chore(main): release 1.0.0

[github-actions]

🤖 I have created a release beep boop

1.0.0 (2026-04-23)

Features

• add alerting for usage abuse (#2413) (e9d0bdf)
• Add Anthropic Messages API compatibility layer (#2704) (4fe2553)
• add hook on merge for deployments (#2673) (c96bb9a)
• add is_private to apps (#2546) (aa04dfa)
• add private access rollout gate and auditing (#2560) (7e07c3d)
• add private app access extension event contract (#2556) (adce8c6)
• add private app asset token auth helpers (#2555) (15e7a35)
• add private app direct-login bootstrap page (#2566) (537f395)
• add puter.peer to sdk, create PeerService in backend (#2664) (8d38e07)
• add subdomain to private asset tokens (#2591) (adf034b)
• Add system info (Client + Server metrics) (#2311) (bbe6f9d)
• app icons in subdomain (#2461) (5129868)
• checkName api for puter apps (#2643) (bba0533)
• cleanup cache invalidation and pull out keys to be easily used in other places that need the same cache (#2515) (ec412ea)
• enable singed uploads on oss and fix broken migration (#2765) (95cbbc5)
• enforce private app hosting access gate (#2557) (784847b)
• limit concurrent request for ai chat (#2640) (156d571)
• more robust error logs (#2605) (3f0b0bf)
• notify prod (#2679) (e6d125e)
• phase 1 canonical app origin resolution (#2624) (57a2999)
• phase 2 enforce index url ownership and uniqueness (#2625) (e96221b)
• phase 3 public hosted actor cookie bootstrap (#2626) (34fdd94)
• private app config to use app urls + app routing (#2587) (911c163)
• puter-js: add Batch builder class (#2651) (d086e49)
• redirect away cookie (#2609) (4aab066)
• redis pubsub for multiple connected clients in broadcast service and webhook fixes (#2681) (9347644)
• remove file cache service (#2464) (afeac49)
• replace serializible caches with redis instead of kvjs 🚀 (#2381) (7a47047)
• resolve private app hosts by index_url fallback (#2583) (4f5fec5)
• root level kv accesses, and installed app listing + server health check fix (#2719) (e75ccb0)
• s3 fs in oss (#2761) (99d96ed)
• scope index_url uniqueness to hosted domains (#2644) (fc273d4)
• signed upload urls (#2753) (ef243c9)
• sonnet-4.6 support (#2506) (5df1ca8)
• start-menu: add "Add to Desktop" option for all apps (#2386) (5cd731d)
• subdomain error redirect (#2483) (354ac31)
• thumbnail event for gui (#2754) (8398531)
• type extension cache update events (#2548) (2c1b21e)

Bug Fixes

• "Popup Closed" message, + excess logs (142d745)
• 2803 (7bb27ff)
• add console log to webhook for debugging (#2677) (8118582)
• add explicit handling for access token in ACL (e5750d8)
• add logs to debug on prod (#2604) (d28cc46)
• add showSpinner and hideSpinner to docs sidebar (#2779) (8cc2972)
• ai metering (#2393) (afbb76f)
• ai: additional auth guard (#2577) (676b6c3)
• ai: additional auth guard (corrected 676b6c3) (930cbfb)
• alerting for metering (#2399) (e2e4794)
• allow html property in UIComponentWindow (4d49f5d)
• allow b64 srings without mime type for app icons (#2502) (00befdc)
• app canonization for puter.com apps (#2800) (9c38c43)
• app icon again (#2478) (8a6d07e)
• app icon origin (#2500) (44bb595)
• app icons saving (#2477) (bfd8a4e)
• app icons via subdomain on localhost (#2544) (7a1468d)
• app id shortcut batch (#2768) (5319940)
• app merging (#2654) (5505da0)
• app-icons protocol (#2480) (1292148)
• app-under-user access token ACL (35461a0)
• auth: add explicit check for access token suspension (#2576) (f6b9c69)
• auto-collapse playground menu on mobile (#2430) (#2431) (06fe07e)
• axiosRequest log dumping b64 urls (#2448) (380e72c)
• backend: default rate-limit scope instead of error (#2564) (8668257)
• backend: ESM/CJS interop is sad (cecb63b)
• backend: invalidate app permission debounce (#2541) (6658a90)
• backend: undo part of 35461a0 (cbde123)
• bad copy with reference in UIItem (7ba40f8), closes #2514
• bad token generation for private apps (#2596) (8a14871)
• broadcast pubsub + cleanup old code (#2695) (c2e77d3)
• cdn cache invalidation (#2826) (7f9873e)
• change_email and user-protected endpoints (#2680) (ef93ed4)
• cleanup some app es and app service validation (#2523) (9f87ccb)
• close start menu popover on repeated click (#2784) (4130fc4), closes #1681
• core: handling of refer code storage add (#2642) (ebb9015)
• corrected service reference (#2559) (7c437fa)
• cost mapping for together ai from openai sdk (#2371) (4aa2039)
• decrease large error log from wrong model (#2456) (5e8ce3a)
• decrease log usage (#2449) (f9805df)
• default timeout on user caches of 15 min (#2530) (eda9f11)
• delete redis keys in parallel, don't grant both read and write if just write needed (#2552) (f8560cf)
• dev center emails (#2447) (7d84d7a)
• disable requests from server in two services (de77b11)
• do not await for puter icon write in db (#2485) (4136cb1)
• don't await cache invalidation for grant app permission (#2551) (1887352)
• don't await for cache writes (#2519) (3b32b4a)
• don't call stat on each file in dir (#2522) (3834571)
• don't stream back bytes for icons (#2486) (809d375)
• don't use ai aggregators if we have the model ourselves (#2424) (fbb2080)
• dynamodb health checks and client recreation (#2789) (9a6c414)
• ensure cache invalidation when verifying OTP (020a64d)
• expose getUserService in extension typings (#2385) (114fbff)
• extension type import (#2723) (25b9911)
• false alarm from openrouter (#2470) (d7a3f61)
• fetching user from session token (#2607) (237973f)
• gemini via openrouter models (#2438) (de7e831)
• gui: account for iOS safe area inset on taskbar/dock (#2682) (3628cf4), closes #2517
• gui: defer login event until listener registered (#2547) (c4346df)
• handle closing server nicer on shutdown signal (#2741) (b3656fd)
• hardcode default perm (#2570) (bb02fc6)
• header resend issue with catch-all handler (a8dc62e)
• healtcheck improvements (#2726) (d292c1e)
• incorrect accessor reference in OIDCService (298f1cd)
• incorrect parameters in UIWindowChangeEmail (b5a3323)
• incorrect parameters in UIWindowChangePassword (2cdc211)
• incrememnt ddb sharding to 10k (#2744) (3e08294)
• init installed apps controller (#2722) (9511323)
• installed apps api (#2725) (08fa2d7)
• issue with tokens not being received by puter app (#2713) (76f5a26)
• keep bootstrap in url for app to do whatever (#2648) (a4aea52)
• letter case issue (#2721) (68985e9)
• limit open router expensive models for now (#2407) (e938d51)
• limit referralCodeService (#2670) (573d5a3)
• log format (#2333) (2402e49)
• make invalidations more robust (#2529) (4c863cc)
• map again (#2372) (5a8e906)
• match override properly (#2373) (de14bf7)
• metering alerts for missing costs (#2466) (0a594bd)
• missing redis changes (#2401) (07a3897)
• missing subdomains and worker flags in readdir (#2772) (2368b2b)
• more reliable 404 responses for .api endpoint (e744333)
• move readdir-subdomains to ESM (b8bdc16)
• no shutdown outside of puter servers (#2762) (0505a5d)
• oidc: add code lost due to editing a .js (ef0a665)
• oidc: add error log for QR login flow (7858f5b)
• oidc: add missing awaits (2b80214)
• oidc: bring "Add Existing User" to working state (#2572) (f2926c9)
• oidc: fix QR code login issues caused by OIDC (e2068e7)
• oidc: http-only cookie sync for switch user (42d3f9e)
• oidc: login flow with puter.ui.authenticateWithPuter (3cd5268)
• oidc: rate-limit identity for username (d0c2e9b)
• oidc: remove generated source file (ccecf0a)
• oidc: request object reference in oidc signup (fc29e57)
• oidc: session token vs gui token issues (d532b3d)
• only rate limit login when failed (#2355) (cc5285f)
• origin app Ids (#2801) (7f7c019)
• origin canonization (#2597) (1720c97)
• prioritize new token thant anything outdated stored in localstorage (#2600) (9721943)
• private app config to use app urls (#2586) (1f975b9)
• private app token (#2623) (e4a5294)
• puter site middleware host (#2594) (6b6f9b4)
• puterfs: await queue items for fsentry action (#2616) (2a027ed)
• range headers in file.js (5250671)
• rate limits for oidc too extreme (1be3eca)
• redis cache deletions (#2518) (2e77650)
• redis cache for user (#2409) (eead0fd)
• redis max retries and fail fast timeouts (#2793) (1cfe69f)
• redis startup (#2571) (314c671)
• remove broadcast for cache updates (#2542) (66f1cd0)
• remove dynamo health check for now (#2743) (677bc29)
• remove flaky event loop check (#2727) (393f4b7)
• remove last opened (#2729) (187b14d)
• remove rate limit await on writes (#2368) (6daac66)
• remove recommended app caching in favour of stronger caching at app fetch layer (#2748) (107521e)
• remove redis cache scan in favour of direct key invalidation (#2589) (dbdead9)
• reset subdomain if empty (#2593) (8380b28)
• resume-analyzer: add preprocessing for DOCX and TXT files (#2359) (fecd67a)
• return fallback icons if no icon present (#2731) (b857fc8)
• security: shell escape paths in HostDiskUsageService; null-prototype objects in batch parser (#2659) (9506c53)
• skip CI tests when only docs are changed (#2335) (#2338) (7045452)
• socket io sockets (#2696) (b87f498)
• stricter invalidation for 2fa and confirm email codes (#2528) (e60f55f)
• suggested apps breaking (#2343) (66a3af6)
• syntax issue with sql (#2730) (ec766ee)
• tests (ec412ea)
• tests oom breaking (#2661) (9169114)
• tighten cors logic for socket io (#2688) (a94620d)
• update knowledge date for Claude Opus 4.7 model (#2816) (b34f695)
• usage limited error handling (#2423) (5fdfae6)
• webhook message to peer (#2678) (6352bc6)
• websocket credentials (#2687) (bb733e7)
• When a maximized window gets resized, Puter apps should be resized as well (#2498) (c0583a9)
• wrong icon for workers (#2524) (3a89dea)
• ws double messages (#2700) (b526c08)

Performance Improvements

• batch readdir suggested apps into single big query (#2332) (2287704)
• batching get_apps cache look ups (#2521) (d418976)
• core: LRU cache PuterHomepageService (#2627) (34d4f49)
• core: very simplistic minifier for homepage (#2630) (ae96912)
• don't fetch b64 icon for apps always, and lru suggestedApps (#2336) (8bb4dec)
• improve app open time (#2490) (32682e7)
• remove recents cache (#2558) (2308990)

---

This PR was generated with Release Please. See documentation.