26.09

## What's Changed
* feat(i18n): add Czech GUI localization by @nevrkla in https://github.com/HeyPuter/puter/pull/3617
* fix: provide fallback for signup verification by @Salazareo in https://github.com/HeyPuter/puter/pull/3631
* 🛠️ PUT-1564: Perms docs — drop the app-root-dir raw string, wire the playground examples by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3623
* :wrench: PUT-1560: Deep-link the shared item from email and notifications by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3632
* Land share-email links in the Dashboard's Shared view by @jelveh in https://github.com/HeyPuter/puter/pull/3634
* fix: metering buffer improvements for manual editing by @Salazareo in https://github.com/HeyPuter/puter/pull/3633
* feat: rep score middleware gateway by @Salazareo in https://github.com/HeyPuter/puter/pull/3639
* feat: guest turn for peer by @Salazareo in https://github.com/HeyPuter/puter/pull/3640
* fix: testing for peer by @Salazareo in https://github.com/HeyPuter/puter/pull/3643
* Carry a share link through the OIDC round trip by @jelveh in https://github.com/HeyPuter/puter/pull/3642
* refactor: dedupe model catalog aliases and stop mutating shared catalogs by @404oops in https://github.com/HeyPuter/puter/pull/3630
* docs: link Dutch and Odia README translations by @roarzx in https://github.com/HeyPuter/puter/pull/3635
* 🧹 PUT-1568: Rename GUI helper files to camelCase by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3641
* docs: add puter site config docs by @Salazareo in https://github.com/HeyPuter/puter/pull/3648
* :bug: PUT-1589: Shared file fs events seem to be lost by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3645
* :bug: PUT-1586 + PUT-1599: Share dialog says what it can grant, and what it did by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3647
* :wrench: PUT-1590: Mark shared items in the file listings by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3646
* feat: add Hoonify AI chat provider by @jelveh in https://github.com/HeyPuter/puter/pull/3499
* :wrench: PUT-1585: Share flag in readdir shared users in stat by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3644
* fix: failed email alarms by @Salazareo in https://github.com/HeyPuter/puter/pull/3651
* Show share notifications in the dashboard by @jelveh in https://github.com/HeyPuter/puter/pull/3653
* :wrench: PUT-1594: Settle a permission request from what is already granted by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3652
* fix: derive the signup client IP from req.ip instead of x-forwarded-for by @Salazareo in https://github.com/HeyPuter/puter/pull/3661
* fix: bound failed WebDAV Basic-auth attempts per account and per address by @Salazareo in https://github.com/HeyPuter/puter/pull/3659
* fix: answer 400 instead of 500 on four malformed-input paths by @Salazareo in https://github.com/HeyPuter/puter/pull/3662
* fix: stop sockets outliving the session that authenticated them by @Salazareo in https://github.com/HeyPuter/puter/pull/3658
* fix: complete the malformed-input guards, including the two paths still live by @Salazareo in https://github.com/HeyPuter/puter/pull/3663
* fix: stop a URL parameter putting puter.js into app mode by @Salazareo in https://github.com/HeyPuter/puter/pull/3660
* 🔧 PUT-1616: Close /share/blocks to app tokens by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3657
* :bug: PUT-1656: stop an embedded fs: in a path from escalating to full FS access by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3666
* :bug: PUT-1655: Open read-only shared files instead of forwarding write_url=undefined by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3667
* Fix sharing indicator in file picker by @Leanderroshan07 in https://github.com/HeyPuter/puter/pull/3665
* :wrench: PUT-1619: Publishing a directory takes ownership, not write by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3654
* fix: alaem cascade by @Salazareo in https://github.com/HeyPuter/puter/pull/3668
* fix: document allowedAppIdsGate's real non-app-gate behavior (PUT-1667) by @Salazareo in https://github.com/HeyPuter/puter/pull/3669
* Cap /app/<name> meta descriptions at 150 characters by @jelveh in https://github.com/HeyPuter/puter/pull/3698
* Comprehensive Normalization. by @404oops in https://github.com/HeyPuter/puter/pull/3655
* fix: metering for ai by @Salazareo in https://github.com/HeyPuter/puter/pull/3703
* Stop server-rendered landings flashing for signed-in users by @jelveh in https://github.com/HeyPuter/puter/pull/3707
* Add Claude Fable 5.1 by @404oops in https://github.com/HeyPuter/puter/pull/3711
* feat: global outbound share listing (PUT-1664) by @Salazareo in https://github.com/HeyPuter/puter/pull/3694
* Ds/put 1674 by @Salazareo in https://github.com/HeyPuter/puter/pull/3715
* feat: better verification step handling by @Salazareo in https://github.com/HeyPuter/puter/pull/3717
* feat: notification scope columns and backfill (PUT-1659) by @Salazareo in https://github.com/HeyPuter/puter/pull/3670
* feat: notification type registry and audience rules (PUT-1665) by @Salazareo in https://github.com/HeyPuter/puter/pull/3671
* feat: notification retention sweep (PUT-1668) by @Salazareo in https://github.com/HeyPuter/puter/pull/3672
* chore: remove dead notification surfaces (PUT-1669) by @Salazareo in https://github.com/HeyPuter/puter/pull/3673
* feat: events subject registry, parser, anchors, filters (PUT-1660) by @Salazareo in https://github.com/HeyPuter/puter/pull/3674
* feat: session event subscriptions and dispatch hot path (PUT-1666) by @Salazareo in https://github.com/HeyPuter/puter/pull/3675
* feat: app sockets join their own events room (PUT-1671) by @Salazareo in https://github.com/HeyPuter/puter/pull/3676
* allow concept of "home regions" by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3699
* fix: classify Replicate prediction failures instead of surfacing them as 500s by @404oops in https://github.com/HeyPuter/puter/pull/3719
* fix: don't redirect puter.com + per app/worker rate limits by @Salazareo in https://github.com/HeyPuter/puter/pull/3723
* feat: subscribe ACL and app scoping for event subscriptions (PUT-1672) by @Salazareo in https://github.com/HeyPuter/puter/pull/3677
* fix: keep the credit-bounded max_tokens on the context-length retry (PUT-1628) by @404oops in https://github.com/HeyPuter/puter/pull/3718
* feat: puter.events SDK module (PUT-1675) by @Salazareo in https://github.com/HeyPuter/puter/pull/3678
* feat: durable event subscriptions store, cache, and routes (PUT-1673) by @Salazareo in https://github.com/HeyPuter/puter/pull/3679
* feat: pending event deliveries and delivery-class invariants (PUT-1676) by @Salazareo in https://github.com/HeyPuter/puter/pull/3680
* feat: delivery re-check cache, revocation and anchor settle (PUT-1677) by @Salazareo in https://github.com/HeyPuter/puter/pull/3681
* Fix PUT-1625 by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3727
* init docs recipes by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3728
* feat: KV change events and KV subjects (PUT-1678) by @Salazareo in https://github.com/HeyPuter/puter/pull/3682
* feat: event handlers, context, and suspension machine (PUT-1680) by @Salazareo in https://github.com/HeyPuter/puter/pull/3683
* feat: background delivery seam, retries, and consent (PUT-1682) by @Salazareo in https://github.com/HeyPuter/puter/pull/3684
* feat: events metering and quotas (PUT-1683) by @Salazareo in https://github.com/HeyPuter/puter/pull/3685
* gemini 3.8 flash direct integration by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3732
* 🏗️ PUT-1699: Add team columns to group and jct_user_group by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3704
* 🏗️  PUT-1700: Deduplicate jct_user_group and make membership writes unique by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3705
* 🏗️ PUT-1701: Add audit_team_membership and share.holder_group_id by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3708
* 🏗️ PUT-1702: TeamStore — workspace CRUD, handle uniqueness, reserved words by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3709
* 🏗️ PUT-1703: TeamStore — membership reads and writes (single writer) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3710
* 🏗️ PUT-1704 + PUT-1707: TeamService — workspace lifecycle, disable and re-enable by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3712
* 🏗️ PUT-1705: TeamService — provision an org account by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3713
* 🏗️ PUT-1708 + PUT-1709 + PUT-1743: TeamController, teams_enabled, and the isolation suite by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3714
* feat: send app icons as a subdomain URL plus an API fallback by @Salazareo in https://github.com/HeyPuter/puter/pull/3734
* fix: stop video generation timeouts and failures from paging (PUT-1620) by @404oops in https://github.com/HeyPuter/puter/pull/3730
* fix: one `**` per match pattern and one `*` per segment by @Salazareo in https://github.com/HeyPuter/puter/pull/3736
* feat: presence and cross-region event forwarding (PUT-1679) by @Salazareo in https://github.com/HeyPuter/puter/pull/3686
* feat: missed-event fetch and notification fold-in (PUT-1681) by @Salazareo in https://github.com/HeyPuter/puter/pull/3687
* feat: scoped app access to notifications (PUT-1684) by @Salazareo in https://github.com/HeyPuter/puter/pull/3688
* feat: notification GUI rides the events surface (PUT-1685) by @Salazareo in https://github.com/HeyPuter/puter/pull/3689
* feat: cross-user KV share grants and handles (PUT-1686) by @Salazareo in https://github.com/HeyPuter/puter/pull/3690
* feat: revocation settles kv handles (PUT-1687) by @Salazareo in https://github.com/HeyPuter/puter/pull/3691
* feat: app-minted kv share handles (PUT-1688) by @Salazareo in https://github.com/HeyPuter/puter/pull/3692
* docs: kv key layout is the ACL boundary (PUT-1689) by @Salazareo in https://github.com/HeyPuter/puter/pull/3693
* PUT-1477 Add fs commands to cli by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3746
* dynamic workers docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3747
* kv add array example by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3748
* fix kv set value type docs by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3750
* explicit mention of kv and fs being user scope and workers for backend by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3751
* fix(ai): make chat fallback reach streamed Claude calls and rank Azure explicitly by @404oops in https://github.com/HeyPuter/puter/pull/3743
* feat(gui): let users reposition and zoom a new profile picture by @jelveh in https://github.com/HeyPuter/puter/pull/3754
* feat: add astra to models by @Salazareo in https://github.com/HeyPuter/puter/pull/3755
* ci: add Dependabot config and patch auto-merge workflow by @Salazareo in https://github.com/HeyPuter/puter/pull/3760
* chore(deps): bump fast-uri from 3.1.0 to 3.1.7 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3756
* chore(deps): bump qs from 6.15.3 to 6.16.0 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3757
* chore(deps-dev): bump browserslist from 4.28.5 to 4.28.9 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3759
* feat: the per-app events worker runtime by @Salazareo in https://github.com/HeyPuter/puter/pull/3697
* fix: harden the events stack for flag-on by @Salazareo in https://github.com/HeyPuter/puter/pull/3752
* ci: add CODEOWNERS, restrict Dependabot to patch bumps, make test wor… by @Salazareo in https://github.com/HeyPuter/puter/pull/3778
* chore(deps): bump highlight.js from 11.11.1 to 11.11.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3779
* chore(deps): bump @prelude.so/js-sdk from 0.12.0 to 0.12.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3780
* chore(deps): bump @esbuild/linux-x64 from 0.25.11 to 0.25.12 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3781
* chore(deps): bump libphonenumber-js from 1.13.6 to 1.13.12 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3782
* chore(deps-dev): bump prettier from 3.9.4 to 3.9.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3783
* chore(deps): bump mysql2 from 3.22.5 to 3.22.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3784
* chore(deps): bump sharp from 0.35.3 to 0.35.4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3786
* chore(deps-dev): bump @types/node from 24.13.2 to 24.13.3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3787
* chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3788
* chore(deps): bump uuid from 14.0.1 to 14.0.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3789
* chore(deps-dev): bump vite from 8.1.3 to 8.1.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3790
* chore(deps): bump fastify from 5.10.0 to 5.12.3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3749
* fix: withdrawing background consent revokes the app's events session by @Salazareo in https://github.com/HeyPuter/puter/pull/3777
* chore(deps): bump nodemailer from 9.0.3 to 9.0.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3795
* chore(deps-dev): bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3793
* chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3792
* chore(deps): bump fs-extra from 11.3.5 to 11.3.6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3785
* chore(deps-dev): bump @eslint/js from 9.39.4 to 9.39.5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3791
* fix: keep matrix legs of test/coverage jobs always instantiated by @Salazareo in https://github.com/HeyPuter/puter/pull/3799
* chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3762
* chore(deps): bump shell-quote from 1.8.1 to 1.10.0 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3774
* chore(deps): bump lodash from 4.17.21 to 4.18.1 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3797
* feat: the invoking backend deploys an events worker the dispatcher cannot find by @Salazareo in https://github.com/HeyPuter/puter/pull/3807
* chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3767
* chore(deps): bump docker/build-push-action from 5 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3765
* chore(deps): bump actions/checkout from 3 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3764
* chore(deps): bump dependabot/fetch-metadata from 2 to 3 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3763
* chore(deps): bump webpack from 5.101.3 to 5.110.3 in /src/puter-js by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3800
* chore(deps-dev): bump browserstack-local from 1.5.5 to 1.5.9 in /src/gui/src/lib/jquery-ui-1.13.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3808
* fix(ai): remove retired Imagen 4 and legacy Moonshot models by @404oops in https://github.com/HeyPuter/puter/pull/3801
* Add resilient PDF thumbnails to GUI uploads by @jelveh in https://github.com/HeyPuter/puter/pull/3809
* fix(puter-js): require prompt in ai.txt2img by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3804
* feat(email): sendTransactional alias and streaming file inputs by @Salazareo in https://github.com/HeyPuter/puter/pull/3812
* chore(deps): bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3810
* fix: harden events by @Salazareo in https://github.com/HeyPuter/puter/pull/3813
* fix: events hardening by @Salazareo in https://github.com/HeyPuter/puter/pull/3814
* fix(ai): canonicalize image parts once and translate them per provider by @404oops in https://github.com/HeyPuter/puter/pull/3815
* feat: let extensions customize recommended apps by @jelveh in https://github.com/HeyPuter/puter/pull/3818
* chore(deps): bump undici from 7.29.0 to 7.29.1 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3821
* feat(puter.js): transferables in AppConnection.postMessage by @r58Playz in https://github.com/HeyPuter/puter/pull/3776
* chore(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3825
* chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3824
* fix: hardening events for shared kv by @Salazareo in https://github.com/HeyPuter/puter/pull/3827
* chore(deps): bump otpauth from 9.5.1 to 9.5.2 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3820
* 🏗️ PUT-1765: a seat is created, never adopted by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3720
* Teams phase 3: land the remaining three PRs on main (#3733, #3724, #3725) by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3830
* add file query param by @ProgrammerIn-wonderland in https://github.com/HeyPuter/puter/pull/3829
* fix: misc event hardening + perm fixes by @Salazareo in https://github.com/HeyPuter/puter/pull/3831
* chore(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3826
* chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3822
* chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in https://github.com/HeyPuter/puter/pull/3823
* fix(puter-js): preserve zero amount in kv incr/decr by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3802
* fix(puter-js): return key_undefined for missing kv keys by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3803
* fix(puter-js): account for base64 padding in estimateDataUrlSize by @Ayush7614 in https://github.com/HeyPuter/puter/pull/3805
* fix: CODEOWNERS + perm dialogs outside puter dashboard/desktop by @Salazareo in https://github.com/HeyPuter/puter/pull/3833
* 🏗️ PUT-1719 + PUT-1725: two-workspace fixture and group permission grants by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3726
* 🏗️ PUT-1726 + PUT-1727 + PUT-1729: share with a workspace by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3729
* more recipes by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3819
* 🏗️ PUT-1745: enforce the forced password change on workspace seats by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3737
* 🏗️ PUT-1746 + PUT-1733: tell a member what was done to their account by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3738
* 🏗️ PUT-1732: delete a workspace seat for good, once it is disabled by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3740
* 🏗️ PUT-1735 + PUT-1737 + PUT-1738 + PUT-1739: the `puter.teams` SDK module, suite and docs by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3741
* 🏗️ PUT-1740 + PUT-1762: the workspace surfaces in the GUI by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3742
* 🏗️ PUT-1736: a team directory apps can read, once the team opens it by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3745
* Add gpt 2.5 image by @reynaldichernando in https://github.com/HeyPuter/puter/pull/3839
* fix(ai): keep per-provider failures when every chat route fails by @404oops in https://github.com/HeyPuter/puter/pull/3836
* feat(ai): refresh txt2vid catalogs, retire Sora, default to Veo 3.1 Lite by @404oops in https://github.com/HeyPuter/puter/pull/3828
* Update CODEOWNERS by @Salazareo in https://github.com/HeyPuter/puter/pull/3841
* Update CODEOWNERS by @Salazareo in https://github.com/HeyPuter/puter/pull/3842
* feat: add TeamStore.countActiveSeats for the billable seat count by @jfcastro92 in https://github.com/HeyPuter/puter/pull/3837
* feat: kv list ordering toggle + addressable path improvements by @Salazareo in https://github.com/HeyPuter/puter/pull/3843

## New Contributors
* @nevrkla made their first contribution in https://github.com/HeyPuter/puter/pull/3617
* @roarzx made their first contribution in https://github.com/HeyPuter/puter/pull/3635
* @Leanderroshan07 made their first contribution in https://github.com/HeyPuter/puter/pull/3665

**Full Changelog**: https://github.com/HeyPuter/puter/compare/26.08.2...26.09