Added

• membrane workspace prefix for all workspace management commands. This clearly separates workspace tenant vs workspace manager scopes in CLI. All workspace management commands are now prefixed with membrane workspace. Old commands (like membrane pull) keep working as before but are marked as deprecated.

• Organized auth: the membrane login command is now the default authentication method for push, pull, and sync operations, providing unified workspace authentication.

Fixed

• The membrane open command now uses platform-user sessions and no longer requires workspace credentials to function.

Added

• membrane push --debug writes a debug.zip to the current directory on failure, containing metadata, the serialized error, and the source/target workspace zips — a single artifact you can attach to a support ticket.

• connection patch command for writing connectorParameters, input, or credentials to an existing connection.

Added

• New endpoint POST /act for executing reusable actions, inline API requests, or custom code.

• New endpoint POST /connections/{elementSelector}/refresh for triggering backend connection refreshes

• Parameter connectionKey added to all connection-related endpoints for stable connection identification

• Parameter status added to GET /external-event-subscriptions

• GET /integrations endpoint now supports dynamic generation of integrations based on connectors, external apps, and web search (experimental).

• connectorParameters and input are now retrievable for connections by tenant.

Changed

• POST /import schema has been modified

• Added DISCONNECTING state to connections to make disconnection process more robust and predictable.

Added

• Modified ConnectionApiResponse to expose new fields related to connection patching

Added

• credentials command for simple management of workspace credentials

• token command for minting Membrane Tokens

• Actions CRUD now automatically selects token scope (tenant or workspace manager) based on whether action has connection.

• ... more changes to support the integration-development skill.

Fixed

• Action listing by intent now properly requires either connectionId or connectionKey parameter.

• MCP server no longer exits immediately after startup, ensuring stable operation.

Added

• New types to support the new CLI release.

Major Updates

• Membrane dashboard was fully re-designed to simplify understanding of your workspace.

  • It is now possible to connect any app (including ones found in the web or just typed-in by you) right from the dashboard.

  • Management of your connected software was refactored and simplified.

  • Added agent onboarding guides for Claude Code, Codex, Cursor, Copilot, and Windsurf

• Agentic Connection UI underwent many improvement based on usage feedback.

• Self-hosted auth no longer depends on Auth0 or any other external services.

Added

• Connections now have key and can be identified in code-friendly way.

• Added workspace instance name display in workspace general setting.

• Added support for tenantKey in client JWT tokens (to replace deprecated id)

• Added flowRunsQueueSizePerConnection to workspace limits configuration

• Code sandbox jobs are now automatically re-routed when runners are over capacity - it will improve latency in some cases.

Changed

• External apps are now sorted by popularity in the interface

• Connections now start in a disconnected state until successfully authenticated. This only affects behavior of the new connected field and doesn't affect the old/deprecated disconnected field.

• Connector versioning now auto-determines latest version by semantic versioning on publish.

• Custom code now handles large inputs in batches with out-of-memory protection.

• Base64 encoding is now applied to Buffers in custom code JSON output - it should speed up data transfer for large custom code jobs.

Fixed

• OAuth loopback redirect URIs now support any port number per RFC 8252 standards

• Connection refresh button in the console now triggers a backend refresh of the connection

• Auth Proxies admin link now appears correctly on self-hosted installations

• Unsupported event types now show proper error messages instead of crashing

• Flow run errors from individual nodes now properly propagate to the overall flow run

• OAuth consent page now properly displays tenant dropdown options

• Workspace logo and app icon components now include fallback image handling

• Connection refresh attempts no longer cause authentication errors when retrying disconnected connections

• Schedule triggers no longer fire multiple times due to duplicate node schedules

• Organization invitation acceptance is now idempotent instead of failing silently

• Expert tasks route now displays properly under the activity section

• External app are now marked as connected immediately after connection creation.

• Connection building agent sessions now receive complete context information

• Archived connectors are now properly excluded from workspace exports

• Rate-limited event pulls are now handled proactively with proper backoff strategies

• Queued runs are now properly stopped for misconfigured and disconnected connections

Fixed

• Fixed a crash caused by missing exports in the CLI package.

• Fixed login flow to use the correct API URI when authenticating.

• Fixed internal dependency version pinning to ensure stable package installations.

Added

• CLI telemetry events now include organization group information to provide better usage analytics.

• Connector token types are now differentiated per MCP type with JWT claims containing settings information.

Fixed

• Workspace imports now use UUID-only matching to prevent import conflicts and improve reliability.

  Note: This change may affect workspaces where elements have different UUIDs across environments. Before pushing, pull from the target workspace first so you can revert if elements don't match as expected.

• Archive file paths now use connector UUIDs instead of names to prevent key collisions when multiple connectors have the same name.

Added

• Field usage (number) added to AgentSessionDto to track session usage metrics

• Field archivedAt (string) added to ConnectorDto to indicate when a connector was archived

• Is is not possible to edit isReadOnly field when updating org-workspaces.

Changed

• feat(cli): add --clientName flag to login for signup source tracking

Changed

• Login flow now uses a simplified single-mode authentication architecture for improved reliability - no more --tenant parameter (it's silently ignored).

• Improved membrane status output.

Major Changes

• Custom code execution engine was refactored to V8 isolates. It makes it much faster and less resource-consuming.

  • About 5% of custom code requests use functionality not supported by isolates. They fall back to the previous implementation (sandboxed node.js processes).

  • If you self-hoste, you can disable the new custom code engine by adding CUSTOM_CODE_RUNNER_DISABLE_IVM env variable. This can act as workaround if you hit features not supported by V8 isolate and fallback doesn't work.

• Agentic Connection UI is now used by default instead of "static" connection UI.

Changed

• Connection state tracking simplified with clearer connected and error status fields.

• Non-agentic connection screens now redirect to the improved agentic flow

• Flow descriptions automatically sync between universal and integration-specific versions.

Fixed

• Connect buttons now work properly for connectors without named authentication options

• OAuth consent page shows helpful messages when revisited after approval

• Connection configuration errors clear automatically after successful recovery

• Action tabs between universal and integration versions navigate correctly

• Console navigation works properly when flow re-runs fail

• Actions and elements can no longer be created without required key fields

Fixed

• The membrane connect command now works consistently with the membrane connection command.

Added

• New endpoint: PATCH /org-workspaces/{id}/user-settings for updating user workspace settings

Changed

• Changes in connection API:

  • connected field on connections that will replace deprecated disconnected field

  • GET /connections now accepts a connected query parameter for filtering connections by status

  • Connection errors are now more consistent with the rest of elements:

    • requestError contains the latest problem with connectivity that made connection disconnected.

    • errors field has all the errors for connection: requestError and any configuration errors

    • error field still stays but is deprecated.

Fixed

• Fixed crash when using the SDK in browser environments that don't support CommonJS require() in the error handling code path.

Fixed

• Authentication now properly re-authenticates with tenant scope when using platform-user tokens
• Removed unnecessary direct dependency that could cause package conflicts

Fixed

• CLI version is now correctly reported in telemetry data
• Non-agentic connection screens now properly redirect users to the agentic flow

Fixed

• OAuth token responses now include the user's email address for proper telemetry tracking