Changelog — August 2, 2026

The cut: on v1/responses and v1/chat/completions, GPT-5.6 Luna costs 80% less and GPT-5.6 Terra costs 20% less. Luna is the small model in the GPT-5.6 family, so this lands hardest on exactly the workloads agents generate most of: classification, routing, extraction, summarization — the high-volume, low-judgment calls that sit underneath a bigger model.

The swap: Fast mode replaces Priority Processing, delivering up to 2.5× faster speeds than standard processing at twice the price. Priority-tagged requests continue to work, so nothing breaks on deploy — but the mental model changes from "pay for queue position" to "pay for a defined speed multiple." For gpt-5.6-sol in particular this is the interactive-latency lever.

Who should care: anyone running a multi-model agent stack. The reason to re-check rather than assume is that an 80% cut can invert a routing decision — work you pushed up to Terra to justify the quality delta may now be cheaper to run on Luna at higher volume, or with a verification pass on top. Our cost calculator tracks Anthropic rates and doesn't model OpenAI's, so check OpenAI's pricing page directly for the post-cut per-MTok figures.

OpenAI changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/tips/

OpenAI Platform resources are now manageable as infrastructure-as-code. The official Terraform provider covers projects, users, groups, roles, and service accounts — the org-structure layer, not the model layer.

The practical use is agent-fleet governance. If you provision a service account and a scoped project per agent, that provisioning has until now been dashboard clicks or bespoke API scripts, with no reviewable diff and no drift detection. Pairing this with the spend limits added July 22 gives you a declarative way to state "this agent gets this project, this role, and this ceiling" — and to catch it in code review when someone widens it.

OpenAI changelog → Affects: /chatgpt/, /chatgpt/teams/, /chatgpt/api-vs-chat/

This is a tag, not a feature release — and the release notes say so plainly. v0.19.1 exists to give Docker images, hosted deployments, and fresh installs a stable point to pin, rolling up the work merged since v0.19.0 "Quicksilver" on July 20.

The scale of the window is the interesting part: ~2,789 commits, ~4,748 files changed, ~442,000 insertions and ~392,300 deletions on main in ten days. Nous describes it as dominated by bug-fix and salvage waves across the gateway, voice subsystem, desktop app, and installer, plus continued platform work on the Buzz/Nostr channel, FLUX3 video generation and delivery, Telegram media reliability, and voice-mode regressions.

Curated notes for this entire window ship with v0.20.0, which will document everything from v0.19.0 onward with highlights, feature areas, and contributor credits. We're flagging that rather than reverse-engineering a feature list from the diff, because a 4,700-file salvage window is exactly where a guessed changelog goes wrong.

Update:

hermes update

Who should care: anyone pinning a Hermes version in Docker or a VPS deployment — take the tag. Anyone waiting to learn what actually changed since v0.19.0 should wait for v0.20.0; there is no per-feature documentation for this window yet.

Hermes v0.19.1 → Affects: /hermes/, /hermes/setup/, /hermes/vps-install/

Three things here matter beyond the release-note bullet:

• Diff review finally has scopes (#12681). The side panel and full-screen review now switch between Branch, Staged, Unstaged, and Session for the selected worktree, and the Branch scope's base branch can be overridden from a picker next to it. Branch stays the default, so existing behavior is unchanged. "Session" is the one to notice — reviewing exactly what this agent run touched, separate from everything else in your working tree, is the review most people actually want and previously had to reconstruct by hand. A follow-up applies a base-branch change to the active diff immediately (#12696), and review now follows sidebar selection instead of being pinned to one session (#12709).
• Skill shell commands are itemized in permission prompts, with individual Allow/Reject (#12606). This is a real security improvement, not a UI tweak: approving a skill wholesale means approving every command it wants to run, sight unseen. Per-command approval turns that into a decision you can actually make. It pairs with the auto-approval rule explanations from v7.4.16 — Kilo Code is steadily making its permission surface auditable rather than binary.
• An experimental multi-project foundation for Agent Manager (#12566), behind Multi-Project Agent Manager in Kilo Settings → Experimental. A persistent project registry catalogs additional Git repositories across restarts while your current workspace repo stays the pinned default. Every repository-bound service — state, worktrees, setup scripts, stale tracking, polling — is owned by an immutable per-project context, so each expanded project runs its own git-stats and PR pollers and all visible accordions show live data at once. Switching projects preserves expansion state and restores the exact worktree or session you had open, sessions created anywhere (sidebar, another window, the CLI) appear in the owning project's list immediately, and open tabs stay private to their project. Single-project behavior is unchanged.

The rest of the release is terminal and navigation work: project setup scripts and worktree setup scripts now run in the terminal chosen from the toolbar dropdown with live output (#12680, #12703); embedded terminals that refused to open in the side panel or as tabs are fixed (#12720); switching to a worktree without a terminal auto-opens one (#12689); and the Cmd/Ctrl+/ toggle and its platform-modifier fallback both behave (#12691, #12694).

Also worth knowing: Persian (Farsi) is a supported UI language with right-to-left layout (#12424); web search can be enabled for models from all providers, not a subset (#12369); MCP server enable/disable now survives a window reload (#12624); the "Past chats" picker shows sessions across the whole worktree family rather than one branch (#12692); the prompt navigator rail gets a compact mode for long conversations (#12656); and the VS Code session usage bar now shows a write-aware cache hit rate (#12738) — useful if you're tuning prompt caching and want to see whether cache writes are actually paying off.

Who should care: anyone reviewing agent output in Kilo Code should switch to Session scope and see if it changes how much they catch. Anyone running skills should look at the new per-command permission prompt before re-approving anything broadly.

Kilo Code v7.4.18 → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/security/, /kilocode/models/

Twenty commits on main since v0.0.97. Four are worth your attention:

• Migration and rebuild backups scrub credentials and fail closed (#7847). Host-to-sandbox migration snapshots and rebuild snapshots now share one filter for credential fields, token shapes, auth headers, and CLI arguments, recursively sanitizing every copied JSON, YAML, and .env artifact including external roots, and omitting authentication-state files entirely. The important word is fail closed: if sanitization or cleanup fails, backup creation is rejected and the staging directory removed, rather than leaving a raw configuration on disk. Traversal and mutation are bound to opened directory descriptors and abort if the parent or root identity changes mid-operation. OAuth access, refresh, and identity tokens are now scrubbed too. The docs are updated to state the tradeoff honestly — these snapshots are filtered restore points, not byte-for-byte copies, so don't expect a backup to round-trip a credential.
• shields up no longer fails on Deep Agents sandboxes (#7995). Both the lock and the verifier treat <config dir>/.config-hash as protected, but the Deep Agents image never writes one — so chmod 444 failed and the verifier reported Config not locked: … .config-hash stat failed. The lock now writes an absent-hash record first, opening the config directory with O_NOFOLLOW/O_DIRECTORY and creating the record with O_CREAT | O_EXCL at mode 0444. A non-regular file at that name, a symlinked config file, or a config path outside the directory each fail the lock rather than redirect a privileged write. Deep Agents sandboxes now reach the same locked posture as OpenClaw and Hermes.
• nemoclaw status stops lying about connectivity (#7820). The Connected: field was derived purely from the local interactive SSH-session count (ps | grep ssh) — not from gateway or messaging health. A healthy foreground-managed gateway with a live Slack path but no open SSH session reported Connected: no, and anything trusting that summary classified an active agent as offline. The field is renamed SSH sessions: (reporting the count, or none), and the identically-misleading connected boolean is dropped from nemoclaw list --json. Note the honest scope note in the PR: this removes the false signal, it does not add an affirmative gateway/messaging indicator — the real gateway diagnostic remains the gateway: down [state] (reason) line that nemoclaw status prints and exits 1 on. If you have monitoring keyed on the connected JSON field, it will break.
• Google Chat lands as an experimental OpenClaw messaging channel (#7317), served at /googlechat through a dedicated Google-Chat-only cloudflared tunnel and a loopback webhook proxy that admits only POST /googlechat and 404s everything else. The design point: it's the first bridge channel, where inbound webhooks are verified inside the sandbox but the outbound bot token is minted on the host — so the service-account private key never enters the sandbox at all. Two JWTs run in opposite directions: Google signs one the plugin verifies, and the gateway signs one to mint the outbound token. Both directions route by hostname through the trusted L7 proxy, so it works in the DNS-less proxy-only sandbox. Scope is OpenClaw only — Hermes uses Cloud Pub/Sub pull with a different credential path, and is a planned follow-up.

Also in the window: an atomic managed-workload rebuild transaction that publishes only through a compare-and-swap against the exact old registry row, retiring the previous runtime only after publication and returning a recovery task if publication is indeterminate (#8001 — inert, not yet wired to a production caller); a fix authenticating superseded HTTPS Pin Runtime route revocation against the policy the adapter was actually started with, which had been leaving revoked routes registered with raw upstream credentials resident (#7889); a PR Review Advisor terminology stage (#8029); an architecture refactor taking runtime cycles to zero from one 85-file cycle, with registered sandboxes now reporting their own agent-definition load error instead of silently falling back to OpenClaw paths (#7749); plus onboarding timeout/poll-override fixes and E2E consolidation that retires a destructive 5,000-process fork-storm test.

Who should care: if you script against nemoclaw list --json, the connected field is gone — check your monitoring. If you rely on migration backups, read them as filtered restore points now. If you run Deep Agents sandboxes, shields up works.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /security/