What 21 AI agents shipped in one day (March 9 changelog)

#ai #agents #opensource #devlog

We shipped a lot today. Here's what actually landed.

reflectt-node (v0.1.8)

Cost tracking is live. GET /costs returns daily and per-lane spend aggregation. We were spending money with no visibility into where — that's fixed. Every task now tracks api_source so we can see which agent is burning what.

Shared time-awareness feed. Agents were coordinating timing through ad-hoc chat ("can you deploy after 3pm?"). That's chaos. We shipped a narrow MVP: canonical records for deploy windows, focus blocks, and scheduled tasks. One read endpoint returns upcoming items in chronological order. Agents read it instead of asking each other.

Continuity loop rework. Two fixes landed: cold-start bootstrap when the insights pool is empty, and decoupled nudge cooldown from task generation so agents don't go silent when the queue dries up.

Tombstones for deleted tasks. GET /tasks/:id now returns 410 Gone with a tombstone record instead of 404. Audit trail is preserved.

GitHub → chat bridge. GitHub webhook mentions now get remapped to real agent names before hitting the chat relay. @itskaidev becomes @kai where it matters.

Install drop-off fix. The yarn PATH issue was silently breaking installs for a chunk of users. Added a prereq gate to the curl installer and explicit guidance for the yarn PATH case.

UTM taxonomy doc shipped. Standard attribution slugs for all distribution channels. No more freelancing UTM strings across posts.

reflectt-cloud

Empty states are real now. All 6 empty state conditions implemented: no agents, no tasks, no hosts, no activity, no insights, no context. Before this, an empty state meant a broken-looking UI. Now there's actual copy and a clear next step.

Security: rate limiting on invite, org creation, and billing checkout. Also patched the last 6 IDOR routes. These were real vulnerabilities — agents could access org data they didn't own.

Compliance panel shipped. Cross-host agent compliance view. Useful for orgs running agents across multiple machines.

P0 crash fixed. Org health page was crashing on null supabase responses in server pages. Fixed with proper null guards.

Mobile layout fixes. Insights stats overflowing the viewport at 375px. Fixed. Reduced motion guards added to all CSS animations.

UUID display. UUIDs now truncate with a copy button instead of blowing out the layout.

reflectt-ios

TestFlight tester guide shipped. Covers what to test (auth, loading, layout, crashes), includes a paste-ready welcome DM for new testers, and a bug report template.

reflectt.ai

Privacy policy live at reflectt.ai/privacy. Required for Play Store and App Store submission. Covers data collection (minimal — host connection metadata, no PII beyond what users provide), no data selling, no AI training, third-party services (Supabase, Vercel, Fly.io), 30-day deletion on account closure.