> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fibonacci.today/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> What changed in Fibonacci, newest first

<Update label="October 2026" description="Tool permissions in the dashboard">
  * **Governance → Tool permissions**: owners block a tool or set its limits for the whole org or one role, without the API. The editor shows only the settings that affect the chosen tool, and each role's row shows its limits once combined with the org's. [Tool policies →](/guides/governance#tool-policies)
  * **The message length limit now covers Discord.** `max_message_length` only checked Slack-style `text`, so a Discord message got past it; it now checks `content` too.
  * New endpoint `GET /api/v1/governance/tool-constraints`: which policy settings each tool takes.
</Update>

<Update label="October 2026" description="Security fixes from an external review">
  * **Each run keeps its own credentials.** Two people's runs at the same moment could share a token: a run without its own GitHub, Slack, Jira or other credential could use the one another run had just applied.
  * **API keys only do what their scopes say.** Every endpoint now names its scope, a key can't create or reactivate a key broader than itself, and password and MFA changes need you signed in. New scopes: `workflows:write`, `secrets:*`, `api_keys:*`, `organizations:*`. Existing keys with the standard scopes get them, so they keep working; a key you had limited to a few scopes doesn't, and a call it now can't make says which scope it needs. [Scopes →](/api-reference/overview)
  * **`allowed_repos` holds on links, searches and `..` paths**, not only on the `repo` parameter.
  * **Jira credentials only go to `JIRA_BASE_URL`**, over HTTPS; links to other sites are refused.
  * **Agent sessions stay in their organization**, and a member who leaves is denied on their open sessions.
  * **A role can't lift the org's `read_only`.**
  * **Agent scripts count as egress** once a session has read company data, so `python -c "…upload…"` is caught by egress rules like `curl` is, also when the program hides behind a variable, quotes or a wrapper. [External agents →](/guides/external-agents#how-agent-tools-are-classified)
  * New template **Confidential data stays out of shared trackers** (Jira issues, Trello cards).
  * Slack approval messages are retried once when Slack is briefly unavailable.
  * MFA users are no longer signed out at their first token refresh.
</Update>

<Update label="October 2026" description="Approvals on Slack, and a permissions fix">
  * **Approvals reach people.** With Slack connected, admins who can decide get a DM when something waits for approval, linking straight to it, and the requester gets a DM when it's decided. Parameters never go to Slack. [Governance → Who hears about it](/guides/governance#who-hears-about-it)
  * The Approvals inbox and the dashboard badge refresh on their own.
  * **Security fix:** a member who saved their own token for a tool could get past their role's limits on it (a role block, read-only, allowed channels). Role and org limits now apply whoever's token is used.
</Update>

<Update label="October 2026" description="Developer workflows">
  **GitHub, Jira and Trello.** A request like *"get issue 23 in the abc repo, find the key issues and make a fix.md, send it to xyz, set a 1:1 with xyz and update the work in Trello"* now runs end to end. [Developer workflows →](/guides/developer-workflows)

  * **GitHub reads**: `github_get_issue`, `github_list_issues`, `github_get_file`, `github_search_code`, `github_list_commits`, `github_list_pull_requests`, `github_get_checks`. Repositories by name or link; issues as `23`, `#23` or a link. Issue text is labelled `internal` + `untrusted`.
  * **Jira Cloud**: read, search (JQL or plain filters), create, update (status via the right transition) and comment with attachments.
  * **Trello**: see boards, search, create, move between lists by name, comment with attachments.
  * **Files travel**: `gmail_send`, `jira_add_comment` and `trello_add_comment` attach a generated file (`attachment_name` + `attachment_content`). `gmail_send` takes `to: "me"`.
  * **Meetings without a time**: `google_calendar_create_event` books the next business day at 10:00 in your calendar's time zone, with an optional Google Meet link.
  * Templates resolve inside lists and objects (`"attendees": ["{{input.email}}"]`).
  * The generator sees every tool's optional parameters, and asks for a person's email as an input instead of inventing one.
  * **Organization → Integrations → Developer tools** walks through each setup.
</Update>

<Update label="October 2026" description="Reaching people">
  * **Add to Slack**: an org admin installs the Fibonacci bot once; runs in the org post as it.
  * Slack channels a workflow creates **invite the person who ran it**; `channel: "@me"` is a direct message.
  * **Discord**: `discord_send_message` (channel, `#name` or `@me`) and `discord_create_channel` (under one "Fibonacci" category).
  * **Built-in dates**: `{{today}}`, `{{yesterday}}`, `{{now}}`, fixed at the run's start.
  * **Web search** is faster and cheaper (Haiku 5.5, up to 3 searches, with a fallback model).
  * Approving a step paused mid-run resumes the run; tools get their own timeouts (web search: 90s).
  * Rules match what people paste (Google links match file IDs); placeholders like `<YOUR_ID>` are rejected.
  * Tool errors say what to change, and failures that retrying can't fix aren't retried.
</Update>

<Update label="September 2026" description="Governance for workflows and agents">
  * Every tool declares a **side effect** (read / write / egress); `read_only` roles key off it.
  * **Labels and rules**: labels follow data along the workflow; action rules allow, deny or require approval; label rules add labels. Templates ship inactive.
  * **Plan analysis** refuses a run a rule would definitely deny (`403`) before anything executes.
  * **Mid-run approvals**: a held step pauses the run, and approval resumes it without re-running finished steps.
  * **Receipts**: `GET /runs/{id}/authorization`. The **audit log** is hash-chained and append-only; `/audit-events/verify` checks it.
  * **External agents**: `POST /authorize`, a Claude Code hook and an MCP gateway apply the same rules to agents Fibonacci doesn't run, with a per-session kill switch. [External agents →](/guides/external-agents)
  * **Quota is enforced** per plan (free: 60 runs/hour, 5 concurrent, 100 queued, \$50/month).
  * Google tools use your Google sign-in.
  * **Live run events** over Server-Sent Events (`GET /runs/{id}/events`).
</Update>

<Update label="June 2026" description="Reliability">
  * Attach PDFs, Word, Excel and CSV files to a run; their text reaches LLM steps as `{{input.uploaded_files}}`.
  * A background worker runs queued workflows; `GET /runs/{id}` explains why a run hasn't started.
  * Tools work as soon as you connect them; admins can still block or scope them.
  * `file_reader` is sandboxed to one folder.
</Update>

<Update label="May 2026" description="Production hardening">
  * Governance settings, quotas, tool policies, workflow versions and the registry; secrets backends; CLI updates.
</Update>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.