Enhancements and Features

/goal keeps pw code working until a condition is met

pw code gains /goal. Give it a completion condition such as "all tests in cmd/cli pass and go vet is clean", and the session keeps working toward it across turns, checking after each one and stopping when the condition is met, instead of handing control back every turn. The goal belongs to the session, so closing pw code leaves it working and reattaching picks it up mid-run. /goal shows progress, /goal clear stops it, and /goal pause or ctrl+c pauses without forgetting the condition.

Admins can limit which models a cloud AI provider offers to users

Platform administrators can now limit which models each cloud AI provider offers. Set the allowed model list per provider in the AI Providers Catalog; users only see and enable models on the list.

Choose how the platform verifies an AI integration's TLS certificate

Platform administrators can now choose how ACTIVATE verifies an AI integration's TLS certificate: against the public certificate authorities, against a CA certificate you supply, or skipped. Skipping lets you connect integrations that serve a certificate no public authority vouches for, such as a model endpoint hosted inside your own cluster.

Custom firewall rules for networks

Org admins can now define custom inbound firewall rules on networks (source CIDR, protocol, port range). Rules are applied to the security groups the platform provisions for the network and, on Azure, to nodes of newly provisioned clusters.

Organization bootstrap script for user workspaces

Organization admins can now set a bootstrap script that runs as root in every user workspace at startup, under Cloud > Workspace Bootstrap Script. It replaces the site-provided /usr/local/bin/preProcess file, which still runs with a deprecation warning in this release.

Owner avatars and organization column on the admin workspaces page

The admin workspaces page now shows each workspace's organization alongside the owner, and lets you filter or search by organization.

Policy to disable password login

Platform and organization admins can now disable password login, requiring users to sign in through SSO, LDAP, or CAC instead. Password resets are also turned off while the policy is active. The policy can only be enabled once another authentication method is configured, so it cannot lock everyone out.

pw workspace commands to start, restart, and check the user workspace

The pw CLI has a new workspace command group: check your user workspace with pw workspace status, start it with pw workspace start --wait, and restart it with pw workspace restart.

Workspace SSH keys are generated at 4096 bits

Workspace SSH keys are now generated at 4096 bits.

Address a running pw code subagent by @-mentioning it in the composer

You can now address a running pw code subagent directly from the composer by @-mentioning it (@task-2 take another look at auth.go) without switching windows. A child that is mid-task takes the message as course correction at its next step; an idle child runs it as a follow-up turn.

Azure providers run on Azure AI Foundry

Azure AI providers now run on Azure AI Foundry. New providers are provisioned as Foundry (AIServices) accounts and can deploy and use models from the full Foundry catalog — Azure-sold families like DeepSeek, Grok, and Phi, partner families like Mistral, and Anthropic Claude models — rather than only the Azure OpenAI model list. Deployments request the capacity Azure rates the model for, clamped to your subscription's available quota, and deployment failures now surface actionable messages instead of raw Azure errors.

Billing admins can view the admin resources table

Billing administrators can now view the admin resources table (cloud inventory) in read-only mode, including all resource tabs and the organization filter. Resource mutations remain restricted to platform administrators.

Change controller instance type while cluster is stopped

The controller node's instance type can now be changed while a cluster is stopped on AWS, Google Cloud, and Azure. The new type is applied automatically when the cluster is resumed.

Check out private GitHub repositories in a workflow

Workflows can now check out private GitHub repositories. Connect your GitHub account under Settings and uses: parallelworks/checkout will read a private repository through ACTIVATE, which fetches it as you and sends only the files to wherever your workflow runs. Your GitHub credentials never leave the platform, and only repositories your workflow actually names can be fetched.

Workflow steps that pull a subworkflow from GitHub with uses: github/OWNER/REPO can now reach private repositories. Connect your GitHub account under Settings and ACTIVATE fetches those steps as you, which also gives each user their own GitHub rate limit instead of sharing the much smaller unauthenticated one.

GitLab support

Organization admins can register GitLab servers under Organization > Settings > GitLab Servers, and every member can connect their account on each server under Settings > Connections.

Workflows can now live in GitLab. A remote workflow can point at a project on any GitLab server your organization has registered, another workflow can include it with uses: https://gitlab.example.com/group/project@main, and pw workflows run accepts the same URL. Private projects are read as you, through the account you connected under Settings.

Workflows can now check out private GitLab repositories. Once your organization has registered the GitLab server and you have connected your account under Settings, uses: parallelworks/checkout with the project URL reads the repository through ACTIVATE as you, sending only the files to wherever the workflow runs. Your GitLab credentials never leave the platform.

Cloud-specific allocation types

Allocations now have a managed or custom type, and managed allocations can be restricted to specific resource types (AWS, Azure, Google, Oracle, OpenStack, Kubernetes, AI). A new allocation details page shows an allocation's type, allowed resource types, budget usage, associated resource groups, and its usage events.

Edit a cluster, storage, workflow, or network from its right-click menu

Cluster, storage, workflow, and network rows now offer Edit in their right-click menu, so you can jump straight to the configuration form without opening the resource first.

Per-node running processes for cloud clusters

Cloud clusters can now record every node's running processes and what led up to a freeze. Turn on Running Processes in a cluster's Advanced Settings and each node's detail page shows a process table (CPU, memory and disk IO per process) plus a timeline of pressure alerts and kernel events such as OOM kills, for controller and compute nodes alike. The same tab charts the top five processes by CPU and by memory over the last few hours, so a spike that preceded a freeze is still visible after the fact. Anyone with access to the cluster can view it, and the record survives reboots and even the loss of the node itself.

Per-provider toggle for emulated tool calling

AI providers that use emulated tool calling now have a provider setting to turn it off. It stays enabled by default; disabling it makes the provider chat-only, and clients see the change immediately in the model list.

pw code shows the model's thinking

pw code now shows the model's thinking: reasoning streams into the transcript while the model works and folds to a "Thought for Ns" line once the answer starts, expandable with ctrl+o. Resumed sessions keep it.

pw browse

pw browse <resource> [url] opens a local browser whose traffic, including DNS, exits from a remote resource, so sites on the resource's network work with local smart card readers and hardware tokens. pw ssh and pw forward also gain OpenSSH-style -D SOCKS5 proxies.

./pw browse --direct "*.google.com" https://intranet.example.internal
# Expect: a new Chrome window opens; the site loads via the cluster; 
# Close the window: the command exits and the tunnel closes.

# Standalone SOCKS proxy with reconnect
./pw forward -D 1080 my-cluster
curl --socks5-hostname localhost:1080 http://internal-host/

# SOCKS proxy alongside an interactive shell
./pw ssh -D 1080 my-cluster

pw code drives the terminal's progress bar while it works

pw code now lights up your terminal's progress bar while it is working, so a glance at the window, even a background one, tells you a turn is still running. It clears as soon as the turn ends. Terminals without progress-bar support are unaffected.

Regional, dual-region, and multi-region Google bucket provisioning

Google bucket configurations now support a location type selection: regional, dual-region, or multi-region (US, EU, ASIA). Previously all Google buckets were provisioned in the US multi-region regardless of the selected region.

Unfavorite sessions to hide them from the dashboard widget

Sessions can now be unfavorited to hide them from the dashboard sessions widget — useful when sessions shared by other users clutter your dashboard. All sessions are favorited by default, and unfavoriting only affects your own view; the session stays available on the sessions page.

Bug Fixes

• AI connections show 0 models on the admin products pages
• AI provider catalog dropdowns are unstyled and name the wrong protocol
• Connecting GitHub shows "App not installed" and flashes loading when GitHub returns an error
• Downloading a file opens it in a browser tab instead of saving it
• Google credentials check fails a project whose access comes from a custom or inherited role
• Managed clusters show no partitions when the scheduler controller is not a registered node
• A bad ssh value stops a run before it can report anything
• A run finalized over REST leaves its tunnels open
• A session model rejecting a chat request looks like an empty successful reply
• Admins cannot edit a user's AI provider
• Azure bucket credentials fail with "Unknown error" when the cloud account lacks Graph permissions
• Changing a custom AI provider's endpoint does not update its mapped connections
• Clicking a log line number collapses the surrounding group
• pw commands fail on compute nodes when the login node's first interface is external
• pw vscode to a compute node through the login node fails on Windows
• Cluster node bootstrap waits on downloading both pw CLI architectures
• Compute worker restarts a finished job's desktop session
• Deleting a session leaves its worker's job in the scheduler queue
• Detaching storage fails when another attached filesystem is not shared with you
• Drawers cannot be resized with a keyboard or a screen reader
• Failed instance stays in the instance list forever
• Favoriting a resource says it worked even when the request failed
• Oracle clusters on a network that is not centralized-nat fail with subnet not found
• Launching Desktop on a macOS existing cluster fails with a TigerVNC download error
• Mounted bucket fails with invalid argument after credentials expire
• Non-streaming session model replies hide the model's reasoning
• Oracle cluster wizard shows an empty Settings step
• pw code agent switcher does not list newly started subagents
• pw code exits with an allocation error instead of letting the user pick one
• pw code prints the gateway's tool-emulation instructions instead of an answer
• pw code shows a 128K context window for models served through a custom AI connection
• pw code shows a raw JSON error frame when the AI gateway rejects a request
• pw code status line is cut off in a narrow terminal
• pw code wastes two rows on blank lines around every user message
• The select VM size panel covers part of the sidebar
• Tool-using chat turns show no duration when the model produced no reasoning text
• Typing in a form is interrupted when the terminal drawer is open
• User workspaces running on EKS with Karpenter disconnect for several minutes when Karpenter consolidates nodes
• Command palette scrolls away from the top while typing

Enhancements and Features

Capacity reservations pin the partition instance type

Capacity reservations now record the instance type they hold capacity for. When a cluster partition uses that reservation, its instance type is set to match and locked, so a partition can't be pointed at a reservation it doesn't fit. Leave the instance type unset on a reservation to keep the instance type freely selectable.

Emoji shortcode completion in the pw code composer

The pw code composer now completes emoji: type : and at least two letters of a shortcode to get a list of matching emoji, then press tab or enter to insert the one you want. It works the same way as the existing / command palette and @ file picker.

Run workflows from private GitHub repositories

pw workflows run can now run workflows from private GitHub repositories. It uses the GitHub credentials already on your machine, checking GH_TOKEN and GITHUB_TOKEN, then gh auth token, then your git credential helper, so an already-authenticated shell needs no extra setup. Authenticating also raises GitHub's rate limit from 60 requests an hour to 5,000, which makes the "GitHub API rate limit reached" failure far less likely on public repositories too.

Run workflows straight from a GitHub repository

pw workflows run now accepts a GitHub repository, running workflow.yaml or workflow.yml from the repository root the way go run handles a repository reference — pw workflows run github.com/parallelworks/workflow-hello-world, optionally pinned with @branch, @tag, or @commit. Because the workflow is someone else's code, the CLI shows you exactly which of your account variables it wants and asks before granting them, remembering your answer on this machine. Use pw workflows permissions ls and revoke to review or undo what you have granted, or --trust to approve without prompting in scripts.

User workspaces pick up newly added organization users without a restart

User workspaces now pick up users added to your organization within a few minutes, so files on shared storage show the owner's name instead of a numeric id without restarting the workspace.

Bug Fixes

• An instance reports provisioned before its users can actually sign in
• Attached storages on a shared user's cluster never show as persistent
• Azure cloud accounts cannot be deleted once a bucket has been deleted
• Built-in AI providers show 0 connections on the admin products page
• pw upgrade shows a spinner instead of a progress bar while downloading
• cannot read NFS-exported attached disks on compute nodes with sudo
• Unrelated results match command palette searches

Enhancements and Features

pw code runs shell commands in the background

The pw code agent can now run shell commands in the background: it keeps working while they run, reads their output incrementally, and is woken to continue when they finish. A new /tasks command lists background commands.

View and terminate active login sessions

You can now see everywhere your account is signed in under Settings → Sessions,

Collapsible environment groups and cluster-name search in the compute target picker

On accounts with many clusters and environments, the compute target picker now collapses each cluster's environments behind an "N environments" row so every cluster's login node stays in view, and the filter matches cluster names so a cluster's login node can be found by typing its name.

Managed SKUs page for admins

Platform and billing admins can review billing SKU classifications on a new Managed SKUs page under Admin > Billing — filter by cloud provider, type, and subtype, find unclassified SKUs, and download the catalog as CSV.

Session transcript path in /status

/status in pw code now shows the path to the current session's transcript file, so you can find the session's JSONL log without knowing where sessions are stored on disk.

System logs streaming for cloud clusters

You can now view real-time system logs directly from the cluster detail page for cloud clusters. Click the "System Logs" button in the Logs panel to see the latest 1000 journal entries, page backward through older history, and watch new entries arrive live — with timestamps shown in your local timezone.

Bug Fixes

• Admin permission in the cluster share drawer doesn't show writer, sudo, and login as included
• pw buckets cp progress bar makes workflow logs one unreadable line
• A run that fails before it starts sits in "running" with no error
• A workflow that targets the user workspace hangs forever
• AI streaming responses drop with a connection error when the model pauses to think
• Cluster scheduler and deletion logs show "Log not found" when the log directory is a relative path
• Dropdown icons don't show after being selected
• pw code hides the shell command it is currently running
• pw nfs ls fails on a cluster node that has only its cluster session token
• Realtime inventory stops tracking S3 buckets outside the account's first region
• Workspace mounts list a cluster that has already been deleted

Enhancements and Features

Agent transcripts fold tool runs and render syntax-colored diffs

Agent transcripts now fold runs of routine tool calls into one expandable summary line, and code diffs render with syntax highlighting and changed-word emphasis.

Messages show timestamps, model, and token usage, long replies collapse, and markdown renders mermaid diagrams

Chat messages now show when they were sent, which model responded, and token usage on hover; interrupted replies are marked; very long replies collapse behind Show more; and mermaid code blocks render as diagrams.

Attach storage modals show icons and online status indicators

Attach storage modals now display storage type icons and online status indicators for each option, matching the workflow form.

Chat composer queues messages while a reply is streaming

The AI chat composer now queues messages sent while a reply is streaming: pending messages are shown, can be removed before sending, survive a cancelled reply, and are delivered in order when the turn completes.

Connect a GitHub Copilot subscription as a personal AI provider

You can now connect your GitHub Copilot subscription as a personal AI provider. pw code and AI chat can run on your Copilot plan instead of per-token API billing - free seats get Copilot's Auto model, and paid seats get Auto plus the full model picker.

Custom AI provider icons

Platform administrators can customize icons for custom AI providers. Updated icons automatically appear on existing AI provider connections.

Default allocation for cloud account billing charges without a resource group

Org admins can set a default allocation per cloud account so billing charges that would otherwise be unattributed are assigned to a budget instead of being untracked.

Download cluster events in CSV, JSON, or text format

Cluster events can now be downloaded from the cluster's Events tab as CSV, JSON, or plain text, honoring the active filters. Platform and organization event exports also gain the plain text format.

GovCloud status on the cloud account details page

The cloud account details page now shows whether the account is a GovCloud account, or an Assured Workloads account for Google.

Platform billing admin role with read-only access to billing data and all org cost dashboards

A new billing admin role can be granted by platform administrators. Billing admins get read-only access to platform billing data across all organizations: billing runs and cost cross-check (including correcting the last billing update date), every organization's cost dashboards and cost reports, group allocations, and organization allocations — without any other administrative access.

Lifecycle hooks in pw code

pw code now supports lifecycle hooks: run your own commands, HTTP calls, MCP tools, or prompts on agent events to observe, block, or rewrite actions. Browse and manage them with /hooks.

pw code /plan enters plan mode and shows the session's saved plan

pw code gains /plan. It switches the session into plan mode and shows the plan that session has already written, with /plan open to edit that plan in your editor and /plan <description> to start planning something in one step. The record stays in the transcript and comes back when you resume the session.

pw code answers ACTIVATE product and pw CLI questions

pw code now understands ACTIVATE. Ask it how to create a cloud cluster, what belongs in a workflow YAML, or what happened on one of your workflow runs, and it loads real product knowledge instead of guessing: reading pw --help for anything about the CLI you have installed, inspecting your own platform for anything about your resources, and fetching the live documentation for everything else. Ask it why a run failed or why a session stopped working and it walks the whole diagnostic path, down to the executor log a failed step never got to write and the scheduler job behind a session the platform still shows as running. It works on air-gapped platforms, and you can override either skill with your own ~/.agents/skills/<name>/.

pw code queued messages sit below the thinking line in the transcript

pw code's thinking line now sits in the transcript instead of above the composer, with messages you queue mid-turn rendered below it, so it is clear which one the agent is working on and which are still waiting. The plan panel hangs from the line and travels with it. Press ↑ at an empty composer to pull the newest queued message back for editing.

pw code subagent rows clear themselves when every agent is idle

Finished subagents no longer pile up in the pw code agent switcher. Once more than four are idle the older ones collapse into a single expandable row, and about twenty seconds after every agent goes quiet the finished rows clear themselves. Agents that failed, the one you are currently viewing, and any holding a message you have not sent yet always keep their row.

Rename sessions from the UI and CLI

Sessions can now be renamed after creation, from the session list's Rename action in the web UI or with pw sessions rename <session-name> <new-name> in the CLI. Renaming keeps the session running and preserves its custom subdomain; only the name and its URL path change.

Session tab title and title bar show the cluster and node hostname

The browser tab title and in-platform title bar for a session now show which cluster and compute node it is running on, making it easy to tell multiple desktop sessions apart.

Share compute clusters with the entire organization

Regular compute clusters can now be shared with the entire organization in one click from the cluster Access drawer, in addition to per-group sharing. A new Organization row sits above the groups list and supports the same admin / writer / sudo / login tiers, with higher tiers superseding lower ones across every group row.

The chat interface renders agent transcripts with tool calls, diffs, subagents, and approvals

The chat interface can now render agent transcripts: tool calls with per-tool summaries and expandable results, file-edit diffs, subagent activity cards, interactive permission prompts, and task checklists

Bug Fixes

• Dropdown icons don't show after being selected
• A dropped connection mid-response ends the turn instead of retrying
• A failed snapshot cannot be deleted and stays on the list forever
• A modal's confirm button stops working after a failed action
• Scrolling up during a streaming reply snaps back to the bottom
• Standalone chat app shows no favicon in the browser tab
• The conversation list cannot be resized
• Allocation dropdowns show a blank option instead of naming it
• GET /api/auth/session returns a server error for cluster and instance tokens
• Canceling a workflow waits for the whole step retry interval before stopping
• Capitalized configuration names break the workflow editor preview
• Changelog feature entries lose their description and acronym titles lose their casing
• Help text drops underscores, misplaces spacing, and omits credential file locations
• pw commands fail on compute nodes without external network access
• Command palette intermittently does not open via cmd+k or the search button
• Compacting a pw code session containing images does not free up context
• Complimentary accounts count against an organization's remaining seats
• Deleting a cloud account leaves its buckets and clusters unusable and undeletable
• Deleting checked files can remove them from a previously viewed folder
• Destroy is not styled as destructive in the storage right-click menu
• Duplicated workflows lose uploaded thumbnails
• Failed and running tool calls do not fold into the run that summarizes them
• Fractional group allocations save as 0
• GCP clusters with flex startup and a placement group fail on most GPU instance types
• Google clusters lose SSH access after stopping and resuming
• Google Tier 1 selection does not adjust the cost estimate
• Grouping and ordering dropdowns overlap in the list display menu
• HPC Connect fails with an opaque error and no recovery path when the remote home directory is over quota
• Instance status filter only offers statuses that already appear in the list
• LDAP test connection cannot test a saved auth method without re-entering its credentials
• List display options menu crowds the "Always show actions" toggle on pages without grouping
• Long pw code turns stop with "exceeded maximum iterations"
• Mistyped commands on cluster nodes print a dnf repo error instead of command not found
• Newly added AI provider is missing from the providers list
• No loading indication while navigating between pages
• Oracle cluster cost estimation shows "Unable to estimate cost" and block volume prices are too high
• Organization sections you have no access to are listed in the org navigation
• Kubernetes pages cannot save filter state and show inconsistent namespace filters
• pw code keeps reporting the permission mode the session started in
• pw code bypass permissions still asks for Explore read approvals
• pw code edit diffs silently lose their line numbers
• pw code ends the turn with a GOAWAY stream error instead of reconnecting
• pw code gives up on an upstream provider error it was told to retry
• pw code main agent messages in a subagent view have no background to set them apart
• pw code plan and read-only modes refuse commands like git status
• pw code plan mode never offers to start implementing the plan
• pw code shows only the first 50 characters of a long tool call command
• pw code shows raw LaTeX in model responses
• pw code subagent views have no spinner line while the agent works
• pw code subagents fail after 10 minutes while still working
• pw ssh resolves another user's missing cluster to the org's managed cluster
• pw vscode help suggests a resource format the command rejects
• Read-only code editors accept typing
• Saving a running cluster shuts down partitions that were never edited
• Scheduler log filters miss bracketed severity levels
• pw code WebFetch can reach internal services through DNS rebinding
• Session history and logs are unavailable while a cluster is off
• Snapshot action is disabled on the cluster details page when the cluster is stopped
• SSH to an instance is refused with permission denied for the owner's key
• Stopped endpoint sessions always show a disabled open-in-new-tab button
• Storage list Size column is blank for Azure NetApp Files
• Storage panel mislabels the controller root filesystem as the root disk
• Storage thumbnails upload to legacy disk storage instead of the thumbnail library
• Streaming pw code responses flash between formatted and unformatted
• Tags on the instance detail page sit against the row divider
• The cloud account page's Actions menu has no delete option
• The cluster details and definition tabs show different attach storage dialogs
• The explore subagent reads raw git objects instead of running git

Other Changes

• Faster installation and upgrades with compressed downloads
• Retire the classic navigation UI

Enhancements and Features

pw ssh configure writes a ready-to-use OpenSSH config entry for a resource

pw ssh configure <resource> writes a ready-to-use OpenSSH config entry that connects through the platform, so plain ssh, scp, rsync, sshfs, and IDE remote extensions just work. Concurrent SSH sessions share one connection that safely outlives any single terminal.

pw code background agents render as a grouped launch tree with completion lines

Background subagents in pw code now announce as a single grouped launch notice with one line per agent, and each completion appears as an Agent "…" finished line with its run time. The transcript stays compact while agents work, and the launch notice points at the switcher for live progress.

pw code tool calls are named by what they do, not the internal tool

pw code tool calls now name the file instead of the tool's internal argument list — Update(config.go) rather than EditFile(file_path: "config.go") — and edits say what they changed, showing Added 12 lines, removed 16 lines above the diff.

Bug Fixes

• pw code mangles code blocks, merges consecutive lines, and drops text in angle brackets
• Existing clusters always route SSH through the platform
• GCP node creation fails when a placement group is enabled
• pw code diff colors are washed out
• pw code ignores AGENTS.md and system instructions on models with emulated tool calling
• pw code stalls mid-task waiting for tool results that never arrive
• pw code strikes through the checkbox on completed todos and doesn't mark which one is running
• pw code subagent failures show no reason anywhere in the TUI

Enhancements and Features

Preview large logs and text files from either end

Large text files and logs now preview in the Storage Explorer instead of offering only a download — you get up to the first 5,000 lines of a file of any size. A new Head/Tail toggle jumps to the end of a file, so you can read the tail of a large log without downloading it.

Subworkflow steps expand inline in the run dependency graph

Inline subworkflow graphs are now the default in a run's dependency graph: clicking a subworkflow step expands it in place (nested), with an "Expand all" control and a per-step shortcut to open it in its own graph. Expanding or collapsing jobs, matrix groups, and subworkflows now animates smoothly in both the graph and the summary sidebar.

VS Code and SSH reach compute nodes through the worker's own tunnel

VS Code and SSH sessions on compute nodes now connect through the worker's own tunnel, authenticated by your platform-registered SSH key — no more password prompts or manual authorized_keys setup on clusters whose compute nodes only trust the login node's key distribution. The pw vscode --node flag is now --jump-node, reflecting that it jumps through the login node to the node's system SSH daemon.

Bug Fixes

• Deleting an instance fails when a deleted instance has the same name
• Partitions with capacity reservations fail to start nodes with ReservationCapacityExceeded
• pw code failed subagents still look like they're working in the agent list
• pw code labels general-purpose subagents "default(...)" instead of Task(...)
• pw code retracts queued message on esc instead of sending it
• pw code shows the agent's todo list as raw tool arguments instead of a checklist
• Storage explorer can't preview or download some files on Google and Azure buckets
• Workflow editor suggestions stop appearing until the page is reloaded
• A deleted controller disk snapshot provisions a blank disk or fails with a cryptic error
• A snapshot still referenced by a cluster definition can be deleted
• A stale partition disk snapshot in a cluster definition permanently fails all compute node provisioning
• A worker reconnect kills a live VS Code or SSH session on its compute node
• Attaching a persistent disk to a running cluster never mounts it on the node
• pw code turns fail after recoverable stream interruptions
• Cluster definitions can save snapshot references that provisioning will reject
• Connected clusters never detect Slurm or PBS when the scheduler is only on the login shell PATH
• Copying an IP or MAC from the network interfaces list navigates away
• Desktop terminal opens a dead-end SSH self-loop error window instead of a shell
• Duplicated instance keeps the original display name instead of the name you entered
• Forked marketplace storage is invisible to organization admins
• Form dropdowns are unlabeled for screen readers
• Hpc6a instances are offered in us-east-1 where they are not generally available
• pw code buries the conversation in raw tool output and ctrl+o does not expand it
• pw code resume picker lists command-only sessions as "(empty session)"
• pw commands create the SDK client multiple times per invocation
• pw environments ls only lists environments on your own active clusters
• Resuming a session dumps a subagent's full report into the main transcript
• Session cost limit input allows 0 or negative values
• The cluster page gives no explanation when a provision is skipped or fails
• The image compliance page misses controller disk snapshot findings
• Two divider lines appear above the user name in the new sidebar
• View owner button overlaps the status pill on the admin workspaces page

Enhancements and Features

Network interfaces with static MAC addresses

Network interfaces are now a first-class resource in ACTIVATE. Reserve a network interface with a static MAC address (and an optional static public IP), then attach it to a cluster controller so the MAC persists across delete/recreate — ideal for MAC-locked license servers. Supported on AWS, Google Cloud, and Azure.

Organization admins can add marketplace items to a member's account

Organization administrators can now add a marketplace cluster or storage item straight into another member's account from the Add to account dialog, under Advanced. This makes it possible to set a teammate up with a starter resource without signing in as them. The action is recorded in the audit log against the receiving member.

Cloud RDMA networks for GCP H4D instances

Parallel Works now supports GCP Cloud RDMA networks for H4D instances. Create an RDMA network in a GCP cloud account and attach it to an H4D cluster partition to get up to ~200 Gbps of low-latency RDMA between nodes for HPC and MPI workloads.

Provisioning failure notifications for clusters and instances

When cluster or instance provisioning fails, the owner now receives a notification explaining the failure and whether the cloud resources were rolled back or intentionally left running in debug mode. Recurring runtime alerts are no longer sent for failed resources.

Rename a saved session from the pw code resume picker

pw code's resume picker now lets you rename any saved session inline with F2, not just the current session via /rename.

Bug Fixes

• Attaching a disk to a cluster shows nothing in the storage table until the page is reloaded
• Deleting an Oracle network shows it as provisioned instead of deleting
• Publishing a cloud cluster to the marketplace does not carry desktop session settings
• A failed cluster partitions update leaves the cluster looking healthy
• A retried API request sends an empty body
• AI chat shows "[object Object]" instead of the error message
• AI Chat stops sending messages until the page is reloaded
• AWS cloud costs undercounted when the monthly billing report is split into multiple files
• Azure cluster bootstrap occasionally fails at the Configure DHCP Hostname step
• Cluster tags lose the space after each comma when the page reloads
• Compacting a long pw code session fails when the summary request exceeds the model's context window
• Cost dashboard shows no cost when realtime is excluded
• Creating a cluster briefly shows a 404 page
• Creating an environment on a connected existing cluster fails with "Cluster not found"
• Deleting a folder only removes its first 1,000 files
• Deleting storage or an instance fails with "User is required"
• Desktop session settings are discarded when saved on a running cluster
• Destroying a disk attached to a cluster leaves the AWS volume behind
• Dev local log view goes blank when scrolling up past the first line
• Emulated tool calls fail with nonce and format errors weak models can't correct
• General notifications default to disabled for new users
• Long model names overflow the chat model selector
• Newly uploaded AI chat attachments only appear after a page refresh
• pw code --no-tools prints raw tool-call markup instead of an answer
• pw code freezes forever on a glob pattern with brace groups
• pw code model picker key hints are scattered
• pw code rejects a second image on a model that supports images
• pw ssh sessions to clusters on peered networks end abruptly instead of resuming
• Quick launch cards overlap each other on narrow screens
• Session filter on the cost dashboard never populates
• Some provider models report a 128K context window instead of their real size
• Stopping a cluster from the right-click menu does nothing
• Tooltips are not showing for run actions in the workflow runs tab
• Typing 0 in an instance vCPU or RAM filter clears the filter
• Clicking the copy icon shows two duplicate toasts
• Workflow name on an inline run links to a page that fails to load
• Workflow runs report why they failed to start instead of blaming a lost executor

Other Changes

• Kubernetes namespaces page slows down as a cluster gains namespaces
• Storage explorer stays responsive in folders with thousands of files
• Stop restating every tool description in the system prompt

Enhancements and Features

List bucket files as a table

pw buckets ls on a bucket now shows each file's size and modified time in a table, the same as pw buckets ls on your buckets and every other pw listing. Use -o list for the previous one-URI-per-line output, which is the form to pipe into other commands, or -o json for structured output.

Recursive delete for pw buckets rm

pw buckets rm -r deletes every object under a folder, telling you how many it found and asking before it starts. -f skips the question and treats an already-missing object as success, so pw buckets rm -rf pw://ns/bucket/folder/ works the way rm -rf does elsewhere.

Per-listing result limits for pw buckets ls

pw buckets ls --limit N lists at most N results, whether you are listing your buckets or the contents of one. It returns the same entries you would see at the top of a full listing, and stops fetching as soon as it has enough, so asking for a handful of entries from a large bucket is fast.

pw vscode opens compute nodes with --worker and --node

pw vscode can now open a cluster's compute node, not just its login node. Pass --worker <id> to open on the node running one of your compute workers, or --node <hostname> to name a node directly.

pw vscode schedules its own compute worker with --environment

pw vscode can now schedule its own compute node. Pass --environment <name> (with --param key=value for the environment's scheduling parameters) and it submits the worker, waits for the scheduler to start it, and opens VS Code on the node. The worker keeps running after you close the editor, so release it with pw workers delete when you are done. pw workers create also gained --wait.

Compute picker lists every environment across clusters in one dropdown

Requesting a worker or launching a VS Code/Desktop session now lists every environment you can use across all your clusters in one grouped dropdown, so you pick an environment (or the user workspace, a cluster's login node, or an existing worker) directly instead of choosing a cluster first.

Bug Fixes

• Azure bucket commands fail after 100 seconds with a permissions error
• A user's groups table leaves empty space after the remove button
• A double slash in an Azure path lists a different folder than cat and cp use
• A mistyped pw command does not suggest the command you meant
• Copying an S3 folder without -r copies it anyway
• Copying between two buckets reports a missing local file
• Listing a public S3 bucket crashes the CLI
• Listing an Azure container never finishes
• Listing an S3 bucket stops at 1000 objects
• pw buckets ls ignores -o json when listing files
• pw buckets rm reports success for objects it did not delete
• Recursive copy reports no objects when a folder starts with directory markers
• Recursive upload drops the folder name, unlike cp and rsync
• Uploading into a bucket folder from Windows puts a backslash in the object key
• Connecting to a session on another user's cluster drops immediately
• pw code freezes while /compact runs
• Logs command shows raw control codes instead of colors

Enhancements and Features

Cluster disk size prefills from the selected snapshot

Cluster disks restored from a snapshot now automatically fill in the snapshot's size, so you no longer have to set it by hand. You can still increase the size to provision a larger disk.

Cluster suspend time accepts SLURM-style duration notation with a never-suspend option

Cluster partition suspend times can now be entered as SLURM-style durations (DD-HH:MM:SS or HH:MM:SS) instead of raw seconds, with a "Never suspend idle nodes" checkbox replacing the magic -1 value.

Create empty folders in the storage explorer

The storage explorer can now create empty folders in writable storage locations from the toolbar or a folder context menu. New folders appear immediately and remain available before any files are uploaded.

Expand subworkflow graphs inline in the dependency graph

You can now open a subworkflow's dependency graph inline on a run — a new icon on each subworkflow step expands it in place (nested, including subworkflows within subworkflows and matrices) instead of navigating away. A preview, Inline Subworkflow Graphs, makes inline expansion the default click and adds an "Expand all" control.

Matrix job index available as $PW_MATRIX_INDEX inside workflows and subworkflows

Workflow steps and subworkflows in a matrix job can now read the worker's index from the PW_MATRIX_INDEX environment variable, instead of parsing it out of PW_JOB_DIR. The variable is empty when the workflow runs outside a matrix.

Natural text editing in pw code search boxes

pw code's search boxes (model, allocation, settings, and resume) now support full text editing: word motion, word delete, home/end, and mid-string cursor.

PBS queues report node capacity and take a project account

PBS clusters now report each queue's node capacity, so a session or worker asking for more nodes than a queue has is caught before it reaches the scheduler, and a queue that has been stopped is shown as down. PBS environments also gained an Account field for clusters that require a project or allocation code.

Require account and QoS per environment, hidden when the cluster doesn't use them

Environments now require an account and QoS on clusters that enforce them, hide those fields on clusters that don't use accounting, and keep them optional (under Advanced) everywhere else — so you only pick an account or QoS when your cluster actually needs one.

pw code auto-compacts based on the model's context window

pw code now auto-compacts based on the selected model's effective context window, preserving substantially more history on large-context models while protecting smaller ones from overflow. Context windows are detected automatically when possible, and organization admins can set a validated per-model override when needed.

See why a cloud account's credentials check failed and re-run it

Cloud account credentials checks now show what failed. When a check fails, the cloud account page lists the permissions the credentials are missing — grouped by service and copyable in one click — or the reason the check could not run, and org admins can re-run the check from the Actions menu without re-entering credentials. Rotating an account's credentials automatically re-runs the check.

Skills support in pw code

pw code now supports skills — reusable instruction sets defined in SKILL.md files that can be invoked as slash commands or automatically by the agent.

Sticky message header while scrolling in pw code

pw code now keeps the prompt for the current turn pinned to the top of the transcript while you scroll a long response, so you never lose track of what's being answered. Click the pinned prompt to jump back to it.

Bug Fixes

• A cluster hangs at connecting forever when the login node stalls the SSH handshake
• A cluster stays stuck at connecting when the proxy cert server stops responding
• A rejected scheduling parameter does not say which parameter was wrong
• Add-resource dialogs close and discard entered input when you click outside
• API docs render oneOf schema variants as one flat list
• Cannot assign a fixed IP to a cluster while another cluster holding it is turned off
• Cloud account permission errors are dumped into an unreadable toast
• Large web fetches break pw code sessions
• Collapse environment scheduling parameters behind an Advanced toggle
• Connecting to a cluster hangs forever when the SSH certificate server stops responding
• Deleted failed network still shows failed
• Desktop sessions report Apptainer/Singularity missing when it is installed in /usr/local/bin
• External authentication permission errors leave the page loading
• GovCloud AWS cloud accounts fail credential validation
• Icon behaving inconsistently on marketplace
• Kubernetes clusters and namespaces pages show a Filters heading with no filters
• Long error toasts overflow their box instead of wrapping
• MFA page shows Dashboard as its page title
• Overlapping workspace mount paths save without error and only fail when the connection starts
• Owner column avatar and name sit higher than other cells in list rows
• Permission manager shows raw permission strings instead of readable labels
• Desktop and VSCode sessions can request extra tasks that only reserve idle slots
• pw code PR descriptions don't follow the repository's PR template
• pw code subagents can run indefinitely and show failures as completed
• Remote workflows are missing the Duplicate action
• Scheduling onto an environment ignores its default parameters
• Sending an admin notification to an organization fails with 'Organization not found'
• Session details drawer shows stale data and survives deletion
• Some cloud accounts can't be deleted and show "Unknown error"
• Storage created with a space in its name fails to provision
• Storage explorer drag-and-drop upload border stays stuck on parent folders
• User workspace shows as raw JSON in workflow form resource fields
• Zone stays editable in the cluster definition while the cluster is running

Enhancements and Features

Flex-start duration fields accept SLURM-style DD-HH:MM:SS notation

Flex-start Wait Time and Max Run Duration for Google cluster partitions can now be entered as SLURM-style durations (DD-HH:MM:SS or HH:MM:SS) instead of raw seconds, with inline validation of the allowed ranges.

Organization default resources added to every new user account

Organization admins can now choose default resources on the onboarding settings page. Clusters the organization has published to the marketplace can be marked as defaults, and they are automatically added to each new user's account when the account is created.

Bug Fixes

• New notifications no longer appear as a toast in the bottom right
• pw forward tunnels hang silently instead of reconnecting when the connection dies
• Storage explorer previews fail for Google Cloud Storage buckets
• Subworkflow input defaults ignored when invoked via uses without with
• Canceled workflow steps running over SSH hang until the cluster connection dies
• SSH workflow steps hang instead of reconnecting or canceling when the cluster connection silently drops

Enhancements and Features

Download folders as zip from the editor

Folders can now be downloaded from the workspace editor: right-click a folder in the file explorer and choose "Download as Zip". This works around the browser error ("can't open this folder because it contains system files") that blocks native folder downloads.

Normalized reasoning effort with per-provider translation in the AI gateway

Reasoning effort settings now apply across all AI gateway providers with one normalized vocabulary (none–max), including Claude models where the setting was previously ignored, and every response reports the effort actually in force via the X-Reasoning-Effort-Applied header.

Per-model reasoning effort capability data in the models API with unsupported-level rejection

The models API now reports which reasoning effort levels each model supports (reasoning_efforts), and the gateway rejects unsupported levels up front with the supported list instead of surfacing an opaque provider error — levels are never silently downgraded.

Reasoning effort selection in pw code

pw code now supports selecting the model's reasoning effort. Run /effort for an interactive slider (or pass --effort <level>) — the slider offers exactly the levels the current model supports, and the status line shows the effort actually applied to each request.

AI chat reads text from Word, Excel, PowerPoint, CSV, and HTML attachments

AI chat can now read the contents of Word, Excel, PowerPoint, CSV, and HTML attachments, not just PDFs. Attached documents are converted to text so the assistant can answer questions about them directly.

AI usage breakdown by client

AI usage dashboards can now group token consumption and spend by client, distinguishing ACTIVATE web chat, PW Code, browsers, and other API clients.

Audit events log for sensitive actions

Audit events: a searchable, exportable log of sensitive actions. Platform admins see every organization on the new Admin → Events page, organization admins see their own organization's events, and resource owners get per-resource Events tabs on clusters and storage. Event retention is configurable through a platform or organization policy.

CLI build identity available on demand

The PW CLI can now display its exact artifact version and source commit through pw version or structured JSON output. The existing pw --version output remains release-only.

Configurable OIDC claim mappings

Organizations can now configure which OIDC userinfo claims map to a user's Platform username, email, external identifier, and optional Unix UID. This helps OIDC integrations work with providers that use claims such as preferred_username, upn, oid, or uidNumber.

Custom session icons with workflow icon inheritance for endpoints

Sessions can now have custom icons: pick one from the icon library on the sessions page. Endpoint sessions started by pw endpoints inside a workflow run automatically inherit the workflow's icon.

Edit YAML values for installed Helm releases

Edit the YAML values of an installed Helm release directly from its detail page; saving creates a new revision.

Governed AI integrations for organizations

AI is now a governed platform product: it starts disabled, and platform administrators choose which organizations and which providers are allowed from Admin Products. Until AI is enabled, existing AI connections are suspended rather than deleted, and they return with their configuration, models, and usage history intact once policy allows them. Users create personal AI providers (vendor API keys, Codex subscriptions, managed Azure, or session-hosted models) from the enabled catalog, organization administrators register shared connections with models, billing rates, and group access, and chat lists every provider you can use with billing-group warnings.

Orgs can customize which onboarding steps new users see

Organizations can now customize the new-user onboarding wizard from the org Onboarding page: the Resources and Workflows steps can each be toggled off, and the recommended items for each step are managed in the same place. The wizard also finishes directly from its last step — the separate completion screen is gone.

Paginate uploaded thumbnails on the Thumbnails settings page

Cleaner layout and pagination for your uploaded thumbnails on the Thumbnails settings page.

Per-step shell selection for workflow run steps

Workflow run steps now support a shell field (e.g. shell: bash -l {0}) to choose the shell that runs the step — for example a login shell so module and the cluster environment initialize on HPC clusters whose account login shell is tcsh. Only bash/sh are accepted. Defaults to the existing non-login bash, so existing workflows are unaffected.

Preview a session's chat history before resuming in pw code

pw code's /resume picker now lets you preview a session's chat history before resuming: press ctrl+t on a session to peek at its full conversation, then enter to resume or esc to go back.

Preview files in the Storage Explorer

Preview files directly in the Storage Explorer — images, video, audio, PDFs, code, Markdown, CSVs, and Jupyter notebooks open in the browser without downloading, streamed over a short-lived signed URL straight from the object store. Right-click any file in the list or the tree for quick actions, and use the new folder breadcrumb to move between folders.

Cache AI model list in pw code model picker

pw code models list will be cached for a short time so multiple /model commands in a row are instant. Press ctrl+r to refresh manually.

Profile picture upload

You can now upload a profile picture from Settings → Profile. Hover your avatar to change or remove it; the new picture appears across the platform right away.

pw ssh sessions survive tunnel drops and ingress restarts

pw ssh sessions to clusters now survive brief network drops and platform restarts, resuming transparently instead of disconnecting. Admins can enable this with the new "Resumable SSH sessions" platform setting.

Redesigned AI provider details page

Redesigned the AI provider detail and edit pages with a cleaner, card-based layout: an identity header, a provider info card, and a searchable model list. Organization providers now show a per-model pricing breakdown, and the edit view mirrors the detail view so model and pricing management stays consistent.

Reserved session subdomains

You can now reserve session subdomains so other users can't take them. Reserve a name from the Sessions page menu or with pw subdomains reserve my-app, then select it when creating a session with a custom domain.

Run pw code on a ChatGPT/Codex subscription

pw code and AI chat can now run on your ChatGPT/Codex subscription. Your usage draws on your subscription instead of per-token API billing.

Stream bucket object contents with pw buckets cat

Users can now print bucket object contents directly with pw buckets cat. The command supports every bucket provider available through PW URIs and produces byte-faithful output suitable for redirection and pipelines.

Subagents in pw code

pw code can now delegate independent sub-tasks to parallel subagents. The model issues Task calls that each run in an isolated context and report progress inline, so multi-part work happens concurrently.

Thumbnail library

Upload an image once and reuse it as an icon or logo across clusters, workflows, and organization themes from a centralized Thumbnails tab in Account settings.

Workspace files in the storage explorer

Workspace files now appear in the Storage Explorer. Browse your workspace home directory, download files, and delete files or folders directly from the explorer, alongside your cloud storage.

Bug Fixes

• Agentic requests to Azure OpenAI fail when reasoning effort is set
• Environment worker job failures show no detail about why they failed
• Adding partitions to a running cluster fails when it had none before
• AI provider pages hide model fetch errors behind an empty state
• Allocation threshold "Send to Group" toggle has no effect
• Bucket access checkboxes revert to their old state until the page is refreshed
• CLI commands with missing credentials do not explain how to authenticate
• Cloud account validation error lists duplicate required permissions
• Clusters and instances show both "Connect via SSH" and "Open Terminal" for the same action
• Create dialog dropdowns can grow taller than the screen
• Create session tooltip stays stuck open after selecting a compute resource
• Duplicating an instance does not keep a Windows cloud image selection
• Editing a workflow's tags does not save them
• Flex-start jobs are cancelled at the wait limit even after the node wins capacity
• Instances created in a private network can't reach the platform
• Long-running root disk snapshots time out, get deleted, and leave provisioning status stuck
• Managed cluster settings inherit and deleted nodes disconnect
• Managed Lustre fails to provision on private Azure networks
• Onboarding footer buttons are oversized and wrap on the cloud account step
• One slow node in a large batch causes all healthy cluster nodes to be deleted and reprovisioned
• Long agent questions, options, and messages are cut off in pw code
• pw code chat permanently stops after sending an image to a model without image support
• pw code shows raw JSON instead of the API error message
• pw ssh remote commands buffer all output until the command exits
• Reservation group dropdown lost its search filter
• Shift+enter in pw code sends the message instead of a newline in the platform terminal
• Snapshots cannot be deleted after their network is deleted
• Transient cluster connection loss kills healthy interactive sessions
• Unitless workflow timeout values expire after nanoseconds instead of seconds
• Windows instances fail to provision on networks that block certificate revocation servers

Enhancements and Features

CLI container image for Kubernetes sidecars

The Parallel Works CLI is now available as a minimal multi-architecture container image for Kubernetes sidecars. The image runs without root and includes no shell or package manager.

New default workflow icon

The default workflow icon has been refreshed to a new workflow-path design, with dedicated light and dark theme variants.

Onboarding cloud account validation and host provisioning opt-in

Self-service organization owners can add and validate an AWS cloud account during onboarding.

Right-click context menu for chat sidebar conversations

Conversations in the AI chat history sidebar now support right-click: a context menu with Rename, Share, and Delete appears directly at the cursor, matching the row context menus available elsewhere in the app. The same actions remain available from the 3-dot button on each conversation.

Bug Fixes

• A group with missing estimated usage data stops allocation threshold alerts for all groups
• Application frame flashes before directing to login page
• Can't select or copy text typed in the chat prompt box
• Conditional form fields are treated as optional and silently discard values
• Desktop session configuration expands by default on existing cluster definitions
• Duplicating an instance fails with an OsType validation error
• Duplicating an instance sends non-boolean debug/bootstrap toggles
• Existing cluster agent spams nodeset errors every 30 seconds
• Failed controller node shows 1 active node when starting a cluster
• Instance status doesn't explain why it failed or when it will be removed
• Logging in from a session domain detours through an extra page
• Logging in from a session domain lands on a choice page instead of the session
• Model breakdown chart on AI usage page gets cut off with too many models
• Newly created org-wide AI provider doesn't appear until the page is refreshed
• OpenAI endpoints open in chat without crashing
• Password field appears in external authentication settings
• pw auth gives no recovery guidance for unreadable credentials
• Read-only bucket mount settings disappear in cluster edit form
• Resuming a pw code session dumps referenced @file contents into the transcript
• Saving a cluster config with cross-region storage only fails at start time
• Subworkflow step errors when its job sets a working-directory
• Time-based workspace scale-down shuts down containers regardless of age
• Underline the hovered row across pw code pickers and improve search bar
• Various propagation issues when runtime parsing workflow inputs

Enhancements and Features

Configurable bucket credential TTLs and GCS HMAC rotation via platform settings

Platform administrators can now tune bucket mount credential lifetimes and GCS HMAC key rotation (enable, max age, grace period, sweep cadence) from platform settings at runtime, with no environment changes or service restarts.

Filterable and clickable pw code pickers

pw code pickers now filter as you type, and most of them let you pick an item with a single click. The model picker also groups models by provider with clean names.

Read-only bucket mounts

Buckets can now be mounted read-only on clusters. Read-only sharing access is enforced automatically, and provider-scoped credentials prevent writes even when mount credentials are inspected on the cluster.

Read-only bucket mounts show a read-only indicator in the cluster storage panel

Read-only bucket mounts are now marked with a "Read-only" indicator in a cluster's attached storage list.

Bug Fixes

• Architecture is not set when adding a partition with a default instance type
• Azure Files SAS signing still uses the account root key
• Instance create shows "Unknown error" instead of the real validation message
• OpenPBS icon renders oversized in cluster lists
• Running a migration for the first time shows a "Rerun Migration" confirmation
• Storage access save confirmation styles its Save button red like a destructive action

Enhancements and Features

Deployment health reporting

Deployments now share a small, PII-free health snapshot with Parallel Works so support can catch expiring certificates, failed renewals, and outages early. Reporting is on by default and can be reviewed or disabled at any time from the new Health Monitoring tile on the admin integrations page.

Account time zone setting with automatic detection

Your account now has a time zone, detected automatically and adjustable under Settings → Time Zone. Dates and times across ACTIVATE follow it, profiles show each user's local time, and ACTIVATE offers to update your time zone when your device's zone changes.

Attributed-to and poster on the usage events page

The allocation usage events page now shows who each usage event is attributed to and who posted it.

Per-type context menus and columns in the Kubernetes Resources home widget

The home Kubernetes widget (now Kubernetes Resources) supports every resource type — PVCs, services, config maps, secrets, and Helm releases now get the same right-click actions, navigation, and columns as workloads, matching their list pages. Its + button also became a chooser for adding workloads, config maps/secrets, or Helm charts.

{path} token for apps served under a path-based endpoint

pw endpoints run gains a {path} token (and PW_ENDPOINT_PATH env var) that expands to the base path your endpoint is served under. Pass it to an app's base-path setting — for example jupyter lab ... --ServerApp.base_url={path} — so apps work over a path-based endpoint (--no-subdomain) without hardcoding the session prefix.

Read-only bucket sharing

Buckets can now be shared read-only: grant a group the new Read-only permission and its members can browse and download bucket contents with credentials that cannot write or delete, across AWS, Google Cloud, Azure, and Oracle.

Show instance architecture when limiting instance types

The organization instance-type restriction picker now shows each instance's CPU architecture (amd64/arm64) alongside memory and vCPUs.

Try the new navigation in one click from the legacy layout

Users on the legacy layout now see a dismissible banner offering the new navigation experience. One click switches instantly with no reload, and you can switch back anytime from Feature previews in your account menu.

Web terminal supports clipboard copy and pw code image paste

Web terminal copy now works for terminal apps that use OSC 52. When running pw code from the web terminal, pasting an image from the browser clipboard attaches it to the prompt.

Bug Fixes

• A transient credential error unmounts healthy bucket mounts
• API docs response section is blank until you click a status code
• AWS provider icon shows stale oversized version from browser cache
• Bucket owners are denied permission when adding CORS rules
• Cluster provisioning fails with cryptic AWS error when an external IP is attached to a private-mode network
• Home dashboard widget deleted via "Delete module" reappears after reload
• Inbox page hangs when notifications contain very large messages
• Instance selector shows every size when both arm and amd arch filters are on
• Long Azure image IDs on the admin images page force horizontal scrolling and overlap the row actions
• pw code drops command output instead of recording it in the chat
• pw code output looks washed out in light web terminals
• pw code up-arrow shows command output blocks after resuming a session
• Single instance list not filtered by allowed instances
• Tooltips stay stuck on screen when moving the mouse between controls
• Unable to create single instance
• Workflow Build breadcrumb links to a dead page
• Remove unused workspace port field shown when creating a Kubernetes tunnel session

Enhancements and Features

Simplify CLI auth command

pw auth now prompts for either an API key or a short-term token. Existing pw auth token <token> and pw auth apikey <key> commands continue to work for compatibility but are hidden from help.

Bug Fixes

• pw code aborts long turns with an exceeded-maximum-iterations error
• Organization user page breadcrumb is missing the organization trail
• Unable to run desktop sessions on cloud clusters
• GNOME desktop sessions fail on first launch and only work on retry

Enhancements and Features

Agent updates for existing clusters and tunnel-based cloud agent updates

Existing clusters now have an Update Agent button. Cloud clusters have improved messaging during updates.

Endpoint session type in the new session menu

The New session menu now includes an Endpoint option. It builds the pw endpoints command for exposing a local app, with knobs for the local port or socket, HTTPS, name, and subdomain, and copies the ready-to-run command to your clipboard.

Managed cluster sessions over the platform tunnel with session-node selection

Managed clusters can now run sessions entirely over the platform tunnel — no inbound SSH access or SSH proxying required. SSH, desktop, and VS Code sessions connect through the persistent tunnel held by the cluster's nodes, and the cluster settings page lets you pick the session node from a dropdown of registered nodes showing their live connection state.

MCP server support in pw code

pw code now works as an MCP client — connect external MCP servers to extend the agent with custom tools and prompts.

Detail page action buttons use the primary theme color

Detail-page action buttons in the new navigation now use your organization's primary theme color, giving primary actions a clearer, on-brand emphasis.

Pw code reads files outside the workspace with permission

pw code can now read files outside the workspace: approve interactively (the directory stays approved for the session), or pre-approve directories with the new repeatable --add-dir flag.

Show snapshots root images status

Bootable snapshots now display the base image they were created from, including its ID, name, and whether that image is still active, retired, or no longer available.

Tool-result images delivered natively to Anthropic providers

Vision models on Anthropic AI providers can now see images read by pw code tools.

Tool-result images delivered on the chat-to-Responses gateway bridge

Vision models behind Responses-capable AI providers now receive images read by pw code tools even when requests arrive over the chat completions API.

Tool-result images reach Chat-Completions-only vision models

Vision models on Chat-Completions-only AI providers (including azure and open-weight endpoints) can now see images read by pw code tools.

Bug Fixes

• Cluster summary hides network and billing group when unset
• Managed cluster node agent update state is unclear and errors on up-to-date nodes
• Platform SSH key lookup fails on clusters without sshd drop-in config support
• Pw code elapsed time keeps counting in raw seconds past a minute
• Pw code status line garbled by macOS malloc diagnostics
• Snapshotting a cluster inline disk captures the root disk instead
• SSH key login fails on managed clusters with SELinux enforcing
• Unable to create az files in private network

Enhancements and Features

New modal for resources to choose icon from thumbnail library

Resource icons can now be picked from a personal thumbnail library or a curated set of presets, with a single modal that works across workflows, clusters, Kubernetes clusters, and organization logos. Uploaded images are reusable across resources instead of being re-uploaded each time.

pw code attaches images referenced by @path

You can now attach a local image in pw code by referencing its path with @ (for example @../diagram.png or @~/Downloads/diagram.png) — it's sent to the model as an image, just like pasting one. This works on remote systems where clipboard image paste can't reach your local clipboard: copy the file to the host and @-reference it.

pw code speaks the Responses API natively to capable providers

pw code and the web chat now talk to Responses-capable OpenAI providers over the native OpenAI Responses API, selected automatically per model. pw code keeps GPT-5's encrypted reasoning context across turns for better multi-step tool use, and can show images from tool results (like reading an image file) to GPT-5 models natively.

pw code suggests scp + @path when image paste fails over SSH

When you paste an image in pw code over an SSH session, the message now explains that your local clipboard isn't reachable and suggests copying the file over and referencing it with @path, instead of a generic "no image" error.

Responses API routing for OpenAI-compatible AI providers

Custom OpenAI-compatible AI providers can now opt into the OpenAI Responses API with a new "Responses API" toggle on the provider add and edit pages. Responses-routed providers no longer drop the configured reasoning effort when tools are in use with GPT-5 reasoning models.

Bug Fixes

• Already-deleted azure nodes treated as hard delete failures
• Clusters stay stuck "provisioning" after a failed cluster create
• Creation box closes and discards input on outside click
• Deleted resources stay marked provisioned when the post-delete status update fails
• parallelworks/checkout action ignores working-directory
• pw code @ picker shows nothing for paths like @.. or @~/Downloads
• pw code copy shows "copy unavailable" on remote systems
• Snapshots appear in the cluster attach storage list
• Subworkflow logs unviewable when a working-directory is set

Enhancements and Features

Automatic TLS certificates for platform domains via Let's Encrypt

Platform domains can now get their TLS certificate automatically from Let's Encrypt. Instead of uploading a certificate, an admin turns on "Automatic certificate" for a domain and points its CNAME at the platform; the certificate is issued over HTTP-01 and renewed automatically before it expires.

Clipboard image paste in pw code

You can now paste images directly into pw code: press ctrl+v to attach a screenshot or diagram from your clipboard, and the agent sees it alongside your prompt. Pasted images show up as an inline [Image #1] placeholder you can cmd+click to preview, and large images are automatically resized to fit provider limits.

Multiple sessions domains for endpoint and session subdomains

Platforms can now register multiple sessions domains: endpoint and session subdomains can be created under any registered sessions domain (pw endpoints run -s myapp.domain2.com), with bare labels landing on the default one.

Notification when image is being retired

Admins can now schedule a retirement date for a machine image. Users with a running cluster or instance on the image are notified in-app and by email when the date is set and again one week and one day before, and the image becomes unavailable on the chosen date.

Interactive /settings menu for pw code

pw code now has an interactive /settings menu — run /settings to search and change your permission mode, the co-authored-by commit trailer, auto-scroll, reduce-motion, and your model and allocation without leaving the session. Menus and pickers open as a panel at the bottom of the screen without scrolling your conversation.

pw code ! shell mode runs commands and adds output to the conversation

pw code now supports a ! shell shortcut: type ! followed by a command (e.g. !git status) to run it locally in your workspace, in your own shell, without going through the agent. The command's output is added to the conversation, so you can immediately ask the agent to act on it.

pw code requires a second esc to clear the prompt

In pw code, clearing the prompt now takes two esc presses — the first shows an Esc again to clear hint — so a stray esc won't wipe what you were typing.

pw code shortcuts overlay behind a single ? hint

pw code now shows a single ? for shortcuts hint at an empty prompt that expands into a keyboard-shortcuts grid, replacing the cramped keybinding footer.

Bug Fixes

• Bucket lingers in provisioning state when create is rejected
• Deleting a workflow can hang until the workspace jobs folder is cleaned up
• Detail page action menus are missing the actions available in the list right-click menus
• Jupyter lab exposed via pw endpoints returns 403 for non-local Host
• pw code agent permission prompts blend into the chat transcript
• pw code menu and picker scroll moves the selection instead of the chat
• pw code agent questions do not properly separate from chat
• Session delete tooltip covers the add new session button
• Viewing a user from the admin panel leaves the admin section
• Viewing a user from the org page leaves the org context

Enhancements and Features

New Navigation available as a public feature preview

New Navigation is now available as a public feature preview. Anyone can turn it on from the Feature Preview page to try the redesigned sidebar layout, which moves the workspace logo, global search, and account menu out of the top bar to give page content more vertical space. You can switch back at any time.

Endpoint sessions for self-served web apps

Run a local web app as a session: pw endpoints create --port <port> dials out and registers a reverse tunnel, serving your app at its session URL with no inbound network access required.

Bug Fixes

• Home Sessions Delete/Details can silently do nothing
• Logged-in dashboard crashes with "Something went wrong"
• pw session connect fails for tunnel sessions on user-owned clusters
• pw vscode cannot connect on Windows
• README doesn't render on workflows added from local marketplace items
• Terminal corners show a white border with non-default terminal themes

Enhancements and Features

pw groups and allocation permission CLI commands

Adds pw groups commands for full group management (create, update, delete, roles, and member management) and pw billing allocations permissions commands to grant, revoke, and list allocation access for groups or the entire organization.

Show running workspace version in admin workspaces list

Admins can now see the actual platform version each user workspace is running, directly in the admin workspaces list.

Bug Fixes

• Deleted instance types show as a blank entry in the allowed instance types list
• Long image digest overflows the workspace version mismatch tooltip
• Orphan resource alerts fire for idle nodes on never-suspend partitions
• pw CLI commands fail with "Organization not set" inside a workspace

Documentation Changes

• scp example command fails on macOS with illegal option -- O

Enhancements and Features

Create ConfigMaps, Secrets, and interactive sessions for Kubernetes resources

Create ConfigMaps and Secrets directly from the Kubernetes console, attach private-image pull secrets when launching workloads, and create interactive sessions to your deployments, pods, and services — from the workload form or any resource detail page.

Simplify allocation threshold configuration

Allocation thresholds are simpler to configure: notification emails use a single built-in template instead of a custom per-threshold one, the name, description, and label color fields are gone, and a threshold can now be set above 100% to act on groups that overspend their allocation.

Bug Fixes

• Cannot edit the image of a published marketplace item
• Managed cluster jobs tab is empty on managed clusters
• Allocation usage events fail to load when the allocation has AI usage
• Billing usage and SKU endpoints hide the real error behind generic messages
• pw upgrade fails with an auth error when not authenticated
• Allocation threshold action descriptions are inaccurate and missing
• Workflow create help text wrongly says it loads starter files into the workspace

Enhancements and Features

Flex-start provisioning mode and GPU accelerators for GCP cluster partitions

GCP cluster partitions now support flex-start provisioning, which queues for scarce or GPU capacity through GCP's Dynamic Workload Scheduler and starts when capacity is granted, with a configurable wait budget so jobs don't hang indefinitely. You can also attach GPUs (type and count) to N1 partitions and see their hourly price reflected in the cluster cost estimate.

Bug Fixes

• AWS logo appears cropped and distorted in workflow, marketplace, and cluster thumbnails
• AWS billing costs duplicated when the first raw billing file has no billable rows
• Cannot stop a cluster that was destroyed and recreated (stuck "provisioning")
• Org logos invisible (white-on-white) on the admin users page
• pw upgrade --canary re-downloads even when already on the canary version
• Self-orphan check only works on slurm version 23
• OS image search bar on single VM form keeps closing

Other Changes

• Store agent port files in ~/.local/state/pw
• Move pw CLI config, cache, and state to XDG base directories
• Stop creating the unused ~/pw/workflows directory
• Store pw credentials in ~/.config/pw (CLI + Go SDK)

Enhancements and Features

pw code attribution on commits and pull requests

pw code now attributes the commits and pull requests it generates, adding a "Generated with pw code" line (and a Co-Authored-By trailer on commits). It's on by default and can be turned off with the includeCoAuthoredBy setting.

pw upgrade --canary installs the canary CLI build

pw upgrade --canary upgrades the CLI to the canary build, regardless of which platform you're authenticated to.

pw workflows runs logs --run-level for the run-level executor log

pw workflows runs logs now accepts --run-level to fetch the run-level executor log, which surfaces SSH/connection/executor errors that occur before any step produces its own log.

Bug Fixes

• CLI commands abort on transient network errors instead of retrying
• Workflow build preview crashes when clicking a step under a job
• Workflow with a non-string ssh.remoteHost stalls silently with no error
• Apptainer desktop sessions launch the host environment instead of the container
• Cannot save instance type restrictions unless every cloud provider is configured
• Cloud account detail and network pages have no padding against the sidebar
• Connect quota error suggests site-specific storage command
• Dashboard alert icon on a failed cluster collapses the widget instead of opening its log
• Loading a marketplace config onto a cluster carries over persistent disks
• Marketplace "latest" loads the last-published version instead of the highest
• Member added to a group doesn't appear in the group's member list
• Mobile scrolling reveals multiple screens of whitespace below the app
• Notification settings page stuck loading for users who haven't customized notifications
• Org logo in the Managed by column renders white-on-white
• Organization AI providers not visible to non-admin members
• Organizations page loads slowly with many organizations
• Password "Last changed" time does not update when an admin resets a user's password
• pw code /sessions message count includes AI replies and tool turns
• pw code /sessions tells you to re-run the CLI to resume while already interactive
• pw code messages render with no spacing between them
• pw code session timestamps are absolute instead of relative
• pw code WebFetch URLs truncate so cmd+click opens a broken link
• pw upgrade fails with a 404 on Windows
• Resume timeout reverts to 1200 when set to any lower value
• Stored SSH private key dates show as Invalid Date
• Updated logos, fonts, and icons can stay stale in the browser
• Workflow run page omits the created session link until a manual refresh

Other Changes

• Localize hardcoded frontend strings

Enhancements and Features

pw code AI coding agent

pw code is a new AI coding agent that can read, write, and edit files in your workspace. It works with any AI model available on your ACTIVATE account, providing an interactive terminal experience with tool-calling, permission controls, and session persistence.

GPU-accelerated VNC desktop sessions via VirtualGL

VNC desktop sessions can now render on the GPU via VirtualGL. Cluster admins enable "GPU-accelerated rendering" in Desktop Session Configuration; each node also needs VirtualGL installed and `vglserver_config` run. The agent re-checks at session start and falls back to software rendering with a clear log line when any prereq is missing.

Marketplace item tags

Marketplace items now support user-defined tags. Publishers can tag items (e.g. slurm, k8s) when publishing or editing, with suggestions drawn from similar items. Visitors can browse and search the marketplace by tag.

Optional initial password when creating a user

Setting an initial password when creating a user is now optional. Leave it unset and the user can sign in later via password reset, or toggle it on to set one during creation.

Organization custom tags for cloud resources

Organization admins can now define custom key/value tags under Cloud → Custom Tags. These tags are automatically applied to every cloud resource provisioned for the organization across AWS, GCP, Azure, and Oracle, making it easy to attribute cost and enforce tagging policies. Reserved platform tags are shown for reference and can't be overridden.

Slurm jobs home page widget

Added a "My Slurm Jobs" home page widget that shows your running and pending Slurm jobs across all connected clusters in real time.

Terms and conditions on new-user onboarding

Platform admins can now set optional Terms & Conditions that new users must read and accept during onboarding. Acceptance is recorded per user.

Bug Fixes

• Bucket list filter omits Oracle buckets
• Cannot create instance with a name shorter than 5 characters
• Cluster detail page dropdown menu is cut off
• Descriptions in sidebar settings don't line up and get cut off when long
• Desktop and VS Code sessions lose the user's supplementary groups
• Duplicating a cloud-image instance fails with 'Operating System type is required'
• Empty partition cost estimate shows column headers with no rows
• Error page overlay covers sub-sidebars
• Missing description for the Editor item in sidebar settings
• New partition instance type does not default to the controller's instance type
• Organizations page can't display more than 100 organizations
• Legacy resource groups page crashes with infinite render loop
• Maintenance message missing from the new navigation
• Marketplace workflow with no README opens to an empty description page
• Primary button in modals shows black text instead of white
• Unsetting one sidebar field in settings unsets all of them
• XFCE PolicyKit Agent error dialog appears when starting a desktop session

Bug Fixes

• Cost explorer filters reset when navigating away and back
• Workspace API key gets invalidated while the workspace is still running

Enhancements and Features

Create an initial user as organization owner during org creation

When creating an organization, you can now optionally create an initial user. When a platform admin uses this option, the user is also set as the organization owner.

Oracle Cloud Clusters generally available

Oracle Cloud is now generally available. You can register Oracle Cloud accounts and provision instances, clusters, buckets, and NFS storage on Oracle directly through ACTIVATE.

Organization default resources are now recommended resources

The organization page formerly called "Default Resources" is now Recommended Resources (under Customize → Onboarding), reflecting what these items actually do: they are recommended to new users during onboarding rather than added automatically.

Preview adoption statistics on the admin previews page

Platform administrators can now see how many and which users have each feature preview enabled, directly on the admin previews page. Orphaned previews left over from removed features can be cleaned up from all user accounts with one click.

Recommended resources page uses onboarding-style selection cards

The organization Recommended Resources page now shows marketplace items as selectable cards with icons — the same cards new users see during onboarding — instead of a dropdown and table, making it clear at a glance what's recommended and what new users will experience.

Bug Fixes

• Browser tab title stuck on previous page
• Create Organization form submits with empty or invalid name
• Desktop sessions fail on hosts missing libxshmfence.so.1
• Organizations page shows an empty table while loading
• "Show Powered By" theme setting is shown to non-admins
• Ansible override fields persist when loading a cluster definition from marketplace
• AWS snapshot marked provisioned before ami finishes registering
• Billing group field is labeled "Group" on resource add and edit forms
• Chat page shows OpenAI sessions on clusters as "Service not responding"
• LDAP login with MFA shows session expired
• Non-square images are squashed and pixelated after setting an icon
• Root disk snapshot with no AMI stays stuck in deleting
• Selected card highlight is cut off on the left in organization and admin settings pages
• Vague "some platform-level policies" copy on the org policies page
• Workspace pegs CPU and clusters never reconnect after a dropped connection

Enhancements and Features

Cleaner desktop session view with open-in-new-tab in the toolbar

The "Open in new tab" button has been moved into the toolbar for desktop sessions, only showing up when you hover near the top of the screen. This lets us remove the top bar from the session, giving more real estate to the session.

Manage marketplace items from the command line

Manage the marketplace from the CLI with the new `pw marketplace` commands: list and inspect items, publish workflows/storage/compute, manage versions and icons, add items to your account, and move items between platforms with `export`/`import` bundles.

Create Kubernetes workloads from a guided builder form

You can now create Kubernetes workloads from a guided form. Choose a cluster and namespace, pick how it runs (one-shot Job, scheduled CronJob, or long-running Deployment/StatefulSet/Pod), and configure containers with image and CPU/memory/storage — ACTIVATE builds and submits the manifest for you. Power users can edit the generated YAML directly before submitting.

Desktop sessions generally available

Desktop Sessions are now generally available. Launch remote desktops (VNC) and remote VS Code sessions on your clusters directly from the cluster page or the sessions page.

Kubernetes provider generally available

The Kubernetes provider is now generally available. The Kubernetes provider enables organizations to centrally manage all their Kubernetes clusters through ACTIVATE’s unified interface.

By integrating your clusters with ACTIVATE, you can:

• View and monitor all clusters in one place
• Centralize role-based access control
• Monitor workload metrics and logs in real time
• Manage Helm charts and Kubernetes resources
• Federate kubectl access through ACTIVATE
• Attribute usage costs to teams and projects
• Define and enforce resource quotas and limits
• Launch shell sessions to pods and services via the ACTIVATE UI
• Run interactive jobs through ACTIVATE workflows
• Access interactive tools like Jupyter, RStudio, and MATLAB via secure in-browser Sessions
• Manage fractional GPU allocation via the NVIDIA GPU Operator

Monthly cost estimates in the cost estimator

The cost estimator now shows an estimated monthly cost alongside the hourly cost, so low-hourly-cost resources like managed disks display a meaningful estimate instead of appearing as $0.00.

Policy to prevent provisioning public IP addresses

Organization and platform admins can now enable a no-public-ip policy from the Policies pages to block users from provisioning standalone public IP addresses.

Reveal toggle for masked fields

Sensitive fields like cloud credentials now show an eye icon so you can reveal what you've typed while masking it by default.

Route existing-cluster SSH connections through the platform proxy

Existing clusters and private cloud clusters now connect from your workspace through the platform's SSH proxy.

Show hidden fields in the JSON configuration editor

The JSON configuration editor now has a Show hidden fields toggle that reveals fields normally hidden because they're specific to each resource (such as name and group), plus a Copy button to grab the full configuration JSON in one click.

Tooltips on cluster provisioning status icons

Status icons in the cluster provisioning view now show a tooltip explaining what each icon means.

Bug Fixes

• AI providers shared with you show "provider not found" when opened
• Billing group is not shown on AI provider details
• Canceling out of editing/adding a threshold sends you to the org page instead of back to thresholds
• Cannot create a root snapshot of an instance
• Creating SKU with duplicate code shows confusing error
• Destroying a cloud cluster doesn't show "Delete requested" in its provisioning status
• Duplicate instance shows wrong-architecture cloud images
• Partner organization on create organization page is a free-text input
• Storage options are not filtered by available networks
• Workflow log viewer clips long lines with no way to scroll

Enhancements and Features

Add Group by to ML Workspaces and IP Addresses pages

ML Workspaces and IP Addresses now support Group by, so you can sort large lists by namespace, status, provider (ML), or attached cluster (IPs).

Clarify onboarding suggestions on user defaults page

The User Defaults page now clarifies that default compute resources and workflows are suggested to new users during first-time onboarding, rather than provisioned automatically.

Command hints reflect the invoked binary name

CLI command hints (re-run, view-run, re-auth, and upgrade tips) now reflect the actual name you invoked the binary as, instead of always printing pw. If you've renamed or relocated the binary, the suggested commands now copy-paste and run correctly.

Helm preinstalled in workspace containers

Helm is now preinstalled in workspace containers and available on the default PATH. Kubernetes users can run helm directly from a workspace terminal without installing it manually.

Hide gen1 azure images when selected instance requires gen2

Azure instance cloud-image picker now hides Gen1 images when the selected VM type only supports Gen2.

Searchable kubernetes namespaces and clusters filters

You can now filter the kubernetes namespace and cluster dropdowns.

Simplify marketplace items to a single "Add to account" action

The marketplace now uses a single Add to account action instead of separate Fork and Favorite options. For workflows it adds a copy to your account (you can fork it into an editable copy later from the workflow page); for storage and compute it provisions the resource directly.

Bug Fixes

• API Docs "Try It" keeps the previous endpoint's inputs and some fields can't be typed in
• Cluster connection logs show a cut-off line in the wrong color after a reconnect
• Cluster icon shows a transparent rim when the cropper is panned past the image edge
• Clusters page shows no message when you have zero clusters
• Edit button is clickable on clusters shared with only login or sudo access
• Fork workflow modal warns that workflow file storage will be deprecated
• Home page widgets briefly show empty state on first login instead of loading
• k8s "Show equivalent YAML" button doesn't imply the YAML is editable
• Newly uploaded organization logo shows default icon instead of the uploaded image
• Some users not getting onboarding screen when the platform has it enabled
• Workspace mount section is buried inside cluster advanced settings
• Workspace mounts show on marketplace compute items

Enhancements and Features

Allow renaming of cloud accounts

Cloud accounts can now be renamed from the account's detail page. The change is metadata-only — existing cloud resources, billing buckets, and network tags continue to reflect the original name.

CLI allocation support for org-level AI providers

CLI AI chat commands now support org-level AI providers by prompting users to select a budget allocation interactively, or via the new --allocation flag in non-interactive mode.

pw workflows run --config to load saved input configurations

pw workflows run now supports a --config flag that loads inputs from a saved workflow configuration. You can combine it with --inputs to override individual values from the configuration.

pw ssh -J for ProxyJump through a pw:// jump host

pw ssh now supports -J <pw-jump-host> for connecting through a pw:// resource, mirroring OpenSSH's ProxyJump. This is useful for SSH-ing to private nodes (e.g. cluster compute nodes on non-peered networks) where the jump host is only reachable through the platform tunnel.

Desktop session terminal opens on host by default

VNC desktop terminals now open on the cluster host by default in Apptainer mode, so users see host PATH, modules and binaries. A new Container Terminal entry under Applications → System opens a bash inside the SIF container for users who need it.

Expose nsscache-required CoreWeave SCIM attributes

Adds the CoreWeave-specific attributes required for nsscache integration: SCIM Users now expose sunkLoginShell and sunkPreferredHomeDirectory, SCIM Groups expose a new CoreWeave extension with POSIX group identity, group members carry sunkPosixUsername, and the Groups endpoint honors ?excludeInactiveUsers=true.

Optionally cancel associated run when deleting a linked session

When deleting a session that was started by a workflow run, you can now choose to also cancel the run from the same modal.

Oracle file storage integration

Oracle File Storage (NFS) can now be provisioned and attached to Oracle clusters, enabling shared file storage for HPC workloads on OCI.

Organization's recommended onboarding items start selected

Organization recommended items on the new-user onboarding Resources and Workflows steps now start pre-selected, so new users adopt their organization's recommended defaults without having to click each one.

Restart button on Kubernetes workload pages

Adds a Restart button on Kubernetes Deployment, StatefulSet, and DaemonSet pages that triggers a rolling restart of the workload's pods.

Bug Fixes

• Admin errors table squishes path column and clips time column
• pw kube auth fails with unhelpful "exit status 1" on old kubectl
• Cluster stays "connected" after a dropped connection but ssh fails and reconnect does nothing
• Cost estimation table missing on sessioned Google Managed Lustre details page
• Kubernetes cluster only accessible from the platform domain it was registered through
• Kubernetes connect button gives no feedback when cluster is unreachable
• Onboarding marketplace featured section missing items for non-publisher orgs
• Unknown error when saving Kubernetes cluster config before OIDC association is ready

Enhancements and Features

Arbitrary url support for remote yamls

Adds support for arbitrary url paths for fetching yamls for remote workflows; when the yaml field for remote workflows is a url, repo is optional.

SCIM 2.0 read-only endpoints per organization

SCIM 2.0 endpoints can now be exposed per organization for syncing users, groups, and SSH keys to downstream identity consumers. Endpoints are read-only and authenticate via org-scoped SCIM bearer tokens (managed by org admins) or by org admin / platform admin sessions. The CoreWeave User extension is included when requested via the standard SCIM ?attributes= query.

SCIM provisioning settings page

Organization administrators can now manage SCIM provisioning directly from organization settings, including enabling the feature, viewing the SCIM endpoint URL, and creating or revoking bearer tokens.

Bug Fixes

• Kubernetes session shows "Proxy Error" after user workspace restart
• ML workspaces fail on legacy AWS cloud accounts silently
• Retrying a subworkflow step has various issues
• Sidebar options turn back on when toggled off in quick succession
• Workspace API endpoints can become unreachable until user workspace pod is restarted

Enhancements and Features

Allow discovering CA certificate when adding a Kubernetes cluster

Adding a Kubernetes cluster now offers a "Discover from endpoint" button that fetches the CA certificate served by the cluster's API server and fills it in for you, so you no longer need to look it up manually for self-signed or private-CA clusters.

Always show attached storages on cluster page

The cluster detail page now shows the Attached Storages panel at all times, not just while the cluster is running. You can see what storage will be mounted before starting the cluster, without having to open the edit screen.

Configurable bind paths for VNC desktop sessions

Cluster admins can now fully control which host paths are bind-mounted into VNC desktop sessions, including remapping to a different in-container path and marking binds read-only.

Copy AI model IDs from the connect page

You can now copy AI model IDs directly from the Connect Tools page (AI Providers → Connect Tools). A new Available Models list shows every model you have access to and copies its ID to the clipboard on click — no need to expand a specific tool's setup guide to find it.

Copy workspace SSH public key when configuring existing clusters

When configuring an existing cluster's Resource Account, picking User Workspace (~/.ssh/pw_id_rsa) now shows the workspace SSH public key directly under the dropdown with a one-click copy button. Previously the key was only reachable from Settings → Authentication → SSH Keys.

LDAPS connections accept a custom CA certificate

LDAP authentication now accepts a custom CA certificate, available in the LDAP auth form when "Use TLS" is enabled. This lets you connect to directories signed by a private CA without modifying the system trust store. Client certificate / key are now optional, so server-only TLS is supported without mTLS.

More workflow expression operators

You can now use length, upper, lower, trim, abs, floor, ceil, round, keys, values, startsWith, endsWith, split, and join directly inside ${{ }} workflow expressions, plus Python-style slice indexing like inputs.list[1:3] or inputs.path[-4:] on strings and arrays, and operators that work on collections.

Optional CA certificate for Kubernetes clusters with publicly trusted certs

CA Certificate is now optional when adding or editing a Kubernetes cluster. Leave it blank for clusters that use publicly trusted certificates.

Show auth method and workspace SSH key on existing cluster details

The existing cluster details page now shows the configured auth method, and lets you copy the workspace SSH public key directly without opening the definition view.

Tunnel sessions no longer require an active workspace

Non-Kubernetes cluster tunnel sessions no longer depend on user workspace and stay reachable even when the workspace is down.

Bug Fixes

• API docs page crashes
• Clarify resource account field as "Auth Method"
• Connecting existing cluster fails when remote ~/.ssh does not exist
• Hide Open Workspace link for unprovisioned ML workspaces
• Inconsistent title casing on existing cluster definition page
• Incorrect title and missing resource icon on single instance terminals
• Missing pw_authorized_keys file results in not being able to ssh to existing cluster
• Remove Claude preview placeholder from AI providers page
• Sessionless resource shortcuts hide instead of disabling
• Snapshot share drawer disappears instantly on close instead of sliding
• Theme presets on org theme page do not work
• Thumbnail crop clips of border
• Workflow accepts duplicate step ids within the same job

Other Changes

• View settings of a running session from the sessions list

Enhancements and Features

Manage access for session AI providers on AI providers page

You can now manage access to session-backed AI providers from the AI Providers list page. This way session owners can share them without first navigating to the sessions list.

Oracle cloud buckets

Oracle Object Storage buckets can now be created and deleted through the platform. Mounting buckets to clusters is not yet supported.

Show retry indicator when delete attempts keep failing

Provisioning Status now surfaces delete retry progress when a delete keeps failing. You'll see the current attempt out of the max, the scheduled time of the next attempt, and the last failure reason on hover, instead of a stuck "Delete requested" entry.

User variables

Define reusable variables under Account → Variables, then reference them in any workflow with ${{ var.name }}. Variables let you share values across workflows without hardcoding them in each one.

Bug Fixes

• Workspace SSH key not automatically added to account for new users
• Admins cannot remove MFA from users
• Bucket creation reports false "group does not have access to network" error
• Cancel button does nothing on resource add pages
• Clicking allocation name in breadcrumb on usage events page does nothing
• Cluster details Logs bar opens blank modal after first click
• Desktop session shows blank page on first open
• Name field auto-fills with openaicompatible for custom AI provider
• Node indicator shows 1 active node when cluster fails to provision
• Orgs list and create org page content flush against right viewport edge
• Platform proxy writes discovery config to non-standard /home/.pw
• Provision status modal not opening on network list page
• Snapshots table has square corners instead of rounded
• VS Code session shows Not Found page
• YubiKey MFA option shows without feature preview on

Other Changes

• Simplify AI providers to Azure OpenAI and OpenAI compatible

Enhancements and Features

Manage Azure OpenAI deployments on existing providers

Azure OpenAI model deployments can now be added or removed on an existing provider from the provider's edit page, without re-provisioning the whole resource. New providers no longer ask for a model up front. Pick from the live catalog on the edit page once the account is ready.

Custom desktop session wallpaper in org theme

Org admins can now upload a custom desktop session wallpaper from the organization theme page. New desktop sessions for users in the organization use the uploaded image; otherwise they fall back to the platform default.

Bug Fixes

• Desktop sessions break on non-singularity clusters
• Clicking a deleted instance opens the live instance with the same name
• Confirm-disconnect modal appears when cluster is already unreachable
• Monitor jobs page is laggy with thousands of jobs
• Open terminal on /docs page causes double scrollbar
• Queues table header scrolled past on cluster queues page
• Reset onboarding control is active when onboarding is disabled
• User with write access to shared cluster cannot destroy cluster
• PBS scheduler jobs slow refresh on busy clusters
• Clicking managed cluster from a session returns 404
• Corrupt credentials file breaks cluster connection
• List field stays collapsed when adding a new item, hiding the new entry
• Loading cluster definition from marketplace returns 404
• OIDC sign out lands user on idp error when id_token has expired
• Platform admin cannot delete or update another org's marketplace item
• Presigned URL generation fails for Google bucket downloads
• Scale-down workspaces modal lists obsolete 'existing' cluster criterion
• Shared cluster with same name in another widget toggles together when first is expanded or collapsed

Bug Fixes

• API key hint too short to distinguish between keys
• Cluster path and workspace path defaults not prefilled on existing clusters
• Org settings sidebar jumps when navigating to cost dashboard
• Shared AI chats are indistinguishable from your own in the sidebar
• Unknown error on organization users page
• Userworkspace scale-down skipped when existing cluster is always connected
• Workspace terminal corrupts pasted text containing CPR-shaped bytes
• Workspace terminal echoes cursor position reports as visible garbage

Bug Fixes

• Cannot duplicate cluster definition with login-only access
• "Use Custom Domain" option in sessions fails when not configured on platform
• Dropdown options clipped inside modals
• Outdated 'Browse Workflows' CTA in Sessions widget empty state
• Subworkflow steps show no name on session loading page
• Workflow sometimes attempts to use shared cluster instead of user's own when names match

Bug Fixes

• Desktop sessions flaky on cluster with multiple login nodes
• Multiple cluster agent tunnels live across ingress replicas

Enhancements and Features

Secondary user groups in workspace container

Your workspace container now mirrors the platform groups you belong to as POSIX system groups. Running id or groups inside the workspace shows each of your platform groups, and files owned by those groups respect the correct ownership and permissions - making it easier to share data within a group across users in the same workspace environment.

Bug Fixes

• Onboarding creates forks for workflows instead of favoriting latest
• Forking an item from marketplace drops desktop session settings and doesn't set organization properly

Bug Fixes

• HPC cluster auto-connect fails with "ssh: connection refused" on reconnect

Enhancements and Features

Minimum agent version enforcement

Platform admins can now set a minimum agent version on the Settings page. Agents below the configured version are rejected at connect and evicted if already connected, so operators can force-retire old agent builds after shipping a fix.

Enhancements and Features

pw ssh -R for remote port forwarding

pw ssh now supports the -R flag for remote port forwarding, matching OpenSSH semantics. This lets you expose a service running on your laptop to a remote cluster over the existing pw ssh connection. For example to serve a local development environment or database for a workflow to reach.

Configurable PKI domain control validation file

Platform admins can now configure a file served at /.well-known/pki-validation/ for HTTP-based domain control validation when issuing certificates. The endpoint is publicly accessible without authentication; only admins can edit the filename and content.

Default workspace images for users

You can now set default workspace images at the organization or platform level. Instead of assigning an image to every user individually, admins can leave a user's image unset and it will automatically fall back to the organization default, or the platform default if no organization default is configured.

Descriptive help text below form fields

Form fields can now show descriptive help text directly below the input instead of only via a hover tooltip. Forms that already set a description on a field (such as parts of the LDAP auth configuration) will start surfacing that guidance inline, so it's scannable without hovering the label icon.

Home renamed to Dashboard

The Home page is now called the Dashboard. Sidebar, breadcrumbs, and related tooltips have been updated in all five supported languages.

Kubernetes session tunnels reconnect when the pod is replaced

Kubernetes session tunnels now automatically reconnect when the underlying pod is replaced. If a pod backing a deployment or service is evicted, restarted, or rolling-updated, the tunnel will detect the disconnection and re-establish the port forward to the new pod - no manual reconnection needed. The tunnel retries with exponential backoff and gives up after ~2 minutes if the new pod never becomes available

OIDC sector_identifier_uri for IdPs using pairwise subject types

Adds support for OIDC IdPs that use pairwise subject types: an admin can now list the platform hostnames covered by an OIDC auth method, and the platform publishes a sector_identifier_uri document the IdP can register, allowing one IdP client across multiple hostnames with a stable pairwise sub claim.

Quick launch VS Code and Desktop sessions from cluster details

Launch VS Code or a Remote Desktop session in one click from any running cluster's details page, without leaving the page or re-picking the cluster from a list.

Replace workflow annotations by id

You can now pass id=<value> on ::error::, ::warning::, and ::notice:: workflow log directives. Emitting another directive with the same id replaces the previous annotation in place instead of adding a duplicate, which makes it easy to surface progress updates (uploads, retries, percentages) as a single, always-current annotation.

jobs:
  example:
    steps:
      - run: |
          echo "::error id=upload::Uploading: 0%"
          sleep 1
          echo "::error id=upload::Uploading: 50%"
          sleep 1
          echo "::error id=upload::Uploading: 100%"

Show image on instance detail page

The instance detail page now shows the launch image (provider icon + image ID/name) as a new row in Instance Definition, matching the compact chip used on the instance creation form.

Split terminal panes side-by-side

Terminals can now be split into side-by-side panes within a single tab (VSCode-style), with draggable dividers, drag-and-drop reordering, and layout persistence across reload. Creating or closing a terminal in one browser tab now shows up in real time in any other tab of the same workspace.

Workspace terminals open in home directory by default

Workspace terminals now open in your home directory (~) by default instead of ~/pw/.

Bug Fixes

• Create organization button touches the breadcrumb bar
• Workflow annotations with reused id only show first and last update
• Action bar on user edit page going past page width
• Admin and org pages scrollbar inset from viewport edge
• Admin images three-dot menu appears disconnected from row
• Agent processes keep reconnecting after user disconnects cluster
• AI chat improperly derives deleted status
• API docs response panel is blank for endpoints that return a map
• Azure northcentralus shows an empty required zone dropdown
• Back button returns to blank page after sso redirect
• Can click "workspace" in session widget, leading to 404 page
• Cannot delete existing cluster configuration while connected
• Cannot open more than 9 working terminals
• Cloud account subnet table labels availability zone as "name"
• Cluster mounts fail for usernames containing underscores
• Compute nodes fail to boot from snapshots with stale /etc/fstab entries
• Copy to clipboard copies empty string instead of IP address during cluster provisioning
• Custom icons missing on onboarding confirmation screen
• Desktop sessions fail or get stuck on shared HPC nodes
• Duplicating a cluster can create a name with spaces
• Dynamic form dropdown lag
• Edit icon remains as if still hovered
• EFS filesystems are created without names in the aws console
• Error pages always link to home instead of going back
• Existing cluster ssh fails when login hostname has port suffix
• Filtering Azure instances by architecture crashes when an instance is missing arch metadata
• FSx storage capacity does not show GiB unit
• Log viewer ANSI colors render as plain text in light mode
• Login banner preserves leading and trailing whitespace
• Login pages remain in back button history after authentication
• Network CIDR field placeholder can be mistaken for a default value
• Network name field accepts dashes that server rejects
• Newly created group not appearing in groups list
• Org sidebar settings auto-save on every click
• Org theme preview settings toggle is off by default
• PBS qstat parse error spam on Cray clusters
• Desktop sessions create huge core dump files in user home
• Snapshot creation rejects names with cryptic regex error
• VS Code session never launches when tunnel reconnects
• Authentication method edit link 404s due to doubled URL segment
• Cannot hide Resource Groups, Inbox from Sidebar settings
• Image dropdown on instance pages doesn't match surrounding dropdowns
• One-click SSH opens a second workspace terminal
• Workflow form auto-capitalizes explicitly provided labels
• Workflow run summary panel takes over the screen on smaller screens

Other Changes

• Remove automatic symlink of ~/pw to /pw in workspace
• Combine LDAP and OIDC add pages into unified flow

Enhancements and Features

Create sessions from home page widget

You can now create sessions directly from the Sessions widget on the home page without leaving the dashboard.

Bug Fixes

• Admin code editor detaches from container when page scrolls
• Org login page shows org name instead of platform name in title
• Platform admin settings cannot be saved when WAF is enabled
• Saving login banner returns 403
• Single-org platform sso page missing org layout
• Top app bar overflows on mobile
• Subdomain session links require extra click to open in new tab
• Cloud account network page continually refreshes and jumps to top
• Cluster workspace mounts repeatedly unmount and remount
• Existing clusters stop auto-reconnecting after a transient disconnect
• Inconsistent margin on provision error logs
• Pasting hex color on org theme page reverts to previous color
• Pressing enter on auth token/apikey prompt with empty input prints unfriendly error
• Terminal page crashes when session expires
• Workflow DAG viewer stays same absolute size regardless of window/zoom

Enhancements and Features

Abillity to create AWS compute nodes with multiple network cards if the instance types supports them

When configuring an AWS cluster, you can now see a Multiple Network Card option under the Partition section. Only certain instance types support having multiple EFA interfaces.

Azure Files support in Explorer

Azure Files shares now have an Explorer tab alongside buckets. You can browse, upload, download, and delete files directly from the UI, and grant the share's storage account the CORS rules it needs with a single click.

pw users reset-onboarding CLI command

Adds pw users reset-onboarding <username>... so organization admins can restart the onboarding flow for multiple users in one command

Users can revisit onboarding flow

Users may now opt to go back to onboarding from their settings page. Organization admins can also reset this for a user so the next time they visit the site they will revisit onboarding.

Bug Fixes

• Annotations hidden below DAG/TREE views require scrolling to find
• Attached filesystems with a '/' at the end of the mountpoint will fail validation checks
• Deleted users remain in org user list for up to 30 seconds
• Ephemeral storage missing on cluster cost estimate and shows empty region
• Failed cloud network can't be retried with the same name
• Failed snapshots appear as selectable options on image dropdown
• Jobs being marked as failed when never run
• Logs command in user workspace only tails, preventing reading previous logs
• Multi-select download in explorer only downloads first file
• OpenAI passthrough breaks opencode on GPT-5 reasoning models
• PW agent can't get external IP on Oracle
• Saving login banner redirects to org users page
• Sessions not removed when workflow reaches terminal status
• Storage explorer refresh loses folder location
• Terminal page shows blank space below terminal after navigation
• User workspace logs connection errors twice
• Users with org:groups role see empty member dropdown when editing groups
• VS Code sessions show Not Found page after server pre-cache

Documentation Changes

• Built-in documentation for external AI tool usage

Other Changes

• Capture VS Code session output to per-session log
• Explorer UI polish, use pw name in paths

Enhancements and Features

Add disable option for machine images

Adds the ability for platform admins to disable machine images, preventing them from being selected by users without deleting them.

Login flow now preserves deep links

Navigating to a specific page while unauthenticated no longer loses the destination; users land on the intended page after signing in.

User workspace shell prompt and terminal tab show "workspace" as hostname

User workspace shell prompt and terminal tab titles now display workspace as the hostname instead of an internal pod/container name, giving a cleaner, consistent experience across all workspaces.

Bug Fixes

• Admin errors table overflows horizontally with long paths
• AI provider display name auto-filled with preset name on creation
• AI provider with long API key silently appears to succeed
• AI usage pie chart tooltip shows grey glyph instead of series color
• Cluster tabs unclickable on node not found page
• Collecting variables stuck at spinning when step failed for storages
• Hovered series in usage chart tooltips isn't bolded
• List type resets sibling fields when adding new item
• Log viewer ANSI white text invisible on light theme
• Organization AI providers not showing for other org admins
• Terminal covers admin/org sidebar items with no way to scroll to them
• Terminal tab rename and close icons invisible on hover for some users

Enhancements and Features

Group and filter reports by SKU

The reports page now supports grouping and filtering by SKU, so you can slice costs by individual custom SKU codes in addition to type, subtype, and user.

Show thousands separators in allocation total budget input

Allocation total budget now displays thousands separators while typing, so large amounts like 1,000,000 are easier to read at a glance.

Right-click context menu for terminal tabs

Terminal tabs now support right-click to rename or close them.

Bug Fixes

• Existing cluster details page shows disconnected while list shows connected
• Cluster thumbnail edit and delete buttons don't appear on hover
• Cramped spacing in pwtty terminal title bar
• Workflow string fields with prefillDefault cannot be edited
• Cloud account names only allow alphanumeric characters
• Log viewer gets stuck at bottom
• NFS and disk attachments silently stuck in provisioning

Enhancements and Features

Admin error logs pagination and search

Admins can now browse all error logs with pagination and search instead of being limited to the most recent 100 entries.

Custom AI providers unable to connect to endpoints with self-signed TLS certificates

Custom AI providers now support endpoints with self-signed TLS certificates. When adding or editing a provider with an HTTPS endpoint, you can either paste a CA certificate (PEM) for secure validation, or skip TLS verification entirely as a fallback. Custom provider endpoints are also no longer forced to use /v1, so providers with non-standard API paths (e.g. /v4) now work correctly.

Bug Fixes

• Cleanup step hangs when referencing missing output from failed job
• Cluster runtime alert sends at the wrong time
• Hammerspace NFS shows error page after creation
• Parent org admins denied access to managed organization cloud accounts

Enhancements and Features

Allow specifying initial directory for VS Code sessions

VS Code sessions now open directly to a specified directory instead of prompting users to select a folder. The directory defaults to the user's home directory and can be customized when creating the session.

Workflow run diagram overhaul

We have overhauled the workflow run diagram to have a more modern look.

Integrated API documentation

In-app API documentation replaces the external viewer, providing a polished, theme-aware API reference integrated directly into the platform navigation.

First-class Kubernetes namespace management with RBAC sharing

Kubernetes namespaces are now manageable as first-class platform resources. Organization admins can create, delete, and configure namespaces on any connected cluster, assign budget allocations, and share namespace access with platform groups using Kubernetes RBAC roles (admin, edit, view).

Queue messages while AI is responding in chat

Users can now send messages while the AI is generating a response. Messages are queued and automatically sent when the current response completes, making it easy to add follow-up questions without waiting.

Rename terminal tabs

Terminal tabs can now be renamed by double-clicking the tab title or clicking the pencil icon. Custom names persist across page refreshes and are not overridden by shell commands like clear.

Bug Fixes

• Kubernetes clusters use default icon instead of the custom one
• Annotations for a step only appear after the step runs
• Workflow run and view commands exit with code 1 in non-TTY environments
• Error when clicking on custom instance types under organization
• Group dropdown for capacity reservation shows all groups instead of filtering by CSP
• Shared chat with "view" permission still allows other users to send messages
• Target missing for Kubernetes sessions
• Workflow step outputs not resolved when referenced via needs expression

Enhancements and Features

Admin interface for managing platform-level previews

Admins can now manage platform-wide feature previews from the admin panel.

Mobile App

Adds a mobile app for iOS and Android that lets you monitor clusters, workflows, runs, and sessions, and connect to SSH terminals from your phone.

Bug Fixes

• Inbox notifications always showing info icon
• Wasm files not included in build-time compression
• Workflows can still be launched when workspace storage is full

Other Changes

• Faster forms
• Pre-compress static assets and compress API responses

Enhancements and Features

AI gateway billing, metering, and usage dashboard APIs

Organization administrators can now configure per-model pricing and enablement on AI providers, enforce budget limits on AI usage, and view usage analytics dashboards showing cost breakdowns by model, user, and allocation.

Require reason when impersonating a user

Admins are now required to provide a reason when impersonating a user. The reason is recorded in the audit log for accountability.

Select existing placement policy for GCP clusters

Adds support for using existing GCP placement policies with cluster partitions. This enables targeting reservations that require specific placement policies.

Store return-to location for impersonate

Stopping impersonation now returns admins to the page they were on when they started impersonating, instead of always redirecting to the admin users page.

Workflow runs widget status filter

The home page workflow runs widget now allows filtering by status.

Bug Fixes

• Able to directly ssh to AWS compute nodes on public-ip networks
• Cluster connection toast missing View Logs button
• Cluster json configuration resets after a period of time
• Scaled-up workspace starts with old image instead of the configured version
• Cannot scroll in feature preview detail
• Recursive download of entire bucket fails with "Destination/Source not specified"
• Job monitor runtime inflated on clusters with non-UTC timezone
• Longer top banner causes Add Cluster button to be hidden behind the app bar

Documentation Changes

• Cloud account permission documentation links return 404

Enhancements and Features

API key management enhancements with AI key support

API keys now support two types: Platform and AI. Keys now display key hints for identification and track last-used timestamps. The key management UI has been redesigned with a unified card-based layout and inline creation modals.

Cluster provisioning logs show ansible task progress

Cluster startup now shows detailed progress for controller node configuration, with each setup task visible as an expandable sub-item with its own status.

Display name for AI providers

AI providers now support display names. You can set a friendly display name with spaces and special characters when creating or editing an AI provider.

Show disk cloud identifier on storage details page

Disk storage details page now shows the cloud-specific disk identifier (Volume ID for AWS, Disk ID for Google, Disk Resource ID for Azure) after provisioning.

Add instances home page widget

Added an Instances widget to the home page so users can view and manage their single VM instances directly from the dashboard.

pw agent pixel art startup banner

The agent will now show a Parallel Works pixel art logo with the version number when starting.

Shared conversations show author of each message

Shared AI chat conversations now show who wrote each message. When viewing a conversation with multiple participants, messages from other users display their name and profile picture, making it easy to tell who said what.

Bug Fixes

• AWS billing fails when listing bucket with too many objects
• Content is required on AI chat API calls
• Errors from AI providers are not surfaced
• Empty credentials file on remote host breaks cluster connection
• New networks don't have private service access
• Scheduler agent bugs
• Workflow forms are slow to load

Enhancements and Features

Network diagrams and organization network topology

Network topology diagrams are now available on network creation and detail pages, showing the full cloud architecture including VPCs, subnets, compute nodes, and gateways. A new organization-wide Topology page under Cloud settings provides a unified view of all cloud accounts and networks in a single interactive, zoomable diagram.

Bug Fixes

• Queue filter URL params get recursively JSON-encoded on each toggle
• pw kube auth fails with permission denied on .kube directory

Other Changes

• Lazy-load heavy bundles and defer WASM initialization

Bug Fixes

• "Can collaborate" is cut off on the share with group dropdown on AI conversations
• "My Jobs" filter not matching jobs on existing clusters with __USER__ slurmUsername
• Cloud cluster slurm jobs not appearing in job monitor page
• Desktop session black screen from orphaned Xvnc after agent restart
• Scheduler jobs returning "Resource not found" for existing clusters on multi-pod deployments
• Bucket explorer crashing
• OpenStack not capitalized on admin images page
• Show cluster panels with no jobs on global jobs page

Bug Fixes

• Impersonate button missing pointer cursor on hover
• Storages status would show failed on provisioning if it was previously failed

Enhancements and Features

Jobs dashboard with queue status and node utilization

Added a new Jobs Dashboard with real-time monitoring of HPC jobs across all clusters, plus a Queues tab showing partition status, node utilization, and time limits at a glance.

Refresh admin panel tabs with sidebar navigation

Admin panel navigation is now a sidebar with grouped sections instead of horizontal tabs.

Bug Fixes

• Dropdown default substitution overrides valid empty string selections
• Feature preview descriptions not showing
• Feature preview toggle on user profile does not persist
• Org user edit page missing top padding
• Sidebar buttons and badges unreadable on activate theme hover
• Workflow configurations reset the form upon saving

Enhancements and Features

Add org delete and delete confirmation prompts

Organizations can now be deleted via the CLI with pw orgs delete. Both user and organization delete commands now require typing the name to confirm before proceeding, which can be skipped with the -f flag.

Bug Fixes

• Allow deleting cloud accounts with unprovisioned networks
• Breadcrumbs not always visible on org groups page
• Ephemeral lustre storage not mounting in fstab

Bug Fixes

• Cursor position reports echoed as visible garbage in pwtty terminal
• Home page session widget broken image and overflow on small containers
• Marketplace publish button silently fails with no feedback

Enhancements and Features

Workflows can opt-out of flattening wizard steps

Workflows that use the wizard mode can now opt-out of automatic flattening of inputs by specifying flatten: false in the wizard configuration. Below is an example:

'on':
  execute:
    inputs:
      $meta:
        wizard:
          mode: wizard
          navigation:
            showSteps: true
            allowJump: false
          flatten: false

pw orgs ls command for listing organizations

Added pw orgs ls command to list organizations you have access to.

Bug Fixes

• Failed tunnel creation blocks all subsequent tunnels from being created
• Feature preview box starts small then gets big
• Home page compute sliders use org theme color regardless of active theme

Enhancements and Features

pw users ls and pw users delete commands

Add CLI commands for listing and deleting organization users via pw users ls and pw users delete.

Enable onboarding gate and add enableOnboarding platform setting

New users can now be guided through an onboarding flow on first login to set up their theme, language, and initial resources. Admins can enable or disable this from the platform settings page (disabled by default).

Bug Fixes

• cancel-jobs action in workflows causes existing cluster connection to drop
• Cluster nodes page does not load for default clusters created for new users
• Skip automatic checkout always shows as disabled for marketplace workflows
• VNC sessions fail on RHEL 8 clusters due to missing libxcvt

Other Changes

• Redesign org pages with sidebar navigation

Enhancements and Features

Single cluster filtering with pw clusters ls

You can now filter pw clusters ls to show a single cluster by providing the full URI: pw clusters ls pw://username/cluster-name. Note that this filters the list output and does not provide additional details beyond what pw clusters ls already shows.

Oracle cluster provisioning

Bug Fixes

• Clusters list page returns 500 when a shared cluster's owner has been deleted
• Storage definitions can be deleted while attached to

Enhancements and Features

Logs panel on cluster details page

There is a new panel at the top of the cluster details page providing quick-access links to provisioning, deletion, connection, and scheduler logs. Logs are still accessible by clicking on the status.

Terminal tabs show resource icons next to name

The built-in terminal will now show the icon of the connected resource next to each terminal tab.

Bug Fixes

• Allow tab navigation when nodes page shows resource not found
• Cannot delete Google managed lustre instance
• Session link missing on workflow runs created from CLI
• Authenticated users can navigate to login pages
• Automatic SSO redirects pollute browser history
• Invalid /sso paths show platform 404 instead of redirecting

Enhancements and Features

Download workflow executor before executing

Workflows now automatically use the latest workflow executor when available, ensuring you always have the newest features and fixes without needing to restart your workspace.

Running clusters show disk attachments in provision status

Attaching and detaching disks to running clusters will generate new logs in the provision status UI.

Bug Fixes

• Messages from CLI don't persist to same chat but go to new convo
• Marketplace item edit page crashes when shared with group

Enhancements and Features

Instance provisioning status expandable sub-steps

Instance provisioning status now shows bootstrap sub-steps as expandable items under "Configuring instance."

Region column added to pw nfs ls table output

pw nfs ls -o table now displays the region associated with the NFS storage.

Bug Fixes

• Existing cluster page makes unnecessary API calls
• Cannot remove unprovisioned disks from cluster definitions

Enhancements and Features

Reference clusters and buckets by name using pw:// URIs in workflows

Added support for pw://username/name URI format when referencing clusters and buckets in workflow inputs. This makes it simpler to set default values and write inputs manually without needing to use the form to look up resource IDs. The workflow execute page also now shows two JSON tabs: one for form values and one for the resolved backend payload.

Add ap-southeast-1 (Singapore) region to AWS

Added support for the AWS ap-southeast-1 (Singapore) region for networks, clusters, and storage.

Support non-streaming OpenAI chat completions

Support non-streaming responses on the OpenAI-compatible chat completions endpoint, enabling compatibility with standard OpenAI clients that don't use streaming by default.

Add Oracle Cloud instances integration

Workflow matrices

Added matrix strategy support for workflows, enabling jobs to run across multiple configurations simultaneously. Define a strategy.matrix in your workflow YAML to automatically expand jobs over combinations of values with support for include/exclude filters, fail-fast, and max-parallel controls.

Example usage:

jobs:
  build:
    strategy:
      matrix:
        field1: ["ubuntu", "windows"]
        field2: [18, 20]
    steps:
      - name: Print combo
        run: echo "OS=${{ matrix.field1 }} VERSION=${{ matrix.field2 }}"

Bug Fixes

• uses: github/ subworkflows have no way of specifying thumbnails, multiple subworkflows in same repo cannot be used
• Workflow expressions cause validation error when used in matrix
• Disabled fields appear enabled in cluster form
• Existing cluster not autoreconnecting after restarting workspace
• Marketplace remote workflows do not respect "skip checkout" setting
• PW_PLATFORM_HOST contains https prefix sometimes
• Desktop sessions flicker with multiple tabs open
• Home page dashboard animates from left to right on page load

Other Changes

• Move AI chat into its own category
• Move AI providers to the top level
• Remove legacy provider query param from groups endpoint

Enhancements and Features

Kubernetes clusters page UX and thumbnail support

Kubernetes clusters page now shows cluster thumbnails, inline connect/delete actions per row, and the cluster definition page has been redesigned with an editable thumbnail and improved layout.

Bug Fixes

• Add workflow schema validation for uses and with when possible
• Incorrect text on storage deletion prompts
• pw_id_rsa unnecessarily generated during cloud cluster bootstrap
• Workflow builder navigates away after saving
• Workflows fail if SSH client creation or git clone fails once

Enhancements and Features

GitHub integration with platform-level app config and user OAuth linking

Platform admins can now configure a GitHub App integration under Admin Settings → Integrations, and individual users can link their GitHub accounts via OAuth from User Settings → Connections. This enables the platform to access users' GitHub repositories on their behalf for workflows and AI coding features.

Bug Fixes

• Inconsistent loading spinner on homepage widgets
• Wrong marketplace doc url

Enhancements and Features

Workflows support multi-select for compute-clusters and buckets types

Workflow developers can now add multi: true to the compute-clusters and buckets types to transform the clusters dropdown into a mutli-select. This will provide an array of inputs to the workflow rather than a single resource.

Bug Fixes

• AI chat clicking stop on an in progress message deletes the whole message
• Attach storage modal with multiple storages constrains dropdown
• Canceling old executor job doesnt work with new executor feature flag and vice versa
• Change default from gp2 to gp3 for AWS disks
• Improve existing cluster connect/disconnect stability

Other Changes

• Always show org logo when available

Bug Fixes

• Workflow executor fails to checkout repositories when on non-bash shell

Enhancements and Features

Support remote host forwarding for workspace sessions

Workspace sessions now support forwarding to remote hosts, not just localhost. You can create tunnel sessions that forward traffic to services running on other machines accessible from your workspace, such as on-prem cluster nodes. Managed clusters are also now available as session targets.

Workflow command annotations

Workflow steps now support commands for structured annotations. Echo ::error::, ::warning::, or ::notice:: in your step scripts to surface important messages as colored banners on the run detail page. Log output also supports ::group::/::endgroup:: for collapsible sections and ::debug:: for verbose messages hidden by default.

Bug Fixes

• Awkward spaces in messages
• Existing cluster on marketplace shows internal fields and double panel
• Managed cluster components have different sizes for each page
• Missing link to workflow run on sessions list page
• Workflow with: suggestions now amend input expressions accordingly

Bug Fixes

• Cannot see shared cluster's scheduler jobs
• Correctly configure Slurm cores for Azure VMs with hyperthreading
• Help message in pw clusters list --status=on shows no clusters found
• Agent re-authentication not triggering on expired token
• Session port has five digit zero padding, session target not showing

Enhancements and Features

Expand cmd+k command palette with quick actions, resource browsing, and recent items

The command palette (Cmd+K) now supports quick actions like creating API keys, connecting to clusters via SSH, and opening the terminal. You can also browse workflows, runs, sessions, instances, and IP addresses directly from the palette, and recently visited items appear at the top for quick re-access.

Generate SSH keys for node-to-node access on managed clusters

Managed clusters with "Access Management" enabled will automatically generate SSH keys in each users home directory the first time the user logs in, facilitating node-to-node access.

Executor statuses and messaging performance

The workflow executor has been updated with new transition statuses and significant performance improvements. Two new statuses now appear during workflow teardown: canceling (shown before canceled) and faulted (shown before error). These make it clear that a workflow is still actively running during shutdown, rather than jumping straight to a final state.

Under the hood, we've reworked how the workflow and platform exchange messages, resulting in meaningfully faster messaging and overall executor performance.

To try it: Enable "New Executor" under the Feature Preview menu.

Background existing cluster connection process

Users can now connect to existing HPC clusters in the background while continuing to use the platform. A new log viewer shows real-time connection progress and any errors. Clusters with auto-reconnect enabled will automatically reconnect when the workspace restarts.

Optional NAT gateway for private networks without peering

When creating private networks on AWS, you will now have an option to deploy a sibling public network with only a NAT Gateway deployed. This is separate from the current public networking mode where controllers are assigned public IPs and compute nodes use a NAT Gateway. In this private mode, all nodes will continue to only be assigned a private IP, but they will have access to the internet through the NAT Gateway.

Note this option is unavailable when using transit gateways to peer the network to the platform, as traffic is assumed to go through a central networking account, so no NAT Gateways are provisioned.

pw sessions create now supports --name and --wait flags

pw session create now supports a --name flag for custom session names and returns immediately by default. Use --wait to block until the session is ready.

Support Windows images on instances

Instances now support Windows images. Users can bring their own Windows images on AWS, GCP, and Azure, with automatic setup of SSH and RDP access.

Bug Fixes

• pw upgrade cross-device link error
• Workflow widget shows "no matches" when user has no favorites
• Marketplace item description not persisting on save
• Kubernetes session tunnels failing with invalid OIDC token
• AI provider shows incorrect text when sharing with organization
• Code block syntax highlighting uses wrong theme colors in AI chat
• Navigating to non-existent cluster page does not show a "not found" error
• No jobs listed under jobs tab in a cluster detail page or jobs page from the sidebar
• Relative URLs in GitHub markdown do not link to GitHub
• Set UTF-8 encoding for VNC desktop sessions

Bug Fixes

• Marketplace run slug numbering resets to 1 for old-format slugs
• SSH terminal closes on connection failure, preventing error output from being read

Bug Fixes

• Managed clusters are not being autoselected in compute resource list
• Switch language without hard page reload
• Workflow run page crashes with unknown error on certain workflows
• Improve API key banner readability in dark mode
• Marketplace page flashes on tab refocus

Bug Fixes

• Forking remote market workflow to local workflow resulted in incorrect yaml definition
• Regular users can see delete/duplicate managed clusters shortcuts
• User workspace logs too verbose
• Validation error messages not very user-friendly

Enhancements and Features

USER_LOGIN webhook

There is a new USER_LOGIN webhook that organizations can configure to respond to successful logins.

Tunnel session health tracking

Tunnel sessions now show when the remote service isn't reachable. Running tunnels display "Remote unreachable" on the sessions page and "unhealthy" on the AI providers page when the destination service is down, with automatic recovery when it comes back online.

Bug Fixes

• Tunnel icon shown instead of AI chat icon for OpenAI sessions
• pw upgrade doesn't work inside user workspaces
• Model selector disappears and unreachable sessions not shown on chat page
• Shared OpenAI tunnel sessions not shown on AI providers page
• Terminal page incorrectly has slide down effect
• TERMINATE migration policy is not set for H4D, H3, and A4 GCP instance types
• Unable to add groups to kubernetes cluster

Other Changes

• Provide pw uri from storage list endpoints

Enhancements and Features

Workload labels in Kubernetes resource details

Adds the workload's own metadata.labels to the detail view for Deployments, ReplicaSets, Jobs, CronJobs, StatefulSets, and DaemonSets.

Make model optional for pw ai chats new

pw ai chats new no longer requires a model argument. Run it without arguments to pick a model interactively from a list.

CLI AI commands

New pw ai command group for AI chat in the terminal.

Start a chat with pw ai chats new <model>. Responses stream in real time and render as markdown. Use Enter to send and Shift+Enter for a new line. Type /model to switch models, /clear to start over, or /help for available commands.

Resume previous chats with pw ai chats resume <id>. The model is detected automatically from the conversation. Use -p "prompt" on new or resume for non-interactive scripting.

Manage chats with pw ai chats ls/get/delete and providers with pw ai providers ls/get/create/delete/models.

Remove model requirement for custom AI providers

Custom AI providers no longer require a model name during setup. Models are discovered automatically from the provider's API.

Use human-friendly model identifiers for AI chat

AI chat model identifiers now use human-readable provider and session names instead of opaque IDs, making it easier to identify models in the UI and API.

Bug Fixes

• Remove model-specific vision capability checks
• User directive missing in pw vscode SSH config
• Destroy/start button on storage page should never trigger opposite tasks
• Improve CLI error messages for expired auth
• Managed cluster node metrics time window returning old data

Bug Fixes

• AI providers show as shared on creation
• Add skip automatic checkout toggle to workflow creation form
• Animation shift and mismatched loader on AI chat page refresh
• Cannot disconnect from existing cluster when login node is unreachable
• Cannot update the saved configurations
• Remove deprecated GCP I_MPI_FABRICS configuration in node bootstrap
• Show workflow run inputs as JSON
• Update broken documentation links on cloud account page
• Cannot create allocation thresholds

Enhancements and Features

Run subworkflows from yaml stored on GitHub

Workflows can now include subworkflows from GitHub by specifying uses as follow:

- uses: github/username/repo@main

This assumes the workflow is located as a top-level file named workflow.yaml. If that's not the case, you can specify where the file is using this syntax:

  with:
    $yaml: yamls/workflow.yaml

Bug Fixes

• Cannot create azure ai provider
• Session links on runs page navigate to wrong URL
• Stack login banner above login card on small screens
• Print friendly error when credentials file fails to parse

Enhancements and Features

Notify when a newer CLI version is available

The CLI now notifies you when a newer version is available and suggests running pw upgrade.

Rename version-update to upgrade and add download progress bar

The CLI update command has been renamed from pw version-update to pw upgrade and now shows a progress bar during download. The old pw version-update name still works as an alias.

Bug Fixes

• Make session name optional with auto-generation

Enhancements and Features

Add session management subcommands and pw vscode

New CLI commands for managing remote sessions (pw session create/connect/stop) and connecting local VS Code to remote resources (pw vscode).

Bug Fixes

• Update user shows unknown error
• Preserve terminal tab state when navigating away from terminal page
• Cloud account cancel button on darker themes looks bad

Enhancements and Features

cancel-jobs action

Workflows now support a cancel-jobs action that lets you cancel specific jobs within a workflow run or cancel other workflow runs entirely. A workflow can always cancel its own jobs, while canceling jobs in other workflows requires the appropriate permissions to be set.

Add onboarding flow

New users are now guided through a welcome flow to select compute resources, workflows, and a theme when they first log in.

Add status and provider icons to compute resources dropdown

The compute resources dropdown now displays status indicators and provider icons for each option.

CLI workflow management and interactive run support

Full workflow management is now available directly from the CLI. Create, update, and delete workflows without leaving your terminal. Launch workflow runs and instantly see a live interactive view of your job tree with real-time status updates, animated spinners, expand/collapse navigation, and inline step logs. Monitor active sessions with direct links, cancel running workflows, and clean up old runs with flexible filters. All CLI list commands now default to a clean table output with colorization for a consistent experience across clusters, sessions, storage, and workflows.

New commands: pw workflows view, pw workflows create, pw workflows update, pw workflows delete, pw workflows run, pw workflows runs list, pw workflows runs view, pw workflows runs cancel, pw workflows runs clean.

Workflow runs logs and workflow runs errors commands

Added logs and errors subcommands to pw workflows runs for programmatic access to step logs and error reports. The get command now shows a job/step tree with durations, and list shows run duration.

Expose PW_RUN_SLUG environment variable to workflow steps

Steps now can access the run slug via the PW_RUN_SLUG environment variable.

Managed clusters can now force all SSH traffic to proxy through platform

Organizations using managed clusters can now force all SSH traffic to flow through the platform using a new proxySsh setting.

Prefill user workspace mounts with default values when adding new mounts

When adding new workspace mounts, a default will automatically be filled into the box, allowing for easier editing.

SSH access to private network clusters without VPC Peering

Users can now SSH into cloud clusters deployed on private networks without VPC peering. The cluster controller automatically establishes a secure tunnel to the platform, enabling pw ssh access without requiring a public IP address.

Support specifying max distance when creating Google placement groups

Clusters running on Google Cloud Platform can now specify a max distance when provisioning nodes in a partition. This can increase performance with the trade-off of less availability.

Bug Fixes

• Forked NFS from marketplace and get 404 page
• Unify session link logic and fix OpenAI tunnel provider display
• Cannot clear display name for existing clusters and tags not shown
• Cluster connection tooltips show up in multiple widgets when hovered
• Google managed lustre doesn't check for allocation exceeded
• License renewal fails with "authentication required" during grace period
• Move online status indicator next to username on org users page
• Outputs do not support multiline values
• Pods dropdown empty on create session interface
• Prevent user workspaces endpoint from hanging on unreachable hosts
• Resource gets stuck on loading on allocations page
• Cannot see scheduler logs for shared clusters
• Stop default values from overwriting workflow rerun values
• Unable to select Create k8s PVC in platform admin settings on a new deployment
• Use org slug instead of display name in breadcrumb hrefs
• Use organization display name in org list
• Remove destroy button from managed cluster home page widget

Enhancements and Features