Context is Everything logo

Sasha Studio Release Notes: v1.0.1444 to v1.0.1478

Release Period: September 2026
Version Range: 1.0.1444 → 1.0.1478
Total Commits: 263 (231 excluding version bumps), 879 files changed

TL;DR - Business Summary

What's New in Plain English:

This release gives you five major capabilities:

  1. Sasha Apps - Small, focused tools (like a time sheet or a research form) now run inside Sasha, keep their own data, and can be built and repaired by Sasha itself.

  2. EA Prep Research app - Consultants fill in one form (candidate, client, role, files) instead of running the research workflow by hand.

  3. HireBest connection - On sasha2, each person connects their own HireBest account once, and Sasha can then read their HireBest projects in chat.

  4. A model per skill, including Fable - A skill can choose the Claude model it runs on, and the model its helpers use. Fable now works on Bedrock.

  5. Sasha learns from its own sessions - Problems that people mention in chat, and failures inside sessions, are now collected automatically as improvement suggestions.

Business Value:

  • Faster repeat work: Apps turn a multi-step prompt into one form that anyone on the team can use the same way.
  • Right model for the job: Heavy research skills can use the strongest model, and routine skills a cheaper one.
  • Fewer silent failures: Busy-server refusals, missing project records and slow file listings on cloud storage are now handled or shown clearly.
  • One place for hiring data: HireBest projects become part of the same chat as the knowledge base.

Executive Summary

The main theme of this range is Sasha Apps (PRD 25). Milestone 1 replaced the old "Agent Apps / Modules" system with packaged apps that run in an isolated sandbox. Milestone 2 gave each app its own governed data tables and declared actions. Milestone 3a lets an AI client read, edit and check an app's source files, with file-and-line diagnostics. Two apps are bundled: Time Sheet Entry and the new EA Prep Research.

The second theme is connections and models. PRD 28 Phase 1 adds a per-user HireBest OAuth connection through a Sasha proxy. It is enabled only on sasha2 and uses HireBest production. Skills can now set model and subagent_model, and the provider passes the full Bedrock ID where the Claude CLI has no alias, which is what makes Fable work.

The third theme is reliability on cloud storage. The aesop instance moved to AWS as sasha2, on EFS network storage. That move exposed three slow paths: the conversation-files prefetch loop, a database check in a helper process that locked the database, and a new-chat refusal after one short stall. All three are fixed. A catalogue gap that refused staff with "Not found" is also fixed, and existing projects are repaired on start.

Major Features & Improvements

Sasha Apps

  • Milestone 1 - Replaced the Modules system with APP.md packages under <DOCS_ROOT>/apps/. Each app becomes an immutable, content-addressed ui:// resource and renders in a separate-origin sandbox, so app code cannot read Studio cookies or pages. Apps reach Sasha only through the window.Sasha façade.
  • Milestone 2 - Added governed per-app data (data.list/get/create/update/delete/aggregate), declared actions (actions.call()), a per-app MCP tool surface, a recovery view, and chat confirmation for actions.
  • Milestone 3a - An AI client can now list, read, write, edit and delete an app's source files (new scope apps:write). A validation failure comes back as { file, line, code, reason }, so the AI can repair the app itself.
  • Clearer tool surface - App tools now say what they do, which host an app needs, and why a call was refused.
  • Bundled skill refresh - The app-builder skill is refreshed on every start, and the version it replaces is archived.
  • Sample apps withdrawn - email-drafter, candidate-comparison and report-builder are now test fixtures only.

EA Prep Research app

  • New bundled app - A front end for the ea-prep-research-orchestrator skill. The consultant opens the engagement project, enters the candidate, client and role, attaches files, and starts a run. Run history is shared.

HireBest connection (sasha2 only)

  • Per-user OAuth - Settings → Connections → Connect HireBest. Each user signs in to their own HireBest account.
  • Sasha proxy - Chat sessions call HireBest through /api/mcp-proxy/hirebest. The proxy holds and refreshes the tokens, and a chat never sees a HireBest token.
  • Only where configured - The card, the proxy and the chat wiring exist only when HIREBEST_MCP_ENV is set. Today that is sasha2 only, on HireBest production.

Models per skill

  • model and subagent_model - A skill can set its own model and its subagents' model. On Bedrock, a skill's model is honoured.
  • Fable on Bedrock - The provider passes the full inference-profile ID for models the CLI cannot resolve as an alias. Before this fix, choosing Fable in Settings broke every chat.
  • Correct placement - Skill model fields go under execution:, not at the top level of the skill's front matter.

Improvement loop (PRD 24 Phase C, PRD 27)

  • Inbox - Every chat session can file one JSON file per problem it finds. The server collects them after each turn.
  • Session miner - A 6-hourly job reads quiet sessions and records tool errors, tool loops, sessions that end on an error, and repeated corrections.
  • Ops report - A standing "reported and fixed" report, with a separate MERGED status for fixes that wait for deploy verification.

Chat UI

  • One header row on desktop - The breadcrumb and chat actions moved into the top bar.
  • "Show tool status" works for grouped calls - When it is off, the N tool calls lines are now hidden.
  • Denser prose - Chat text spacing now matches claude.ai.
  • Busy refusals are visible - When the server is briefly busy, the chat stops the spinner, puts your message back in the input and offers Retry. Before, it showed a spinner for 3 minutes.

Stability & Reliability

Projects and access

  • Staff "Not found" fixed - Creating a project now also creates its catalogue row, and a start-up backfill repairs existing projects. Before, a staff user could send one message in a new project and was then refused on every later one.
  • Uploads - New projects get a docs folder, and an upload can create a missing folder for a registered project.

Cloud storage (EFS)

  • Sidebar prefetch loop stopped - An empty file list now counts as loaded, so the sidebar does not ask for the same conversation again and again. On sasha2 that loop had made the server stop answering its health checks.
  • Database lock in helper processes - The secretstore MCP child process no longer runs a full database check at every chat start. That check held a lock for 40–106 seconds on EFS.
  • One stall no longer refuses chats - The new-session circuit breaker now refuses only on sustained lag (p99 ≥ 500 ms), not on a single long pause.
  • Diagnostics for the "Stuck?" chat tail - Logging and a root-cause analysis for replies that appear only after "Stuck?" is pressed.

Security and logging

  • No session tokens in logs - The WebSocket connect log and the start-up health stub no longer write session JWTs.

Start-up and seeding

  • Seeder fixes - The seeder's own archive no longer blocks all seeding, every bundled app is on the seeder allowlist, and the front-matter backfill starts after the last lock step.
  • Drive MCP - Registered with its own database path and rclone connection.

Developer Experience & Docs

Development Tools

  • scripts/deploy-sasha.mjs - A command-line deploy for Sliplane instances. It changes the image tag and nothing else, checks the schema version first, and confirms the version file afterwards.
  • In-AWS image copy - The sasha-image-copy Fargate task copies a release from GHCR to ECR in seconds. Copies from a laptop were not reliable.
  • Playwright live-verification runbook - How to check a change on a live instance in a browser.

Documentation Updates

  • PRD 25 (Sasha Apps), PRD 27 (ops report), PRD 28 (HireBest OAuth) and PRD 29 (project identity lifecycle).
  • New help articles "Building skills" and "Connecting with MCP"; "Getting started" and "What's possible" updated (knowledge-source/help/).
  • Runbooks for the AWS move (aesop → sasha2), the CJK Associates teardown, and schema cutovers on ECS.

Upgrade Notes

Required environment

  • SASHA_APP_SANDBOX_ORIGIN and SASHA_PUBLIC_ORIGIN: required from Sasha Apps Milestone 1 onward. The sandbox origin must be HTTPS on a different hostname from Studio. If it is missing or invalid, the server does not start.
  • TOTP_ENCRYPTION_KEY: still required, as before this range. Without it, the image exits at start-up.

Optional environment

  • HireBest: HIREBEST_MCP_ENV, HIREBEST_MCP_CLIENT_ID and MCP_OAUTH_ENCRYPTION_KEY. Leave all three unset to show no HireBest card.
  • Fable on Bedrock: the AWS account must use Bedrock data-retention mode aws_review in the calling region. Other Claude models are not affected.

Database

  • No schema change inside this range. The authorization schema is 9 at both v1.0.1444 and v1.0.1478.
  • An instance older than v1.0.1444 may cross a schema cutover. Back up the database, stop every old process, then start one new process. See docs-developer/operations/deployment/authorization-schema-cutover-runbook.md.
  • Avoid v1.0.1448. It could crash on upgrade because of an MCP token index. Use v1.0.1449 or later.

Breaking Changes

  • Modules removed: MODULE.md, the module parser and the module sidebar are gone. Convert modules to APP.md packages with the app-builder skill.
  • Skill model fields: put model / subagent_model under execution:. A top-level model field is read by the Claude CLI, not by Sasha.

Deployed so far (2026-09-23)

Instance Before Now Notes
sasha2.hirebest.ai (Aesop) v1.0.1476 v1.0.1478 sasha-aesop:16; no schema change; HireBest production connection accepted
sasha1.hirebest.ai (AWS) v1.0.1433 v1.0.1478 sasha-aesop4:21; schema cutover from generation 0 to 9; backup kept on EFS
Sliplane sasha1, aesop-eu, onbio v1.0.1472–1476 unchanged Not part of this deploy

Changelog Summary (since v1.0.1444)

Sasha Apps

  • Landed Milestone 1 (#777), Milestone 2 (governed data, actions, MCP surface, recovery view, chat confirmation) and Milestone 3a (#789, source editing with diagnostics).
  • Improved the app tool descriptions and refusals (#783, #790, #795); refreshed the bundled skill on start (#792); matched sidebar app rows to project rows (#780).
  • Added the EA Prep Research app (#817) and fixed its seeding (#821); withdrew the three sample apps; defaulted the time-sheet date to today.
  • Memoised app discovery (M-013); failed fast on a refused spawn (M-012); probed the app surface (M-014).

Connections and models

  • Added the per-user HireBest OAuth connection through a Sasha proxy, sasha2 only (#822).
  • Added per-skill model and subagent_model; made Fable work on Bedrock (#819, #823, #824).

Improvement loop

  • Added session signal intake: an inbox and an interval miner (#800).
  • Added the standing ops report and the MERGED ledger status (#794); sent the pass report to internal recipients (#782).
  • Fixed the daily-activity skill schema read; the miner now ignores CLI-cancelled calls (#806).

Chat and UI

  • Showed busy refusals in the chat with Retry; one stall no longer refuses chats (#833).
  • Added diagnostics for the chat tail that appears only after "Stuck?" (#832).
  • Lifted the header into the top bar on desktop (#787); honoured "Show tool status" for grouped calls (#786); an expanded project lists its own chats while another chat is open (#781).
  • Stopped the conversation-docs prefetch loop (#801).

Projects, data and start-up

  • Fixed staff "Not found" in projects with no catalogue row, with review fixes and a backfill (#810, #813, #815).
  • New projects get a docs folder; uploads can create a missing folder.
  • Skipped the integrity check in the secretstore child process (#804); registered Drive MCP with its own paths (#805).
  • Fixed seeding order and the seeder archive (#793, #812); fixed the v1.0.1448 upgrade crash (MCP token index).
  • Stopped logging session JWTs on WebSocket connect and in the health stub.

Operations

  • Added the command-line Sliplane deploy and fixed its checks (#798, #827).
  • Decommissioned the CJK Associates instance and added a teardown runbook (#829).

Looking Ahead

  • Wait instead of refuse: when the server is briefly busy, start the chat a few seconds later instead of asking the user to retry.
  • Sasha Apps Milestone 4: state transitions (transition-one / transition-many) for apps.
  • HireBest in skill runs: Phase 1 covers chat only. Skill runs need a user identity before they can use the connection.
  • Fleet roll-out: bring the Sliplane instances up to this release, and onboard them to the improvement harvest.

Jargon Buster - Technical Terms Explained

Sasha App

  • A small, self-contained tool (form, table, dashboard) that runs inside Sasha.
  • Like an app on a phone: it has its own screen and data, but the phone controls what it may touch.
  • New in this range; replaces the old "Modules".

Sandbox origin

  • A separate web address where app code runs, apart from the main Sasha address.
  • Like a guest room with its own key: a guest cannot open the rest of the house.
  • This is why SASHA_APP_SANDBOX_ORIGIN must be a different hostname.

MCP (Model Context Protocol)

  • A standard way for an AI assistant to use tools and read data from other systems.
  • Like a universal adapter plug between Claude and a service.
  • Sasha Apps, HireBest and the Sasha knowledge base are all reached through MCP.

OAuth

  • A standard way to let one service act for you in another without sharing your password.
  • The "Sign in with Google" flow you already know.
  • Each user connects their own HireBest account; Sasha never sees the HireBest password.

Proxy

  • A go-between that forwards requests and adds the credentials.
  • Like a receptionist who holds the building keys, so visitors never carry them.
  • The HireBest proxy keeps the tokens on the server, away from the chat session.

Bedrock / inference profile

  • Amazon's service for running Claude models inside an AWS account; an inference profile is the model ID that Bedrock accepts.
  • Like a full street address when a nickname is not understood.
  • Passing the full ID is what makes Fable work where the CLI has no short name for it.

EFS (Elastic File System)

  • Network storage that AWS containers use for files and the database.
  • Like a shared drive: safe and persistent, but each file access takes longer than a local disk.
  • Several fixes in this range remove file work that was cheap locally but slow on EFS.

Circuit breaker

  • A safety check that refuses new work when the server is overloaded.
  • Like a fuse that trips to protect the wiring.
  • It now trips only on sustained lag, not on one short pause, and the chat tells you when it trips.

Schema cutover

  • A one-time change to the database structure when an instance moves across versions.
  • Like re-wiring a building: switch off, change, switch on, never half-and-half.
  • sasha1.hirebest.ai crossed one on 2026-09-23 after a verified backup.

Thanks for upgrading. This range turns Sasha from a chat with a knowledge base into a place where teams build, run and repair their own tools.