #7905)
• feat(coda): add Coda integration with API-token credential and resource pickers (feat(coda): add Coda integration with API-token credential and resource pickers #7907)
• fix(insights): reduce activity aggregation overhead (fix(insights): reduce activity aggregation overhead #7908)
• fix(gmail): open search results in the indexed mailbox (fix(gmail): open search results in the indexed mailbox #7910)
• fix(knowledge): increase hosted rerank capacity (fix(knowledge): increase hosted rerank capacity #7912)
• fix(outbox): process cron batches outside HTTP requests (fix(outbox): process cron batches outside HTTP requests #7911)
• fix(credential-groups): expose provider emails and align people rows (fix(credential-groups): expose provider emails and align people rows #7904)
• fix(credentials): render the credential selector with the editor combobox (fix(credentials): render the credential selector with the editor combobox #7913)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 17, 2026 3:16am UTC

[github-actions]

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into main yet (aggregated across the feature PRs in this release). Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

• ⚠️ simstudioai/mothership#502 — merged into staging (this PR targets main) — fix(browser): align structured input and multiple selection contracts
• ⚠️ simstudioai/mothership#505 — merged into staging (this PR targets main) — fix(billing): admit assistant spend once per logical turn
• ⚠️ simstudioai/mothership#506 — merged into staging (this PR targets main) — fix(browser): preserve Gemini tool identities and add BrowserGym evaluation

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until a timed-out native screenshot capture has a recovery path that does not permanently disable screenshots for the affected tab.

Findings

1.  Stalled capture blocks retries ▶

Summary

This release introduces organization-governed permission access requests, contracts retired database columns, improves desktop browser automation, hydrates workspace policy earlier, and updates sidebar/menu behavior.

• Adds request discovery, submission, cancellation, administrator preview and resolution, notification, audit, and organization-settings flows.
• Adds the permission-access-request schema and removes retired usage/file-size compatibility columns and scripts.
• Improves browser snapshots, native structured controls, multi-select handling, click reliability, and cancellation.
• Exposes restricted workspace features as requestable states while preserving existing behavior when requests are disabled.
• Refines sidebar row actions, menus, and workspace policy hydration.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Member[Workspace member] --> Discovery[Discover restricted capability]
  Discovery --> Request[Create access request]
  Request --> DB[(Permission access request)]
  DB --> Outbox[Notification outbox]
  Outbox --> Admin[Organization administrator]
  Admin --> Preview[Recompute policy preview and impact]
  Preview --> Decision{Decision}
  Decision -->|Decline| History[Record final decision and audit]
  Decision -->|Apply| Lock[Acquire organization and policy locks]
  Lock --> Recheck[Reauthorize and verify fingerprint]
  Recheck --> Policy[Update permission group or member limit]
  Policy --> History
  History --> Requester[Notify requester]

Loading

_{Reviews (1) · Last reviewed commit: "fix(workspace): hydrate access policy be..."}

[cubic-dev-ai]

All reported issues were addressed across 222 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>