更新日志
The changes that matter, newest first.
31 项更改，自 May 8, 2026 起。
Website
The site now opens on a full-viewport hero and walks through the primitives, three use cases, a pricing preview and the agent environments that can install cohesivity. The /offerings index and all 21 offering pages, plus changelog, pricing, community and contact, were rebuilt in the same light lattice, and every price, cap, quota and endpoint was carried over verbatim from what shipped.
Runtime
POST /api/genesis rejects any request whose User-Agent contains curl with a 403 bannedUserAgent, so a new project comes from npx @cohesivity/init, the quickstart, or an agent sending an attributing User-Agent such as cold:<your-runtime>. Existing tenants are unaffected.
Hosting
Your hosted app's CPU, memory and egress now draw on real monthly buckets: Free gets 100k vCPU-seconds, 400k GB-seconds and 5 GB of egress, Plus gets 400k, 1.5M and 50 GB, and Pro gets 1.5M, 6M and 250 GB. Past the bucket, cohesivity draws fluid credit in blocks of 85 cents per 100k vCPU-seconds, 85 cents per 200k GB-seconds and 55 cents per 10 GB, then sleeps and finally stops the service once there is nothing left to draw.
Runtime
Your agent mints an approval link with POST /api/claim/url and you approve it in the browser at /c/<token>. The page that asked a human to paste coh_management_key into a form is gone, /claim/<tenant_id> now 404s, and POST /api/claim/complete returns 410 claim_management_key_retired if a management key is sent.
Billing
Successful OpenAI, AI Gateway, Deepgram and Exa usage settles at the upstream price plus 10%, down from plus 50%, rounded up to the nearest cent for each settled charge. Failed calls still cost nothing, and GET /api/billing/plans publishes the multiplier so an agent can quote it before spending.
Runtime
cohesivity.ai now answers the probes an unfamiliar agent makes first: an RFC 9727 linkset at /.well-known/api-catalog, an OpenAPI 3.1 document at /openapi.json, the real auth model at /auth.md, an Agent Skills index with a canonical SKILL.md, and a read-only MCP endpoint at /mcp. The homepage serves text/markdown when a client asks for it, while browsers keep getting HTML.
Postgres
POST /api/resources/database now returns 410 offering_retired with postgres as the replacement, and the legacy D1 database is off every public catalog. Projects already running D1 keep the exact same endpoints and responses, and fresh social-login and realtime history moves to private Neon storage without provisioning D1 at all.
Steel Browser
Steel Browser provisions a managed browser session at /api/resources/steel-browser and your agent drives it over CDP at /edge/steel-browser, with one-shot scrape alongside it. Free includes 60 browser minutes and 20 scrapes a month, Plus 600 and 200, Pro 3,000 and 1,000, and a claimed account can add 20 minutes for $0.05 or 50 scrapes for $0.50 when a bucket runs out.
Hosting
Legacy vercel-hosting is off the agent landing page, the offerings catalog, llms.txt, llms-full.txt and the public skill, so a fresh build provisions railway-hosting instead of picking the older integration. Existing Vercel projects keep working and /offerings/vercel-hosting is still reachable directly.
Dashboard
The dashboard bento now carries a contributions heatmap of per-day deploys and hosting provisions over the trailing 20 weeks, read from metered usage rather than logs, so it survives log retention. The fluid tile beside it now shows the available balance, wallet minus reserved, instead of month-to-date spend.
Hosting
Railway hosting responses now carry deployment_url, state, logs_url and docs_url and nothing else: no provider URL aliases, no provider ids, no deploy script, no next_steps. Env, vanity and custom-domain responses drop provider metadata the same way, so a bring-your-own domain means copying every row of records_to_add and never opening a provider dashboard.
Inbox
An unclaimed project can now provision Inbox at <tenant_id>@inbox.cohesivity.app and send, receive, list, read, reply and delete, capped at five accepted emails and five recipients for the lifetime of the tenant, one recipient per message. The older tenant Resend API is retired on the new runtime: POST /api/resources/resend-api and /edge/resend-api/* return 410 offering_retired with inbox as the replacement, and tenants pinned to an older runtime keep Resend until they upgrade.
Dashboard
A new /account/inbox page lists what your apps sent and received across every claimed Inbox project, with received and sent filters, search and pagination. It is read-only on purpose: HTML mail is converted to plain text before it reaches the browser, attachments show metadata without bytes, and there is no compose, reply or delete.
Inbox
Each Inbox can carry one optional message.received webhook, set at provisioning or later through /api/inbox/webhook, delivering {type, message_id} with a base64url HMAC-SHA256 signature over <id>.<timestamp>.<raw-body>. Delivery is at-least-once and retries at 1, 4, 15 and 40 minutes before the fifth failure lands in a dead-letter queue, with GET /edge/inbox/messages still there as the recovery feed.
Inbox
Claimed projects can now provision one purpose-built Inbox at inbox.cohesivity.app. Agents send, receive, read, reply, and delete through a small HTTP API, with immutable shared vanity identity, private message storage, and fixed 30-day retention — no mailbox UI, SMTP, or separate provider account.
Custom domains
A project claims its *.cohesivity.app name once at /api/vanity, and hosting and Inbox then share it. Renaming and releasing are gone, a later attempt returns 409 vanity_immutable, and provisioning the second offering inherits the name the first one claimed.
Hosting
railway-hosting provisions from POST /api/resources/railway-hosting and deploys by uploading files to POST /api/railway/deploy, with no GitHub repo, no CLI install and no provider credentials in your hands. Env vars, *.cohesivity.app vanity hosts and custom domains all run through /api/railway/*, and cohesivity applies the compute cap for the plan: 0.5 vCPU and 1 GB on Free, 1 vCPU and 2 GB on Plus, 2 vCPU and 4 GB on Pro.
Agent skill
npx @cohesivity/init is now the setup path every surface leads with, from the landing page through llms.txt and /onboarding. It is a version-pinned single file with no postinstall hook and a --dry-run, and the quickstart script stays as the fallback for machines without Node.
Billing
POST /api/billing/topup/x402 funds a claimed account's fluid wallet with USDC on Base, no human and no hosted checkout: an unpaid POST returns the 402 challenge, and re-posting with the X-PAYMENT header verifies, settles and credits once per settlement transaction. The agent rail is bounded at $5 to $200 per payment, while the human Razorpay rail keeps its $5 to $500.
Dashboard
cohesivity.ai/account and its sub-pages now serve the redesigned console instead of the old inline HTML, and the claim pages paint their final state with no round trip and no flash. The console reads /account/data as JSON, so an expired session returns 401 and the page can say so rather than bouncing you into a login redirect.
Website
cohesivity.ai's public routes now negotiate by Accept header: a browser gets the human site, and anything asking for text/markdown or text/plain gets the exact agent documentation it always did. The negotiated set is /, /about, /blog, /changelog, /community, /contact, /pricing, /status, /offerings and every offering page, while /docs, /llms.txt, /skill.md and the account, claim and billing routes stay agent-only.
Postgres
/edge/postgres accepts {statements: [{query, params}, ...]} and runs every statement inside one transaction over a single HTTP round trip, returning {results: [...]} positionally. A page that used to pay the 0.7 to 1.2 second floor per query now pays it once, and the single {query, params} form keeps its path, response shape and validation messages.
Hosting
Apps you deploy through Cohesivity now get their canonical URL on cohesivity.app. New deployments advertise the new domain end-to-end — provisioning, deploy responses, status, claim emails, and social-login callbacks — while existing projects are migrated without downtime.
Agent skill
The Cohesivity skill is now served at a stable /skill.md URL and installs with a single curl — no MCP server or SDK required. Once installed at personal scope, your coding agent loads it automatically in every project on the machine.
Postgres
A net-new /postgres backend on managed Neon brings real Postgres to your agent: pgvector retrieval, tsvector full-text search, materialized views, partial indexes, and true BEGIN/COMMIT transactions. It runs alongside the existing SQLite database — both coexist on the same tenant.
AI Gateway
Call approved OpenAI, Anthropic, Google, and xAI models through one governed Cohesivity endpoint, with provider keys kept server-side. Tier gates, quota reservation, and wallet guards apply automatically — and you're never billed when a successful response carries no usage.
Custom domains
Agents can now purchase a domain for the user — .com, .ai, .io, .uk and 300+ TLDs — or attach a domain you already own at any registrar to your project. All of it happens through Cohesivity, with no registrar or hosting dashboard to click through.
Dashboard
A new Insights tab in the dashboard shows project owners who signed up and signed in through the social-login offering. It surfaces owner-safe identity and coarse auth activity only — no IPs, tokens, or raw metadata are exposed.
Runtime
Tenants pinned to an older runtime can now move forward on their own. /api/status flags when an upgrade is available, and your agent applies the tenant-facing changes from a structured release-notes feed and commits the bump — no manual intervention needed.
Speech
Speech-to-text and text-to-speech are now available through an approved deepgram-api provider. Cohesivity injects the credentials server-side, so there's no upstream key for your app to hold or manage.
OpenAI
The offering is now openai-api at /edge/openai-api/, and it rejects any Authorization or upstream OpenAI key because cohesivity injects the provider credential itself. The surface is limited to models, Responses, embeddings and image generation with model access gated per plan, and the Gemini and YouTube Data offerings were removed at the same time.
可以跳过此页。
/api/status 已经知道答案。此页面供你阅读。