Changelog

Unreleased

Fixed

• Scheduled APM collection progress (#262): the background task panel lists enabled application collections before their first run and keeps their next run visible. The desktop taskbar and tray tooltip now report active collection progress; no additional cloud calls are introduced.
• Up next follows the real schedule (#278): application collections show when the 30-minute interval fires next instead of "30 minutes after the last change", and they leave Up next while scheduled collection is paused.
• GCP local profiles recover from a rejected token: a local: profile (a gcloud configuration) kept using a cached access token for 30 minutes even when Google already refused it, so GCP reads failed with 401 until KUA restarted. KUA now keeps the token only until shortly before the expiry gcloud reports, and drops it as soon as Google refuses it, so the next read asks gcloud again.
• Attached resources can be collected (#280): attaching a resource to a KUA Application without a provider now adds the scope it lives in (AWS account and region, GCP project, Vercel team), shown in the preview, so its collection no longer fails with scope_unbound. Kubernetes PersistentVolumes get their own type, ConfigMaps, Secrets and volumes no longer claim metrics KUA does not collect, and the AWS regional inventory shares its cap between services, so many Lambda functions no longer hide SNS topics, EventBridge rules or load balancers; the estimate names the services that had more than the cap kept.

Added

• Add GCP resources like AWS stacks (#283): the map's GCP discovery becomes a wizard like the AWS one. Choose Infrastructure Manager deployments (the resources their latest revision manages, with the Terraform resources KUA does not map listed apart) or labels (app=orders; Terraform marks its resources with goog-terraform-provisioned), or the whole project, or find one resource by its full name like Find ARN. Resources are grouped by type with search, and the disk → VM and subscription → topic relationships are drawn. Every GCP catalog type can now be drawn and joins the application (VMs, disks, GKE, Cloud SQL, buckets, Pub/Sub, Cloud Run jobs, Firestore, Memorystore, Workflows, Scheduler, Tasks, BigQuery), not only Cloud Run and Functions. Only List calls, at no cost; without Infrastructure Manager the panel says so and keeps labels.
• APM signals for queues, tables, workflows, databases, APIs, volumes, Glue, GCP and Kubernetes jobs and volumes (#286): attached resources stop showing as unsupported. CloudWatch: SQS (visible messages, age of the oldest, sent), SNS (published, failed), DynamoDB (consumed capacity, read and write throttles), Step Functions (started, failed, duration), RDS (CPU, connections, free storage), API Gateway REST and HTTP (requests, 5xx, latency), SES (account bounce and complaint rates) and EBS (queue length, burst balance), each one GetMetricData call per collection. Glue jobs: runs, failures and duration from GetJobRuns (free). GCP from Cloud Monitoring: Cloud Run requests, 5xx and p95 latency, Cloud SQL CPU, disk and connections, VM CPU, one time series per metric. Kubernetes: CronJob time since its last success, active and failed jobs; PVC bound state and, with Prometheus, used bytes and percent. The collection cost preview includes them: CloudWatch USD 0.01 per 1,000 metrics; Cloud Monitoring USD 0.50 per million time series after the first million free per billing account each month.
• Recommended and Search the account when adding resources (#284): the Add resources panel of KUApps opens on Recommended: resources related to what the application holds, each with its evidence ("used by orders (Extract)", "volume of claim db/data") and confidence, released volumes flagged, and a Dismiss button. Search the account lists what an AWS profile, GCP project or Kubernetes context holds, by type and text, or resolves a pasted ARN or full resource name, with paging. Selected resources are added in one step, with the scopes they need; the panel stays open to keep adding. The Map discovery is the third tab, and opening the panel from the Map starts there. Only List/Describe calls, at no cost.
• EBS volumes in the AWS view: a new EBS tab under Storage lists the volumes of the region with size, type, state, the instance they are attached to, the Kubernetes claim the EBS CSI driver created them for, and their monthly cost at list price. Volumes attached to nothing are highlighted and summed (count, GiB and USD per month), with a filter to show only them. Only DescribeVolumes, at no cost.
• Agents build and tune the APM of an application (#285): two MCP tools, search_resources (the AWS, GCP and Kubernetes catalogs, with the exact attach input) and recommend_application_resources (related resources with evidence), and seven previewed operations: scopes.add, scopes.remove, resource.update, thresholds.update, collection.update, collection.run and recommendations.dismiss. Turning collection on, running it and enabling a resource show the CloudWatch calls and estimated USD per run and per month in the preview, so the user approves the cost before anything is collected; every change still needs the user's approval and "Allow agents to change KUApps".
• Resource recommendations (#283): GET /api/kua-apps/applications/:id/recommendations suggests what else belongs to an application from what it already holds, each with its evidence and confidence: the Lambda functions, Glue jobs, DynamoDB tables, queues and topics a Step Functions definition uses, the ARNs and queue URLs in a Lambda environment (variable names only, never values), the target groups and EC2 instances behind a load balancer, the EBS volumes of an instance, and for Kubernetes workloads the EKS cluster, the EC2 instances of its nodes and workload → PVC → PV → EBS volume or GCP disk. Released volumes of the same claim are flagged to review. Members, detached resources and dismissed suggestions (POST .../recommendations/dismiss) are left out; nothing is attached until the user or an approved agent change does it. Step Functions now also recognises Glue, DynamoDB and SNS tasks in the architecture map. Only Describe/Get/List calls, at no cost.
• GCP and Kubernetes resource catalogs (#282): GET /api/kua-apps/catalog/gcp lists Compute Engine VMs and persistent disks, GKE, Cloud SQL, buckets, Pub/Sub topics and subscriptions, Cloud Run services and jobs, Functions, Firestore, Memorystore, Workflows, Cloud Scheduler, Cloud Tasks and BigQuery datasets of a project with their full resource name and location, and resolves a full resource name; a disabled API is reported without hiding the rest. GET /api/kua-apps/catalog/kubernetes lists Deployments, StatefulSets, DaemonSets, CronJobs, Jobs, Services, Ingresses, PVCs, PVs and Nodes of a context; each PV names the EBS volume or GCP disk behind it and each node its EC2 instance. All these GCP types and Kubernetes CronJobs and Jobs can be attached to a KUA Application. Only List calls, at no cost.
• AWS resource catalog (#281): GET /api/kua-apps/catalog/aws lists what an AWS account holds so it can be attached to a KUA Application: EC2 instances, EBS volumes, S3, DynamoDB, SQS, SNS, SES identities, Glue jobs, crawlers and workflows, Step Functions, load balancers and target groups, Route 53 zones, CloudFront, RDS, API Gateway, EKS, ECS, EventBridge and Lambda. Filter by type or text, or paste an ARN to resolve one resource; every item carries the ARN, account and region the registry needs. A type the profile cannot read is reported without hiding the others, and pages continue one five-minute snapshot. Only List/Describe calls, at no cost. EBS volumes, Glue, Route 53, SES and target groups can now be attached.
• Tray status panel (#278): clicking the tray icon opens a panel with the state of KUA (version, plan, backend answering or not, with Restart backend), the background tasks running now with their progress, the next ones scheduled, paused or failed tasks with pause, resume and cancel, and the app update downloading in the background (Restart to update when it is ready). Right-click keeps the menu; on Linux the panel is its first item. It reads only the local API: no cloud calls.
• AI agent access (MCP) switch (#278): turn agents on or off on this computer from the tray panel or Connect an AI agent. Off, KUA refuses every request from the MCP server with AGENTS_DISABLED and the agent tells the user where to turn it back on. On by default; an agent cannot change its own access.
• Read-only inventory tools for agents: the MCP server adds check_profile (connection and read permissions of an AWS, GCP or Vercel profile or a Kubernetes context, without credentials or raw provider errors), list_kubernetes_contexts, kubernetes_architecture (workloads, Pods, Services, Ingresses, PVCs/PVs and Nodes with their relationships; no Secret values) and cloud_resource_inventory (AWS, GCP or Vercel resources filtered by text and type, paged over one five-minute snapshot). gcp_advisor accepts refresh and says whether its data is fresh, cached or stale. They use only list/describe control-plane reads, at no cost, and never change resources.

Kubernetes. Clusters read honestly and explain themselves. Pod details lead with health (failing, not ready, ready) and usage without samples says so instead of showing 0. A diagnosis path links a pod to its current and previous logs, ReplicaSet, Deployment, Node and Services, and a Service says why it has no backends. Writes (restart, cordon, drain, delete, scale, YAML) confirm the environment, cluster, context and namespace first. The URL keeps the view, tables say "N of M" with their filters, and narrow windows and the keyboard are first-class. Workload logs come with their own intelligence.

AWS. The AWS UX audit (A01-A15) makes every tab say its profile, account and region, and stops showing unread data as zero. EC2/ECS start and stop and the Lambda invoke dialog confirm what they will do. The Overview starts with what needs attention in the last 24 h, tables carry tags, filters and "N of M", and the URL keeps the view. New: CloudFormation (read-only), CloudWatch Logs with a local cache and Logs Insights queries, and Load Balancers.

GCP. The GCP UX audit (G01-G15, R01-R06) renames what KUA cannot know: Cloud Run "Keep warm" and "Allow scale to zero" change only the minimum instances, Storage shows public access prevention instead of a bare "Public", and read errors name their cause while an unread list is never 0. Locations, regions and pages are read for real, late answers never land on another resource, and the Overview separates incidents from read coverage.

KUApps. KUA Applications become a workspace per application: Overview, Resources, Map (Canvas and Routes), Signals, Review and Settings. Resources show the state of their signals, can be opened where they live (AWS tab, AWS console or Kubernetes view), and every map resource is checked against Kubernetes and AWS Cloud Control, with changes proposed and applied only after the user confirms. Applications without provider, portable backups, sync, "Why?" explanations and a Vercel and multicloud log reading complete the set.

Plans and account. KUA gets Free, Pro and Team plans and an optional KUA account: sign in with Google, subscribe in the Polar checkout, and the plan is cached for offline use. Free keeps every local feature that reads and changes clusters and clouds; Pro and Team add the Advisor, automatic log refresh and larger caches, agents through MCP, scheduled background work and more KUA Applications. Account also holds the optional spend tracking.

Desktop and agents. Closing the window keeps KUA and its backend in the system tray, a background tasks panel shows what runs and what it costs, and the local API now listens on 127.0.0.1 only. The MCP server lets Claude Code, Codex CLI and other clients read KUA data, including applications and the architecture graph, and change KUApps in two steps (preview, then apply after approval, off by default).

Upgrading from 1.x

Visible changes and changes that break behavior when you update from 1.17:

• Free plan limits apply from 2026-11-10. Until then Free keeps agents through MCP, scheduled background work and an unlimited number of KUA Applications, and KUA shows an in-app notice. From that date Free is limited to 3 KUA Applications and those two features need Pro or Team. Help & Options → Account lists what changes and when.
• The Advisor needs Pro or Team. On Free, overviews and KUApps show only the counts behind a lock with "See plans", and the MCP Advisor tools explain the plan instead of returning findings. Automatic refresh of cached logs, log caches above 256 MB, alert webhooks and saved path filters in the map also follow the plan.
• The local API listens on 127.0.0.1 only. Before, it listened on every network interface without authentication. If you reached KUA from another device on purpose, set KUA_HOST (for example 0.0.0.0 on a trusted network); KUA warns at startup.
• Closing the window no longer quits KUA. It keeps running in the system tray; use the tray menu and Quit for an orderly shutdown.
• Signing in is optional. Without an account KUA runs as Free. KUA_PLAN (free, pro or team) only overrides the plan for development and is ignored by the packaged desktop app. The plan is cached for 7 days offline and refreshed every 6 hours.
• Spend tracking is on by default. Turn it off in Help & Options → Account; while it is off nothing is recorded and the spend panels are hidden.
• Agents cannot change KUApps unless you allow it. Connect an AI agent → Allow agents to change KUApps is off by default, and every applied change is audited.
• Backups and sync keep working. The KUAAppBundle format stays at version 1, so cloud backups, sync, team sharing and older KUA versions keep reading it. Backups and team copies made before this release keep their old profile value until the application is uploaded again.
• Links and URLs carry more state. The AWS, GCP and Kubernetes views keep service, profile, search, filters and selection in the URL, so old bookmarks open the view but not those details.

Kubernetes

• Kubernetes ergonomics (K06, K09-K11, K13, K14): the URL keeps the Kubernetes view (?view=kubernetes&context=…&ns=…&resource=…&name=…), so a reload, back/forward or a link opens the same cluster, namespace, list or Overview and selected resource; a context missing from the kubeconfig is said, not replaced, and a stale ?app= from KUApps no longer reopens that application. Resource tables show "N of M", the active filters (quick filters must all match, severities add up) and a Clear filters button, and an empty table hidden by filters says so. Columns are translated, ages use kubectl units (7d 5h), node CPU and memory read as capacity in cores and GiB, and Events label KUA severity apart from the Kubernetes type, with repetitions, first and last seen and the severity rule as help. Rows open with Enter or Space, sort headers are buttons with aria-sort, the filter box has a label and inspector tabs follow the tablist pattern. Below 1180px the header wraps instead of clipping the context and namespace; below 900px the resource menu is a drawer and the inspector takes the full width; row actions stay pinned to the right. Workload logs say whether they show the local cache or live Kubernetes, point to the previous-instance logs of a pod, mark cached workloads that left the cluster as historical and warn that 0 cached events does not prove there were no logs.
• Kubernetes diagnosis path (K05, K07, K08, K12): from a pod's Health block, open its current logs or the logs of the previous instance of the container that ended (the terminal's Previous checkbox follows the tab). A Relations section links the ReplicaSet, Deployment, Node and the Services that select the pod, and says whether the pod is a ready endpoint of each. A Service detail explains its backends: no pod matching the selector, matching pods not ready, no selector or ExternalName, with matching and ready pods, endpoints, and the pod whose label shares the app name but no longer matches (a selector left on an older release). The Overview shows active incidents before the advisor, which now starts collapsed; the problem-pods tile splits pods restarted in the last 60 minutes from the restart history, and pods have a "Restarted in the last hour" quick filter. The crash-loop rule counts pods crash-looping now and pods with 10+ restarts whose last restart was within 24 hours, and says so.
• Kubernetes node metrics from Prometheus: when the Metrics API is missing, a node's metrics failed ("Unexpected token '<'") after about two minutes. The query escaped the node name as \. inside a PromQL string, which Prometheus rejects, and it matched node-exporter by instance, which holds IP:port rather than the node name. KUA then tried every Prometheus service and port until one answered HTML. Nodes are now matched through node_uname_info{nodename}, with cAdvisor container usage as a named fallback; names are escaped for PromQL in pod queries too; and a query Prometheus rejects stops at once.
• Kubernetes recheck (R01-R04): a workload whose CPU and memory were sampled on different pods mixed both populations: each signal now has its own reference and coverage, and the inspector says "CPU samples for X of N pods, memory for Y of N" when they differ. Moves inside the Kubernetes view (resource list, selection, namespace, context, Overview and Workload logs) add a browser history entry and Back/Forward re-apply them; start-up no longer records transient states. Overview incidents, nodes, not-ready workloads and warnings have real buttons, the Kubernetes menu items are links with aria-current, and on narrow windows the drawer moves focus to the active item, closes with Escape returning focus to its toggle and is inert while closed. The crash-loop rule now says what it measures: accumulated restarts with a last termination within 24 h or without a recorded time, not restarts counted within 24 h.
• Kubernetes health and usage (K02-K04): the pod detail called the pod phase "Status", so a pod in CrashLoopBackOff read as Running; it now leads with a Health block (failing, not ready, pending, ready) with each problem container's state, ready containers, restarts and last termination, and lists the phase as "Pod phase". The Overview chart is "Pods by phase" and links the Running pods that are not ready. An empty Prometheus answer or a pod the Metrics API has not scraped read as 0 usage; they now read "No recent sample", workloads say how many pods have samples, and Prometheus fills per-pod values. Usage bars were measured against an invented 1 core / 512 MiB per pod with a 2 % floor and a 100 % cap; they now use container limits, else requests, or node allocatable, show values above the reference, and show no percent when there is no reference. The APM collector no longer stores zeros for missing samples.
• Kubernetes write confirmations (K01): restart, cordon, uncordon, drain, delete, scale and YAML edits show the environment, cluster, full context, namespace and resource before acting. The context is captured when the action opens and the server answers 409 without changing anything if the active context changed meanwhile. The header shows the short cluster name (not the EKS ARN) with a text environment label, and its selectors have accessible names. Restarting a DaemonSet no longer returns 404.
• Kubernetes workload logs with intelligence: Logs → Workload logs lists the deployments, statefulsets, daemonsets and standalone pods of the namespace and brings the CloudWatch Logs experience to them: cache the pod logs of a workload (encrypted, same cache and budget), query them live or from the cache with Logs Insights syntax, scan up to 5 days in the background, and open the same Intelligence panel with anomalies, local ML, recommendations and agent briefs. Logs are read through the Kubernetes API (every container, plus the previous instance of restarted ones) behind a FilterLogEvents-compatible adapter, so sync, backfill and scans are shared with CloudWatch; one scan runner now serves both providers. CloudWatch-only advice (retention CLI, data protection policies) is skipped for Kubernetes. New MCP tools: list_kube_log_workloads, kube_log_intelligence, and search_logs with provider: "kubernetes". Database errors of TypeORM, MongoDB, Sequelize, Prisma and pg ("Unable to connect to the database", ServerSelectionTimeout, "Connection terminated unexpectedly"…) are now categorized as database errors.

AWS

• AWS writes and honest data (AWS UX audit A01-A06): EC2 and ECS start/stop ask first with the resource, its state, the account, profile and region, the impact and the EKS or Auto Scaling owner; ECS Start is disabled while the service runs (it sets the desired tasks to 1). The Lambda invoke dialog has its title and Invoke button, warns that it runs for real and may cost, and validates the JSON next to the field. Write dialogs belong to the profile they were opened with: a profile change closes them and nothing is sent. Step Functions counts tell a confirmed zero, "1000+", a partial read, no access and Express workflows apart, never turning a failed read into zero. Lambda tags are read in bulk (Tagging API) and say "Not read" when they could not be; the State column, which ListFunctions never returns, is gone. The CloudWatch Logs cache separates this machine's shared budget from this profile and region. Load balancers count as covered by KUA, and their error rate only divides target 5xx by RequestCount. Cached AWS and GCP responses keep their dates (they were stored as {} and showed "Invalid Date").
• AWS ergonomics (AWS UX audit A07-A15): every service tab shows the profile, account and region, and global services say the region does not filter them. The Overview starts with what needs attention in the last 24 h and opens the affected Lambda functions or state machines worst first (load balancers open their current health, which is not 5xx attribution, and say so). Tables show two relevant tags and "+N", keep secondary and write actions in a "More" menu, and filter by state, runtime, activity, type or region with "N of M" and Clear filters. Each block says its window and when it was read. The Advisor lists the three most severe findings first and says how many sources were not checked. Actions say whether they read, configure or check. The sidebar, sortable headers, menus and dialogs work with the keyboard (Escape closes, focus stays inside and returns). The URL describes the view (?view=aws&service=…&profile=…&q=…&f.…), Back and Forward move between providers and services, and a link's profile is only used when it exists on this machine.
• AWS Load Balancers: AWS → Networking → Load Balancers lists every Application, Network, Gateway and Classic load balancer of the region: public or internal, DNS name, listeners and healthy targets. Its health flags failed load balancers, target groups without healthy targets, unhealthy targets, load balancers without targets, public HTTP listeners that do not redirect to HTTPS and TLS policies that still accept TLS 1.0/1.1. Details show listener rules, TLS policy and certificates, target groups with the reason of each unhealthy target, deletion protection, access logs and tags. It only uses Elastic Load Balancing Describe* calls, which have no charge; a missing permission hides only that part and offers an access request.
• AWS resources discovered from CloudFormation lost their account and region: resources added from a CloudFormation stack have no ARN, and their account and region were dropped when they joined Observability. An application without provider could not collect them ("Application profile and region are required"), and the registry listed each one twice (one with its account, one without), reporting them as divergent. Resources now keep the account and region of their Architecture node; existing ones are fixed by one reconciliation at startup. When a region is still unknown, the collection says which scope needs it.
• AWS CloudFormation (read-only): new Management → CloudFormation tab with every stack, grouped by status (complete, in progress, failed, rolled back, in review), drift status, termination protection and nested stacks. Each stack shows parameters, outputs and tags, its resources linked to the KUA tab that manages them, its events with the root cause of the last failure highlighted, the original template, and on-demand drift detection with the property differences. CloudFormation read calls have no charge; stacks are linked to KUA Applications (adding their resources once), exports show which stacks import them, change sets can be reviewed with their risk (removals, replacements, data-bearing resources), parameters can be updated through a previewed change set, termination protection toggled and stacks deleted after a deletion preview. Destructive operations require typing the stack name (and a reason to delete), are re-checked by the server and recorded in the audit log, with an operation history per stack.
• Overview coverage: CloudWatch Logs and CloudFormation are no longer listed as partly covered; CloudWatch stays partial until alarms and a metrics explorer exist.

GCP

• GCP labels that say what KUA knows (GCP UX audit G01-G09): Cloud Run "Start/Stop" are "Keep warm" and "Allow scale to zero": they only change the minimum instances, the dialog shows the change (0 → 1) and says the endpoint keeps serving. Storage shows public access prevention (Enforced, Inherited, Not determined) and public exposure as "Not verified" instead of a "Public" label without IAM evidence. Functions read their region from the resource name, so their detail, logs and invoke reach the listed function (it was a 403). Read errors name their cause (API disabled, permission, credentials, rejected request, not found, quota, temporary) with the raw body under technical details; the enable-API link only appears for a disabled API, and an unread list says "Not read", not 0. Artifact Registry, Cloud Scheduler, Cloud Run Jobs and Cloud Tasks list each location instead of "locations/-", which Google rejects; locations blocked by policy are skipped. The Overview separates observed-resource incidents from read coverage, lists pending reads with their cause and lets you mark services not used; build history is counted apart from deployed resources and paged lists say when they are partial. Each metric chart has its own state and Retry; totals are summed, p99 uses the merged distribution, filters include the region and CPU is a percentage.
• GCP ergonomics (GCP UX audit G10-G15): write dialogs show project, profile, region and resource and close without sending if the profile changes; an estimate that cannot be computed says the cost is unknown. Rows, side lists, detail tabs and the 20 GCP dialogs work with the keyboard. Overview signals open their service filtered to the affected resource (and its detail), area cards filter the services table, and GKE Connect explains the kubeconfig import first. The cost card is an idle baseline of modeled resources with its coverage and what it leaves out. Tabs, toasts and estimate warnings are translated, and the Advisor footer no longer claims no billed calls next to a billed schedule. Lists filter by state and region, sort, say "N of M" and stack on narrow screens. The URL keeps the GCP view (?view=gcp&service=…&profile=…&q=…&f.…&selected=…), Back and Forward move between services and the search is kept per service.
• GCP recheck fixes (R01-R06): a late detail, log or metric answer for a previous selection, range or retry is dropped instead of drawing another resource's data. Lists keep their scope from the API to the table: a region that failed or a page cap is shown as "Partial list" with the regions and "n+", and every list reads all its pages. The Cloud Run detail, notices and history speak of the minimum instances and use the same units as the table. Detail tabs support arrows, Home/End, roving tabindex and a labelled tabpanel. Links also restore the Overview evidence filter, the detail tab and the Artifact Registry repository. The Advisor's GCP read estimate follows the selected frequency and states its assumptions, and the remaining hard-coded labels are translated.

Vercel

• Vercel Overview and Advisor: Vercel opens on a new Overview of the account or team: health, projects, the production state of each project, the recent deploy failure rate, domains (and how many are not verified), env vars counted by type, and a table of projects by last deployment. Inside it, the Advisor checks every project of the profile's account or team against 13 good practices: credentials in Plain env vars, production secrets shared with every preview or not marked Sensitive, previews without Deployment Protection, fork pull requests built with the project's env vars, a failed last production deploy, unverified domains, paused projects, projects without production or deploying straight to production, end-of-life Node.js, a high deploy failure rate and projects without Git. It reads env var names and types, never their values, with free Vercel API reads (about 3 per project, cached 15 minutes). Findings can be accepted or silenced, keep their history, can be analysed on a schedule and raise posture alerts like the AWS and GCP Advisors. Agents get them with the new MCP tool vercel_advisor. A profile added with a bare token is stored under a hash of the token, never the token itself, and cannot be scheduled.
• Vercel runtime logs could hang: the runtime-logs endpoint streams and can stay open; a read now stops after 20 seconds and keeps the complete lines read as a sample, so a sync or the automatic log refresh never waits indefinitely. Runtime logs are read from the latest production deployment that is ready, not from one that failed.

KUApps and Architecture

• KUApps reliability (#239): the Kubernetes picker keeps its own contexts (other views of the application shared and reset them, so it said the kubeconfig had none) and, when the map view is not ready, says so with a retry instead of blaming the connection. Refreshing the Summary renews thresholds and issues together; when issues cannot be read the health reads "Partial evaluation", never zero issues, and an answer for a previous range is ignored. Narrow windows fold the application list as they shrink, use two-line rows and icon tabs. Opening a resource in the AWS view says its account, region and profile, and warns about another region or an ambiguous account. A cluster Node no longer opens a false "0 % ready pods" critical, EKS objects no longer show the cluster as namespace, "Not supported" reads "No KUA metrics", and log findings name their resources and the next step.
• Open a resource where it lives (#239): every AWS resource of a map or a KUA Application can be opened from the canvas, from each row of Resources (KUApps list and registry table) and from the KUApps inspector: in its tab of KUA's AWS view (SQS, SNS, DynamoDB, S3, ECS, EKS, ECR, RDS, API Gateway, CloudFront, Cognito, Secrets Manager, load balancers and target groups, CloudWatch Logs, Glue, Step Functions, Lambda, EC2…), searched by the name AWS lists it with and with the profile bound to its account, or, for what KUA has no tab for (security groups and their rules, launch templates, Auto Scaling groups, EKS access entries, IAM roles and policies, KMS keys), on its AWS console page in its region. Kubernetes resources open in the Kubernetes view: their detail, the pods of a workload and their logs, in their own context and namespace.
• KUApps recheck (#239): live log reads (resource logs of Lambda, ECS, EventBridge, GCP and Vercel, CloudWatch live and Insights, and the pod, GCP and Vercel streams) now hide secrets like the cache already did, also compound keys (DB_PASSWORD, aws_secret_access_key) and PEM private keys, and the logs viewer says how many it hid and that they must be rotated at the source. The Summary's health counts the open issues too (a critical issue is never "Healthy"), says when and over what it was evaluated, and waits for both before it can be clicked. The inspector knows whether it is in Resources or the Map, the Advisor no longer asks a new application with the previous one's profile and explains a failure instead of showing it raw, every application is reconciled at startup, Resources keeps one operational list with the registry's technical table folded apart, denominators are named (inventoried, followed by Observability), and Review shows decisions before the folded possible duplicates.
• The diagram comes first (#239): the map's tools fit in one row (search, arrangement, Filters, Layers, Hidden, Component) and each opens its panel below, one at a time; the advisor is folded with its count visible and an up-to-date check takes one line. Long resource names wrap inside their node with the full name as tooltip, map text is at least 12 px, section headings wrap in narrow windows, and the remaining tablists (a resource's metrics and logs, the application's log resources) follow the arrow keys.
• One node per resource in the map (#239): nodes that are the same resource become one: the same ARN (an EKS worker node and its EC2 instance, a resource discovered and also projected from Observability) or the same Kubernetes object. The discovered node is kept and takes the relationships (decisions made by hand included), the place and the evidence. It happens on every reconcile and discovery import; a shared name alone never joins two nodes. Kubernetes Nodes now have their own type, so their projection matches the discovered node.
• The map checks its resources where they live (#239): when a map opens, KUA reads the Kubernetes API of its contexts and namespaces and asks AWS Cloud Control for its AWS resources with the profile bound to their account (reads with no charge of their own; nothing changes in the cluster or the account). Every drawn resource is checked, also the ones Observability projected into the map, and the application membership follows the change. An AWS resource KUA cannot read (no connection, access denied, a type or identifier it does not verify) is reported as not verified, never as gone; and marks pods replaced by a new release, workloads recreated with a new uid and resources that no longer exist. It proposes the change (successors take the place and the relationships, even the ones drawn by hand; gone resources leave the map) and applies only what the user confirms, in one revision with its reason in Changes. A context that cannot be read marks nothing as gone. Routes walk the same resources once and list every kind of relationship of a step.
• KUApps finds a resource among many (#239): Resources has search, filters (provider, type, connection, namespace, signal state), column headers and readable connections (the cluster instead of the kube context ARN). A diagram node without account joins the resource of its only known account instead of appearing twice; what KUA cannot join shows as possible duplicates in Review, which is split into pending decisions, structure findings and a folded history. Add resources opens the provider and context of the chosen connection, no longer closes itself while the profile loads ("no contexts for this profile" until a second click), names a context this computer lacks and offers Repair connection. "Why?" only suggests caching the logs of a resource that writes them, verified connections name the profile of this computer, and "N resources on one side only" lists them with the next step. "Connection" replaces scope, registry and discovery in the text, nothing is under 12 px, the application list folds in narrow windows, tabs follow the arrow keys, and the Summary's collection confirmation separates what is read now, the cache and the cost. The map opens at a readable size (grouped by domain when large), keeps its search visible (Enter goes to the match and its neighbours), and Routes shows each route from where it branches, first 5 per entry.
• KUApps guides from the problem to the action (#239): the Summary lists what needs attention under its indicators (resource, evidence, since when and an action: see metrics, review, bind a profile, collect again), and the health card opens Signals on the affected resources with the same range. Signals has one time range, starts with those issues, folds the aggregated metrics and charts without data, and names which resources failed their last collection and why (stored per resource). Resources and the Map share one inspector (detail, the resource's own metrics and logs, relationships in words, arrow-key tabs). Collecting from Signals asks first and separates what is read now, what comes from the local cache and what costs.
• Resources that no longer exist (#236): when a release replaces Kubernetes workloads under new names (attencion-3.9.1 → attencion-3.9.2), the collection no longer ends partial with "HTTP request failed": the resource reads "No longer exists" since that time, and KUApps → Review suggests its successor from the same namespace (same app label, or the same name without version) to replace, detach or ignore. Nothing is replaced automatically and nothing changes in the cluster. Pods are observed through their Deployment instead of as members of their own.
• KUApps Signals by resource: Signals lists the whole application and then each resource grouped by type, with metrics and logs read with the profile and region of the resource's own account (before, an application without provider read every log with a non-existent profile: "Credential profile not found"). Types KUA does not collect (API Gateway, SQS, DynamoDB…) show as not supported instead of "no data". CloudFormation secrets an older KUA stored as Kubernetes workloads are removed at startup (they made every collection partial), and collections cut by a restart are closed instead of showing as running.
• Sync and Remove from diagram in KUApps (#146, #153): applications without provider sync between computers like the others; the sync link belongs to the application, and their membership travels: a resource detached on one computer is detached on the other, and members added on either side reach the other. Remove from diagram now only hides a real resource in that view: it stays in the application with its relationships, signals and history, and Hidden in this view shows it again. Before, a resource that came only from the diagram left the application and lost its metric history, and a member's node came back on the next refresh.
• KUApps resources show their signal state (#151, #152): every resource in Resources and the inspector says whether its signals are current, stale, partial, missing, off, failing, unreachable from this computer or not supported, instead of looking empty. The workspace tab travels in the URL with ?app=. Add resources marks what is already in the application and shows native identities, recovers from a view changed meanwhile without losing the selection, and Remove from diagram asks for confirmation. Linking a CloudFormation stack now goes through the shared membership service (#150). Scopes of plugin providers show as not supported.
• Portable KUA Applications (#153): a backup now carries the application's scopes, every architecture view, its resource membership, the relationships the user drew and the resources they detached, and applications without provider can be exported. Importing first shows a preview: the name it gets, scopes to bind, views, which resources come back and which cannot (and why), resources this computer already has, and anything left out of the file. Import creates a new application, restores membership through the shared registry service without starting any collection, and rolls back on failure. The format stays KUAAppBundle version 1 (with contentVersion: 2), so cloud backups, sync, team sharing and older KUA versions keep reading it.
• AWS load balancers in Architecture (#210): regional discovery adds load balancers and their target groups to the KUApps graph, then suggests the declared target-group-to-ECS-service path with configuration evidence. Relationships remain reviewable before import; no CloudFormation stacks are required.
• Architecture Canvas rollout and security overlays: Kubernetes Deployment nodes can show their latest retained ReplicaSet revision, creation time and ready/desired replicas. An opt-in security overlay projects AWS and GCP Advisor findings plus Kubernetes security checks onto nodes only when provider, resource type, project/region/context, namespace and resource identity match exactly; it respects Advisor access decisions and does not persist scan data in the graph. Rollouts and findings load on demand.
• Why? for every relationship and suggestion in KUApps: in Review, the Map inspector and the relationship list, Why? explains a relationship in plain words: one sentence per piece of evidence, classified as declared (a template, manifest or configuration), observed (traffic or logs) or inferred (names or scope), the confidence split by those classes, what Observability saw on the pair (error rate of each side in the cached logs, and the caller's recurring errors that talk about the target, found by name and, with Local ML on, by meaning), advice (verify before accepting, declare it in code, add timeouts and retries when the target fails, rotate secrets with care) and what accepting or rejecting does. Copy for AI agent turns it into a task. Everything is local: no cloud calls, and the local model only compares embeddings; it does not write the text. The product Advisor gets a new finding for confirmed dependencies whose target shows errors above the application objective in its logs.
• KUApps Settings by section, and syncs that say what they do: Settings has its own navigation: application details, accounts and scopes, sources and sync, backups and collaboration, and delete. "Join Observability and Architecture" explains that it compares both sides by identity locally, with no cloud call, shows its last run and what is left on one side, and can run now or open Review. "Update from CloudFormation" explains that it reads the stack at no charge and applies nothing until you confirm. Deleting an application asks for its name and says that Architecture projects and cloud infrastructure stay. In the Map, the resource inspector has Detail, Signals and Relationships tabs.
• Compact KUApps Overview: the Overview of an application is now four cards instead of the full Observability view: health in the selected range (with its worst signal and threshold), structure score and findings, what waits for review, and signal coverage (resources with a collector and the types without one). Each card opens the tab with the detail. An application without data reads "No data", never healthy. The range and Collect now stay at the top; Collect now opens Signals with its usual confirmation of what it reads and costs. The product Advisor is shown open below the cards.
• Add resources in a side panel: in KUApps, Add resources opens a panel on the right from the application header, Resources or the Map, without leaving the tab. It asks for the account first (when the application has several verified ones), then which discovery to use (AWS, Kubernetes, GCP, Vercel or a manual resource), and says what adding does: the resources join the application and its map, nothing changes in the cloud, and metric collection stays off. Settings no longer has an Add resources section at the bottom of the page.
• KUApps workspace per application: each application opens on Overview and has Resources, Map (Canvas and Routes), Signals (metrics, logs and traces), Review and Settings. Review brings back what the previous layout hid: the structure score and findings, "Analyze cloud topology", suggested relationships with their evidence and confidence (confirm one or all), references to resources outside the application, accepting or rejecting relationships, and accounts without a usable profile of this computer. The Review tab shows how many items wait for a decision. The KUApps sidebar entries for Architecture and Observability are gone: everything opens inside the application.
• One way to add, update and detach application resources: Observability, Architecture and KUApps now go through the same service. Adding a resource that is already in the application answers with the existing one instead of creating a duplicate, writes check the application revision so a newer change is never overwritten, and a failed projection into an Architecture view is finished by the next reconciliation. Detaching a resource removes it from the application but keeps its node in the diagram, and the application no longer takes it back from that node; nothing is deleted in the cloud. Relationships you confirmed or rejected keep their status.
• KUA Applications without a provider: KUApps → Create application now creates an application with just a name, environment and team, without going through the Observability setup. Its accounts are added as scopes (AWS account and region, GCP project, Kubernetes context, Vercel team, or another provider id), and each computer binds one of its own profiles to each scope: the panel lists the profiles of this computer for that provider, warns while a scope has no profile or one that does not match, and shows whether it is verified. Verification only uses free reads (AWS STS GetCallerIdentity, the GCP project and Vercel team of the profile, the kube contexts), and a scope whose account was unknown is completed with the account the profile reaches. Profiles are never exported. Existing applications are migrated at startup without losing data: they get the scopes their resources live in and a binding to the profile they used, and the resource registry moves to identities without profiles (resources seen through two profiles become one). Application names are no longer unique, a link with ?app=<id> opens that application, and selecting an application no longer falls back to the AWS profile of the top bar. GET /api/kua-apps/migration-report lists what needs a decision. Architecture and Observability of an application without a provider open once resources can be added to its scopes (#151), and these applications are not published to the team until the bundle carries scopes (#153).
• KUApps clarity fixes (#239): the Map inspector showed only the resource name (its content was inside an unrendered template); after a reload, a multi-account application asked to add accounts it already had (a 404 from the provider selected elsewhere in KUA hid the application details, and the Map depended on a scope chosen in Add resources), so the Map now opens with the profile that owns its view; the load balancer 5xx rate could pass 100 % because the errors the load balancer generates itself are not part of RequestCount, so the rate now counts target errors only and the load balancer's own 5xx are a separate counted signal; "Signal coverage" became "Resources with recent data", with compatible, enabled and with-data counts and green only for effective coverage; {targetGroup} and "No data in this range" are translated.
• Applications without a provider had no signals: an application created in KUApps with accounts of several providers (for example an EKS cluster) could not open Signals, Review or Collect now, and Sources and sync said it was unavailable, because Observability only served applications with a profile of their own. They are now served through the generic Observability routes: Kubernetes workloads are collected through their kube context, AWS resources with the verified profile bound to their account (a resource of an account without a verified profile is reported as such, never read with another account's profile), and scheduled collection includes them when polling is on. The Map inspector also shows the signals of Kubernetes workloads inside an AWS application.
• KUApps sidebar losing applications: opening Map, Resources or Settings of an application loaded the Architecture list of that application's profile into the shared list, so applications of other profiles disappeared from the KUApps sidebar until a refresh. KUApps now keeps its own list.
• Legacy applications after the scopes migration: an application created with a profile lost its Map and Add resources once the migration gave it scopes whose profile was not verified yet. It uses its own profile again.
• Local profile in exported KUApps: a KUAAppBundle (export, cloud backup, sync and team sharing) left out profile ids but kept them inside the resource registry identities (identityKey), and automatic architecture changes were exported with the profile as their author. Resources now travel with a portable identity (provider, account/project/context, location, type and native id), relationships point to those ids and profile authors are exported as local; older bundles are cleaned when they are read again. Backups and team copies made before this release keep the old value until the application is uploaded again. The KUA Application contract behind it, which has no provider or profile of its own, is in Architecture → KUA Application Contract.

Advisor

• Product Advisor v2 (#96): shows APM/log error-budget consumption and burn rate, reuses recent technical inspections for verified application scopes, and filters findings through registry membership before surfacing cross-recommendations for overlapping risks. DORA is explicitly unavailable until release and commit history can be correlated; no scans or billable reads are added.
• Provider Advisor coverage (#95): AWS adds IAM wildcard/unused-role/password checks plus SQS, SNS, DynamoDB and CloudFront checks to the cached 15-minute scan. S3 is a separate opt-in scan: the overview shows bucket count and a conservative request/cost estimate at USD 0.0004 per 1,000 requests, asks for confirmation before detailed reads, and caches results for 15 minutes. Kubernetes adds cluster-admin bindings, missing Pod Security Admission labels and widely mounted Secrets. Vercel checks preview deployment protection and credential-like Preview variable names only; variable values are never returned. Deprecated-runtime catalogs carry a review date and a six-month freshness test. Collector limits are surfaced as partial results, not complete scans.
• Per-resource log analysis in KUApps: the product Advisor reads sanitized local aggregates for each AWS and Kubernetes resource using that resource's verified account/region or cluster/namespace scope. It flags error rates above the application objective, recurring or severe log signals, groups not yet cached, and scopes without verified access as distinct findings; no raw log messages or new cloud calls are used. Topology can open the matching Kubernetes workload logs directly.
• Advisor false positives: the AWS rule for unused IAM roles read the last use from ListRoles, which never returns it, so every role was reported as never used; it now reads it with GetRole (no charge, up to 200 roles, a few at a time), reports never-used roles only once they are older than 90 days, and IAM roles and policies are paged with Marker instead of stopping at the first 100. The Kubernetes cluster-admin rule no longer reports the bootstrap cluster-admin binding to system:masters, managed eks: bindings or service accounts of kube-* namespaces, which every cluster has. The rule for widely used Secrets counts workloads instead of replicas. In Vercel, credentials for previews are reported only when previews are not protected, no longer duplicate the shared-with-production finding, and Vercel Authentication on previews counts as protection even when a password protects only production.
• Advisor in every overview: the Kubernetes, AWS and GCP overviews get a panel of good-practice recommendations grouped as security, infrastructure, architecture and development, each with its severity, the affected resources and a link to the provider docs. The checks are deterministic (no AI) and only use data KUA already reads or free control-plane APIs: Kubernetes adds NetworkPolicies, PodDisruptionBudgets and HPAs to the overview (privileged or root containers, plain-text credentials in env vars, missing requests/limits/probes, single replicas, floating image tags, namespaces without NetworkPolicy…; kube-* namespaces are skipped); AWS reads the IAM credential report, CloudTrail, EC2, RDS, Lambda and EKS (root MFA and keys, old or unused keys, ports open to the internet, IMDSv1, public or unencrypted databases, backups, Multi-AZ, deprecated runtimes, orphan volumes and IPs…; cached 15 minutes, no Cost Explorer or CloudWatch calls); GCP reuses the overview rows (default service accounts, public IPs, Cloud SQL backups and HA, bucket access, GKE hardening, deprecated runtimes…). Sources that cannot be read are listed with the IAM actions they need.
• Product advisor in KUApps: each application gets the product lens: breached objectives, objectives left at KUA defaults, missing owner or environment, production without a pre-production stage, no architecture for the user journeys, and missing or stale telemetry. It is computed from the KUApps registry with no cloud calls.

Logs and observability

• Multicloud log intelligence (#92): KUA Applications can opt in per GCP Cloud Run/Function or Vercel project resource. Cloud Logging is capped at five entries.list pages per sync with a request estimate before the first read; Vercel reads only runtime logs from the latest production deployment, caps each response at 2 MiB/5,000 events and honors Retry-After. Both sources use the encrypted shared cache, sanitizer, retention window and evidence mapping.
• Historical log rates and shared objectives (#90): Observability charts cached error and warning rates from the 30-day local buckets, with sync freshness and explicit missing-scope/cache coverage. The existing error-rate objective now evaluates both APM and log events; recurring sanitized signatures are compared with the previous 24 hours against a configurable growth threshold. Product Advisor reports breached log objectives through the shared threshold engine; no raw logs or cloud reads are added.
• Compact log coverage in KUApps: Signals and Map show a resource count first and keep the full uncached/unavailable-scope list in a bounded, expandable disclosure, so large applications do not overwhelm the view.
• Signatures of container logs: lines wrapped by the container runtime ({"time","stream","log"} from Docker, containerd and Container Insights) and colored logs (NestJS, Winston) produced one signature per pod and samples filled with escape codes. Signatures and samples now come from the application message without colors, so the same error in several pods is one recurring error. Cached groups are re-analyzed automatically on the next read (locally, no AWS calls).
• CloudWatch Logs search: live searches returned the oldest events of the range (FilterLogEvents reads forward) while the cache returned the newest, and the cache searched filter patterns as plain text. Both now return the newest events and apply the same filter pattern syntax.
• Automatic refresh of cached logs and a configurable cache size (Pro and Team plans): each cached CloudWatch log group or Kubernetes workload can refresh its newest events every 1, 5, 15, 30 or 60 minutes while KUA is open (no history backfill, never Logs Insights, stops at the cache budget), set from its row or right after a scan finishes, with the requests per day it generates and the next refresh shown. The log cache size can be chosen in the logs views (256 MB up to 20 GB). Limits per plan: Free keeps 256 MB and manual syncs, Pro up to 2 GB and refreshes every 15 minutes or more, Team up to 20 GB and every minute or more. The desktop app gets a plan layer with the same plans as the control plane; until it is linked to a KUA account the plan comes from KUA_PLAN (free by default). KUA_LOG_CACHE_MB still overrides the size.
• Log Intelligence panel sections can be collapsed: anomalies, local ML, recommendations, categories, recurring errors and warnings, resources mentioned and observability fold from their title, keep a count next to it (red or yellow by severity) and stay closed across log groups and sessions. The panel no longer reloads by itself when a sync or a background scan caches new events: it says a scan of the group is running and, once new events are cached, offers "Refresh analysis", so filters and open sections are kept while reading.
• Local ML for logs: an optional, local embedding model (paraphrase-multilingual-MiniLM-L12-v2, about 130 MB, downloaded once from Hugging Face for free when you enable it in Intelligence → Local ML, and deletable from there) adds search by meaning across the recurring errors of every cached log group, also in Spanish over English logs; groups errors that say the same thing in different words; and suggests a category for errors the rules leave uncategorized. It runs on this computer with ONNX Runtime (no text leaves it, no AWS calls), on the sanitized signatures, and vectors are cached so each error is embedded once. Agents get the similar errors in the brief and a new MCP tool, search_logs. The installer only carries the ONNX Runtime binaries of its platform.
• Log anomalies: the Intelligence panel of each cached log group flags what changed, compared with its previous 7 days: error spikes in the last hour (and whether they only follow more traffic), log volume dropping against the same time of day, a failure or client category at 3× or more its usual rate, and recurring errors that appeared in the last 24 h. Each anomaly explains the expected value, opens its time window or its events, and is part of the agent brief and the MCP log_intelligence answer. Only synced time is evaluated, so a stale or new cache is reported instead of guessed. Simple statistics on the local aggregates: no AI and no AWS calls.
• Background log scans: read up to 5 days of a CloudWatch log group into the local cache while you keep working. Scans run in the background (two at a time, the rest queued), read the newest hour first, show progress and remaining time, and can be paused, resumed or cancelled; progress is saved after every page, so a scan interrupted by closing KUA comes back paused and resumes where it stopped. The scanned range is kept beyond the group's usual window (up to the 7-day cache limit), and a scan stops instead of evicting data when the cache reaches its budget. Before starting, KUA estimates the volume against the free cache space; FilterLogEvents has no per-request charge, and the download counts as AWS data transfer out (first 100 GB/month free). "View in cache" opens the scanned range in the cached events.
• Log activity chart: events per level over time with a resolution that adapts to the range (seconds, minutes, hours or days), zoom by click or drag, tooltip and table view; Logs Insights results grouped by bin() are charted as well. The chart keeps its history: a per-minute index of events by level is stored for 30 days even after the events leave the cache (a busy group may only fit an hour of raw events), and a "Total volume" view reads the CloudWatch IncomingLogEvents metric for any group and range (about USD 0.00001 per read, reused from the local metric history).
• AWS CloudWatch Logs: new tab with every log group classified as AWS service, machine (CloudWatch agent, EC2 instances detected from streams) or custom; recent streams and events.
• Local log cache: cache chosen log groups for up to 7 days, shortened when the group's volume would not fit its share of the budget (KUA_LOG_CACHE_MB, 256 MB by default). Events are sanitized, compressed (about 19x on real Lambda logs) and encrypted with AES-256-GCM using a key kept in the OS keychain of the current user; they never leave the machine. Syncs read the latest hours first and fill older hours afterwards. An existing plain-text cache is migrated automatically. Each group has a history setting (only new events, last hour, 6 h, 24 h, 3 days or the whole window) and a "fill now" action.
• Logs queries: Logs Insights syntax (fields, filter, parse, stats, sort, limit, display, dedup) with autocomplete, live validation with suggestions, templates per log type and a filter builder. Runs for free over the cache or a live sample, or in Logs Insights after showing the estimated scan and cost.
• S3 backup view: per log group, whether its logs are copied to S3 (subscription or export tasks) and which ones expire without a copy; export tasks, CloudTrail and VPC flow logs written to S3, and an archive browser that reads gzip exports.
• Log intelligence: every cached log group is analyzed with deterministic rules shared with the Kubernetes log evidence: error and warning rates, recurring error signatures, failure keywords (timeouts, throttling, memory, access, connection) and references to other resources. Only aggregates are kept (30 days). In Observability, the Intelligent topology shows these signals for the application's resources, flags error rates above the application threshold, lists resources without cached logs, and suggests relationships seen in logs for review; nothing is connected automatically. Lambda REPORT lines in cached groups also feed the APM metrics. Events are categorized (timeouts, memory, throttling, permissions, connection, code, configuration, database, client errors, cold starts…) and can be filtered by category, level or recurring error; sensitive values reaching the logs are counted by type (including card numbers and RUTs). Each group gets recommendations with evidence and confidence: fixes per category (with the exact IAM actions when an access-denied message names them), masking at the source and CloudWatch data protection policies, structured logging, log level and retention.

AI agents and MCP

• KUApps changes from AI agents (#155): agents can create and edit KUA Applications, attach or detach resources and link or unlink views through the MCP server, in two steps: preview_application_change returns a plan, and apply_application_change runs it only after the user approved it and only while Connect an AI agent → Allow agents to change KUApps is on (off by default). A plan made against an older revision is refused with the current revision, applying a plan twice returns its recorded outcome, get_application_change reads it after a lost response, resources need their native identity and scope, and every apply is audited. Nothing is created or deleted in the cloud.
• KUA Applications for AI agents (#154): the MCP server adds three read-only tools: get_application, list_application_resources and get_architecture_graph. They read an application through the same KUApps service as the UI (scopes from the application, never the AWS profile selected in KUA), report each resource's signal state and the time of its latest data, serve a view only through its application, and say which scopes this computer can read without naming the profile. Local data only.
• Briefs for AI agents: the Advisor in every overview (AWS, GCP, Kubernetes and the KUApps product lens) and the log intelligence recommendations get "Copy for AI agent" and "Download brief (.md)". The brief is a self-contained Markdown task for Claude Code, Codex, ChatGPT or any other agent: context (provider, account, region, namespace or log group), working rules (verify the current state first, fix by severity and root cause, change infrastructure as code instead of the console, ask before destructive or billed operations, never expose secrets), every finding with its affected resources and docs, and for logs the activity, sanitized signatures, Logs Insights queries, code snippets and the resources the workload talks to, plus how to verify the fix. It is built locally from data KUA already has, in the app language: no AI and no cloud calls.
• MCP server for AI agents: mcp/server.mjs lets Claude Code, Codex CLI and other MCP clients read KUA directly: profiles, AWS, GCP, Kubernetes and product Advisor findings, cached log groups and their log intelligence, as the same Markdown briefs or as JSON, in English or Spanish. It runs over stdio on your machine, reads the KUA API (KuaDashboard must be open; KUA_URL overrides http://localhost:7190), has no dependencies and every tool is read-only: no billed calls, no credentials returned. It also runs from the installed app with the KuaDashboard executable in Node mode, so Node.js is not required; the plug icon next to the brief buttons opens Connect AI agents with the exact setup for Claude Code, Codex CLI, JSON clients and Codex config.toml. Setup in Features → AI Agents.

Plans and account

• Alert webhooks in Account, for Pro and Team: the Slack and Microsoft Teams webhooks for Advisor posture alerts moved from Help & Options to their own section in Account, and are available on the Pro plan too (they follow the Advisor plans). The plan comparison lists them.
• Optional spend tracking: Help & Options → Account turns off the record of what KUA spends on cloud APIs (optionally deleting its history) and turns it back on. While it is off nothing is recorded and the spend panels in the AWS overview and the log cache are hidden. It stays on by default.
• Sign in to a KUA account and subscribe from KUA: Help & Options → Account signs in with Google through the system browser (loopback redirect with a one-time code and PKCE; the session token stays in the OS keychain and never reaches the UI) and takes the plan from the account, cached for 7 days offline and refreshed every 6 hours. Linked accounts can upgrade to Pro or Team, monthly or yearly, in the Polar checkout (KUA waits for the payment confirmation and updates the plan) and manage the subscription in the billing portal. KUA_PLAN still overrides the plan on a computer, for development. The control plane adds /auth/desktop/start, /auth/desktop/token, bearer logout and a "return to KUA" page after checkout.
• Account in Help & Options, and the Advisor as a Pro feature: a new Account tab gathers everything that will depend on the KUA account: the plan and where it comes from, a Free / Pro / Team comparison, the log cache size, local ML and what KUA spent this month; sign-in arrives with account linking. The Advisor is now part of the Pro plan: on Free, the overviews and KUApps show only the counts (checks passed, findings per category and severity) behind a lock with "See plans", and the MCP Advisor tools explain the plan instead of returning findings. The server enforces it, so resources and fixes never reach a Free client. Until the app is linked to an account, set KUA_PLAN=pro or team to use it.
• What KUA spends: every AWS SDK call KUA makes is measured in one place, priced with AWS public list prices (us-east-1) and, when it has a usage price, kept in a local ledger with its calculation: GetMetricData per metric, Logs Insights per GB scanned, Cost Explorer per request, Athena per TB scanned (10 MB minimum), Lex per text request, and log downloads (FilterLogEvents: no request charge, data transfer within the first 100 GB per month free, shown as the cost beyond the free tier). Each call is attributed to the profile and the feature that made it, including background scans and Observability collections. A "Spent by KUA" panel in the AWS overview and in the log cache view shows today, this month and the last 7, 30 or 90 days, each operation as quantity × unit price = USD, the split by feature and the latest billed calls. It is an estimate of KUA's own calls, not the AWS bill.
• Polar billing (merchant of record): Stripe does not accept accounts from Chile, so the control plane gets a pluggable billing provider with Polar as the main one: checkout and customer portal through the Polar REST API, customers linked by external id, Standard Webhooks verification, and subscription events that grant or revoke Pro/Team. Same plans and prices; Stripe stays available for a future foreign company.
• Stripe plans (test mode): KUA Pro (USD 9/month, 90/year) and KUA Team (USD 29/month, 290/year, up to 10 members), a customer portal to change plan, card or cancel, and yearly checkout. The plan is taken from the subscription price, so portal plan changes apply.

Desktop and system

• Background tasks panel: the shared header opens a live view of active, scheduled and recent tasks, with progress, a live elapsed timer, provider labels, safe controls announced by the API, and process-wide CPU/memory metrics clearly separated from task usage. Where the AWS usage ledger has matching activity data, it shows the last 30 days of estimated AWS cost by activity (including potential cost beyond the free tier), never as the cost of one run; other provider costs remain explicitly untracked. Drawer and task updates use restrained transitions and respect reduced-motion settings. It polls only while open, refreshes when KUA returns to the foreground, and shows loading, empty and recoverable error states in English and Spanish.
• Per-task background controls: POST /api/system/tasks/:id/:action exposes only the actions supported by each task. Log scans can be paused, resumed or cancelled independently; an in-flight request finishes its page before applying the control, and progress survives restart as paused. Periodic schedulers pause only their own timer and let active work finish safely.
• Background task status API: GET /api/system/tasks reports the scheduled, running, completed or failed state of APM collection, automatic log refresh, application/team sync and Advisor, together with process-wide uptime, CPU time counters and memory use. It is read-only; errors are reduced to validated codes and CPU/memory are not attributed to individual tasks.
• Desktop background mode: closing the window keeps KUA and its backend running in the system tray; restore it from the tray or choose Quit for an orderly shutdown. The close-to-tray preference is local, and launching KUA again restores the existing instance when a Linux desktop has no compatible tray.
• Transparent panels: about a dozen screens (AWS, GCP, Observability, KUApps) painted panels with a color token that was never defined, so they were see-through. The token now exists in both themes.
• Local API reachable from the network: the KUA server listened on every network interface, and its API has no authentication, so another device on the same network could read profiles, clusters and logs or open shells through it. It now listens on 127.0.0.1 only; KUA_HOST exposes it on purpose (for example 0.0.0.0 on a trusted network), with a warning at startup.
• Language of detail screens: the EC2, Lambda, EKS and VPC details, the GCP Cloud Run, VM and Cloud SQL info panels, the GCP create resource modal, the terminal and the EC2 RDP/SSH connection screens, the AWS and GCP views (every service tab, modal, toast and empty list), the Step Functions detail, the Architecture views (canvas, routes, resources and discovery panels), Helm, the profile modal, EventBridge, application observability and logs, KUApps, the S3 and GCS browsers, the EKS observability dashboard and the file viewer had hard-coded text, so several stayed in one language whatever the app language was. They now follow the app language, dates included, and a test keeps migrated screens from getting hard-coded text back.
• Release history and remaining texts in both languages: releases 1.16 and older in the Help modal, the GCP polling, state history, labels and start/stop/delete confirmations, the YAML editor, update and AWS session notices, port forwarding and the donation window are now in English and Spanish. GCP scopes, the Cloud SQL maintenance day and the create-form presets come from the server as codes, so they follow the app language too.
• Control plane deployment: The Cloud Run control plane (cloud/control-plane) now builds and deploys. Cloud Build runs as the deploy account instead of the default Compute Engine account (which the deployer could not act as), stages source in its own bucket and no longer uploads node_modules; the service runs as kua-control-plane-run. Configuration moves to GitHub vars and secrets, with sensitive values synced to Secret Manager. Stripe webhooks failed with PERMISSION_DENIED because the project's (default) Datastore database rejects every write; the service now uses its own kua-control-plane database. /health replaces /healthz (reserved by Cloud Run) and 500 errors are logged.

v1.17.0 (2026-09-28)

Cloud Insights brings overviews, costs, activity and health to AWS and Kubernetes, adds SQS, SNS and SES, draws CloudWatch dashboards inside KUA, and makes every automatic read state what it costs.

Fixed

• AWS auto-refresh costs: The app-wide auto-refresh (every 5 s by default) re-read the Lambda and Step Functions 24h activity and the Overview KPIs on every tick. Those reads use CloudWatch GetMetricData, which is billed (USD 0.01 per 1,000 metrics, not in the free tier): about USD 0.006 per Lambda table load with ~600 metrics, or roughly USD 4 per hour with the tab open. Activity and Overview insights are now reused for 15 minutes and the free resource overview for 5 minutes; the refresh button still forces a new read.
• AWS dashboards: Log widgets whose SOURCE is a log group ARN (for example SOURCE "arn:aws:logs:…:log-group:/aws/lambda/…") failed with Value at 'logGroupNamePrefix' failed to satisfy constraint. The size estimate now uses the log group name and the query uses logGroupIdentifiers, which accepts names and ARNs; groups that cannot be sized (for example, from another account) never run automatically. Widgets with their own relative range (start/end) and hidden legends are now respected.
• Vercel view: Fixed stale data from previous project persisting after rapid project switches. Implemented race-condition protection with request IDs and explicit context clearing when project or profile changes.
• AWS Lambda modal: Fixed env var table cells not wrapping long values (ARNs, long strings). Made the Code tab layout responsive on mobile and tablet devices: file tree and code viewer now stack vertically on screens ≤768px.

Changed

• Language: English is now the base language. New installs start in English (a language chosen before is kept), and any text missing in the active language falls back to English instead of showing the raw key. The Kubernetes resource tables, quick-filter chips, filter history, Overview and the resource detail panel (Overview, YAML, Env, Data, Metrics and Events tabs) are now fully translated to English and Spanish; a test keeps both dictionaries with the same keys.
• Kubernetes navigation: Switching between sidebar sections (Workloads, Network, Configuration, Storage, Cluster) no longer empties the table. Resources already visited in the same context and namespace appear instantly from a local cache and revalidate in the background; only a never-visited resource shows the loading state. A delete, scale, restart or edit now invalidates only the server-cached lists it affects (for example a deployment scale refreshes deployments, replicasets, pods and events) instead of the whole cache, and unchanged refreshes skip re-rendering the table.
• AWS VPC: The VPC "Details" action is now "Info" and opens a dedicated modal aligned with the EC2/Lambda Info pattern (underlined tabs, definition lists, copy buttons, header badges). Same data and endpoint as before.
• AWS Route 53 (fixes): DNS tests now reach the backend (the UI was calling a non-existent URL), A/AAAA tests include the TCP 443/80 check, SPF and DKIM tests are offered on the TXT records that carry them, and only tests that make sense for each record type are shown. Record selection no longer shifts when the search or filter changes, routing-policy records (same name and type) are exported separately with their Set ID, and zones with more than 300 records load completely. Added a DNS diagnostics guide to the AWS docs.

Added

• GitHub star notice (#261): after 5 sessions or 7 days of use, a discreet banner invites you to star the repository; "Give it a star on GitHub" opens it in the system browser, "Maybe later" hides it for 30 days and "Don't show again" turns it off for good, both kept across restarts. It never appears in the session where the what's-new window opens. Options has a "GitHub star reminder" switch to turn it off or back on (which forgets earlier choices). The state stays in local storage; nothing is sent and GitHub is not queried.
• Docs navigation reordered (#265): the top menu now follows what a visitor wants to do (Product, Features, Download, Guide, Changelog, GitHub, My account) in English and Spanish, with Legal, Architecture and Sponsor moved to the footer, which also lists the EULA. The sidebar reads Product, then Guide, then Technical reference, with the current section expanded. Spanish gains its own EULA page (a summary that points to the English reference) and a Spanish footer. Every existing URL keeps working and the sitemap picks up the new page. The Pricing entry arrives with the plans page (#264).
• AWS messaging: details, logs, health and metric history: SQS details show Lambda consumers, SNS producers, access policy, tags, receive wait (flagging short polling) and more metrics. SNS details show each subscription's filter policy, raw delivery and dead-letter queue, plus a delivery status log viewer (success/failure groups, on demand); the table adds success rate and filtered messages. SES adds the suppression list, rendering failures, delivery rate, reputation rate charts and per-configuration-set event metrics (counted first, read on request). Queues, topics and the SES account get a health status with reasons, using the AWS SES review thresholds. Hourly metrics already read are kept in a local metric history (APM database), so details only request what the tables did not read and 24h/7d/30d charts reuse it; retention is set in Options (30 days by default). Resources use KUA registry identities, and GET /api/cloud/aws/metrics/history reads stored history without calling AWS, ready for KUA Applications.
• AWS SQS, SNS and SES (#85, #86, #87): New tabs under Integration. SQS: queues with visible/in-flight messages, 24h sent/received/deleted, dead-letter queue and redrive, encryption and retention. SNS: topics with confirmed/pending subscriptions, protocols, 24h published/delivered/failed and delivery status logging state. SES: sending state, sandbox, 24h quota, send rate, sent/delivered/bounce/complaint/reject metrics, identities with verification, DKIM and MAIL FROM (SPF), and configuration sets with their event destinations. Each resource has a detail with hourly 24h CloudWatch charts, notices when metrics or logs are unavailable (with Request access), and each tab states its cost; SQS listing is billed per request, so a new Table auto-refresh option for AWS (30 s by default) limits background reloads. The three services are counted in the Overview instead of outside KUA, and costs cached before a service got its tab no longer mark it as outside KUA.
• Cache & refresh for Kubernetes, GCP and Vercel: Options now groups cache and refresh settings by provider. Kubernetes: resource list cache window (applied to the backend cache through PUT /api/system/cache-settings), Overview/Prometheus trends auto-refresh interval and Prometheus discovery reuse. Google Cloud and Vercel: minimum time between background table reloads. None of these reads is billed per call; the new 30 s defaults for the Kubernetes Overview and the GCP/Vercel tables replace a reload on every 5 s tick, and the refresh buttons still load right away.
• Platform options: cache & storage: Help → Options has a Cache & refresh group to choose how long AWS activity, Overview KPIs, resource counts and Cost Explorer costs are reused, the CloudWatch dashboard auto-refresh interval and the Logs Insights auto-run limit. Each option shows its cost at the chosen value. A Local storage panel shows the disk used by KUA's data folder: each SQLite database with used space, free pages, WAL journal and per-table rows and size, every file, browser storage, cached AWS cost profiles and free disk space (GET /api/system/storage, read-only). The Options tab now fits phone widths, Restore defaults keeps the language, and the language buttons show their flags again.
• Console saved connections: Save any console session under a recognizable name and reopen it later with one click from the Console workspace (Kubernetes logs/exec, local shell, EC2 SSH, AWS SSM with its confirmation, GCP logs/SSH, Vercel logs); rename or delete saved connections, and rename active sessions (double-click a tab name). Only what is needed to reopen is stored, never credentials. Sessions and tabs get provider icons and colors, and long names are shortened in the middle.
• AWS activity and log status: The Lambda table shows each function's invocations and errors of the last 24h and the state of its CloudWatch Logs group (active, empty, missing or unknown, using custom LoggingConfig groups), and the Step Functions table shows 24h executions (Express included) and the logging level, flagging machines with logging off. The Lambda logs endpoint answers a missing log group with a typed status instead of an error, and the Lambda logs tab is now translated. SQS, SNS and SES are tracked in their own issues.
• AWS dashboards drawn in KUA: CloudWatch dashboards can now be viewed inside KUA on their original layout: metric widgets (time series, bar, single value, metric math, SEARCH, Metrics Insights SQL, annotations and alarm thresholds), Logs Insights widgets as tables or bars, text and alarm widgets, with a time range selector and a metrics-only auto-refresh. Log queries show an estimate of the data to scan first and run automatically only under ~1 GB; the bytes scanned are shown per widget. The IAM catalog now reads the SDK commands each route imports, which also completes the tag routes.
• AWS CloudWatch Dashboards: New Monitoring → CloudWatch Dashboards view listing the account's dashboards with a link to open each one in the AWS console and a detail panel that summarizes its widgets (metrics and namespaces, Logs Insights log groups, alarms, view and region) and shows the JSON definition. Dates in the AWS tables now follow the app language instead of the operating system's.
• AWS Overview costs and coverage: The AWS Overview now shows this month's cost, the month-end forecast, last month and the most expensive services from Cost Explorer (cached 12h per profile on disk, since AWS bills each request, with a manual refresh), falling back to the CloudWatch billing metric; last-24h activity cards for Lambda, EC2 (CPU), load balancers (requests, 5xx, latency), EKS (with Container Insights), RDS, DynamoDB, Step Functions, EventBridge, Glue job runs, CloudFront and S3 storage; and the services outside KUA that have cost, tagged resources or recent CloudTrail changes. Each source degrades on its own and offers an access request when a permission is missing.
• AWS access requests: Permission errors from AWS are now typed: the API answers 403 with the denied IAM action, the other actions the screen needs and a suggested IAM policy. The AWS error banner and the Overview's No permission cards offer Request access, with a copyable message for your AWS administrator (in English or Spanish) and the policy JSON. Actions come from a catalog generated from each route's SDK commands (npm run aws:iam-catalog), limited to the services KUA supports.
• AWS Overview: New first view of the AWS module with the active account (and alias), identity type and ARN (with a warning for root credentials), the profile's region and the account's enabled regions, and a card per service with its resource count for 16 services. Services are read in parallel, each with its own timeout, so a missing permission only marks its card (showing the IAM action when AWS reports it). Clicking a card opens the service tab. Lambda uses the account total instead of paging through every function.
• Kubernetes Overview: New Overview at the top of the Kubernetes sidebar with pods by status, pods with problems (CrashLoopBackOff, ImagePullBackOff, OOMKilled, NotReady…), node health and pressure, workloads below their desired replicas, recent Warning events, and cluster CPU/memory usage from metrics-server. Pods, workloads and events follow the namespace selector; nodes and usage cover the cluster. Every tile and row opens the matching table already filtered, and each section degrades on its own when a permission or the Metrics API is missing. The Pods Status column now shows the problem reason and a new With problems quick filter lists unhealthy pods. Prometheus discovery is now cached per context instead of listing every Service on each query.
• Kubernetes Overview trends: With Prometheus in the cluster, the Overview adds CPU, memory, restart and not-ready pod charts for 1 h, 6 h, 24 h or 7 d, for the whole cluster or the selected namespace. Clusters without metrics-server now get current cluster and per-node usage from Prometheus node-exporter. Prometheus queries reuse the service and port that last answered instead of retrying every candidate.
• Kubernetes table views: Each resource table remembers its own text filter, sort column and filter chips when you navigate away and back, and after a reload. New quick-filter chips with counts on most resources (e.g. Pods: Not Running, Not ready, With restarts; Deployments: Not ready, Scaled to 0; ReplicaSets: Inactive; Services/Endpoints: No backends; Secrets: TLS, Registry, Opaque; HPAs: At max/min; PDBs: Blocking evictions; NetworkPolicies: Deny ingress/egress; Nodes: Not Ready, Cordoned; PVCs/PVs: Not Bound). The filter box keeps a per-resource history of recent filters and lets you star filters to keep them as saved.
• AWS Route 53: Added search and filter functionality for DNS records. Users can now search records by name or value, filter by record type (A, TXT, MX, CNAME, etc.), select multiple records with checkboxes, and export selected records as CSV for backup or analysis.
• AWS Route 53 DNS Validation: Added DNS record validation and diagnostics. Users can test records directly from the Route 53 view to verify they resolve correctly and are published on the internet. Supports A (with TCP connectivity check), TXT, MX, CNAME, NS records plus SPF and DKIM validation. Backend uses Node's native dns module for public DNS resolution.
• Kubernetes Services: The Services table now shows the associated app (from the Service selector) and the internal IPs of the pods backing each Service, read from EndpointSlices with a single list call per namespace. Not-ready pods are flagged, and the Type and Cluster IP columns are unchanged.
• AWS EKS Info: New Info panel for EKS clusters, following the EC2/Lambda layout, focused on the cluster's AWS infrastructure: VPC, subnets and security groups (with what uses each one), managed node groups, EC2 node instances (managed, Karpenter and self-managed) and EKS add-ons. Sections degrade independently with a notice when a permission is missing. The EKS table adds Node groups and EC2 instance count columns and shows the API endpoint under each cluster name.
• Kubernetes Events severity: Events are colour-coded as Critical, Warning or Normal (badge column and row accent) based on their type and reason, and toolbar chips with counts filter the table by severity, combined with the text filter.
• Vercel Profile → Project selector: A Project selector next to the Vercel profile in the header, like Cluster → Namespace in Kubernetes. Changing profile reloads its projects; changing project reloads the active project-scoped view. The last project per profile is remembered, and the Projects table stays in sync as a shortcut. Selecting a project no longer reloads views that do not depend on it, and project lists from a previous profile are ignored if they arrive late.
• GCP Cloud Run, Compute VMs and Cloud SQL: Tables with detail-level columns (image, CPU/memory, scaling and revision for Cloud Run; network, disks, Spot and protection for VMs; a clear RUNNING/STOPPED status, HA, storage, backups and IPs for Cloud SQL) and inline Start/Stop/Delete. New create forms with a live cost estimate. Starting shows the estimated cost and needs a cost acknowledgement; deleting needs the typed name and is blocked for resources with deletion protection; creating needs the typed name, the cost acknowledgement and, from $100/month, a second high-cost confirmation. The backend enforces the same checks and audits every create and delete.
• GCP VM SSH: Open an SSH shell on a Compute Engine VM from the VM table into the KUA console, like EC2 SSH, with no stored keys: one encrypted key per Google account, authorized through OS Login or expiring instance metadata for 24 hours and reused on reconnect without changing the VM.
• GCP details, labels and state history: Cloud Run, VM and Cloud SQL details are restructured into cards with much more configuration and security observations (public access, plaintext secrets, disabled backups, unencrypted SQL connections…), never exposing secret values. Labels can be edited with GCP's rules validated. A new History tab shows state changes and user actions; background state polling can be enabled per profile with a chosen interval, resource types and retention (off by default, API reads per day shown).

v1.16.0 (2026-09-16)

Console Sessions unifies every remote connection — Kubernetes, Local Shell, EC2 SSH, AWS SSM, GCP, and Vercel — behind one shared session registry and a global workspace.

• Console sessions now have contextual "Open in Console" one-click actions wherever a capability actually exists: an EC2 instance row gets a new "⚡ SSM" action alongside SSH/RDP, a GCP Cloud Run service's Logs tab gets an "Open in Console" action, and a Vercel deployment row gets one too. Every session opened from Architecture, Observability or these new actions now correctly threads its real environment and application id into the session (previously every session's audit entry read environment: default regardless of where it was opened from). GCP Cloud Run's Console launcher no longer requires typing a project id — it was always resolved from the credential profile server-side, but a stricter client-side check blocked that fallback from ever being used. This closes the Console epic (#36-43). See console sessions.
• GCP and Vercel join the Console with honest capabilities: GCP Cloud Run logs and Vercel deployment logs can now be tailed as sessions (no shell — both are one-way log streams), while GCP Cloud Shell is explicitly marked unavailable with the reason shown in the launcher, since there's no way to start it from a stored service-account credential. See console sessions.
• AWS SSM Session Manager sessions can now be started from the Console — no SSH keys needed, just a confirmed AWS profile and instance ID. Requires AWS's session-manager-plugin to be installed (the launcher shows an install hint and disables Connect if it isn't); starting a session always requires explicit confirmation first. A denied permission never leaves an orphaned session. See console sessions.
• Console tabs, their order, the active tab, and wrap/height preferences now survive a reload — restored tabs always come back disconnected, never silently resuming a remote session, and require an explicit Reconnect (now available from the quick panel too, not just the Console workspace). Command history is now shared and persisted per exact target (namespace/pod/container, environment, or host/user/ profile) instead of two separate, non-persisted, unscoped histories, bounded at 200 commands per target and 50 targets total, with an explicit "Clear history" action per tab and a "Clear all history" action in the Console workspace. Nothing sensitive is ever written to storage — only the session descriptor, never raw output or credentials. See console sessions.
• EC2 SSH sessions now join the same shared Console registry as Local Shell and Kubernetes logs/exec: connecting to the same host/user/credential profile from the AWS view and from the Console workspace launcher converges on one session instead of opening a second parallel connection, and the session's connection state is now one of connected, error, done, reconnecting or stopped instead of a single generic "closed". EC2 RDP is unchanged. The now-unused standalone Local Shell view was removed. See console sessions.
• The Console is now reachable from a global header button in every module, in addition to the existing per-action quick panel. It opens a dedicated workspace listing every active session (provider, environment, region/project, target, status) with close/reconnect actions, plus a launcher to start new Local Shell or Kubernetes logs/exec sessions. Both surfaces read the same session store, so nothing opened in one is ever invisible in the other. EC2 SSH/RDP remain reachable only from the AWS view for now. See console sessions.
• Architecture Canvas adds an opt-in "Events" overlay showing Kubernetes Warning Events on the node they apply to (kind/name/namespace now captured from each event), and inline "View metrics here" / "View logs here" node actions that open in a modal instead of always navigating away from the Canvas.
• Console connections now validate their context before opening. EC2 SSH/RDP use an Env Manager credential profile ID instead of entering passwords or key paths in the console. Local and Kubernetes transports remain available; SSM, GCP shell and Vercel logs are explicitly planned, not enabled. See console sessions.

v1.15.0 (2026-09-05)

Architecture Foundation brings application-centered architecture and observability together in KUApps.

Continues the KUA Application convergence plan (Phases 9-16): persistent Architecture context, node-level navigation, Canvas health overlays, a canonical shared Resources view, fewer surprise graph revisions, visible sync diagnostics, shared Canvas/Routes filters, and deterministic log-based relationship suggestions. Also fixes a real duplication bug found while validating this work.

Observability: Kubernetes log intelligence in Intelligent topology

• The Intelligent topology panel now measures the currently retained lines from explicitly opened Kubernetes workload/Pod log tabs: line count, error rate, warning count, recurring normalized error signatures, and common failure-keyword counts.
• The measurement is deterministic and session-scoped. It does not issue another Kubernetes read, does not persist raw logs, and does not participate in the 30-minute scheduler. Historical rates and alerting remain a future persisted aggregation phase.
• Log-derived relationship evidence redacts common credentials, bearer tokens, URL credentials, URL query strings, and email-shaped values before displaying a short sample. The existing explicit review flow is still required before a calls dependency becomes confirmed.

Architecture Canvas and Routes: relationship filters and provider lanes

• Canvas and Routes now share persisted filters for relationship type and relationship status, so large diagrams can focus on routes_to, uses, suggested/manual relationships, or other dependency slices without changing the graph.
• Canvas adds a Provider lanes arrangement that groups resources by cloud/platform and orders them by logical dependency stage: entrypoints, routing/buffers, compute, runtime, data/configuration and governance.
• Canvas also adds a Provider + resource sections arrangement for diagrams that should keep each provider separated first, then split resources into ordered type sections inside that provider.
• Provider lanes use stepped connectors and provider section headers to keep multi-provider diagrams more structured and easier to scan.
• Sectioned layouts now expand their node spacing when operational overlays such as labels, metrics, collection status or trace highlights are active, and order same-type resources using relationship context before falling back to names.
• Improved the Canvas toolbar on narrow screens so the growing set of filters and overlay buttons remains reachable through a horizontal control strip.
• Refreshing an Architecture project now reloads the graph in place instead of clearing and remounting the current Canvas/Routes/Resources view while the request is in flight.
• When Architecture is opened inside KUApps, projects now appear as a sublevel under the selected Application instead of consuming a second sidebar beside the canvas.
• KUApps now uses its global sidebar as the single Architecture/Observability switch, and Observability no longer renders a second internal application list when embedded there.

Architecture Canvas: PDF and Mermaid export

• Added an "Export PDF" button that renders the entire diagram (all nodes and relationships, not just what's currently visible on screen) into a print-ready PDF sized to the full graph, so large diagrams can be printed or shared without anything being cut off.
• Added an "Export Mermaid" button that downloads the currently visible diagram (respecting active provider/context/namespace filters) as a .mmd Mermaid flowchart file.
• Fixed "Export PDF" producing a blank page: the diagram's zoom was being computed with the wrong padding units, effectively shrinking the whole diagram down to almost nothing inside the exported image. Also added a size cap and a timeout with an error notice so exporting a very large diagram degrades gracefully instead of hanging indefinitely.

Architecture: Lambda environment-variable reference discovery

• The AWS regional inventory scan now infers what a Lambda function talks to (SQS queues, DynamoDB tables, S3 buckets, SNS topics) by reading its environment-variable configuration — the same metadata ListFunctions already returns — without downloading or running the function's code.
• Only values that resolve to a full ARN or an SQS queue URL are turned into a resource/relationship suggestion; arbitrary strings and secrets are never copied into the graph or its evidence.
• These new references relationships flow through the existing suggestion review and application-candidate detection, so an event-driven Lambda (e.g. a queue dispatcher) can now surface its related queue/table/bucket as an import suggestion even when nothing points to it from CloudFormation or EventBridge.

Architecture: IAM role capability and static code reference discovery

• The regional inventory scan now also reads each Lambda's execution role policies (metadata only) and surfaces queues, tables, buckets or topics it is authorized to use as a weaker "can access" suggestion, even when nothing in its configuration references them yet.
• A new, strictly opt-in static code reader can download a specific Lambda's deployment package and pattern-match its source text for literal ARNs/queue URLs and AWS SDK client usage — it never executes or evaluates the code, and only runs for functions explicitly selected for analysis.
• Both signals reuse the same relationship-suggestion review flow as every other discovery source.

Architecture: generalized resource discovery (SNS fan-out, unknown services, cross-stack)

• Any recognizable AWS ARN now becomes a suggested resource, even for services without dedicated support yet (Kinesis, API destinations, etc.) — previously these were silently dropped, which also meant some EventBridge targets never appeared at all.
• SNS topics and their SQS/Lambda subscriptions are now discovered as part of the regular AWS scan, completing common pub/sub fan-out patterns.
• When a CloudFormation resource imports a value from another stack (Fn::ImportValue) that can't be resolved from the selected stacks alone, the discovery panel now shows a hint recommending you add the exporting stack too, instead of silently dropping that dependency.

Fix: "Retry sync" could never clear some divergent resources

• Resource types Architecture can discover but Observability has no schema support for yet (S3, SNS, DynamoDB, and any generically-detected AWS service) were counted as "divergent" even though they can never be observed from both sides — retrying the sync could never fix them, since that would have required correlating with a source that doesn't exist for these types.
• The divergent-resource diagnostic now only counts resource types that can genuinely be confirmed by both Observability and Architecture. Divergent relationships (pending review) are unaffected, since those really are actionable from the Canvas.

Architecture + Observability: S3, SNS and DynamoDB now correlate as shared resources

• Observability's shared resource registry now supports S3 buckets, SNS topics and DynamoDB tables, matching what Architecture discovery can already find. These resources now correlate automatically into a single shared entry instead of only ever appearing on the Architecture side.
• Fixed a related identity bug: S3 bucket names are globally unique and never carry an account/region in their ARN, so relying on the Architecture node's discovery-time account/region to compute identity could create a duplicate registry entry instead of matching the one Observability produces.

Fix: Kubernetes workloads could be discovered twice with a broken identity

• Kubernetes discovery derived a workload's Kind (Deployment, StatefulSet, ...) from a field the Kubernetes API does not reliably return on list results, which could silently turn into an empty/generic value. When that happened, the discovered workload's identity no longer matched the one produced by a manual add or a previous sync, creating a duplicate resource in Observability and a duplicate node in Architecture.
• The workload's Kind is now known upfront from which Kubernetes endpoint produced it, never inferred from that unreliable field, so newly discovered workloads always resolve to the same identity as their manually-added or previously-synced counterpart.

Architecture: discovery panels show resources already added to the project

• Both the AWS and Kubernetes discovery panels now mark preview resources that already exist in the current project's graph, instead of listing them exactly like new ones. Already-added resources show a distinct badge and can no longer be re-selected by accident.
• Identified applications also show how many of their resources are already part of the project.

Observability: Kubernetes resources show their specific kind, and divergence is marked per item

• Kubernetes resources in the Observability Resources table and Topology view previously all showed as generic "Kubernetes" with the same icon. They now show their actual kind (Deployment, Pod, Service, ConfigMap...) with a matching icon, so you can tell them apart at a glance.
• Divergent resources and divergent (pending review) relationships are now marked individually, not just as an aggregate count, using the same rule that already excludes resource types Observability can never correlate — ready to extend to future GCP/Vercel resource types without any UI changes.

Architecture: Kubernetes Deployments now relate to each other from metadata, like AWS already does

• Kubernetes discovery only related resources through label selectors and ConfigMap/Secret/PVC references; a Deployment whose environment variables pointed at another Service by name (the most common way Kubernetes apps actually call each other) produced no relationship at all.
• Discovery now reads plain environment variable values — never downloading or running anything — and recognizes both a full internal DNS reference (service.namespace.svc.cluster.local) and a bare service name when the variable's own key hints at it (..._HOST, ..._URL, ..._SERVICE, ...), suggesting a calls relationship to the matching Service or Deployment.
• These suggestions go through the same review flow as every other discovered relationship, and now show up consistently in both Architecture and Observability.

Observability: EC2 and S3 report CloudWatch metrics, and more AWS resources reach the inventory

• EC2, EKS, RDS, API Gateway, CloudFront, Auto Scaling and ElastiCache resources discovered by Architecture were rejected outright by the resource type constraint, so they never appeared in Observability even as inventory. They are now stored and correlated like any other resource.
• EC2 instances now report CPU, network in and out, and failed status checks. S3 buckets report storage used and object count, asked for at the daily rate those metrics are actually published at.
• These readings come from CloudWatch, which bills per request, so each resource is one call carrying all of its metrics, the existing monthly AWS request budget is reserved before spending it, and a failed call still reports what it spent. The collection confirmation says explicitly that these reads are billable.
• Resources of a type that has no measurable target - a security group is also an "EC2" resource - are reported as inventory without ever contacting CloudWatch.

Fix: importing discovered resources silently dropped their relationships

• Since resources already in a project stopped being selectable, any relationship connecting a newly selected resource to one of them was discarded on import: a relationship is only imported when both of its ends travel with it. This is why Deployments were not linked to their Pods in the canvas even though discovery found those links correctly.
• Resources already in the project are now sent along as context, so those relationships survive. Re-sending them is idempotent: the server merges them onto the existing nodes by identity instead of duplicating them.
• The same applied to AWS imports, and is fixed the same way. AWS now also recomputes which resources are already present at import time, instead of trusting a preview that may have been cached before they were added.

Architecture: cluster nodes are now identified as the cloud instances they run on

• The EC2 resources discovered from CloudFormation for an EKS cluster are security groups, rules and launch templates - never the running instances, because a node group's instances are created by its Auto Scaling group at runtime. The actual instances are the cluster nodes.
• Discovered nodes now carry their instance id, availability zone, instance type and, when the context names the account explicitly (an EKS context ARN), their EC2 ARN. That ARN is what lets a running node correlate with the same instance seen from AWS.
• When the account cannot be determined, the instance identity is still recorded but no ARN is invented.

Observability: a Relationships view to review discovered connections

• Discovered relationships waiting for a decision were only counted, never shown: they did not appear in Topology and the only way to act on them was to open the Architecture canvas. Observability now has a Relationships tab listing each one with both ends, its type, the evidence behind it and its status, with Accept and Reject actions. It works the same for AWS and Kubernetes, because it reads the shared registry.
• Accepting or rejecting from Observability records exactly the same decision the Architecture canvas does, so the two views can never disagree.
• Relationships whose evidence is declared by the resource itself - an Ingress naming its Service, a selector match, the node a Pod is scheduled on - are now confirmed automatically instead of asking for a decision that has only one sensible answer. Anything inferred from naming still waits for review, and a decision already made by a person is never overridden.
• Existing relationships are re-evaluated on the next reconciliation, so enabling this does not require re-importing everything.
• "Divergent relationships" is now "relationships to review", which is what it always meant: unlike divergent resources, these are not a problem to fix but a decision to make. The counter is now a shortcut into the new view.

Observability: the collection confirmation now describes Kubernetes too

• Confirming a collection only ever described Lambda: an application made entirely of Kubernetes resources was asked to confirm "Lambda functions: 0" and an AWS read budget that the collection does not even consume.
• The confirmation now lists what will actually be read, broken down by resource type (Deployments, Pods, Services, Ingresses, Nodes), and explains that a Kubernetes collection only reads from the cluster and never touches the AWS read budget. Lambda details are shown only when the application actually has Lambda functions.
• Its description was also out of date: Kubernetes usage may now come from Prometheus, and Ingress inventory from the Kubernetes API.

Fix: Secrets and ConfigMaps raised a collection error on every run

• The collector is called for every Kubernetes resource of an application, but only workloads, Pods, Services, Ingresses and Nodes have something to measure. A Secret or ConfigMap raised an "unsupported kind" error on each one, on every collection cycle.
• Those kinds are now reported as topology-only, exactly like resource types from other providers that no collector supports.

Observability: log volume per workload, and less space wasted on resources without metrics

• Deployments, StatefulSets, DaemonSets and Pods now report how much log they are writing to disk, read from Prometheus. This answers a question the Kubernetes Metrics API never could, and is collected even when usage came from a Metrics Server.
• If the cluster has no Prometheus, log volume is simply skipped: a collection never fails because of it, and the cluster is probed once rather than once per resource on every run.
• Resource types with no metric collector (Secrets, ConfigMaps, and any future type) no longer take a whole section each. They are now summarized in a single compact line, leaving the space to resources that actually report something.
• Ingress request metrics were evaluated and deliberately not added: this cluster has no instrumented ingress controller in Prometheus, and load balancer request counts live in CloudWatch, which is billable. Ingresses keep reporting their routing inventory instead of numbers that would have to be invented.

Observability: cluster Nodes, Ingresses and Pods now report their own metrics

• Cluster Nodes are now discovered as resources and report CPU used, memory used, hosted Pods and their CPU/memory capacity, read from the Prometheus already running in the cluster. Pods are linked to the Node that runs them in the diagram.
• Ingresses now report their routing inventory (rules, paths, hosts and TLS hosts) read from the Kubernetes API. Ingress controller traffic is deliberately not reported, because no controller is guaranteed to be scraped by Prometheus and inventing those numbers would be misleading.
• Pods are now collected directly instead of failing: previously every Pod in an application raised an unsupported-kind error on each collection.
• Listing cluster Nodes needs a cluster-scoped permission that many roles do not have. When it is denied, discovery now degrades that capability and keeps everything else, instead of failing the whole Kubernetes scan.
• Each resource section now leads with how many resources of that type the application has, and no longer repeats counters that do not belong to it: Pods show usage and restarts instead of a ready/total pair that just restated the section, and Services show the Pods they route to instead of duplicating their workload's CPU and memory.

Observability: KPIs and charts are now organized per resource type

• The Overview used to show a single flat KPI row and one chart grid, hardcoded to Lambda and Kubernetes. Metrics are now grouped into a section per resource type — and per Kubernetes kind (Deployments, Pods, Services, Ingresses...) — each with its own KPIs, charts and resource count.
• Metric series can now be requested filtered by resource type and Kubernetes kind, so a chart shows only the resources it belongs to instead of one cluster-wide total.
• Resource types that Architecture already discovers but no collector reports metrics for yet (S3, SQS, SNS, DynamoDB, Ingresses, ConfigMaps, GCP and Vercel resources) are now listed explicitly with a note explaining they are correlated for topology only, instead of being silently omitted.
• Which metrics belong to which resource type now lives in a single provider-agnostic catalog, so adding EC2, Cloud SQL or any future provider's metrics is one entry in that catalog rather than changes spread across the Observability views.
• The Kubernetes usage KPIs no longer claim their source is always metrics.k8s.io, since usage may now come from Prometheus.

Fix: Kubernetes CPU/memory usage never actually reached Prometheus

• When a cluster has no Metrics Server, Observability's Kubernetes CPU/memory usage falls back to querying a discovered Prometheus Service — but that fallback always failed on a real cluster (silently reported as "Metrics not available"), even though the same Prometheus was already reachable from the resource detail panel.
• The collector was building the Prometheus proxy request through a Kubernetes client helper that encodes the whole PromQL query path as a single URL segment, corrupting it before it ever reached the cluster. It now builds the proxied request directly, the same proven way the resource detail panel already does.
• Kubernetes CPU and memory charts and the "Average CPU"/"Average memory" summary now populate correctly for clusters relying on Prometheus instead of Metrics Server.

Fix: Kubernetes resources duplicated between Architecture and Observability

• An AWS-hosted Kubernetes application (e.g. EKS) stores aws as the resource provider for its workloads, while Architecture's Kubernetes adapter always used kubernetes. The shared registry treated those as two different resources, so the same Deployment could appear twice — once from APM, once from Architecture — in the Observability resources table and the registry.
• Kubernetes discovery nodes now carry a stable context/namespace/kind/name key (matching the key APM already uses for manual and EKS-discovered workloads), and every place that turns an APM resource into a graph node or vice versa now normalizes the provider to kubernetes instead of trusting the application's hosting cloud.
• Existing duplicates self-heal the next time the shared registry reconciles (automatic collection, a manual reconciliation, or any Architecture/APM resource change) — no manual data migration is required.
• Generalized the fix into a reusable rule: a resource's provider is now always derived from what the resource actually is (resourceOwnProvider in applicationRegistryService.js), never inherited from its parent application's hosting cloud, for both APM→Architecture and Architecture→APM projections.

Architecture Phase 9: application context persistence

• The active KUA Application context (application, project, provider and profile) now persists to local storage and is restored on reload, so a window reload no longer loses the selected Architecture application.
• The Architecture profile no longer forces the global AWS profile selector when an application already has its own profile scope (e.g. a Kubernetes-only application), only falling back to it when no application context is active.

Architecture Phase 10: node-level navigation

• Canvas node inspector now exposes contextual navigation actions: Kubernetes workloads/Pods can open their logs, YAML/metrics detail (reusing the existing Kubernetes detail panel) and owned Pods list; AWS Lambda, EC2, EventBridge and Step Functions nodes can open Lambda logs or jump straight to the matching AWS view tab filtered by name.
• Unsupported resource types show no navigation section instead of a broken or empty action.

Architecture Phase 11: Canvas health overlay

• The Canvas gained an opt-in "Health" toggle that shows a small badge on each node: degraded/healthy for Kubernetes workloads and Services using the health already captured during discovery, and a stale badge for resources missing from the last sync.
• The overlay preference persists with the rest of the canvas view and does not change the diagram layout, keeping dense diagrams readable when disabled.

Architecture Phase 12: canonical Resources view

• Architecture gained a "Resources" tab that lists the shared registry for the linked KUA Application: provider, resource type, scope/location, confirming sources (APM, Architecture, or both) and relationship count.
• Resources confirmed from only one side (APM or Architecture) are flagged as a single-source divergence instead of being silently merged.
• Operational status reuses the Phase 11 health/staleness signal already available on the Architecture graph node, with no new telemetry pipeline.
• The shared registry endpoint (GET /apm/applications/:id/registry) now reports which sources confirmed each resource.

Architecture Phase 13: fewer surprise revisions from shared registry reconciliation

• Reconciling the shared registry after an Architecture operation could previously create up to two additional graph revisions on top of the user's own save (one for projecting missing APM resources into the graph, another for stamping registry correlation ids). Both mutations are now merged into a single working document and saved at most once, so one user action now produces at most one derived reconciliation revision instead of up to two.

Architecture Phase 14: visible shared registry sync diagnostics

• Every shared registry reconciliation (manual or automatic) now persists a diagnostic: last successful sync time and duration, last error, and how many resources/relationships are confirmed from only one side (APM or Architecture).
• The Observability application view shows this diagnostic as a persistent status strip instead of a one-off toast, with a "Retry sync" action that reuses the existing reconcile endpoint.
• A failed sync no longer erases the last known good sync time or divergence counts.

Architecture Phase 15: Routes owns its own provider/context/namespace filters

• Routes already respected the Canvas's persisted provider/context/namespace filters, but only Canvas could change them. Routes now has the same filter controls in its own toolbar, writing to the same shared view state, so switching to Canvas is no longer required to narrow down routes.

Architecture Phase 16: deterministic log-based relationship suggestions

• Kubernetes workload/Pod nodes gained a "Suggest relationships from logs" action that scans the already-open log stream for internal DNS references (service.namespace.svc.cluster.local) and proposes calls edges to matching Kubernetes nodes in the same diagram.
• Extraction is fully deterministic (no ML) and sanitized before anything is kept as evidence: common secret-shaped substrings (Authorization headers, tokens, API keys, passwords) are redacted first, and only a short sample plus an occurrence count are stored, never full raw log payloads.
• Every suggestion is added with status: suggested and a confidence below 1, going through the same accept/reject relationship review already used for automatic discovery — nothing is added to the graph without explicit human confirmation.
• The underlying extraction library also groups recurring error signatures and collects distinct correlation/request/trace ids for future phases, without persisting or displaying raw log content beyond the existing terminal view.

v1.14.1 (2026-08-26)

Reconciliación de recursos AWS heredados

• La reconciliación de Architecture ya no falla cuando un nodo AWS legado no incluye provider; usa el provider de la KUA Application enlazada.
• Los nodos AWS con ARN recuperan automáticamente cuenta y región para compartir una identidad única con el recurso APM, evitando duplicados en el registro.
• Los nodos incompletos no proyectables se omiten de forma segura y se agregó una prueba de regresión para aplicaciones serverless como syn agent-call.

v1.14.0 (2026-08-26)

Shared resources and AWS topology analysis

• AWS topology analysis now isolates AWS resources and relationships from mixed Kubernetes memberships, while preserving the complete mixed application in the returned topology.
• AWS resource matching is null-safe and CloudFormation/SAM serverless functions and state machines retain their Lambda/Step Functions semantics.
• Architecture discovery derives the AWS account from preview resources when the selected scope does not provide it.
• Linked applications now reconcile observable resources in both directions: APM additions appear in an existing Architecture view, and Architecture AWS/Kubernetes/GCP/Vercel-compatible nodes become APM resources without duplicates.
• Kubernetes resource providers are persisted explicitly where needed, and Architecture-projected memberships are removed when their source node is removed.
• Added regression coverage for mixed AWS/Kubernetes analysis, bidirectional projection, serverless normalization and schema migration to v1.14.

v1.13.0 (2026-08-26)

Application-first Architecture workspace

• Architecture now loads and presents the KUA Application catalog before profile-scoped projects, selecting the active application and limiting its architecture views to that application.
• The Architecture workspace now exposes application identity, provider, environment, team, active scopes and link status together with the diagram revision.
• Creating or refreshing an Architecture view preserves the selected applicationId; legacy unlinked projects remain available as a compatibility path.

v1.12.0 (2026-08-26)

KUA Application shell hardening

• Architecture now accepts an application context, scopes project loading to the linked KUA Application and binds new projects to that application.
• Architecture and Observability expose reversible navigation for generic Kubernetes applications as well as cloud providers, with a shared shell context showing application identity, environment and team.
• Registry reconciliation now runs after project deletion, unlinking, snapshot restores and other graph mutations, pruning stale architecture memberships and relationships.
• Legacy Kubernetes graph nodes are normalized from their native kind, so existing Deployment, Service, Pod and related nodes no longer render as generic clusters.
• Persisted provider, context and namespace filters now apply to both Canvas and Routes, and the GitHub control uses the bundled SVG icon without Lucide warnings.

Architecture Phase 8: Kubernetes Adapter Foundation (2026-08-26)

• The Routes view is now provider-neutral: it retains APL event/workflow paths and adds Microservice paths for Kubernetes Ingress -> Service -> Pod flows and their declared configuration or storage dependencies.
• Kubernetes route evidence remains declared and explainable. Future high-frequency log analysis will produce privacy-bounded observed suggestions for review, never automatic relationships from raw log text.
• Kubernetes Architecture preview now accepts one or more namespace filters and groups selectable resources by type, with per-group selection for workloads, Pods, Services, Ingress, ConfigMaps, Secrets and persistent volumes.
• Kubernetes diagrams now use a dedicated cluster visual treatment and distinct icons for workloads, Pods, Services, Ingress, ConfigMaps, Secrets and persistent volume claims.
• Kubernetes discovery includes Services and Ingress routing, plus only the ConfigMaps, Secrets and PVCs explicitly referenced by workload environment or volume declarations; these dependencies are drawn with evidence-backed uses relationships.
• Architecture now supports explicit manual resources alongside discovery: add EC2 instances or any AWS component, plus Kubernetes, GCP or Vercel resources, with provider, stable native identity, scope and location recorded in the graph.
• Architecture now uses one Add resources menu instead of an AWS-only action: AWS and Kubernetes previews/imports are available today, while GCP and Vercel are visible as planned provider adapters.
• Kubernetes Architecture discovery lists contexts, previews one explicitly selected context with health and relationship evidence, then imports only confirmed resources and their internal relationships in one graph revision.
• Applications with confirmed Kubernetes resources now refresh their scoped topology preview automatically after loading, querying only their configured contexts; opening the preview reuses that result.
• Creating an Architecture view from Observability now seeds the new diagram with the application's confirmed resources and dependencies instead of opening an empty graph.
• Kubernetes Observability now falls back to a discovered in-cluster Prometheus Service for aggregated Pod CPU and memory usage when metrics.k8s.io is unavailable, while retaining stable restart cursors across sources.
• Pod readiness, totals and restart signals now remain complete when metrics.k8s.io is unavailable; Observability explicitly identifies only CPU and memory usage as unavailable.
• Observability now derives KPIs, charts, cloud analysis and trace controls from confirmed application resource capabilities, so Kubernetes-only applications do not show Lambda signals or AWS-only analysis.
• Configured Kubernetes Pods, Deployments, StatefulSets and DaemonSets now expose their existing live log stream directly from Observability, switching to the associated Kubernetes context before resolving workload Pods.
• Observability setup now loads compatible Kubernetes clusters before workload discovery and queries only the explicitly selected EKS cluster, with separate cluster and workload loading states.
• The setup flow treats Kubernetes as an explicit application scope, reusing provider-aware context selection that can support GKE and general Kubernetes connections without changing confirmed membership rules.
• Kubernetes topology preview now lists compatible clusters first and requires selecting one before querying workloads, Services, Ingress and events, avoiding unnecessary multi-cluster scans.
• Added visible loading feedback while KUA lists clusters and while it reads the selected cluster's Kubernetes resources.
• Added a read-only Kubernetes topology adapter with stable context/namespace/UID identities for workloads, pods, Services and Ingress resources.
• Kubernetes previews now provide declared selector and Ingress evidence, workload/pod health signals, warning-event summaries and per-context capability metadata that degrades safely when APIs are unavailable.

Architecture Phase 6 Foundation (2026-08-26)

• Added a provider-neutral shared registry for KUA Application resources, memberships and relationships, keyed by stable provider identities with source lineage retained separately.
• Added explicit registry reconciliation from linked APM and Architecture data, projecting correlation IDs to graph nodes and relationships while leaving metric buckets, cursors and traces in their current local stores.

Architecture Phase 5 Foundation (2026-08-26)

• Added a reversible, profile-scoped link from an Observability application to an existing or newly created Architecture project, without moving resources, metrics, traces or graph data.
• Observability now shows Architecture link coverage, unmatched resources and duplicate identity warnings, and opens the exact linked diagram in one action.

Architecture Phase 4 Kickoff (2026-08-26)

• Added authoritative CloudFormation sync apply with one atomic graph revision, optimistic expectedRevision conflict protection, selected-stack sync metadata and retained stable resource identities.
• Sync review now shows concrete resource categories, preserves manual and rejected relationship decisions, marks absent discovered resources stale, and provides explicit restore or removal actions.
• Added the KUA Unified Management Plan, defining KUA Application as the shared product boundary between APM and Architecture and sequencing the migration toward one provider-neutral application workspace.
• Added the phase 4 contract for authoritative CloudFormation synchronization, stale-resource lifecycle, sync metadata and relationship review.
• Documented the first phase 4 milestone as a safe CloudFormation sync review that compares selected stack sources before applying one graph revision.
• Added the first read-only AWS sync preview endpoint, classifying selected CloudFormation resources and relationships as new, changed, unchanged, missing, stale, manual, reinforced or rejected without mutating the graph.
• Added an Architecture workspace sync preview panel that checks existing CloudFormation sources and summarizes resource and relationship changes before any apply flow exists.

Architecture Phase 3 Closure (2026-08-25)

• Rediscovery now reconciles current and historical AWS identities without duplicating nodes, while remapping edges, groups and saved positions to the retained graph ID.
• Manual and rejected relationship decisions continue to take precedence when the same resources and evidence are imported again.
• Canvas arrangement mode, direction and relationship-label preference are now stored in the versioned graph, restored after reload and included in snapshot comparisons.
• AWS discovery now shows whether CloudFormation stacks are loading or resources and evidence are being analyzed, including a visible waiting state for longer reads.
• Architecture projects can now be deleted explicitly, including their local graph, snapshots and revision history.
• A live rediscovery of the three AFEX stacks retained 119 nodes without duplication and recorded newly available relationship evidence.
• Lambda layer versions are now modeled as layers with their layer name instead of as functions named after a numeric version.
• API Gateway Lambda permissions are consolidated into route-to-Lambda evidence rather than rendered as repeated policy nodes; Lambda inspection now shows its API routes, permission declarations and CloudFormation identity.
• Added a bilingual phase contract with explicit acceptance criteria and deferred authoritative synchronization to phase 4.
• Closure validation passed: 118 backend tests, 374 frontend tests, the frontend production build and the VitePress documentation build.

Architecture Workspace Foundation

• Added a new profile-scoped Architecture workspace for application diagrams, initially targeting AWS.
• Added a provider-neutral graph model for scopes, sources, nodes, relationships, groups, evidence, and persistent layout.
• Added a private architecture.sqlite3 store with WAL, optimistic graph revisions, immutable snapshots, and safe server shutdown.
• Added profile-isolated APIs for creating projects, reading and updating graph drafts, and creating or browsing snapshots.
• Added the first Vue workspace for project creation, graph summaries, and local snapshot history.
• Added typed graph operations with cascading cleanup, optimistic revision checks, and semantic change history.
• Added snapshot comparison and transactional restore, which always creates a new revision and immutable snapshot instead of rewriting history.
• Added workspace controls for comparing snapshots, restoring prior graph states, and browsing recent revision history.
• Added an interactive Vue Flow canvas for manually creating, connecting, moving, editing, and deleting architecture components.
• Canvas interactions persist through typed graph operations, including layout changes recorded only after a drag completes.
• Added read-only AWS discovery for active CloudFormation deployments and ECS services, with profile/region scoping and request estimates.
• Added a two-step preview and confirmation flow: KUA never preselects resources, and confirmed resources are imported atomically with their inferred relationships.
• Added evidence-backed relationship suggestions from CloudFormation DependsOn, Ref, GetAtt, and Sub references, including YAML intrinsic shorthand support.
• Inferred relationships are classified as automatic or suggested using the project confidence threshold, while retaining their confidence and source evidence.
• Added explicit accept/reject review actions; reviewed decisions are preserved across rediscovery and rejected relationships remain in canonical history while hidden from the canvas.
• Added AWS-specific relationship semantics for EventBridge targets, Step Functions definitions, and ECS service placement, plus direct SQS-to-Lambda relationships inferred from CloudFormation event source mappings.
• Added direct regional inventory for Lambda, EventBridge, and Step Functions, with CloudFormation stacks as optional enrichment instead of a discovery requirement.
• Connected AWS resources are now identified as application candidates from EventBridge target and ASL evidence, ready for explicit selection; truncated 500-resource previews are clearly reported.
• Identified applications can now be drawn directly with one action: the validated preview is reused for five minutes, the discovery panel closes after import, and large diagrams receive a wider adaptive layout.
• Added direct regional Lambda event source mapping discovery so SQS-to-Lambda triggers complete application paths without requiring CloudFormation.
• Added an ordered APL Routes diagram with Event sequence, Name A-Z, Event bus, Service flow, and Longest route modes; ordering applies to both entrypoints and branches while preserving distinct relationship paths.
• New Architecture projects now open a guided CloudFormation-first setup: choose deployments, confirm inferred application resources, then review the generated diagram, with regional inventory available as an explicit fallback.
• Step Functions resources now open their configurable internal ASL diagram from either Routes or Canvas, while candidate composition shows which applications contain workflows and other AWS resource types.
• Architecture can now map every resource from explicitly selected CloudFormation stacks, including isolated resources and previously unsupported AWS services, without widening the APM resource contract.
• CloudFormation evidence now identifies S3 notifications, IAM role and policy attachments, workload roles, Lambda permissions, and governed resources with dedicated relationship semantics.
• The Canvas can arrange request flow horizontally or vertically using persisted causal levels and crossing reduction; dense diagrams start at a readable zoom with optional relationship labels and recognizable AWS service icons.
• API Gateway methods and HTTP API routes now display their resolved HTTP method and path, preserve direct route-to-Lambda evidence, and expose navigable component references in the Canvas inspector.
• Selecting a Canvas component now centers it at a readable zoom and dims unrelated nodes and edges, keeping direct dependencies visible in dense application topologies.
• Clearing a Canvas selection now explicitly restores every node and edge to full visibility, including styles internally mutated by Vue Flow.
• Added a resource-type arrangement mode with labeled count sections, deterministic grids, persisted resource positions, and subdued straight connectors for large diagrams.
• Architecture discovery consumes the existing per-profile AWS request budget; templates are parsed locally and never persisted or returned to the frontend.
• Added focused backend and frontend coverage for graph validation, snapshot immutability, revision conflicts, profile isolation, and store behavior.

v1.11.3 (2026-08-11)

macOS Packaging Hotfix

• Fixed the Intel macOS package bundling an ARM64 better-sqlite3 native binary, which prevented the packaged backend from starting after installation.
• macOS x64 and ARM64 artifacts are now built in isolated, sequential processes so native dependencies cannot be replaced while another architecture is still being archived.
• Added architecture checks for the Electron executable and SQLite native module inside both final ZIP artifacts before a release can be published.
• Preserved a combined macOS update manifest containing the x64 and ARM64 ZIP/DMG assets.

v1.11.2 (2026-08-11)

Multicloud and Provider-free APM

• Extended application observability from AWS to isolated AWS, GCP, and Vercel scopes, plus a provider-free General scope for Kubernetes applications.
• Moved Observability into the primary navigation and added application editing, deletion, resource management, and provider-aware setup flows.
• Added explicit-column SQLite migrations for provider-scoped applications and resources, preserving existing APM data safely.
• Added bilingual credential setup guides for AWS, GCP, Vercel, and Kubernetes, with improved profile persistence and lazy provider loading.

Explainable Topology Intelligence

• Added a local structural evaluator with topology score, connected coverage, isolated-resource detection, findings, and explainable dependency suggestions.
• Generic related_to relationships are now reported separately and do not count as operational causality.
• Added explicit, read-only AWS definition analysis for associated Step Functions.
• ASL analysis recognizes direct and optimized Lambda calls, nested Step Functions, SQS sends, ECS tasks, and S3 SDK operations.
• External ASL references remain suggestions: users must add the resource, reanalyze, and explicitly confirm the dependency. KUA never creates causal edges automatically.

Process Requests and Execution Traces

• Added an AWS Traces tab that accepts a request/correlation ID, execution ARN, or associated Step Function ARN.
• Pasting a Step Function ARN lists up to 10 recent executions and traces the latest run; any listed execution can then be selected directly.
• Step Functions execution history provides an ordered timeline with Lambda, ECS, S3, nested workflow, status, duration, and failure evidence.
• Added an explicit Show sanitized request/response option for execution-level and per-step inputs, parameters, outputs, errors, and causes.
• Common credential and personal-data fields are redacted, large strings/arrays are bounded, event payloads are requested only on demand, and trace data is never persisted.
• All trace and topology reads remain scoped to associated resources and consume the existing per-profile AWS request budget. KUA does not invoke production workloads or enable logging automatically.

Vercel and Reliability Fixes

• Updated Vercel API paths and versions, preserved upstream error details, and supported both current and legacy Cron response shapes.
• Corrected provider-specific copy, profile handling, environment management behavior, and resource presentation across the multicloud views.
• Added focused backend and frontend coverage for migrations, scoping, ASL extraction, topology analysis, request tracing, sanitization, Vercel compatibility, and profile workflows.

v1.11.0 (2026-08-06)

Local Application Observability

• Added a profile-scoped application workspace for explicitly confirmed Lambda, Kubernetes, SQS, EventBridge, Step Functions, and ECS resources.
• Added read-only CloudFormation and ECS deployment discovery with a preview-first import flow. KUA never selects candidates or creates dependency edges automatically.
• Added a private SQLite telemetry store with 30-minute UTC aggregates, local thresholds, collection cursors, run history, retention cleanup, and health checks.
• Added Lambda and Kubernetes collectors with resumable pagination, deduplication, partial-result states, and opportunistic capture from metrics already loaded in the UI.
• Added manual application topology, configurable health thresholds, local trend forecasts, and per-profile metric history.

EKS Container Insights

• Added an EKS observability dashboard backed by read-only CloudWatch Container Insights queries.
• Metrics can be grouped by namespace, workload, pod, or node, with cluster and node group context shown alongside the time series.
• Collection reports unavailable or partial Container Insights data without provisioning agents, dashboards, alarms, or other AWS resources.

Cost and Privacy Guardrails

• Automatic APM polling remains disabled by default and collection must be enabled explicitly per application.
• Enforced a local hard limit of 100,000 AWS read requests per profile and calendar month.
• KUA stores only confirmed identifiers, configuration, cursors, request counters, collection status, and metric aggregates. It does not persist CloudWatch log lines, payloads, credentials, secrets, environment variables, or arbitrary tags.
• Metric buckets, cursors, and collection runs expire after 90 days; request-budget records expire after 15 months.

Refresh and Terminal Reliability

• Added stable five-second background refresh for Kubernetes, AWS, GCP, and Vercel, paused while the window is hidden.
• Added in-memory stale-while-revalidate caches for cloud and Kubernetes list endpoints, invalidated after mutations and context changes.
• Background refresh preserves object identity for unchanged data and ignores stale responses after resource navigation.
• Terminal logs now retain at most 5,000 lines, render 1,000-line windows, support live-follow pause/resume, and allow selecting an individual pod for workload logs.

Runtime and Kubernetes Compatibility

• Added idempotent native-module repair for better-sqlite3, Electron unpacking/rebuild support, private database file permissions, and a strict Vite development port.
• Updated Kubernetes patch calls for the current client signatures and removed server-managed fields before applying edited YAML.
• Added clean APM scheduler/database shutdown and health reporting for the local backend.

v1.10.5 (2026-07-07)

Development and Release Reliability

• Separated the stable backend (7190), development/Electron backend (7192), and Vite frontend (7193) ports.
• Added a release-workflow workaround for optional native modules that could fail during cross-platform Electron rebuilds.

v1.10.4 (2026-06-22)

Vercel Marketplace OAuth

• Added full support for the Vercel Marketplace integration flow: the callback page now handles configurationId, teamId, next, and source parameters in addition to the standard code+state OAuth flow.
• Fixed "Missing OAuth parameters" error that appeared when Vercel Marketplace redirected to the callback page without a state parameter.
• After completing Marketplace authorization, the app now opens the Vercel next URL in the browser so the integration is marked as installed.
• VERCEL_CONFIGURATION_ID and VERCEL_TEAM_ID from the Marketplace flow are persisted in the credential profile.

v1.10.3 (2026-06-22)

Vercel OAuth Callback

• Switched the Vercel OAuth redirect flow to the HTTPS callback page at https://lnavarrocarter.github.io/kuadashboard/vercel-callback so the app can complete authorization without relying on the custom protocol redirect.
• Added an auto-forwarding callback page that hands the OAuth code and state back to the desktop app through the existing Vercel callback flow.
• Added VERCEL_OAUTH_REDIRECT_URI support in the runtime config so local and packaged builds stay aligned with the HTTPS callback.

v1.10.2 (2026-06-22)

AWS — Temporary Credentials + Browser SSO

• Added support for AWS_SESSION_TOKEN in stored credential profiles and AWS resolution, enabling STS / temporary credentials end-to-end.
• Added browser-based IAM Identity Center (SSO) device authorization flow with account/role credential exchange and automatic temporary credential capture.
• Added SSO session expiry tracking and renewal support through stored SSO metadata (meta.__sso) and one-click renewal flows.

Security, Reliability, and UX

• Restricted local AWS profile discovery and SSO bootstrap endpoints to localhost-only access to prevent workstation metadata exposure from remote clients.
• Updated Env Manager metadata sanitization to preserve reserved structured meta.__sso fields (start URL, region, account/role, expiration) while keeping existing tags behavior for normal keys.
• Hardened SSO browser popups by opening verification links with noopener,noreferrer.
• Normalized generated public/index.html line endings to remove stray carriage-return artifacts and avoid noisy diffs.

Additional AWS Fixes

• Fixed Step Functions diagram rendering freeze for state machines with cycles by adding a cycle guard in BFS level assignment (StepFnDiagram.vue).
• Fixed Athena query failures when the selected workgroup has no configured output location by allowing an explicit S3 output override in the Query Editor and workgroup query modal.

v1.10.0 (2026-06-09)

GCP — Master-detail panels

All four core GCP services now have a full split-panel master-detail layout: a resource list on the left and a tabbed detail panel on the right, consistent with the established Cognito / Athena / Lex pattern.

• Cloud Run — tabs: Overview (config, image, scaling), Revisions (with traffic %), Variables (env vars), Logs, Metrics.
• Compute VMs — tabs: Overview (tags, labels, deletion protection), Disks, Network (interfaces & IPs), Logs, Metrics.
• Cloud SQL — tabs: Overview (backup & availability), Config (storage type, flags), Connection (IP addresses, connection name), Logs, Metrics.
• Cloud Functions — tabs: Overview (runtime, resources, trigger), Variables, Logs, Invoke (inline, replaces the old floating modal), Metrics.

GCP — Embedded Cloud Monitoring Metrics

A Metrics tab is now embedded in all four service panels. Each tab shows three Chart.js line charts pulled from the Cloud Monitoring v3 API with a configurable time range (1h / 3h / 6h / 24h) and a Refresh button.

Service	Charts
Cloud Run	Request Rate (req/s) · Latency p99 (ms) · Instance Count
Compute VMs	CPU Utilization (%) · Network In (B/s) · Disk Read (B/s)
Cloud SQL	CPU Utilization (%) · Connections · Disk Used (bytes)
Cloud Functions	Execution Count (req/s) · Duration p99 (ns) · Active Instances

GCP — GCS Upload & Delete

• Upload: a new "⬆ Upload" button appears in the GCS Browser toolbar. Supports multi-file selection, uploads each file to the current folder as raw binary, and shows a per-file result log (✓ / ✗).
• Delete: a "🗑 Delete" button appears in the file preview panel. Asks for confirmation before calling the new DELETE /storage/:bucket/object backend route.

GCP — Artifact Registry Deploy-to-K8s

Artifact Registry is redesigned as a master-detail panel with two tabs:

• Packages & Tags — two-column view: packages list on the left, tag table on the right. Each Docker tag row has a 🚀 Deploy button.
• Deploy to K8s — clicking Deploy pre-fills the full image reference (location-docker.pkg.dev/project/repo/pkg:tag). The panel then lets you select the target Namespace, Deployment and Container from the active Kubernetes cluster, shows a deploy summary and applies the change with a single click.

Kubernetes Deployment Integration

• New POST /api/:namespace/deployments/:name/set-image endpoint: performs a strategic-merge-patch on one container's image and writes an audit log entry.

GCP — Log viewer improvements

• Log entries in all detail panels now use severity-based colour coding: ERROR/CRITICAL → red, WARNING → amber, INFO/NOTICE → green, DEBUG/DEFAULT → dim.

v1.9.3 (2026-06-09)

AWS Amazon Lex

• Redesigned the Lex view with a master-detail split-panel layout (like Cognito and Athena). The left panel lists all bots with status, version and last-updated date. Clicking a bot opens the detail panel on the right.
• Removed the 8 individual colored action buttons from each table row. All functionality (Intents, Aliases, Slot Types, Chat, Logs, Missed, Metrics, Test Set) is now accessible via a tab bar in the right panel.
• Data is loaded on-demand per tab and cached for the active bot — switching tabs for the same bot does not re-fetch.
• The Chat and Build actions inside the Aliases tab now navigate to their respective tabs instead of opening nested modals.

v1.9.2 (2026-06-09)

AWS DynamoDB

• Added item editing in the Browse modal: each row now has an ✏️ button that opens a JSON editor pre-filled with the item's current data. Saving performs a PutItem (full replace) and refreshes the current page.
• Added item deletion per row: the 🗑 button extracts the primary key fields automatically from the table's key schema and asks for confirmation before calling DeleteItem.
• Added New Item button in the Browse modal toolbar: opens the JSON editor pre-filled with only the key fields so you can create a new record from scratch.
• JSON editor validates syntax in real time and blocks saving when there are parse errors.

v1.9.1 (2026-05-28)

AWS Cognito

• Fixed user search behavior in User Pools to support free-text lookups without triggering AWS filter parsing errors.
• Added user attribute editing from the user details modal.
• Added group membership management from user details: assign and remove groups for a selected user.
• Added per-user MFA controls in details: enable via toggle, disable via action button, and preferred method switch (SMS/TOTP).
• Added create-group flow with description support in the Groups tab.
• Fixed runtime issue in group creation flow where the UI could fail with createCognitoGroup is not a function in stale hot-reload states.
• Fixed MFA status mismatch between user list and details by aligning list calculation with Cognito MFA settings (UserMFASettingList / PreferredMfaSetting, with compatibility fallback).

v1.9.0 (2026-05-26)

Vercel

• Full Vercel provider integration with OAuth authentication — connect your Vercel account directly from the profile modal.
• Projects view with deployment status, framework, region and quick links to the live URL.
• Deployment details with Activity feed, DNS Records, Aliases, Cron Jobs, Webhooks, Edge Config and Checks tabs.

AWS Step Functions

• New Executions column in the Step Functions table showing live counts of running (▶), failed (✗) and timed-out (⏱) executions.
• New Versiones tab in the Info panel — lists all published workflow versions with creation date, description and on-click ASL definition viewer with copy button.
• Info modal refactored with five tabs: Detalles, Diagrama, Ejecuciones, Eventos and Versiones.

Terminal & Shell Improvements

• Native Copy/Paste Support: Electron menu now includes Edit menu with native roles for copy, paste, cut, select all and standard keyboard shortcuts.
• Context Menu: Right-click on selected text to copy; right-click on input fields to cut/paste/copy as native OS behavior.
• Copy Selected: Button to copy currently selected terminal text without depending on keyboard shortcuts.
• Copy Output: Button to copy the entire terminal output (all filtered lines), with timestamps automatically removed for clean text.
• Paste into Input: Button to safely paste clipboard content into command input, with confirmation for multiline text to prevent accidental execution.
• Terminal Panel: Full copy/paste UI in the bottom terminal panel used for Kubernetes, local shell, and AWS/GCP logs.
• Local Shell: Dedicated copy/paste buttons in LocalShellView header for shell session management.
• SSH Terminal: Ec2Shell now supports copy selected, copy output, and safe paste with Ctrl+C remaining as interrupt signal.
• RDP Paste Modal: RDP session has a "Paste text" feature with textarea modal to send text as keyboard events to the focused remote field. Note: copy from RDP canvas is not available (render is pixels, not selectable text); use SSH or remote command to extract logs from Windows machines.
• Selection CSS Fix: Terminal output areas now allow text selection (user-select: text) while preserving non-selectable decorative elements like timestamps and tab headers.

v1.8.0 (2026-05-10)

Kubernetes

• Resource tables now support multi-select, bulk delete and richer row actions.
• The Kubernetes menu now covers more resources across workloads, networking, storage, config, policy, RBAC, scheduling, admission and cluster administration.
• The Age column displays readable durations such as 1day 3hrs 10min, 23hrs 10min, 2min and 30sec, while sorting by the real elapsed duration.
• ConfigMaps and Secrets have an easier key/value data view for mapping and editing values.
• Workloads expose environment variables in the detail panel, including editable container env entries.
• The kubeconfig modal can import pasted YAML, load a file through the desktop file picker or register an existing kubeconfig path.

Helm

• Charts can be searched from configured repositories and installed directly into the active cluster.
• Installed releases can be listed and uninstalled from the Helm view.
• Installations show progress, output and final release status instead of leaving the UI waiting silently.
• metrics-server installs include a compatibility preset for local or self-signed clusters, adding kubelet TLS and preferred address flags.

Observability

• Metrics are available for Pods, workloads and Nodes through metrics.k8s.io.
• When Metrics Server is unavailable, KuaDashboard can discover Prometheus services and query metrics through the Kubernetes API server proxy.
• Resource and Node detail panels include related events and notification-style summaries to help diagnose scheduling, image pull, health and lifecycle issues.

Port Forwarding

• Service and Pod tunnels are more reliable, with improved target pod resolution, persistent session state and reconnect behavior.
• Port-forward actions are available from resource tables and detail surfaces where the selected resource supports a tunnel.

v1.7.0 (2026-05-05)

• Auto-refresh for Kubernetes, AWS, GCP and Helm views without resetting navigation context.
• Resizable Kubernetes resource detail panel with specialized summaries and structured YAML.
• Pod metrics using metrics.k8s.io, Prometheus detection and Helm handoff when monitoring is missing.
• Real-time log streaming for Pods, Deployments, StatefulSets and DaemonSets.
• Terminal Logs search, serialized date filters, downloads and line counts.
• YAML editor search, lint, save, line/column status, section path and autocomplete.
• Persistent EC2 SSH/RDP sessions that can be hidden and reopened without closing the connection.

v1.6.2 (2026-04-29)

• AWS EC2 Info copy buttons for key fields: Instance ID, AMI, Public/Private IP, Public/Private DNS, Key Pair and IAM Profile.
• AWS Lambda Info copy buttons for key fields: ARN, SHA256, VPC ID, DLQ ARN and KMS Key ARN.
• UX polish for copy actions: hover visibility and temporary visual confirmation.

v1.6.1 (2026-04-24)

• AWS RDS: new per-instance panel with actions for Info, Configuration, Connection and password reset.
• AWS RDS: redesigned detail modal with AWS-console style tabs (connectivity/security, monitoring/logs, configuration, maintenance/backups, migration/replicas, tags).
• AWS RDS: Spanish translations completed for modal texts, buttons and status messages.
• AWS Database: unified navigation and view under RDS, removing residual DocumentDB section from UI.
• Documentation: expanded Spanish IAM minimum-permissions guide with RDS required actions.
• Fixed mojibake encoding in HelpModal titles/comments.
• Fixed Helm behavior for EKS ARN contexts by injecting full KUBECONFIG when invoking helm CLI.

v1.6.0 (2026-04-24)

• AWS Lambda: dedicated Logs tab with CloudWatch events and selectable time ranges.
• AWS Lambda: create log group flow with retention options when missing.
• AWS ECR Deploy to K8s: optional Service creation (ClusterIP / NodePort / LoadBalancer).
• Fixed generated deployment YAML indentation issue.
• Added --validate=false to kubectl apply for compatibility in restricted API setups.
• Fixed Athena UI error sortedRows is not a function.
• Adjusted AWS Lex/Athena maxResults to supported API limits.

v1.5.0 (2026-04-23)

• AWS S3: create bucket modal and per-bucket test action.
• AWS ECR: image browser and direct deploy-to-Kubernetes flow.
• AWS VPC: details panel with overview, subnets, security groups, route tables, IGW and NAT GW.
• AWS Cognito: groups tab per user pool.

v1.4.3 (2026-04-23)

• Windows app icon/taskbar behavior fix via App User Model ID.
• Packaging metadata updates.

v1.4.2 (2026-04-21)

• AWS Lambda details panel with multiple tabs and richer diagnostics.
• AWS EC2 details panel with monitoring, security groups, volumes and console output.
• EC2 SSH password authentication and PEM picker support.
• OS-aware SSH/RDP actions with integrated RDP canvas.

v1.4.1 (2026-04-21)

• Auto-updater robustness: quitAndInstall fallback handling.
• UpdateNotice error state with manual download option.

v1.4.0 (2026-04-20)

• GCP feature expansion (Cloud Run Jobs, Pub/Sub Subscriptions, VPC Networks, Cloud Monitoring, Cloud Logging, Cloud KMS).
• Pagination improvements in Cloud Build, IAM Service Accounts and Cloud Tasks.
• Observability section improvements in GCP sidebar.

v1.3.3 (2026-04-21)

• macOS: migrate credential storage to native keychain using @napi-rs/keyring.
• macOS updater compatibility fixes for release artifacts.

v1.3.2 (2026-04-21)

• macOS auto-updater fix ensuring ZIP artifact availability.

v1.3.1 (2026-04-21)

• macOS auto-updater fix ensuring ZIP artifact availability.

v1.3.0 (2026-04-21)

• GCP phase expansion (Spanner, Redis, Cloud Tasks, Scheduler, Cloud Build, IAM Service Accounts).
• Full EN/ES bilingual UI with reactive switching.
• Header quick actions for language and theme.
• Helm view and related UX improvements.
• WebSocket and terminal reliability fixes.

v1.2.0 (2026-04-20)

• GCP phase 1-2 additions: Secret Manager, Cloud Functions, GCS Browser, Artifact Registry, BigQuery, Cloud Workflows, Cloud DNS and Firestore.
• Persistent port forwarding.
• Expanded AWS coverage across core services.

v1.1.3 (2026-04-21)

• macOS auto-updater ZIP target compatibility fix.

v1.1.2 (2026-04-20)

• macOS: Electron now inherits login shell PATH when launched from Dock.
• Update availability notice integrated in Help modal.

v1.1.1 (2026-04-20)

• AWS/GCP credential selectors in global header.
• Local Shell and Env Manager quick access from header.
• Help modal with About, Releases and Feedback/Issues.
• UI icon and refresh controls improvements.

v1.1.0 (2026-04-20)

• Initial AWS/GCP sidebar navigation and credential selectors.
• Early support for Step Functions, EventBridge, API Gateway, Pub/Sub and Cloud Functions.
• SSH and terminal UX improvements.

v1.0.0 (2026-01-01)

• Initial KUA release: Kubernetes dashboard, cloud views, env manager, port-forwarding and log/exec tooling.