This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Light signalRelease v0.28.0 adds multiple gateway‑service enhancements including drain readiness, admission rejection during drain, and connection reconnection logic for sandboxd and browser clients.
Why it matters: These feature additions improve graceful degradation and reliability of the gateway surface; operators should evaluate impact before deployment.
Summary
AI summaryUpdates 0.28.0] - 2026-06-04, Bug Fixes, and Chores across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Add gateway drain readiness state Add gateway drain readiness state Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Reject gateway admissions while draining Reject gateway admissions while draining Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Reconnect sandboxd on gateway service restart Reconnect sandboxd on gateway service restart Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Reconnect browser clients on gateway restart Reconnect browser clients on gateway restart Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Classify direct egress gateway restarts Classify direct egress gateway restarts Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Drain gateway connections on shutdown Drain gateway connections on shutdown Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Add sandboxd skills discovery Add sandboxd skills discovery Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Add sandboxd skills reconcile Add sandboxd skills reconcile Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Add control-plane API cache config Add control-plane API cache config Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Resolve codex skill mentions at turn start Resolve codex skill mentions at turn start Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Define gateway service restart close contract Define gateway service restart close contract Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Show Mistle-managed sandbox provider Show Mistle-managed sandbox provider Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Automate release PR creation Automate release PR creation Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add skills source repo model Add skills source repo model Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add skills source repo sync service Add skills source repo sync service Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add sandbox profile skills config Add sandbox profile skills config Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add sandboxd activation command Add sandboxd activation command Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add skills source repo refresh API Add skills source repo refresh API Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Wire sandbox profile skills activation Wire sandbox profile skills activation Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Add provider runtime activate command Add provider runtime activate command Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Refine sandbox profile skills editor Refine sandbox profile skills editor Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Support setup and snapshot activation Support setup and snapshot activation Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Activate setup and snapshot workers Activate setup and snapshot workers Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Distinguish Codex subagent conversations Distinguish Codex subagent conversations Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Expose provider stopping inspect disposition Expose provider stopping inspect disposition Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Dependency | Low |
Update codex to 0.136.0 Update codex to 0.136.0 Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Refactor | Low |
Prune sandbox operation events Prune sandbox operation events Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Refactor | Low |
Move worker sessions to sandbox activation Move worker sessions to sandbox activation Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Refactor | Low |
Prove sandboxd runtime readiness Prove sandboxd runtime readiness Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Refactor | Low |
Remove legacy provider runtime control Remove legacy provider runtime control Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Refactor | Low |
Shutdown sandboxd before provider stop Shutdown sandboxd before provider stop Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
Full changelog
[0.28.0] - 2026-06-04
Features
- Resolve codex skill mentions at turn start (#2598)
- Define gateway service restart close contract (#2589)
- Add gateway drain readiness state (#2590)
- Reject gateway admissions while draining (#2591)
- Reconnect sandboxd on gateway service restart (#2592)
- Reconnect browser clients on gateway restart (#2593)
- Classify direct egress gateway restarts (#2594)
- Drain gateway connections on shutdown (#2595)
- Prune sandbox operation events (#2601)
- Show Mistle-managed sandbox provider (#2603)
- Automate release PR creation (#2618)
- Add sandboxd skills discovery (#2615)
- Add sandboxd skills reconcile (#2619)
- Add skills source repo model (#2620)
- Add skills source repo sync service (#2622)
- Add sandbox profile skills config (#2623)
- Add sandboxd activation command (#2621)
- Add skills source repo refresh api (#2624)
- Wire sandbox profile skills activation (#2626)
- Add control-plane api cache config (#2637)
- Add provider runtime activate command
- Move worker sessions to sandbox activation
- Prove sandboxd runtime readiness
- Refine sandbox profile skills editor (#2640)
- Support setup and snapshot activation
- Activate setup and snapshot workers
- Remove legacy provider runtime control
- Distinguish Codex subagent conversations (#2641)
- Expose provider stopping inspect disposition (#2646)
- Shutdown sandboxd before provider stop (#2647)
Bug Fixes
- Default MCP OAuth resource for dynamic clients (#2588)
- Keep sandbox startup UI during resume (#2599)
- Extend snapshot provider timeouts (#2600)
- Show refresh guidance for stale dashboard errors (#2602)
- Guard direct egress websocket drain race (#2604)
- Make sandboxd init idempotent (#2614)
- (dashboard) Render routed navigation as links (#2617)
- Tolerate stale runtime skills (#2630)
- Route changed integration tests through integration config (#2631)
- Resolve sandbox git actor independently of signing (#2642)
- Recover session workbench after sandbox stop (#2645)
- Mark sandbox stops stopping before enqueue (#2644)
- Make sandbox stop inspect provider state (#2648)
- Centralize sandboxd shutdown before provider stop (#2650)
Refactors
- Remove Archil sandbox persistence (#2613)
- Remove legacy worker resume path
Documentation
- Update setup assistant profile guidance (#2635)
- Add quickstart page (#2643)
- Document sandboxd activation contract
Tests
- Prove activation-only system lifecycle
Style
- Improve sessions sidebar spacing (#2616)
Chores
- Update codex to 0.136.0 (#2596)
- Update opencode (#2597)
- (deps) Bump @rjsf/utils from 6.5.1 to 6.5.3 (#2612)
- (deps) Bump @commitlint/config-conventional from 21.0.0 to 21.0.1 (#2610)
- (deps) Bump crate-ci/typos from 1.46.2 to 1.46.3 (#2611)
- (deps) Bump @opentelemetry/auto-instrumentations-node from 0.75.0 to 0.76.0 (#2606)
- (deps) Bump fff-search from 0.8.1 to 0.8.4 in /packages/sandboxd (#2608)
- (deps) Bump reqwest from 0.13.3 to 0.13.4 in /packages/sandboxd (#2607)
- (deps) Bump posthog-js from 1.373.4 to 1.376.0 (#2605)
- (deps) Bump @opentelemetry/api-logs from 0.217.0 to 0.218.0 (#2609)
- Update opencode sdk (#2649)
- Require activation startup diagnostics (#2651)
- (release) V0.28.0 (#2659)
Breaking Changes
- Remove legacy provider runtime control
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Mistle
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]