What shipped.
Everything that changes what you can do, or what something already does. Dated, newest first.
- Security
REST API keys are now sealed with your workspace's key
REST API keys you register are sealed with your workspace’s key, exactly like the credentials for services you connect, and stored in your workspace. They are removed when you delete the API or when the workspace is erased.
On a plan with a key of its own, that key now covers them too. Copies in backups and point-in-time recovery stay for the same periods as every other sealed value: 7 days for daily backups, 98 days for weekly ones, and 7 days for point-in-time recovery. Inline still cannot revoke a key at the service that issued it, so revoke it there if you want it to stop working.
The 2026-10-01 post listed REST API keys among the things a key of your own does not cover. That is no longer so.
- Changed
Plans that include it now have a key of their own for stored credentials
Until now every workspace’s stored credentials were sealed under one key shared by all of them, with the workspace bound into each value sealed in the current format. That is still the default. On plans that include it, a workspace now has a key of its own.
We make and hold the key in Cloud KMS; you cannot hold, disable or destroy it yourself. When a workspace is erased, its key is destroyed. After a 30-day window in which the destruction can be undone, the stored credentials and secrets sealed under that key cannot be opened by anyone, us included. Erasure is done by a person after a closed workspace’s 30-day grace period, with no fixed deadline yet, and a closed workspace keeps its key until then. There is no self-serve destroy button. The key does not stop Inline using your credentials while it exists, which it has to do on your behalf.
What this does not do, in the order that matters most:
- It covers stored credentials and secrets, not everything Inline holds. Not sealed by this key: REST API keys (held in Secret Manager under Google’s default encryption), tool-call arguments in the activity record, script source and run records, saved tool versions, large results, audit rows, and workspace configuration and settings. Agent keys use a separate hardware-backed key.
- It takes effect once the move to your own key has finished. Until then, values stored earlier are still under the shared key.
- Backups taken before then still hold a copy under the shared key until they age out: 7 days for daily backups, 98 days for weekly ones. Database point-in-time recovery also keeps earlier versions for 7 days.
Leaving a plan that has a key of its own returns your credentials to the shared key before your key is destroyed. From then on, destroying a key can no longer make them unreadable. Before anything moves, Inline tells the workspace owners, in the app and by email, the date it will happen and what it means, at least 7 days ahead. Staying on the plan, or coming back to it before that date, keeps the key.
The audit trail, scoped keys that fail closed, the erasure receipt and the backups are the same on every plan. The pricing page used to say security is not a tier, which was true while every plan shared one key; it now says which plans have a key of their own and what that does and does not cover.
- Added
Add an app from the marketplace, and remove it again
The marketplace has a page now. You can see what your workspace runs, browse what it could add, and review an app before it acts here — the card says Review rather than Add, because adding an app lets somebody else’s code run under your real credentials. The grant shown is worked out from the app’s own script rather than taken from what its publisher declared, and the gaps in that analysis are shown next to its conclusions.
Adding is three decisions, in order: what the app needs against what this workspace already has, which of your sources each of its roles points at, and which writes you are willing to tick. Reading turns on once a role is bound, and every write is yours to allow. The order is not presentation — whether an operation reads or deletes is a fact about the source you bound and not about the package, so the third decision cannot be drawn until the second is answered.
An app can also be removed, which revokes the grant at its next call rather than at some later tidy-up. The history stays, and the confirmation says so: an app being gone is exactly when somebody asks what it did. Publishers are still taken on by hand and payouts are not wired up yet, so the catalogue carries free listings only.
- Added
A checkup for the tools your workspace is offering
Every other check in the product asks whether a piece of code is right. This one asks whether what your workspace currently holds is sound — the tools cached from your providers, and the servers composed out of them, none of which any test can reach.
Findings come in two kinds and are kept apart, because the difference decides what to do about them. Ours are defects: a tool with no input schema cannot be called, a server listing a tool no source offers any more is a promise the catalogue stopped keeping, two sources can share a tool-name prefix and collide. Theirs are not defects but are worth saying: a provider’s annotations are a hint, and several of them grade every write they have at the same severity, so a ceiling set between reading and that severity refuses all of those writes rather than some. The level on each finding says which kind you are looking at.
- Changed
Seats and the live-updates window are what a plan buys
A seat count shipped in every plan and was read by nothing, so a plan sold as one person gave unlimited people. It is enforced now, at both doors that put somebody in a workspace. Free holds two, because one person cannot demonstrate governing an agent acting on somebody else’s behalf, and Pro holds five. Somebody already in a workspace is never refused their own seat, and creating a workspace asks nothing: its first member is its owner.
An open live-updates stream is a request held open, so a tab left on a desk costs as much as one being watched. A free workspace gets sixty seconds at a time, with a control in the navigation to ask for another; a paid plan gets a stream that ends only for the server’s own reasons, each of which the page comes straight back from. A hidden tab already closed its stream after a minute and still does.
Both limits are named on the pricing cards. A limit the product enforces and the pricing page does not mention is a surprise sold as a feature.
- Added
A tool can draw a panel, and the panel can act
A saved tool can carry a template, and the host draws it as a panel instead of having the model narrate a table. A panel can now act as well: a form or a button declares the call it makes, the shell collects the fields, shows working, done or failed in place, and re-runs the panel so it never leaves a stale view up after a write.
None of that is script. A call from a panel arrives as an ordinary call on the same session, so the server list, the key’s scope, the rules, the loop brake and the audit all apply, with the permissions of whoever is looking at it. An action can be marked as needing a second click. A template has no styles of its own — style attributes and style blocks are stripped, because CSS can fetch and a panel that could fetch could leak what it draws — so five classes are provided instead, drawn from the host’s own tokens, and a panel follows light and dark without asking.
The Servers page says which tools draw something, and a tool registered here opens a preview: the template as stored on one side, and on the other the panel filled with values read out of the template itself, rendered the same way the real call will render it.
- Added
You decide what the audit trail keeps, per source
What the trail records used to be two fields on a database document, which in practice meant nobody would ever change them: running a deployment should not require a database console. Both now sit on any source, under “What is kept”, for an admin or for whoever registered it. Arguments are kept redacted or not at all; responses are kept or reduced to their size and fingerprint. The dialog says what each choice costs, because the two defaults are deliberately different and a switch that does not say why is a switch people flip.
Stored arguments also carry a SHA-256 now, taken over the redacted copy and before it is capped — so two calls with the same fingerprint carried the same arguments, even where the stored copy was truncated. A source set to keep nothing gets no fingerprint either, because none has to mean none.
Keeping responses is off everywhere until somebody turns it on, and both settings can only be changed from a browser: an agent must not be able to stop its own work being recorded. Either change is written to the admin trail.
- Added
Python and TypeScript clients for a server's HTTP surface
A server can be driven from Python or TypeScript without writing the HTTP by hand: listing tools, calling one, reading a result, and typed errors for refusals, authentication failures and upstream faults. The TypeScript client has no dependencies. Both are generated from the same document the server publishes, so renaming a field there breaks a test rather than a job at three in the morning.
Reading a large result is one call. Running several tools at once fans out over individual calls, keeping order, losing nothing when one of them fails, and holding at most five in flight. A tool call is never retried and there is no option to make it so — a client cannot tell a request that never arrived from one whose answer was lost, and a write that ran twice is worse than a job that fails where somebody can see it. Reads are retried, and only when nothing ran.
Plain
http://is refused except to this machine, since the key travels in the header. There are also connection recipes for six agent frameworks, each checked against that framework’s own documentation. - Added
An agent key can be limited to the tools it needs
Until now every agent key carried the authority of the person who created it. A background agent had to be handed everything its owner could do, which is the wrong grant for a job that reads two endpoints.
A key can now carry an explicit list of tool names. A key with no list is unrestricted, so keys issued before this keep working; a key with an empty list is a deliberate grant of nothing, and the two are not the same thing. Tools added later are denied by default, so a provider shipping a destructive tool cannot quietly widen a key that already exists.
Issued keys are also listed in the interface — label, hash prefix, created and expiry — with a revoke button that says plainly that any agent using the key loses access immediately. The key itself is still never shown again after it is created; only its hash identifies a row.
- Operational
Inline is running
This is where the record starts.
Inline runs as a deployed service. You sign in, connect an account you already have, turn the operations you choose into a small number of named tools, say who may call them and what has to wait for a person — and every call an agent makes through the gateway is written down against the account that made it.
Everything below this entry is a change to that: what was added, what behaves differently, what was fixed. Dated, newest first, and written for somebody deciding whether it affects them rather than for somebody who wants to know we were busy.