Molecule.dev Changelog

Changes on 2026-09-04

Fri, 04 Sep 2026 00:00:00 GMT

minor: Add gemini-3.8-flash and deprecate gemini-3.7-flash; record the DeepInfra US region for glm-5.3. (@molecule/api-resource-ai-models@1.5.0)
patch: The command menu now dedupes by id, so a host-provided command with the same id as a shared one replaces it instead of listing twice. (@molecule/app-ide-react@1.10.1)
patch: The default model is now gemini-3.8-flash. (@molecule/api-ai-google@1.2.1)

Changes on 2026-09-02

Wed, 02 Sep 2026 00:00:00 GMT

minor: Adds `claude-fable-5-1` (Anthropic's current latest; same $10/$50 per MTok as `claude-fable-5`, with $0.25/MTok cache reads) and marks `claude-fable-5` as legacy. `claude-sonnet-5` is now listed at its standard $2/$10 rate. Model ids with a dash-separated minor version (e.g. `claude-fable-5-1`) now parse as a newer generation of their family instead of a sibling. (@molecule/api-resource-ai-models@1.4.0)
minor: Adds a side-channel send for human-to-human chat messages (e.g. team notes): `ChatProvider.sendSideMessage` (optional, implemented by the HTTP bond on an independent request lifecycle) and a `sideChannel` option on `useChat`'s `sendMessage`. A side-channel message goes out immediately even while a turn is streaming — it never queues behind the active turn, never aborts the live stream, and never disrupts remote-turn tracking. Callers fall back to the normal send path on providers without side-channel support. (3 packages)
minor: Adds an optional `onRestartBackend` escalation hook to the preview panel: when the backing server answers probes but the app has not confirmed a render for minutes and an automatic reload was already tried, the panel asks the host to restart the backing dev server — at most once per broken episode, with a long cooldown, never during a build. This recovers failure classes a document reload cannot (e.g. module failures cached against the dev server's immutable versioned URLs). Hosts that omit the prop are unaffected. (@molecule/app-ide-react@1.10.0)
minor: Peak-hour pricing windows can be restricted to certain UTC weekdays (`peakPricing.windows[].daysOfWeekUtc`), and the DeepSeek entries now carry the Monday-through-Friday qualifier their rate card publishes, so weekend hours inside those windows no longer meter at the peak multiplier. The `/models` picker labels a weekday-only window with the days it applies on. (2 packages)
patch: Peak-hour pricing windows can be restricted to certain UTC weekdays (`peakPricing.windows[].daysOfWeekUtc`), and the DeepSeek entries now carry the Monday-through-Friday qualifier their rate card publishes, so weekend hours inside those windows no longer meter at the peak multiplier. The `/models` picker labels a weekday-only window with the days it applies on. (@molecule/app-ide-react@1.10.0)
patch: Read-only viewers no longer auto-send the initial prompt on mount (a stale project-keyed prompt could start a turn the server rejects) and the auto-fix countdown can never dispatch a fix turn from a viewer's client. (@molecule/app-ide-react@1.10.0)
patch: Team notes (/teamsay) now send immediately even while a response is streaming, instead of silently queuing until the turn ends; and read-only viewers no longer arm the auto-commit countdown, which fired /commit on their behalf and surfaced a spurious "view-only access, so this command is unavailable" notice. (@molecule/app-ide-react@1.10.0)
patch: The preview panel now recovers on its own after its server comes back: while the "can't load here" or "preview is blank" notice is showing, it keeps probing the preview URL and reloads automatically once the app is serving again (for example after a slow sandbox wake), instead of waiting for a manual reload. (@molecule/app-ide-react@1.10.0)
patch: The preview's first-load spinner can no longer sit forever without a way out: if the preview server hasn't answered after 45 seconds, the panel shows the reload / open-in-new-tab notice while it keeps polling (mounting and clearing the notice by itself when the server appears), and the 30-second stuck backstop now re-checks after wake/build holds instead of disarming permanently. (@molecule/app-ide-react@1.10.0)
patch: The preview's stuck-load recovery no longer reloads a heartbeating document: the inline bridge heartbeats from HTML-parse time, so liveness means the module graph is still loading — reloading it aborted every in-flight module fetch and could trap large apps (slow module graphs behind a proxy) in a permanent reload-and-blank loop. Recovery still fires for a genuinely dead document. (@molecule/app-ide-react@1.10.0)
patch: Viewers watching a teammate's turn now see the normal streaming activity indicator; previously the chat activity slot showed "Waiting for the development environment to finish starting…" for the whole remote turn even when the environment was already running. (@molecule/app-ide-react@1.10.0)

Changes on 2026-08-29

Sat, 29 Aug 2026 00:00:00 GMT

minor: `ShareLinkManager` accepts a `refreshSignal` prop so a host's live-update channel can reload the link list in place, and the ChatPanel's settings re-read signal now refreshes the full agent-behavior bag (per-mode models, effort, regions, max tool loops, auto-fix, auto-approve) — so pickers and toggles reflect changes another collaborator just made instead of holding stale values. (@molecule/app-ide-react@1.9.0)
minor: Add qwen3.8-flash (Alibaba's low-cost tier: 1M context, 131K output, multimodal input, hybrid thinking; native host); correct qwen3.8-max's implicit cache-read price. (@molecule/api-resource-ai-models@1.3.0)
patch: `/effort` now opens a selectable level picker (like `/model`): bare `/effort` lists the target mode's model-native levels with current/default indicators, live typing filter, a mode selector, and keyboard navigation. `/effort ?` keeps the textual status view; `/effort ` still sets directly. (@molecule/app-ide-react@1.9.1)
patch: Add the `ide.chat.settings.effort.label` ("Reasoning effort") translation in all 79 languages. (@molecule/app-locales-ide@1.3.1)
patch: Chat broadcasts missed while the push channel was down (e.g. a teammate's note against a backgrounded tab) are reconciled from the persisted transcript when the channel reconnects. (@molecule/app-react@1.3.1)
patch: The context-usage ring's mount-time restore retries transient failures instead of silently losing the ring for the whole session. (@molecule/app-ide-react@1.9.1)
patch: The preview freeze watchdog is visibility-aware: a hidden tab's throttled timers no longer read as an 18–58s "app stopped responding" freeze (banner + alert once per throttle wake, ~every minute, for as long as the tab stayed backgrounded). Checks pause while hidden and re-baseline on return to the foreground. (@molecule/app-ide-react@1.9.1)

Changes on 2026-08-28

Fri, 28 Aug 2026 00:00:00 GMT

minor: Add `canShare` to ChatPanel and `canManage`/`canCreate`/`canRevoke` to ShareModal so hosts that gate share-link management above the edit role can hide the /share command, header share button, and modal controls instead of surfacing requests the backend rejects; read-only viewers no longer trigger a settings write when their selected model is delisted. The locale bond adds the matching `ide.chat.share.notAllowed` message in all languages. (2 packages)
minor: Honor `toolChoice` ('required' and named-tool forms) as OpenAI-compatible `tool_choice`. MiniMax and Moonshot family gates now key on the canonical model id (a `modelMap`-translated upstream id never matched, so re-hosted requests lost their thinking rules); MiniMax forwards image input for the natively-multimodal M3 and disables its thinking via `chat_template_kwargs` on hosts that ignore the `thinking` param; Alibaba pairs a forced tool choice with an explicit thinking-off (DashScope rejects forced `tool_choice` in thinking mode). (4 packages)
minor: Live collaborative chat streaming: pushed broadcast frames from a turn running elsewhere (a teammate's send, another tab) render in real time — text and thinking deltas, tool activity, verification, completion — via the new `useChat.applyRemoteEvent` ingestion path, with a `readOnly` watcher mode for viewers and a progress-preserving history reconcile. Agent-setting changes (model, effort, fast mode, max tool loops, processing region, auto-fix, auto-approve) surface as shared, attributed transcript cards through the new `setting` card kind. (4 packages)
minor: Send server tools in Zhipu's native nested schema (`{ type: 'web_search', web_search: {} }`) instead of the abstract `{ type, name }` marker, which the API rejects. New `supportsServerTools: false` config drops server tools for OpenAI-compatible hosts that don't serve them, so tool-carrying requests succeed there. (@molecule/api-ai-zhipu@1.1.0)
minor: Tool-use blocks and events carry an optional provider-opaque `signature` replay token. The Google bond captures Gemini 3.x's part-level `thoughtSignature` on function calls and echoes it on replayed calls — without it, Gemini rejects the second request of any tool round-trip (400 "Function call is missing a thought_signature"). The Google bond also sends `thinking.effort` as `thinkingLevel` (previously the effort value was silently ignored and a fixed token budget was sent), and forwards the `google_search` server tool with `includeServerSideToolInvocations` when function tools ride along. (2 packages)
patch: Correct the Anthropic `codeExecutionToolType` to the current `code_execution_20260521` (the previous value was a beta-header date, not a tool type) and remove `webSearchToolType` from OpenAI entries — the chat-completions endpoint the OpenAI provider uses has no such tool type, so advertising it surfaced a capability that could never work. (@molecule/api-resource-ai-models@1.2.7)
patch: Parse xAI's string-form error bodies (`{ code, error }`) so upstream 400 details are logged instead of a bare "HTTP 400", and surface an attachment-specific message when an image is rejected for size instead of the generic invalid-request text. (@molecule/api-ai-xai@1.0.2)

Changes on 2026-08-27

Thu, 27 Aug 2026 00:00:00 GMT

minor: Add `ChatParams.extraBody` — extra provider-native request-body params (e.g. `reasoning_effort`, `enable_thinking`, `top_k`) shallow-merged into the outgoing request as a base, with the bond's structural fields (model, messages, tools, stream, token limit) always winning. The Gemini bond merges a nested `generationConfig` into its own rather than replacing it. (4 packages)
minor: Add team-only chat messages: `ChatMessage` gains a `teamOnly` flag (a human-only note the model never sees, rendered with author attribution) and the chat stream gains a `{ type: 'message'; message: ChatMessage }` event that appends a complete, non-streaming message to the transcript. The React `useChat` binding handles the new event via `appendCompleteMessage`, with the same id-based dedupe as card messages so a live team note is byte-identical to what history reloads. (2 packages)
minor: ChatPanel gains a `canEdit` prop (default `true`): when `false` — a read-only project viewer — the composer blocks a plain message or write-command with a read-only note (team `/teamsay` and viewer-safe commands still pass), slash commands default-deny unless the command registry flags them `viewerSafe`, the plan/fast mode toggles disable, and a view-only note shows above the composer. `CommandDef` gains a `viewerSafe` flag. The `/model` picker now refreshes when the custom-model catalog changes (editing a BYO provider no longer leaves the old model shown), and a removed custom model re-points to the same provider before a platform fallback. Also renders teammates' human-only team notes (the `message` stream event) and matches side-channel command aliases. app-locales-ide adds the read-only-viewer strings. (@molecule/app-ide-react@1.6.0)
minor: Share modal now reflects a project's current public link: when one exists it shows the full, absolute URL with click-to-copy and a Revoke control and no longer offers to create another; when none exists it offers create. Adds a reusable `ShareLinkManager` component (export) so a host can render the same UI in its own team/access panel. (@molecule/app-ide-react@1.5.0)
patch: Add GLM-5.3 Flash (zhipu): native multimodal, 1M context, 128K output, low/high/max reasoning, served in us + cn regions. (@molecule/api-resource-ai-models@1.2.6)
patch: ChatPanel gains a `canEdit` prop (default `true`): when `false` — a read-only project viewer — the composer blocks a plain message or write-command with a read-only note (team `/teamsay` and viewer-safe commands still pass), slash commands default-deny unless the command registry flags them `viewerSafe`, the plan/fast mode toggles disable, and a view-only note shows above the composer. `CommandDef` gains a `viewerSafe` flag. The `/model` picker now refreshes when the custom-model catalog changes (editing a BYO provider no longer leaves the old model shown), and a removed custom model re-points to the same provider before a platform fallback. Also renders teammates' human-only team notes (the `message` stream event) and matches side-channel command aliases. app-locales-ide adds the read-only-viewer strings. (@molecule/app-locales-ide@1.1.6)
patch: Default model is now `glm-5.3` (was `glm-5.2`). Documents that glm-5.3 narrows `reasoning_effort` to low | high | max and can no longer disable reasoning; the budget-tokens fallback keeps returning the `'high'`/`'low'` both generations accept. (@molecule/api-ai-zhipu@1.0.2)
patch: Share modal now reflects a project's current public link: when one exists it shows the full, absolute URL with click-to-copy and a Revoke control and no longer offers to create another; when none exists it offers create. Adds a reusable `ShareLinkManager` component (export) so a host can render the same UI in its own team/access panel. (@molecule/app-locales-ide@1.1.5)

Changes on 2026-08-20

Thu, 20 Aug 2026 00:00:00 GMT

minor: Add an `extraCommands` prop to `ChatPanel` so a host can merge its own slash commands into the command menu, `/help`, and the keyboard dispatcher alongside the shared registry. Selecting one fills the input with `/ ` for the host's own handler to run; ids must not collide with a built-in command. (@molecule/app-ide-react@1.4.0)
patch: Add translations for the parameterized `/scripts` panel keys, the chat queued-count label, item render errors, and the peak-hour keys across all supported languages. (@molecule/app-locales-ide@1.1.4)
patch: Apply a pending update by reloading only once the new service worker actually controls the page, instead of on a fixed 100ms timer that could reload onto the old cached build. (@molecule/app-version@1.0.2)
patch: Claim clients when the new service worker activates, so the "Update" prompt reliably reloads onto the new build once the worker takes control. Also remove the `/api/` runtime-caching rule, which broke on streaming (SSE) responses and cached authenticated API data. (@molecule/app-vite-config-default@1.0.2)
patch: Reload only after the new service worker takes control. Clicking "Update" could previously reload before the waiting worker activated, leaving the old cached bundle in place until another refresh. (@molecule/app-pwa-default@1.0.2)

Changes on 2026-08-19

Wed, 19 Aug 2026 00:00:00 GMT

patch: Add the `ide.chat.queuedCount` translation key. (@molecule/app-locales-ide@1.1.2)
patch: Add translation keys for the parameterized /scripts panel. (@molecule/app-locales-ide@1.1.3)
patch: Anchor queued chat messages above the composer with compact rows. (@molecule/app-ide-react@1.3.3)
patch: Make gpt-5.6-luna the free-tier planner and drop minimax-m3's stale free-tier region carve-out. (@molecule/api-resource-ai-models@1.2.5)
patch: Parameterized scripts and built-in commands in the /scripts panel, plus ShareModal copy-button alignment. (@molecule/app-ide-react@1.3.4)
patch: Transparent OAuth divider label — flanking hairlines instead of a background-color mask. (@molecule/app-oauth-buttons-react@1.0.2)

Changes on 2026-08-18

Tue, 18 Aug 2026 00:00:00 GMT

patch: `SubscriptionUpdateParams.items[]` now types the optional `quantity` a subscription update may set. (@molecule/api-payments-stripe@1.2.2)
patch: ChatPanel: drop a `requiresSignup` limit banner once `isAnonymous` is `false`, so a viewer who signs in mid-session no longer sees the guest-tier limit and its dead-end sign-up buttons. (@molecule/app-ide-react@1.3.2)
patch: Checkout sessions now attach their metadata to the subscription they create, so subscription webhooks can be matched to the buying account on a first purchase. (@molecule/api-payments-stripe@1.2.1)
patch: DeepSeek pro and flash now carry their August 2026 rates, with peak pricing live in place of the staged schedule. (@molecule/api-resource-ai-models@1.2.3)
patch: Mark `gpt-5.6-luna` free-tier plan-eligible in the `us` region (`freeTierRegions: ['us']`), so it can serve as a free-tier plan-mode default and free users may select it in plan mode. (@molecule/api-resource-ai-models@1.2.4)
patch: PreviewPanel: the steady-state health probe now allows 5s and requires two consecutive misses before treating the app as down, so a preview behind a remote edge is no longer reloaded on a single slow probe. (@molecule/app-ide-react@1.3.1)
patch: Serialize `tool_use` and `tool_result` message blocks as native `tool_calls` and `role:"tool"` messages instead of flattening them to placeholder text. Multi-turn agentic tool loops now receive real tool results, so models that previously looped on their first tool call and never finished can complete a tool-driven conversation. (2 packages)
patch: Subscription updates now set the line item quantity explicitly, so a seat-count change applies and a switch to a flat-priced plan no longer inherits the old quantity. (@molecule/api-payments-stripe@1.2.1)
patch: useChat: the auto-retry after a 5XX / transport drop now runs up to 8 attempts (5s, 10s, 20s, then 30s holds) so an interrupted turn resumes across a server restart. (@molecule/app-react@1.1.1)

Changes on 2026-08-17

Mon, 17 Aug 2026 00:00:00 GMT

minor: `createCheckoutSession` accepts a `quantity` for per-seat plans, and the idempotency key now includes it so changing the seat count starts a new session instead of replaying the previous one. (@molecule/api-payments-stripe@1.2.0)
minor: `PATCH /users/:id/plan` accepts an optional `quantity`, passed to the payment provider for per-seat plans and clamped to a whole number of at least one. (@molecule/api-resource-user@1.4.0)
minor: Add `chargeOffSession` for capturing a payment from a saved card without the customer present. Resolves the customer's default card (falling back to their most recently attached one), confirms off-session, and returns a normalized outcome with the decline code when it fails. Requires a stable `idempotencyKey` so a retry inside Stripe's 24h window returns the original PaymentIntent instead of charging again. (@molecule/api-payments-stripe@1.1.0)
minor: Add an optional `quantity` to `updateSubscription` so per-seat plans can bill more than one unit. (@molecule/api-payments@1.2.0)
minor: Custom chat cards can declare `coversLimitType`, and ChatPanel then hides such a card while its limit banner is stating the same limit, so one limit is never shown twice. (@molecule/app-ide-react@1.3.0)
minor: New `captchaSlot` / `captchaSolved` props render a human-verification challenge in the signup form and gate its submit, so an API that requires a verification token can be used from the in-app modal. (@molecule/app-auth-modal-react@1.1.0)

Changes on 2026-08-16

Sun, 16 Aug 2026 00:00:00 GMT

minor: `PlanUpdated` now confirms the purchase a checkout redirect returns with, showing a spinner while it is in flight and a retry if it fails. New `provider` and `verify` props. Requires `@molecule/app-react` ^1.1.0. (@molecule/app-plan-updated-page-react@1.1.0)
minor: `PlanUpdatedPage` now confirms the purchase a checkout redirect returns with, showing a spinner while it is in flight and a retry if it fails. New `provider` and `verify` props. Requires `@molecule/app-react` ^1.1.0. (@molecule/app-legal-pages-react@1.1.0)
minor: `POST /portal` no longer passes a caller-supplied `returnUrl` straight to the payment provider — the provider renders it as a link on its own domain, so an arbitrary one was an open redirect. Send an app-relative `returnPath` instead; a `returnUrl` is honored only when it is already on the app origin. (@molecule/api-billing-routes@1.1.0)
minor: `SandboxConfig` gains `command` (the sandbox's main process, instead of the image's), `restartPolicy`, and `selfDeliveredEnv` (env the caller delivers itself, which a provider validates but must never persist in its own configuration). (@molecule/api-code-sandbox@1.2.0)
minor: `spawn()` accepts `pty: { cols, rows }`, creating the exec with a TTY so Ctrl-C interrupts the foreground job, streaming the raw (unmultiplexed) terminal bytes, and exposing `handle.resize({ cols, rows })`. (@molecule/api-code-sandbox-docker@1.1.0)
minor: `spawn()` now takes `SpawnOptions`, which adds `pty: { cols, rows }` for a process with a real controlling terminal, and `SpawnHandle` gains an optional `resize({ cols, rows })` for it. Providers that cannot allocate a PTY must reject the spawn rather than return pipes, so a caller can feature-detect a terminal. (@molecule/api-code-sandbox@1.2.0)
minor: `verifyEgress()` now reads the app's network policy back from Fly, so the verdict names every allowed port as reachable to any host — a Fly policy matches protocol and port with no destination — and reports `open` when the policy in force allows a port this provider never configured. Adds `reconcileEgressPolicy(app)`, which re-applies the current policy to an app that already exists. (@molecule/api-code-sandbox-flyio@1.2.0)
minor: Adds `POST /users/:id/billing-portal/:provider`, which opens the bonded provider's hosted billing portal so a subscriber can update their card, read invoices, and cancel. Returns `{ url }`; an optional `returnPath` sends them back to a specific app page. Requires `@molecule/api-payments` ^1.1.0. (@molecule/api-resource-user@1.3.0)
minor: Adds `resolveCheckoutRedirectUrls` and `resolveBillingPortalReturnUrl`, which build the URLs a hosted checkout or billing portal returns the buyer to from the APP origin (`APP_ORIGIN`/`ORIGIN`) — configurable with `PAYMENTS_PLAN_UPDATED_PATH`, `PAYMENTS_CHECKOUT_CANCEL_PATH` and `PAYMENTS_BILLING_RETURN_PATH`. (@molecule/api-payments@1.1.0)
minor: Adds `spawn()` — a long-running process with streaming stdout/stderr, writable stdin and `kill()`, plus `pty: { cols, rows }` for a real terminal where Ctrl-C interrupts the foreground job and `resize()` renegotiates the width. `exec()` now starts every command in the background and waits on its handle, so a launch that leaves a detached child behind returns its real exit code immediately instead of blocking until the deadline, and a command ending in `&` reports its actual output and exit code instead of a fabricated success. (@molecule/api-code-sandbox-e2b@1.2.0)
minor: Adds `useVerifyPaymentReturn`, which confirms a purchase with `POST /users/:id/verify-payment/:provider` after a payment provider redirects back to the app, reading the transaction id a provider left in the query. (@molecule/app-react@1.1.0)
minor: Map `SandboxConfig.command` onto the container's `Cmd` and `restartPolicy` onto its Docker restart policy, so a container the daemon restarts comes back running the caller's own process. (@molecule/api-code-sandbox-docker@1.1.0)
minor: Map `SandboxConfig.command` onto the Machine's `init.exec` and `restartPolicy` onto its restart policy, so a Machine Fly restarts comes back running the caller's own process. Adds `find()`, which enumerates managed Machines app-by-app and throws rather than returning a partial result. `selfDeliveredEnv` is validated for private routes and never written into the Machine config. (@molecule/api-code-sandbox-flyio@1.1.0)
minor: New package: builds a CONNECT-capable HTTP(S) agent from the standard proxy environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY`, honouring `NO_PROXY`) for vendor SDKs that create their own HTTP agent and read no proxy variable. `getProxyAgent(url)` returns the agent, `getProxyAgents(url)` the `{ httpAgent } | { httpsAgent }` shape AWS SDK v3's `requestHandler` accepts, and `getProxyUrl(url)` the URL for clients that want it directly. All return `undefined` when the target is not proxied, so passing the result through is a no-op outside a proxied environment. (@molecule/api-proxy-agent@1.1.0)
minor: Persist a project's files beyond its sandbox: `create()` mounts a named volume at a caller-chosen path, `createVolume`/`removeVolume`/`volumeExists`/`listVolumes` manage volumes, and `commitTemplate`/`getTemplate`/`listTemplates`/`removeTemplate` capture and restore sandboxes as E2B snapshots. (@molecule/api-code-sandbox-e2b@1.2.0)
patch: `exec()` no longer blocks for its whole timeout when a command leaves something behind holding its output stream — a detached supervisor, a daemon that keeps its descriptors. It now checks whether the started process is still running and returns as soon as the command itself is over. (@molecule/api-code-sandbox-e2b@1.2.0)
patch: `hibernate()`, `stop()` and `sleep()` now pause the sandbox or throw — an SDK build with no pause method used to resolve a success-shaped `noop` outcome while the sandbox kept running. They prefer the supported `pause()` over the deprecated `betaPause()`, and treat an already-paused sandbox as success. (@molecule/api-code-sandbox-e2b@1.2.0)
patch: `PreviewPanel` now asks the preview host for a CORS-readable status before mounting the app, so an edge's "unavailable" error page is no longer mistaken for a working preview; hosts that do not serve `/__mol/preview-status` keep the previous behaviour. (@molecule/app-ide-react@1.2.6)
patch: `ShareModal` offers only the roles the host actually grants, via a new `roles` prop that defaults to `['viewer']` — a public link is an unauthenticated credential, so write access through one is opt-in. The role `