Changelog

We strengthened Agent execution safety, approval handling, workspace isolation, and Skill Pack script reliability. These improvements reduce duplicate actions, prevent stale operations, and make installed Skill Packs safer during updates and retries.

Builder chat now separates generated images and preview validation evidence into focused activity items. You can expand the specific image or screenshot you want to review instead of opening one large grouped activity.

Image generation also uses stronger project context so generated visuals are more tied to the page narrative, section purpose, and audience.

Publishing now runs deterministic backend security checks before deployment. Projects with blockers such as hardcoded secrets, unsafe package sources, fake backend behavior, or direct runtime API misuse are blocked before the public artifact is created.

The Builder composer now exposes /skill-installer alongside /skill-creator. Skill installs, updates, and removals use managed preview/install/remove tools with hashes, approval, and safety checks.

Agent mode and Plan mode can now use controlled read-only web research for current technical references, package documentation, changelogs, examples, and troubleshooting sources.

The agent can search public pages, fetch safe previews, and extract bounded text for evidence.

Visual edits now provide a clearer direct-edit workflow for selected elements in the preview, including more focused controls for style, layout, text, colors, save, and discard.

Save feedback is easier to understand when an edit is applying, when the preview is refreshing, or when something needs attention. When a direct edit is not supported, the interface now guides you to Ask RIB AI with the selected element as context.

Curated skill packs now come from a static trusted registry with publisher, latest version, changelog, version history, manifest hash, bundle hash, and immutable version references.

Settings shows the latest curated pack metadata before preview or install.

Skills settings now shows whether a pack was installed manually or by Builder chat, plus publisher, source, commit, manifest hash, bundle hash, trust level, and runtime status. Status chips separate usable guidance, refs/assets availability, and script hook state.

Builder chat can now preview skill pack sources, install or update them after approval, preview removal, and remove packs after approval using managed pack tools.

The agent can also convert a simple pasted SKILL.md into a manual workspace skill when the markdown is clear enough. This creates markdown-only workspace guidance; scripts, dependencies, references, and assets still require skill packs.

Project owners can now configure Google sign-in from Cloud -> Users -> Google. The form supports Managed by Rib and BYOK credentials.

Generated apps can now use real Google sign-in through RIB Cloud runtime auth. Projects can use Managed by Rib credentials or connect their own Google OAuth credentials.

Claude model selections now start reliably in the builder. The project menu also keeps your previous credit balance visible while a run is in progress, then updates to the settled amount when the run finishes.

Verified curated Skill Bundle packs can now install sandboxed hook scripts for supported agent lifecycle points. Script runs are limited to trusted curated packs, execute with timeout and bounded output capture, avoid inherited secrets, and appear in the agent operation/audit trail.

GitHub and manual packs still cannot run scripts. Elevated permissions, dependency installation, network access, browser access, MCP connectors, workspace write APIs, and subagent invocation remain blocked for Skill Bundle scripts.

Skill Bundle previews now separate verified curated sources from external GitHub/manual sources and show blocked script or elevated permission requests before install. The agent can load read-only bundle reference files with a skill, while packaged assets are exposed as verified inventory.

Skill packs can now use the Skill Bundle format for GitHub-installed packs. Bundle previews show file-level changes for skill markdown, reference files, and assets, and installs verify declared checksums from the pinned GitHub commit before storing an immutable bundle snapshot.

Script execution remains disabled for GitHub/manual packs. Packs that declare executable scripts from external sources or elevated operational permissions are blocked instead of run.

Workspace owners and admins can now preview and install public skill packs from GitHub URLs. The packs page resolves repo, tree, blob, and raw manifest URLs, shows the manifest and diff before install, and stores provenance for later update checks.

Manual JSON pack import/export and verified curated packs remain available. External installs never run automatically in the background, and GitHub packs must pass preview/diff checks immediately before install.

RIB Creative now has a dedicated public changelog inside the user documentation. It is designed for product-facing release notes, not internal engineering logs.

Use it to understand what changed, why it matters, and which docs to read next.