What we ship

Operators re-enter their account password when approving sensitive or side-effect actions, so an unattended browser session cannot authorize irreversible work alone.

Configure approver addresses in shell settings. Duct can also emit a signed webhook event when a confirmation is created or nearing expiry.

Invoke responses include verifiable receipt identifiers unless you explicitly disable them in deployment config.

Dashboard sessions use a 24-hour cap and idle timeout by default, with a refresh endpoint to extend activity within that cap.

Token format spec and conformance vectors document delegated and deeplink JWTs for non-Node stacks. Setup docs are split for operators vs integrators.

Checkup and runtime errors explain when your manifest still points at localhost and how to use an HTTP tunnel.

Pending approvals are stored durably and default to a 24-hour window, so a reviewer in another timezone can still act on them. Approving no longer asks anyone to copy a token by hand — your agent receives it directly over its own authenticated channel, or through a webhook.

When an action declares a side-effect setting that disagrees with what its HTTP method implies, the CLI asks you to confirm and records the reason in your config — so the decision lands in version control and code review rather than a terminal prompt. Pushes are warned by default, and can be set to block.

The analytics page now opens with what the gate actually did — actions invoked, blocked, sent for approval, and slowest p95 — rather than chat volume, and the section count is down from eight to five. Daily volume switches to a calendar view over longer periods, and a new chart plots success rate against tail latency so you can see which action to fix first.

The export control now offers JSON for machines and a print-ready report for people. The report covers whichever period you have selected and opens straight to your browser print dialog, where Save as PDF is a destination.

A per-agent panel counted every automated event including token issuance, while the reliability table beside it counted action invocations only — so the same word, Calls, showed two different totals, and the error rate was divided by the wider one. That panel is gone; per-key attribution belongs in the audit log, where a row traces back to a request. Panels that ignored your selected date range were removed too.

A shell health panel rendered twice under two different headings, and an engagement score was shown as a percentage it could not support. Both removed. Chart colours are now validated for colour-vision separation and contrast in both light and dark themes.

Enabling cross-shell calls from the Network kill switch also sets registry visibility to Public — both are required. If intershell was already on but the shell was still Private, the dashboard warns you and offers a one-click Make public fix instead of failing with shell_not_public.

Turning on cross-shell calls or public visibility in the dashboard now asks you to confirm when your stored manifest still has those settings off. Duct updates the live manifest so a later duct push cannot silently revert what you enabled in the UI.

If you enabled cross-shell calls or public visibility in the dashboard but your local duct.config.ts still has them off, duct push flags the mismatch and blocks unless you pass --yes. Add matching values to duct.config.ts to keep local config aligned.

The Shell-to-Shell playground no longer auto-selects a caller shell that cannot pass intershell validation. When no compatible caller exists, it prompts you to create a sandbox caller instead of failing with an opaque error.

Each docs page expands in the sidebar to show its section headings, so you can jump straight to the part you need without scrolling the full page.

Download a self-contained evidence bundle from a conversation in the dashboard audit log. Each bundle includes staged action evidence, signed receipts, and chain integrity metadata you can verify offline.

Run duct verify-evidence against a downloaded bundle to confirm receipt signatures and audit-chain checkpoints without calling Duct.

Audit session cards use a consistent expand affordance, clearer timeline styling in dark mode, and show permission, consent, and cross-shell chain details inline when you expand an action step.

Shells can now call each other over the Duct network with a two-sided handshake: the calling shell must list the target and the target must accept it. Shells belonging to the same company connect on a frictionless internal lane, while connections between different companies additionally require a verified target.

When you ask one shell to do something on another, you now confirm your identity with the shell that will perform the action before anything runs, so a protected action is always authorized as the right account on the target product. Products from the same company can confirm silently through shared sign-in.

After you confirm on the target shell, the protected action you started from your home shell completes automatically on your next message — no need to repeat the request.

Testing shell-to-shell calls in the dashboard playground? Provision a throwaway caller shell in your workspace when none exists, then tear it down automatically when you leave the tab.

The readiness checklist and duct checkup now HTTP-probe your product base URL (with a Docker-friendly fallback for localhost) and include the platform status page in health signals.

The dashboard receipt verifier now accepts intent receipts alongside outcome receipts, with manual paste and advanced verification options.

The dashboard Network settings now show which shells can call yours and which shells yours can call, so you can review your cross-shell connections at a glance.

The embedded chat now shows a clear "AI can make mistakes" disclaimer and a "Powered by duct" link, defaults to a taller panel so the footer never crowds the conversation, and starts a new chat with a single icon button.

Hover any chat message to copy its text or see a relative timestamp; hover the timestamp for the exact date and time.

Scroll up mid-conversation and a button appears to take you straight back to the latest message, so it stays easy to catch up without losing your place.

When outbound email is configured, new accounts register and verify through dashboard email links. Production blocks self-serve signup until delivery is ready and provides a clear contact path when registration is paused.

Owners invite teammates by email, assign roles (owner, admin, developer, viewer), and remove members. Key rotation, API key creation, and account deletion respect role gates.

Shell Settings shows manifest, product URL, actions, recent activity, platform health, and documentation checks before launch.

The Duct CLI can switch between named local and hosted profiles, inspect the active account and endpoints, and prevent accidental localhost use when a hosted profile is active.

duct checkup reports configuration, authentication, service reachability, and documentation signals in a machine-readable format before go-live.

Documented manifest fields now survive SDK validation, CLI startup works in ESM installs, and release packages include the matching runtime contracts.

Dashboard readiness settings and API routes now load correctly in the containerized production topology.

Anthropic-backed agent turns now consume structured routing decisions directly instead of failing when generated JSON text contains malformed quoting.

The embedded shell preview uses the configured client URL or its local development fallback instead of appearing unavailable when the optional override is absent.

Natural-language and direct-action presets now use the production intershell message protocol and select a valid caller shell owned by the workspace.

The shell Stop control aborts the active turn immediately instead of waiting for the stream to finish. Error responses include a correlation ID for support.

Direct invoke or message to another shell URL returns a typed error directing callers to the intershell API. Same-shell and delegation flows are unchanged.

If upstream accepted a mutation but Duct has not durably recorded completion, retries with the same idempotency key return 409 outcome_unknown with retry guidance instead of dispatching a blind duplicate.

Threat model and audit distinguish operator session, link-holder, and policy-only approval factors — including when no human-in-the-loop guarantee exists for agent-only callers.

Production pricing now separates Developer, Team, and Enterprise paths without placeholder prices or quotas. Pricing questions use collapsible answers and link to the full FAQ.

Public status, threat model, and action-permissions pages updated for mid-market operator workflows.

The embed shows a close control on the panel frame until the shell is ready, so visitors are not stuck on a blank panel during connect.

After a user approves agent access, Duct redirects your callback with a one-time authorization code (90 seconds). Exchange it server-to-server for the long-lived consent token — the token never appears in the browser URL.

Revoked consent, schema errors, and idempotent replays are resolved before execution or delegation tokens are burned. Duplicate side-effect retries replay the cached response instead of dispatching twice.

Intershell hop limits, kill switches, and rate limits now apply identically whether the caller uses REST or a persistent WebSocket connection.

Operator dashboard sessions, link holders, and future WebAuthn factors are labeled explicitly in audit — channel possession is never reported as a verified human.

When someone is already logged into your app, protected chat actions could still fail with "please sign in." Duct now forwards your app session to your API instead of rejecting it.

Reopening the chat panel or returning to the tab picks up a fresh session from your app. Sign-in guidance no longer asks users to hard-refresh.

Shell-wide agentPermissions (defaultLevel, actionOverrides, requireUserConsent, allowedActions) and per-action policy now apply the same way on direct invoke, natural-language /message, and agent page-context resolution.

On retry with an execution token, Duct re-checks user consent before consuming the approval. If consent was revoked, you get consent_invalid and the token is not burned.

Signing out blocklists the session JWT so a copied cookie cannot keep creating keys or minting guest tokens after logout.

Saved LLM provider keys return only a preview after save. The Actions Network badge shows only when the shell is public and intershell is enabled.

Copy shell_id, profile slug, and /message endpoint skeletons for partners — or paste into llms.txt. Docs add Partner handoff and Token checklist sections (agent token always required; add user consent only for user-scoped calls).

The chat panel close is a large thin-line × in the header (no gray pill behind it), beside + New. Tapping it closes the host embed panel the same way as before.

The host embed frame no longer draws a second close on top of the shell — a single in-shell control drives panel collapse.

When an independent agent (whose user has no Duct account) needs approval for a sensitive action, forward the approval link to the person — they open it in a browser and click Approve. The link is bound to their browser, so the agent itself can never approve on its own.

Add a Cloudflare Turnstile or hCaptcha challenge to the approval page so only a real person can approve — a scripted agent cannot pass it.

The setup command now generates a working integration for Nuxt, Vue 3, Express, and FastAPI / Python, in addition to Next.js, Remix, SvelteKit, and Vite + React. Unsupported stacks stop with clear guidance instead of writing files that do not run.

Fixed chart and session-detail colors that were hard to read on a light background, and relabeled session metrics so caller counts no longer look contradictory.

The audit integrity check now reports how much of your history it re-verified and explains when older records predate the current format — instead of one confusing failure — and the result no longer shifts the page layout.

When an agent needs human approval for an irreversible action, operators can open the confirmation in the dashboard, review the details, and approve or deny — then copy the execution token to retry the agent request. No manual API calls required.

Event-type filters now match the events stored in the log, and pagination shows the real total with working Next/Previous — so you can browse and export the full history, not just the first page.

A shell-wide integrity check on the Audit page verifies the tamper-evident hash chain across all events and reports hash coverage and redacted rows — not just per-session row checks.

Agent action cards now group executions by turn so multi-step agent runs read like a conversation instead of a flat chronological log.

Privilege events use plain-English labels, and the admin log explains what will appear when empty or when a filter matches nothing — with a one-click reset to show all events.

Cross-shell delegation tokens are now signed with a dedicated key, separate from session and consent signing — so a single key leak cannot forge every token type at once.

Sending a session token or other non-CLI credential to the validate endpoint no longer counts toward the failed-attempt lockout — only invalid CLI API keys do.

Every action invocation now gets a cryptographically signed record you can verify from the Audit page — tamper-evident proof that the action ran under the right authority.

Audit filters and help text use plain English instead of internal jargon. The verify panel only appears when signed records are enabled for your environment.

Authentication and registry services now drain in-flight requests and close database connections cleanly on deploy or container stop, reducing connection leaks during rolling restarts.

Agents can no longer approve their own irreversible actions: the approval link no longer embeds the secret nonce, the approval page requires a signed-in operator, and approving without that session is rejected. API-only third-party agents cannot self-approve from the 202 response alone.

Invalid or missing user consent on a side-effect action is rejected before a confirmation is created, closing a path that let agents spam audit events with bogus approval tickets.

All newly written audit events are included in the tamper-evident hash chain, and the integrity check reports how much of your history is covered.

Every named security fix now has an automated test that runs on every pull request, so a reverted guard cannot ship unnoticed.

Paste any signed outcome receipt into the dashboard to check its signature and confirm it has not been altered — the same offline verification a third party would run, now one click away for operators.

Deleting a conversation, turn, or action from Audit now clears the sensitive details while keeping each event in place, so the tamper-evident ordering still verifies end to end instead of showing a false gap. Every shell keeps its own independent chain, so removing one shell's history never affects the integrity proof of another.

Signed receipts are now canonicalized with the RFC 8785 JSON Canonicalization Scheme, so any third party can reproduce the exact bytes and verify a receipt offline using a standard, language-agnostic implementation.

A single action now invalidates all outstanding agent and user tokens for a shell at once — useful during key rotation or an incident — without waiting for individual tokens to expire.

Manifests can now grant an action only within a validity window, require human approval when a condition matches, scope a consent grant to specific actions, and cap how often an action can run — all enforced before the action executes.

Privilege-affecting operator actions are now recorded in a dedicated admin activity log so you can see who changed what and when.

A previous signing key is honored during a rotation window, so receipts signed just before a rotation still verify while you roll to the new key. Signing keys are now purpose-scoped for stronger isolation.

Save and test errors in Agent consent & identity and Outbound webhooks now appear directly under the field that caused them, and are written in plain language. Low-level system and network details are no longer shown, so nothing sensitive leaks into the message you see.

As you scroll through Shell Settings, the current section is highlighted in the "On this page" list so it is easy to see and jump between sections.

The account menu in the sidebar now layers on top of page content instead of appearing behind cards. A redundant line under the signing secret was also removed since the field already shows the key ending.

Rolling back to an earlier configuration snapshot, or promoting a shell between environments, no longer erases the identity resolver URL, consent callback, signing secret, model (BYOK) settings, routing threshold, or widget appearance you saved in the dashboard. Pushing a new config from the CLI also keeps your saved routing threshold instead of resetting it.

Audit and usage events are retried instead of dropped if the database has a brief hiccup, and their tamper-evident ordering is protected. Sessions, conversation history, and pending approvals now persist across a service restart so they are not lost during routine maintenance.

Push History highlights the live manifest with action, deeplink, and route counts, a git-style timeline when you reactivate an older snapshot, and a copy-paste npx duct pull command on every card. Overview now shows only the live manifest instead of a rolling list of recent pushes.

The shell sidebar is grouped into Shell, Observe, Build, and Configure with clearer icons. Answer-confidence and live-conversation panels live on Analytics; the old Intelligence page redirects there. Settings uses a sticky section nav, consistent password show/hide controls, and refresh buttons that spin instead of swapping label text.

Audit → Actions no longer labels agent executions as "Unknown action". Token events name the agent access profile, and execution titles are human-readable instead of bare internal ids.

After a user clicks Approve, Duct now hands off to your identity sign-in with a proper browser redirect instead of a silent failure. The success screen copy button works again, internal user identifiers are hidden from end users, and wording makes clear the human is authorizing a partner agent to use your app — not the app itself. Agents may pass an optional profile slug on the consent request so the page shows the agent name from Dashboard.

When a user approves a high-risk action, the execution token copy control works again, the review screen fits in one view without scrolling, and the Approve button uses Duct brand styling.

Dashboard Agent Setup now walks through identity resolver and consent callback configuration, a five-step approval diagram, and copy-paste examples for partner agents.

When a partner agent requests access, the user now confirms who they are through your own login at approval time. Point the new Identity resolver URL (Settings → Webhooks) at your existing sign-in; Duct sends the user there, you confirm the session, and hand back an opaque reference signed with your webhook secret. Agents send only their shell ID — never a user identifier, callback address, or internal action name — and can never learn or forge who the user is. Companies that already drive consent from their own backend are unaffected.

Consent requests now accept action_ids: ["*"]. The user approves a single time and the resulting consent token covers every action the agent is already scoped for on that shell — no more one approval per action. The agent can never exceed its granted scopes, and actions with side effects still require the usual per-call human approval. Pass a specific action list instead when you want a narrower grant.

A unit mismatch meant consent approval URLs from POST /v1/consent/request always expired immediately. This is fixed. The user_ref you pass in the consent request is now forwarded through the approval page and into the issued token, so your backend receives it without additional grant storage. Requesting shell is now validated on consent requests.

Actions marked requiresAuth were only verifying the user consent token on /invoke. /message now runs the same check for agent callers, so the two endpoints are consistent.

The Dashboard analytics page now shows: a reliability table with success rate and p50/p95 latency per action; per-agent call and error breakdown; consent approval/denial funnel; side-effect confirmation funnel; and daily forbidden/consent-invalid security signals. Human session counts were also undercounted — now fixed.

Test failure banners now appear immediately below the URL that was tested, not at the bottom of the page. Each Test button is independent. "Failed to fetch" and timeout messages are translated into plain English. Generated secrets now use the whsec_ prefix.

Pass user_ref (your stable internal user ID) when requesting consent. Duct carries it into the issued token and forwards it as X-Duct-User-Ref on every proxied API call — your backend can now identify the acting user without a separate grant storage table.

When a third-party agent tries a user-scoped action without a consent token, the 403 now includes a remediation block showing exactly which endpoint to call, the required request body shape, and a link to the docs. Agents can surface this guidance automatically.

The Agent Setup page has a new end-to-end User Delegation section explaining the consent request flow, callback handling, and how to read the user identity header in your API — without leaving the dashboard.

Each turn in Audit → Conversations shows what happened step by step — how the request was understood, which actions ran, and what was delivered — in chronological order. Verify integrity and export (spreadsheet, raw log, or summary) are on each conversation card.

Delivered text replies and navigation handoffs (with destination URL) are captured in the audit log so you can see what the user actually received, not just that something was sent.

Shell cards and overview show product.logoUrl when pushed, an optional company logo URL from Settings → Branding, or a stable pixel avatar derived from product metadata.

Set logoUrl under product in duct.config.ts (not widget). Appears in the open shell header and dashboard; the launcher bubble stays Duct. duct init auto-detects public/logo files and resolves them against baseUrl.

Dashboard playground Human mode keeps its own conversation and session on your browser, separate from the shell embedded on your product — so testing in the playground does not overwrite or mirror live embed chat.

Set theme, size, welcome text, and colors in duct.config.ts or save from the dashboard playground — whichever you update most recently applies to the live shell. Tool-loop limits still follow your manifest push.

Dashboard Agent playground /message tests now get session and turn IDs and appear under Audit → Conversations with a Playground caller badge — not orphaned rows in Advanced.

Conversation cards and raw rows distinguish Human, Playground, Agent, Network, and Shell callers. Filter Audit by caller type.

Completed-reply counters and routing outcomes no longer show as blank invoke records — delivery rows explain what they count and link to Conversations trace.

List and table cards now expand nested breakdowns (such as per-program salary stats) into proper columns instead of showing raw JSON. Table data always comes from your API response, not model-generated placeholders.

While a confirmation card, form, or multiple-choice prompt is on screen, the message box is disabled until the user responds — preventing accidental messages that interrupt side-effect approvals or disambiguation.

Operators can permanently remove a conversation, turn, action execution, or individual invoke row from Audit. Hide still only affects your browser session.

Turn ID, Correlation ID, cache badges, and other audit labels have inline ? help in the dashboard, with a full glossary on the Agents docs page.

Turn trace steps and action cards link to matching rows in Advanced’s invoke table — filtered, highlighted, and scroll-into-view.

When an action returns a structured “not found” or validation hint with suggested values for a parameter, the shell retries once with the closest match before giving up — no company-specific wiring required.

Data lookups stay in the chat widget when routes declare a search action; failed turns appear in Audit; real API error messages replace generic “couldn’t complete” text; sign-in handoff no longer loops on every protected question; assistant replies no longer leak internal tool narration.

Dragging the chat launcher or open panel to a new spot is remembered after deeplink navigation (including sign-in handoff). Positions persist per shell in the browser.

The floating chat bubble keeps the Duct wordmark when the hosted shell is temporarily unreachable instead of showing a generic placeholder icon.

Audit now has Conversations and Agent actions — one place to follow a chat turn from user message through routing, delivery, and permissions. Turn search, raw events, and hash-chain verification live under Advanced.

Audit’s Verify chain check no longer shows a false tamper warning on normal action history.

When someone uses the chat widget before logging in and asks for protected data, the shell navigates them to your sign-in page instead of showing a generic error. Set auth.loginRoutePath in duct.config.ts (duct init can detect /login automatically).

If a question needs an account and the chat does not have your session yet, the shell explains that you should sign in and ask again — with a Sign in button — instead of only showing a generic navigation line and redirecting automatically.

Each chat turn shows routing decisions, cache hits, delivery, and LLM token usage in one timeline. Search by turn or correlation ID in Conversations, or verify the tamper-evident audit hash chain under Advanced.

Analytics → Recent sessions expands a merged routing + invoke timeline. Each session and event row links to the matching Audit view — full permissions, confirmations, and turn trace.

Analytics supports 1-day, 7-day, 30-day, month-to-date, and last-month presets, plus custom from/to ranges up to 90 days. Message volume and LLM usage charts follow the same window.

Configuration and Action permissions docs describe loginRoutePath, guestAllowed, and how sign-in handoff works for embedded shells.

Agents Are Not Users — our reference architecture for governed agent actions in third-party products: declarative manifests, invocation-level authorization, consent on side effects, and verifiable audit receipts. Available on Zenodo with BibTeX and JSON citations.

Every gate decision can now produce a signed receipt. When offline verification keys are configured, receipts can be checked by any third party without contacting Duct — plus replay detection and staleness checks when a receipt is presented for verification.

When one shell delegates authority to another for cross-shell calls, further delegation can now only narrow — never broaden — the original grant, and revoking a delegation now revokes everything delegated from it.

Shells can choose how often a user's consent is re-verified for a given action — the default behavior (verify on every call) is unchanged, with an opt-in cached mode for lower-risk, high-volume actions.

duct init now prints a wiring plan before writing files and saves copy-paste middleware snippets under .duct/snippets/ so authenticated action calls work after embed.

After init, a deterministic audit lists what still needs wiring — token route, receiver, embed mount, env vars, deeplinks. Run duct checkup anytime to re-run the same audit plus service connectivity.

Auth-aware token routes per detected login provider, third-party agent setup prompt, filesystem verification of discovered routes, OpenAPI mode still discovers UI routes, and pre-write manifest validation.

Docs now describe the wiring plan, middleware snippets, integration audit, and duct checkup project audit — matching what the CLI ships in v0.4.0.

Remix, Vite, and SvelteKit deeplink receivers now confirm handoffs with Duct when your API key is configured — matching Next.js behavior for delivery tracking.

All framework deeplink receivers reject tokens missing required identity claims after verification.

onReceive handlers across Next, Remix, Vite, and SvelteKit now share the same result shape for redirects, response data, and headers.

Every docs page and code block includes a Copy for AI menu — copy the prompt as Markdown, or open it in Cursor, Claude Code, Codex, Claude, ChatGPT, Gemini, or Grok with context pre-filled.

Dedicated docs for which actions agents may call, side-effect rules, sensitivity levels, and who can invoke each endpoint — with an enforcement matrix and error catalog.

Find pages instantly with Cmd/Ctrl+K or / — fuzzy search across the full docs sidebar.

A ready-to-paste prompt for wiring Duct into your codebase. Environment URLs resolve from your deployment, not hardcoded domains.

Deeplinks can resolve page context from your APIs or hosted pages so agents get structured handoff data without scraping. Quality checks keep low-signal fetches out of the response.

When enabled, every invoke permit or deny can return a signed receipt_id, verifiable against your shared signing key — groundwork for enterprise audit trails.

When a deeplink resolves page context through a manifest action, the same agent-access, consent, and scope rules apply as on a direct invoke — blocked actions can no longer slip through the page-resolution path.

Agent handoff URLs are built from your manifest first. Router-suggested links are only returned when their origin matches your configured product base URL.

Shorter tool loops, buffered audit writes, and partitioned event retention keep latency predictable as traffic grows.

Execution and raw audit rows show plain-language permission rules instead of internal enum values.

The shell no longer ends turns with “I’ll look that up” after tools already returned data. Answers come from completed results or a clear summary of what is missing.

Cross-shell calls now default to deny unless a target shell is explicitly public and intershell-enabled. Caller restrictions and audit logging apply before delegation.

After tools complete, routing and synthesis reject replies that promise future fetches instead of answering from data in hand.

Agent access profiles now list agent-accessible actions from your manifest with read and write toggles, a read-all shortcut, and setup-time validation for unknown action ids.

Manifest push rejects dependsOn cycles. /message returns plan_too_long or depends_on_cycle instead of running a truncated chain.

approval webhooks retry with backoff, log delivery outcome in Audit, and redact params for high/critical actions.

Stateless agent traffic (no session_id) now counts toward the Human/Agent sessions KPI — one bucket per calendar day — matching what Audit already showed.

When dependsOn expands into multiple steps or the router emits a plan, side-effect steps return confirmation_required instead of permission_denied.

Poll GET /v1/confirmations/:id/status for pending → approved without a human pasting a token. When approved, the response includes execution_token and remaining TTL for your retry.

Pass confirmation_webhook_url on POST /invoke or POST /message to receive an HMAC-signed confirmation.approved event with execution_token when a human approves.

POST /message auto-runs manifest dependsOn prerequisites and forwards paramMapping between steps — same behavior as the human shell. Publish ordering in the manifest, not in action description prose.

Human/Agent session counts include stateful agent /message and /invoke traffic. Analytics shows agent message vs invoke turn breakdown. Chat sessions lists agent conversations, not only human shell turns.

Natural-language agent turns now count toward Analytics session and message KPIs. The audit log records the full /message lifecycle — including post-approval retries — so confirm → approve → execute appears as a complete timeline under Single actions.

Dashboard Audit opens on Single actions when you have agent access profiles. A hint appears when Chat sessions is empty but agent executions exist. Playground and guest traffic shows as Playground instead of Human.

Chat turns now reliably show up in Analytics. Older shells pick up missing counts automatically so existing shells are not stuck at zero.

Human confirmation URLs use Duct-branded layout with clearer Approve/Deny copy, a post-approve execution-token screen with Copy, and retry guidance for agents (X-Duct-Execution-Token on POST /message — your original message body still works).

Dashboard Intelligence “When” timestamps no longer crash the page from timezone mismatches between server and browser.

New guidance for third-party agents: agent access tokens prove which agent is calling; user-scoped actions need a user consent token or delegated user access that external agents can obtain. Covers the common case where the human shell works but partner agents get 403 because APIs only accept login-minted tokens.

Agent tab copy now directs operators to agent access profiles and /v1/agent-access-token instead of legacy agent keys. Guest-token limits banner and integration callout link to Agent setup.

Dashboard Agent setup now focuses on agent access profiles: create a scoped profile, share shell_id + agent_profile slug, and exchange at /v1/agent-access-token — no pre-shared keys in the UI. Integration snippets and credentials callout updated to match.

Create named profiles per shell (e.g. partner-read). Third-party agents request a 1-hour token with only shell_id + profile slug. Optionally wire a webhook so your backend approves each issuance.

Third-party agents can now call POST /message and /session/init with an agent access token — no pre-shared shell secret required. Profile scopes are enforced at action resolution time, so write scopes are checked when a side-effect action is routed.

Dashboard Analytics now tracks delivered chat responses — text, actions, UI cards, and deeplinks. Previously, routing and audit events were logged but completed chat turns were not mirrored, so the Audit Log could show activity while Analytics stayed at zero.

The audit log opens on Chat sessions — full conversations grouped by session ID, with per-message previews, action chains, confirmation steps, and lifecycle timelines. Filter by session or execution ID and jump to Raw events in one click.

Refresh button, light-theme contrast for labels and status pills, bidirectional execution links between sessions and raw rows, and copy on manifest hash in the advanced panel.

The duct.config.ts snippet always includes widget.theme. Save to shell still patches the live manifest; SDK embeds generated by duct init pass theme to DuctShell and iframe URLs.

Session cards in the audit log now show the human prompt on new chat turns — not just action param fallbacks — on form submits and confirmations.

The shell panel grab bar uses a solid mid-gray with subtle shadow so it stays visible on light headers — in the SDK embed, dashboard playground preview, and marketing demos.

The audit log groups related invokes into execution records — action, target, who requested it, why, human approval, policy matched, and a request → approve → execute timeline. Expand a card for session ID, manifest hash, and raw events. A Raw events tab keeps the flat per-call view.

Each execution shows Human, Agent, Network, or Guest as clear badges. Filter the log by badge type.

Each chat turn gets a turn ID on invokes and intelligence events, so execution records can show the user message and routing reason when available.

When a human rejects an agent approval request, the execution record shows Denied instead of Pending approval.

Side-effect requests through the agent /message endpoint now create confirmation rows in the audit log, same as /invoke.

CSV and JSON exports now include execution ID, target, reason, turn ID, and approval metadata.

Analytics now splits tokens by provider (Claude, ChatGPT, Gemini, and more), pipeline stage, and call type — with separate input and output counts, per-model drill-down, a daily trend chart, and a glossary for what each bucket means.

Every model call records which provider and model served it, so usage charts reflect your BYOK configuration and platform defaults — not just a single blended total.

Chat invocations and routing events show as Chat user for easier filtering. The caller filter groups chat users under one option.

Find past manifest pushes by typing part of the hash or checksum on the Push History page.

The audit log filter placeholder now reads Action name — matching how operators think about manifest actions.

When your API returns a wrapper object containing a list of records — a common pattern — the shell now renders a table automatically instead of displaying the raw array as text inside an entity card.

A bug in cross-shell routing caused every request to fail with a 500 error. This is now fixed.

Audit log CSV export now builds reliably in production deployments.

When an agent requests a risky action, Duct returns an approval link. A person reviews the action, approves it, copies a one-time token, and hands it back to the agent to retry.

Every invoke is logged with action, caller, permission rule, consent status, and outcome — searchable, expandable, and exportable as CSV or JSON.

A valid user consent token authorises the request, not the execution. Agents still need per-call human approval before irreversible actions run.

If you change an action after someone granted access, that approval no longer covers the new behavior — users confirm again before anything runs.

Separate controls for read-only access, specific write actions, and destructive deletes — so keys can stay narrow without listing every endpoint by hand.

When your shell uses data from another company’s product, replies treat that data as untrusted input — not instructions for your users.

Start a manifest from API exports you already have, alongside OpenAPI specs.

Public shells are discoverable by capability search. Cross-product calls use runtime user consent, single-use delegation tokens, and bidirectional audit logging.

Token usage is now captured across request routing and responses, so dashboard analytics reflect real model cost.

Required parameters are collected before confirmation. Confirm cards show neutral copy instead of raw action descriptions.

Path and query parameters are preserved through manifest storage and routing so handoff URLs land on the right page.

Backend-safe imports for token helpers and verification — no React dependency on server routes.

Arrays become tables, status objects become cards, and search results render inline — without per-action frontend work.

Copy-ready shell-token and invoke examples on the agent setup page, plus corrected analytics gauges.

Real-time health checks across authentication, the platform API, the shell, AI routing, and related services.

New accounts land in the dashboard immediately after registration with an active session.

Preset panel sizes (tall, square, large), a movable bubble and panel, and theme-aware launcher chrome — persisted per shell.

The dashboard playground previews the real draggable launcher and panel behavior before you ship.

The shell routes intent through an LLM agent loop — manifest actions as tools, silent execution, and synthesized user-facing responses.

Agent access profiles, permission checks, a confirmation step for side effects, and audit rows on every call.

The shape of each result drives how it’s shown — tables, status cards, comparisons, timelines, and more.