Changelog

2026-09-01Signing in with Google lands you in the dashboard

Fixed

  • Signing in with Google no longer drops you back on the sign-in form. If a previous session had expired in that browser, the app was still trying to renew it while the new sign-in completed — and when the doomed renewal finished last, it discarded the session you had just created. The address bar said /dashboard, the screen showed the sign-in form, and only a second attempt worked. An expired session being cleaned up can no longer take a newer one with it.

2026-08-25Billing that charges once, and roles you can see at a glance

Most of this release is invisible if everything was already working, which is the point: it makes several ways of billing you incorrectly impossible rather than unlikely.

Added

  • The users list shows each person's role, next to the organization it applies to, instead of making you open a row to find out. Someone who belongs to no organization shows a dash rather than a made-up role.

Fixed

  • A period of AI usage can no longer be charged on two invoices. If an invoice went unpaid and the next billing cycle opened a new one, the same usage could land on both — and if the older invoice was later collected, it was paid for twice. The database now refuses a second charge for a period that already has one.
  • The month in progress is no longer billed early. Doing so closed it mid-month, and everything used after that moment became impossible to invoice.
  • A small overage is carried instead of quietly dropped. Usage that fell under the minimum invoice amount was logged as "deferred to next cycle" and then written off. It is now genuinely carried and charged once it crosses the threshold.
  • A past-due subscription keeps the AI budget it paid for. A failed payment reduced the included budget to the default for accounts with no plan, so the next invoice overcharged. Owing this month's fee no longer un-buys last month's budget.

Changed

  • The MCP warns about email verification before you seed test users. A new organization requires it by default, so users registered with made-up addresses can never sign in. The build guidance now says so where it matters, and points at the setting (@genlobe/mcp-server 3.37.0).

2026-08-25Users, Subscriptions and Plans redesigned, and billing that reports the truth

The three modules that had never been through the redesign now match the rest of the dashboard, and the Subscriptions view stopped showing you things that were quietly wrong.

Added

  • The Users, Subscriptions and Plans modules were rebuilt. All three now have the same shape as the rest of the dashboard: a header with the primary action, a strip of KPIs, filters on one row, and a side panel for detail. Previously each looked like a different product.
  • Open a user, a subscription or a plan without leaving the list. Clicking a row opens a panel with the full record — a user's organizations and their role, a subscription's periods and Stripe ids, a plan's features and limits — and the URL updates, so you can link someone straight to it.
  • Plans have editable limits, and a comparison view. limits was already stored and enforced, but there was no way to see or set it from the dashboard. You can now edit limits per plan and compare plans side by side.
  • Archived plans can be shown or hidden, instead of always being mixed in with the live ones.
  • Sign-ups over the last 30 days joined the KPIs on Users, with the real count and its trend rather than a total that never moved.
  • Subscriptions say who and what. The list showed raw ids where the customer and the plan belong; it now shows the customer's email and the plan's name.

Changed

  • The Organization Owner Dashboard is gone. It had been replaced by the Tenant Dashboard for billing, Stripe configuration and plans, and the old screens had been unreachable for a while. Around 5,500 lines of it came out.
  • Money is calculated in whole cents, and a yearly plan is normalised to a month before it lands in an MRR figure — so a yearly and a monthly plan can be added up without rounding drifting.
  • The changelog you are reading is easier to scan. Releases are separated and dated with a chip, categories are tagged and colour-coded, each entry leads with its headline, and there is an index at the top to jump by release.

Fixed

  • A yearly subscription is no longer recorded as monthly. Every Tier-3 subscription was written with a monthly billing cycle regardless of the plan bought, so a customer on a yearly plan was displayed as monthly.
  • Subscriptions show when they started and when they renew. Both dates were empty for every subscription, because they were read from the wrong place in Stripe's payload — the period moved onto the subscription's line item and we were still reading the subscription itself.
  • The reconciliation pass repairs those records instead of damaging them. It could not correct a billing cycle at all, and — reading the same wrong place — would have overwritten a correct renewal date with an empty one.
  • An invitation email can no longer hang the request that sends it. An unreachable mail provider was indistinguishable from a slow one, and the call waited well past the point the browser had given up.

Security

  • A validation error no longer echoes your secret back. Submitting Stripe credentials with a field missing returned a 422 that included the secret key you had just sent, which meant it could reach logs and error tracking. Secret fields are now redacted in every validation error, on every endpoint, while still telling you which field was wrong.
  • Webhook probes stopped generating false alarms. The per-Organization Stripe webhook endpoint is public by design, so anything on the internet can post to it; each probe was raising an internal error alert. It is now recorded as the expected traffic it is, and the alert for a genuine signature mismatch explains the most common cause — two webhook endpoints configured for the same URL in your Stripe account.

2026-08-20Codebase setup, a dashboard that shows movement, and billing that records your payment

Added

  • A real setup wizard for Codebase. Connecting a repository now walks you from provider credentials to a chosen branch per repository to an agent you can talk to, instead of leaving you on a queued job with nothing to do.
  • Pick a branch instead of typing it. When you sync a repository, the branch field is now a list of that repository's real branches, with the default one marked. A typo used to surface only later, as a failed sync job.
  • Sync several repositories at once. The sync form accepts more than one repository per submit, so connecting a dozen no longer means a dozen trips through the same form.
  • A guided path for setting up RAG. Choosing a repository, connecting it and creating the knowledge base it feeds now happen in one place, instead of moving back and forth between Integrations and Knowledge Bases.
  • Skip parts of a repository you don't want indexed. When you sync a repository you can now pass exclude patterns for it, and they are remembered for later syncs — so one folder of fixtures or generated output no longer forces you to choose between indexing everything and indexing nothing.
  • The overview shows movement, not just totals. Each KPI carries a sparkline, the range switches between 1h / 24h / 7d / 30d, and a recent activity feed lists what actually ran.
  • Usage is one screen. Consumption by Organization, by agent and by model now live in a single Usage module instead of separate, differently shaped pages.
  • Syncs report progress where you were looking. An in-flight repository sync shows its state on the Codebase page, instead of only in a job list.
  • The agent wizard ends on the chat, and that chat has a URL you can share or come back to.
  • Ask the MCP for a repository's branches. New tool list_repo_source_branches lists the branches of a connected repository with the default one marked, so an agent no longer has to guess main (@genlobe/mcp-server 3.36.0).

Changed

  • Repo Source is now called Codebase, in the sidebar and everywhere else — it is the code your agents can answer about, not a settings row.
  • Integrations opens on your connections, not the provider catalog, and the catalog no longer repeats integrations you already connected.
  • Sync repositories reads as the main action on the Codebase page, and the tile routes you by state (connect, sync, or view) instead of a header button that meant something different depending on where you were.
  • A connected integration looks connected. After you save credentials the form is replaced by a read-only summary, so it is obvious the integration is live rather than still waiting for input. A failed sync now offers Retry.
  • Paste a repository URL where the owner goes. The Organization/Owner field accepts a full Azure DevOps or GitHub URL and takes the name out of it, instead of rejecting it.
  • Integration tiles show provider logos instead of two-letter initials.
  • Indexed code and Markdown render as code in knowledge-base query results and the chunk viewer, instead of being reflowed as prose.

Fixed

  • A completed checkout records your payment. Two paths could take money and leave no subscription row behind: a plan id that did not resolve, and a legacy checkout whose row could never be written. Both now create the subscription, and a plan changed on Stripe's side updates on our side too.
  • One active subscription per tenant. A tenant could end up holding two active rows, which made "what plan am I on" arbitrary.
  • Agent runs started from the dashboard now appear in per-Organization usage. They were being recorded without an Organization, so every per-org view under-reported.
  • The dashboard no longer hangs on "Verifying authentication." In some states it never resolved and there was no way forward but a reload.
  • Real 404 and error screens. A wrong URL or a failed render used to fall back to a blank page.
  • Connecting a large repository works. A big repository could fail to index outright, and a repository that was mostly data — CSV dumps, exports, generated files — could be rejected as "too large" even when the code in it was small. The size limit now counts only the source that will actually be indexed, and data files are skipped rather than embedded. Skipping them also means your searches stop returning rows of comma-separated numbers.
  • A repository that really is too big now tells you what to exclude, naming the folders taking up the most space, instead of only saying it was too large.
  • A connection stored in the old shape offers a way out. An Organization configured before the URL fix kept a URL where a name belongs, and the repository list dead-ended on a provider 400; it now explains the problem and lets you fix the field.
  • A pasted URL from an unsupported host is refused up front, instead of failing later as a sync error.
  • The Codebase wizard remembers this Organization is already set up rather than starting from zero every visit.
  • The agent Capabilities card no longer says RAG is off on an agent that answers from RAG.
  • A successful owner invitation reads as success, not as an error.
  • Running out of plan quota tells you what happened and what to do. The message used to render as [object Object] with no way forward; it now explains the limit you reached and links to upgrading.
  • The plan card no longer clips its badges. "Current Plan" and the yearly badge were cut off by the card's edge.
  • The dashboard works on a phone and a tablet. The sidebar collapses into an overlay drawer below large screens, and page-header and top-bar actions no longer overlap or clip the title.

Security

  • Creating an agent validates the Organization you name. The endpoint accepted a caller-supplied organization_id without checking it belongs to your tenant.

Added

  • Ask the MCP which Organization you are. A new whoami tool answers with your Organization's id, name and slug, so a builder agent authenticated with only an API key no longer has to be told the id it needs for almost every other call. It never returns your key or any secret.
  • get_email_config_url joins the other redirect tools, so an agent can hand you the screen to set up your Organization's email provider. Email was the one credential with no such tool.
  • A recipe for the repository-agent flow (get_repo_query_recipe), matching the ones that already existed for chatbots and CRMs.
  • Read your email delivery log with a server key. The log already recorded why a message did not arrive — including when a provider declines to send to an address that bounced before — but only the dashboard could read it. A server-key integration can now read it too, which is usually the fastest answer to "the email never arrived".

Changed

  • Your invited role now survives registration. If you register through an Organization's API key before opening your invitation, you used to land as a plain member and the role you were invited with was silently discarded. It is now applied as soon as you verify your email address.
  • Endpoints populate the field names their documentation promises. role on the organizations listing, email and display_name on members, repo on repository sync jobs. The previous names still ship, so nothing that already adapted to them breaks.
  • token works where the docs say token. Accepting or rejecting an invitation now takes either token or invitation_token; the documented one used to be rejected.
  • Registration tells you whether the verification email actually went out. If it could not be sent, the response says so and points at the resend endpoint, instead of asking you to check an inbox nothing was sent to.
  • The MCP documents what it actually returns. execution_metadata is no longer described as an opaque object — the citation data an agent produces (file, repository, branch, commit) is documented, along with what will never be in it. Job status, agent runnability and the connected-repository list are documented too.
  • An expired session says so. Requests with an expired token now answer with the standard invalid_token challenge, so an app can tell "refresh and retry" apart from "sign in again" instead of guessing.
  • Searching the MCP finds the configuration tools. Asking it for something like "email configuration url" returned nothing, because the tools that hand you a dashboard link were not part of what the search looked at. They are now, and a search no longer comes back empty just because one of your words was a filler word.
  • Endpoint documentation no longer skips sections it points at. The agent chat endpoint referred you to a response shape that was never printed.
  • The health endpoint reports which build is running, instead of a fixed version string that never changed, so you can tell whether a fix has reached the environment you are looking at.

Fixed

  • Invitation emails from invite-owner now send — from the dashboard too. Neither the API nor the dashboard version of that endpoint had ever successfully sent one; the owner was created and the message silently was not.
  • Inviting an owner a second time works. If the first welcome email did not arrive, there was no way forward: the owner had no password, could not sign in, could not reset a password without that email, and a second invitation was refused because the account already existed. Re-inviting the same Organization's owner now issues a fresh temporary password.
  • Your invited role is applied even when your Organization does not require email verification. In that setup the role was never applied at all, and opening the invitation afterwards reported that you were already a member.
  • A password reset reaches every account on your address. If the same email is registered with more than one company on the platform, each account now gets its own reset message; previously only the most recently created one did.
  • Email always sends through your own Organization's provider account. When two Organizations sent at the same moment, one could go out through the other's provider — so a message could arrive from the wrong sending domain and be counted against the wrong account. Each Organization's provider settings are now used strictly for its own messages.
  • Repository sync from the MCP works for GitHub, not only Azure DevOps. The tool rejected GitHub's owner/repo coordinates before the request ever left, despite documenting support for them.

Changed

  • An invitation now confirms you are the person it was sent to. An invitation is tied to the email address it was issued for, so it is accepted from an account with that address — a forwarded link no longer joins someone else to your Organization.
  • The pre-registration invitation check returns just what it needs to show who invited you and to which Organization, so someone can see they have an invitation waiting before they have an account.

Fixed

  • Invitation links use your Organization's own frontend URL. Invitations pointed at the default Genlobe address even when the Organization had its own configured — verify-email and reset-password links already honored it, and now invitations do too, so you can own your whole onboarding.
  • Password reset and change-password emails go out again. Requesting a reset returned a success response while the message itself did not send, which made it look like the mail had simply not arrived.
  • The MCP hands you the right dashboard link. Tools that give you a URL to paste a credential — Stripe, Azure DevOps, GitHub — now derive the dashboard address from your API host correctly instead of guessing an app. prefix.

2026-08-06Answers that stream, and a Knowledge Bases module you can work in

Added

  • Agent answers now stream as they are written. The dashboard chat fills in word by word instead of showing a spinner until the whole reply is ready, and it tells you which files the agent is reading while it works. Long answers used to sit silently for half a minute and, past a point, never arrive at all — they now come through.
  • Try a Knowledge Base before you wire an agent to it. A query box on each Knowledge Base shows exactly which passages it returns for a question, with their similarity scores. When an agent answers badly, this is how you tell whether the retrieval brought the wrong material or the model misused the right material.
  • Indexed documents have their own page. Open a document from its Knowledge Base and read it at its own address — linkable, shareable, and navigable with the browser's back button.
  • A truncated answer says so. If a reply is cut short by its length limit, it is now labelled instead of being presented as complete.

Changed

  • Knowledge Bases is now a list with a detail panel. Pick a Knowledge Base on the left and work on it on the right, with a filter box for finding one by name. The previous grid of cards stopped being usable once an Organization had more than a handful.
  • Saving a repository connection now takes you to the sync workspace instead of dropping you back on the integrations grid with nothing to act on.
  • Chat citations say what they actually are. An answer now shows the files the agent genuinely read, separately from the passages retrieval merely surfaced — the two used to be presented together as "sources". Commit hashes stay out of the way unless you ask about a specific version.

Fixed

  • A repository connection is verified before it is saved. Pasting a token that the provider rejects used to be stored anyway and reported as connected; the failure only appeared later, when a sync refused to run. It is now checked against the provider on save and refused with an explanation, while a genuine provider outage still lets you save.
  • Long lists no longer end silently. A Knowledge Base, document or passage list that had more entries than fit in one page simply stopped, with nothing to say more existed. Lists now load more on request and tell you when there is more to load.
  • An answer in progress survives leaving the tab. Switching away from the agent's Test tab mid-question used to discard the reply when you came back — after it had already been generated and billed.
  • Enter submits again when naming a new Knowledge Base or running a query.

2026-08-05Repo-query agents: connect a repository and ask about your code

Added

  • Connect a code repository and ask an agent about it. Point Genlobe at an Azure DevOps or GitHub repository, sync it into a Knowledge Base, and your agent can answer questions about the codebase — citing the file it drew the answer from. You paste the credential in the dashboard; it never travels through an agent.
  • Agents can read the live repository, not just the index. Grant an agent repository access and it gains read-only tools to list the tree, read a file and search the code as it is right now — useful when the indexed snapshot has drifted, or for files the index skips: binaries, lockfiles, anything over 1 MB. Off by default, per agent and per Organization.
  • A "Repository agent" starter preset. One click scaffolds the whole use case — the Knowledge Base binding, a prompt tuned for answering about code, and the repository access grant — instead of wiring three things by hand.
  • Cancel a repository sync in progress, instead of waiting out a long one.
  • Schedule automatic re-syncs, so a connected repository's Knowledge Base does not silently go stale.
  • Multi-turn chat in the agent Test tab. Hold a real conversation with an agent from the dashboard and see which files each answer used.
  • One agent can now use several Knowledge Bases. Bind an agent to multiple KBs by role tag; results are merged by relevance.
  • Agent replies render as formatted text. Code blocks, lists, tables and headings now display properly instead of showing raw Markdown.

Changed

  • Integrations is now a searchable directory. Every integration is a card with its connection status at a glance, filterable by category, and opens in a side panel instead of a stack of long forms.
  • Repository sync has its own page. Picking a repository, watching a sync run and reviewing past attempts live at their own URL — so a sync in progress can be linked and returned to — reached from the Repo Source panel.
  • The agent Access tab explains what it is granting. Repository access shows the indexed snapshot the agent already reads — which Knowledge Base, when it was last synced — next to the live-access switch, and states what the switch adds on top.
  • A Knowledge Base in use by an agent is protected from deletion.

Fixed

  • Knowledge Base search is dramatically faster. Retrieval was scanning every stored chunk instead of using its index, so search time grew with the size of the Knowledge Base — on a large one, a single question spent seconds just searching. It is now in the low hundreds of milliseconds.
  • Long dropdowns are fully usable again. A picker with many options — an Organization with a lot of Knowledge Bases, for example — could grow past the bottom of the screen, leaving its last options impossible to click.

2026-07-23Organizations: create/edit pages + per-Org branding

Added

  • Organizations get dedicated create and edit pages. Creating or editing an Organization now has its own page instead of an inline form — upload a logo file, and set the website, brand color, and per-Organization Frontend URL right there.
  • Trash & restore for custom entities. Recover a deleted record — or an entire schema — from a trash view that shows when each was deleted.
  • Filter your usage by period. The dashboard overview now has a period/month filter, so you can review past periods instead of only the current one.

Changed

  • Set your app's Frontend URL per Organization. The base URL where your end-users land for verify-email and password-reset links now lives on each Organization (set it on the org form) instead of a single workspace-wide setting.
  • Simpler Knowledge Base creation. The role tag is generated automatically from the name — one less thing to invent.
  • Safer schema deletion. Deleting a custom-entity schema now asks you to confirm by typing its slug and shows how many records it holds.

Fixed

  • The dashboard reliably loads the latest version after an update — a caching fix so you no longer see a stale page until a hard refresh.
  • Deleting a Knowledge Base document frees up your document quota again — soft-deleted documents no longer count against your plan.
  • Knowledge Base creation no longer silently does nothing when no Organization is selected.
  • Drive uploads can't be misrouted if you switch Organizations mid-upload.
  • Cross-schema search filters now interpret filter values using the target schema's field types.
  • The password-requirements checklist on signup and reset now reflects the real rules.
  • The sidebar collapse button no longer shifts when you hover it.

2026-07-16

Added

  • Delete an agent from the dashboard. You can now remove an agent you no longer need, with a confirmation step so you don't delete one by accident.

Changed

  • Clearer sidebar. The workspace switcher and your user menu are now easy to tell apart — the user menu shows your avatar with a brand ring — and you can collapse the sidebar from an edge toggle to get more room.
  • Better agent creation. When you create an agent, you can now choose which Organization it belongs to and attach a Knowledge Base directly from the form, so a new agent lands in the right place with the right knowledge.
  • Landing page adapts to your session. The landing page's call-to-action buttons now reflect whether you're already signed in.

Fixed

  • Accurate usage on the dashboard. The dashboard now shows your real usage and per-Organization AI cost — including amounts below one cent — instead of appearing empty when usage was small.
  • Clickable Genlobe logo. The logo in the sidebar and on the login screen now takes you back home.

2026-07-15

Added

  • Knowledge Bases — ground your agents on your own documents. Create a Knowledge Base, upload documents, and your agents answer from them using Genlobe's built-in vector search — no third-party search service. Manage it all from the dashboard: create and edit Knowledge Bases, upload and sync documents, and expand a document to see exactly how it was indexed.
  • Drive — per-Organization file storage with real access controls. Each Organization gets its own file space. Choose who can read each file or folder (private, everyone in the Organization, or public), and grant your agents explicit, opt-in access to Drive files — they get none by default.
  • Export your data & delete your account. Download a full copy of your data and request account deletion, with a 30-day cancellable grace period (GDPR Art.15 / Art.17).
  • 18+ confirmation at signup. Creating an account now asks you to confirm you are 18 years of age or older.
  • Account & agent suspension. Platform admins can suspend a tenant, organization, or agent that breaches the Acceptable Use Policy, with a clear reason surfaced to the affected account.
  • AI transparency notice. A disclaimer appears before your first interaction with an AI agent, so it's always clear you're talking to AI.
  • Public changelog. This page — see what shipped, release by release.
  • Build a whole app through the MCP. A builder agent can now stand up an app end-to-end via the MCP: publish an agent so it can serve traffic, manage Knowledge Bases, and set file access — without leaving the tooling.

Changed

  • Refreshed dashboard & landing. A cleaner look across the dashboard and landing pages, with improved light-mode contrast.

Fixed

  • Your light/dark choice is respected. Light mode no longer flips back to dark after you log in, and the homepage hero follows the theme.
  • Organization Stripe setup. Fixed an error that could block configuring an Organization's own Stripe.
  • Logout. Signing out no longer pops duplicate "session expired" messages.
  • Billing visible to admins. Admin team members can now open the Billing page in read-only mode; changing the plan, payment method, or usage settings stays limited to owners and billing members.
  • Reliability fixes across agents, Knowledge Bases, and Drive.

Removed

  • Google File Search is no longer used for retrieval — replaced by Genlobe's own vector search. Your documents are re-indexed automatically.
← Back to Home