What changed in Inference Bureau, newest first. For what is coming, see the roadmap.
The homepage, the Apps, Auditor and Gateway pages, pricing and the roadmap have a new look, with each idea shown working: a first build running step by step, a pull request going from finding to fix, a request passing your Directives on its way to a provider. The Apps page shows what people build with it, from Shopify apps to internal tools, integrations and sites.
Read more →Preview's bar has a desktop and a phone button: the phone button shows the app 400px wide. In that view, Code opens the page's file next to the phone, and any file you choose in the sidebar opens there instead of in Files. Save with ⌘S and the phone updates within seconds, so you can work on the mobile layout without leaving Preview. The width and Code are remembered for each app and environment.
Read more →TypeScript files in an app's Files editor now get completions as you type: after api. your models and actions, inside a filter a model's fields with their types. Hovering a name shows its type and docs, and type errors are underlined as you type, checked against the SDK and your app's generated types. An error's tooltip offers the fix when it's a misspelling, and Ask the assistant to fix it; a line under the editor lists the file's problems.
Read more →A team now runs up to 2 development servers at once on Free, 10 on Pro and 25 on Scale; another starts once one goes to sleep, 30 minutes after it was last used. On Free, an app's development server stops waking after 100 awake hours in a month, until the month ends. Dev servers also start only once one of the team's owners or admins has verified their email address. A server held by a limit shows as asleep to visitors, and Logs, Preview and ib-apps dev say which limit held it. Production is never affected, and ib-apps dev --local isn't limited.
Read more →A custom domain now serves your app only once we find its _ib-verify TXT record, listed with its other records on the app's Domains page. Pointing a CNAME at us is no longer enough on its own, so a hostname another team removed but left pointing here can't be picked up by someone else. Domains already live keep working with nothing to add; one still pending needs the record before it goes live, and a domain never proven within 7 days is let go.
Read more →On a pull request from a fork, only the author skip rule now skips Auditor merge checks: its branch name, title and missing opt-in label no longer do, since the person opening it chooses them. A required check that goes unjudged there, from a spend cap, no allowed model or an unclear verdict, fails the merge checks instead of leaving them neutral. Branches in the repository work as before.
Read more →A synced model's Shopify webhooks now go through the job queue: written a few at a time per store and model, each record's in the order they arrived, and retried when writing one fails, instead of being lost. Every installed store is reconciled each hour, however many there are. The job runner takes each app's jobs in turns, so a big import queued under one key can't hold up anyone else's jobs or webhooks.
Read more →What automation runs and Auditor in Linear spend now shows in each repository's cost on the Auditor page, with its own lines in the breakdown, and in Analytics under the repository that did the work. A repository's Analytics page lists each @Auditor ask in Linear, each ticket check posted on a Linear issue, and its automation runs, with how they ended.
Read more →Sign Linear in from Add-ons › Issue trackers and the Auditor app joins your workspace. Reviews read the issue a pull request is for, and can say on the issue when the change misses something it asks for. Mention @Auditor on an issue, or assign it one, to ask whether its pull request is ready, get a plan, or have the change made and opened as a pull request that fixes the issue.
Read more →Mention @auditor on a GitHub issue and say what you want. Auditor reads the issue, its comments and the code and does what you asked: a plan for "how would you approach this?", an answer for a question, or the change itself for "fix this, keep the old endpoint", opened as a pull request that fixes the issue. When it can't tell whether you want the change made, it plans and asks. Each issue is one conversation, so you can push back on a plan and then say go ahead.
Read more →The Auditor page has an Analytics tab: how often your team acts on findings, findings posted, cost per pull request and time to merge, against the period before; findings by how they ended; each kind of finding by how often it is acted on, with what tuning muted; and every repository or author with findings posted, resolved and open, reviews started automatically or asked for, commands, previews and cost.
Read more →Comment @auditor resolve conflicts on a pull request that conflicts with its base branch. Auditor merges the base branch in: files only one side changed take that side, files both changed are merged line by line, and only the lines that still conflict go to the model, with the pull request's description and the base branch's commit messages, so both changes survive. The result is a real merge commit of the base branch as it is at that moment, committed straight onto your branch as GitHub's own Resolve conflicts does, with each file's resolution explained.
Read more →Comment @auditor tests on a pull request, optionally with what to focus on. Auditor learns how the repository tests, writes unit tests for the behaviour the pull request adds or changes, and runs them in a sandbox with Vitest, Jest or pytest, or a command you set, fixing them from their failures for up to three rounds. It only writes test files, never the code under test.
Read more →Write rules about the pull request itself, such as "a change to migrations/ says in the description how to roll it back", under Merge checks on the Auditor page's Reviews tab or in .auditor.yaml. Auditor judges them on every push and every edit of the title or description and reports them as a check of their own, Auditor merge checks, with a one-line reason for each. A required check that fails fails it, so branch protection can block the merge; warnings never do.
Read more →Mention @auditor in any pull request comment that isn't a command, such as "@auditor what else calls chargeCustomer?", and Auditor answers from the code. It reads the pull request, its diff, the conversation and its open findings, then reads and searches the repository at the pull request's head, and cites the files it relies on. Asked on a line of the diff, it answers in that thread about that code; in the conversation, it answers with a comment that quotes the question.
Read more →A repository can keep its review settings in an .auditor.yaml file at its root: when reviews run, what re-reviews post, the deep review and its depth, skip rules, the walkthrough, fixes and the rest, by the settings' own names. What the file sets wins over the team's settings and the repository's on the Auditor page, and anything it leaves out keeps those. Auditor reads it from the default branch whenever a push there changes it, so a pull request can't loosen its own review.
Read more →When the dev server runs on your computer, the CLI now checks every half minute, and as soon as the computer wakes, that its tunnel still reaches it. Before, a quick tunnel whose connection died during sleep stayed in charge: the heartbeats resumed the moment the computer woke and kept pointing the environment at an address that answered nothing, so the app's development address refused to connect and Logs filled with 503s until ib-apps dev was restarted by hand. Now the environment is handed back to the hosted dev server at once, a new tunnel opens and next dev restarts behind it, which takes about as long as a restart did. A tunnel of your own (--url) is served again once it answers.
Read more →A web app created with the Site starter now has one published post the moment it exists: Hello, and how this site works, at /blog/hello, with a cover. The front page leads with it, the blog lists it, and its page is a short tour of the starter with the code it runs on: the post model and its publish action, how pages read records in server code, how the contact and newsletter forms become records and email, the CLI, the tests, and where to take the site next. It's an ordinary post record, written as the app is created rather than kept in a file: edit it or delete it in Records → post.
Read more →A theme guide can now be served at a subdomain you own instead of its /t/ address. On the repository's Theme docs card, under Your own domain, add the subdomain and then the DNS records it lists at your DNS provider; the certificate is issued for you once they're in place, usually within a few minutes, and the card says where the domain stands. While it's active, links to the guide's address here open at the domain, and the password, link previews and keys work as before.
Read more →A web app can now start as a site instead of a Members app: choose Site under Starter on New app, run ib-apps create --starter site, or send starter: "site" to POST /v1/apps. It has a front page led by the latest post, posts written in the dashboard's record editor and served at /blog and as RSS at /feed.xml, a contact form whose messages become lead records and an email to you, a newsletter list with double opt-in and a lasting unsubscribe link, and the metadata, sitemap, robots and Open Graph image a site needs to be found. Visitors have no role: pages read records in server code only, and the forms post to server actions that run the models' actions.
Read more →New app now has Start from: Blank, or one of the seven example apps as a recipe (product reviews with moderation, a wishlist, a product quiz, a product tagger, Notion sync, bundles with a Shopify Function, or the backend of a Shop Mini). The app starts with the recipe's files, a Shopify recipe's scopes are filled in on the connect step, and the setup page lists what's left to do and the keys the app reads. ib-apps create --recipe <id> and recipe on POST /v1/apps do the same. Everything stays editable.
Read more →cors.origins in settings.ib.ts accepts http://localhost:*, so an app can be the backend of a Shop Mini, which calls from localhost on a port of its own in the Shop app as well as in development. The new parcel-globe example is one: a web app that verifies Shop's buyer tokens, keeps each buyer's parcels and draws them on a globe.
Read more →Shopify now sends each page only the {% stylesheet %} CSS of the files it renders. When a theme pull request moves or deletes a class's rule and an untouched file still uses that class out of the rule's reach, the review now says so on the line that moved the rule (or in its summary when the rule was only deleted), naming the file and line that may show unstyled. Theme Check flags the class itself, but on a line the pull request didn't change, which reviews used to drop.
Read more →The Gateway, Auditor and Apps each have their own page at /gateway, /auditor and /apps, linked from the Products menu: what the product does, one idea at a time, with a picture of it working. The pricing page now prices all three: the Gateway's provider prices plus the platform fee, Auditor's reviews and automations billed as inference with no seats, and the Apps plans side by side, all paid from one balance.
Read more →The project switcher at the top of the console now lists the team's apps under its projects, and shows on Apps pages too, so moving between a Gateway project and an app is one menu. Past three in either group it shows the three you opened most recently, with the full count on All projects or All apps, and a filter field appears: typing narrows both groups, arrows move, Enter opens.
Read more →On a section's or a block's page, a setting the theme editor can connect to a metafield or a product attribute now carries a mark beside its name, explained once above the table. A default that names a source, such as Featuring: {{ product.title }}, reads as its text with a chip for the source instead of None. Under Where your store uses it, each copy on the store lists where each such setting's content comes from: the metafield or attribute it is connected to and what that is, that it was typed in, or that it was left as the theme has it. A metafield the store no longer defines is flagged as missing, and the page's badges count the connected settings and the missing sources.
Read more →Error bodies on every /v1 route now carry type next to code: the kind of thing that went wrong, from the status, so a client can decide between fixing the request and retrying without a table of codes. The names are Anthropic's (invalid_request_error, authentication_error, billing_error, permission_error, not_found_error, request_too_large, rate_limit_error, overloaded_error, api_error), so /v1/messages answers as it did. The few routes that answered a bare message, the Apps preview and the dashboard's hosting and domain calls, now return a code and the request id like every other.
Read more →A finding's Fix link, in the review comment's table and under each comment, now opens a page for that finding: what is wrong as the comment says it, the whole prompt, and a card for each way to fix it. Cursor opens the prompt in Cursor, now always with the whole prompt. Claude Code and Codex give one command that fetches the prompt in your checkout. Auditor fixes that one finding and posts the result in its thread. The page opens without signing in for anyone who can see the review; fixing with Auditor needs a member of the team.
Read more →A Markdown file under .ib/guides/ in the repository is now a page of the guide: a getting-started walkthrough, a launch checklist, a glossary, under Guides in the sidebar next to the pages the theme produces. Front matter names the page (title), groups it (category) and orders it (order); relative links such as ../sections/hero open the page they name; search finds its headings; kept versions keep it. A push that changes only files under .ib/ shows on the guide within seconds, without a run, as does Read notes now under Theme docs. Open /t/your-address/preview/a-branch, signed in, to read the guide with that branch's .ib/ over it before merging.
Read more →Share, in a guide's header, copies the page's address and shows the card it unfurls as in Slack, iMessage and email. For a guide with a password, Share can add a key to the link: the link then previews the page and opens it without the password for 30 days, and changing or removing the password ends every key. Under Theme docs, Link previews shows the cards as they stand, and Refresh previews gives every link's card a new address, so a chat app that kept an old card fetches the new one.
Read more →The comparison with the store's published theme now includes the locale files under locales/, so translations merchants edit in Shopify's language editor are listed after a deploy and come with @auditor pull like templates, section groups and theme settings. The note on a locale file says how many strings are only on the store, only in the branch, or have different text. Files the pull request you comment on changes itself are still left out of a pull, with the answer listing each one; comment @auditor pull --all to bring the store's copy of those in too.
Read more →A guide's tab icon, and its icon on a phone's home screen, are now drawn from the logo you upload under Theme docs, on a small tile in the guide's color scheme, in place of the Inference Bureau mark. A theme performance report, which shares the guide's look, takes the same icon. A guide without a logo keeps the mark, on the same tile.
Read more →Change a guide's address under Theme docs and links to the old one, a section's page or a kept version included, open the same page at the new address instead of a 404. The same goes for a theme performance report's address. An address you leave stays yours: no other team's guide can take it, so the links you shared keep opening your guide.
Read more →The Inference Bureau GitHub App now receives push events itself, so a guide is regenerated ten minutes after each push to the default branch without subscribing your installation to the event by hand. It is on for every repository with theme docs; turn it off under Theme docs, After a push to the default branch.
Read more →Each app environment now has an API Reference after Playground: every model with its fields, their types, filters, sorts and descriptions, who may read it, and every action with its params, who may call it and what queues it, each as SDK, curl, fetch and MCP code with Try in Playground. Copy it as Markdown, or download it as JSON or OpenAPI 3.1; the API serves the same at …/reference and …/openapi.json. A new description on a field, a schema, a param or an action's options shows there, in the generated types and to agents.
Read more →Development's MCP server now has builder tools: list, read, search, write, edit and delete the app's files, read the dev server's problems and the environment variables, and, for team owners and admins, set a variable and deploy. Five schema-level tools, create_model, add_field, change_field, create_action and grant_role, write well-formed files (storage keys set and kept on a rename, params as a plain literal, grants in permissions.ib.ts) and answer with the reference entry they produced and what a schema change does to the records that exist. Production's server keeps the reading tools alone.
Read more →Playground, next to Dispatch and Logs, sends a chat, Messages, Responses, embeddings or images request as one of the project's keys and shows the streamed answer with its receipt beside it: the model and provider that served it, every upstream call and the routes skipped, time to first token, tokens and the charge, with a link to the request in Logs. Only models and aliases the project's Directives allow are offered, so a denial is explained where the Directive lives.
Read more →Auditor → Knowledge has a switch, off by default, that lets the findings your team fixed or dismissed as wrong become test cases for the reviewer: the changed lines around the finding, the finding and how it ended, with nothing that names your repository, the rest of the file, who wrote it or which commit.
Read more →Image generation now serves models priced per output token: OpenAI's gpt-image-1-mini, gpt-image-1.5 and gpt-image-2.5, and Microsoft's MAI-Image-2.6. We measured how many tokens an image takes at each size and quality, and your balance holds that much for the size and quality you ask for, then settles at what the provider billed. POST /v1/images/edits changes an existing image from a prompt, with an optional mask, on FLUX (including FLUX Fill for inpainting), Seedream, Muse, MAI, gpt-image and Grok Imagine.
Read more →A schedule or webhook automation now has a Run on the repositories together option under Scope: one run, one agent, reading every repository in scope at once (up to 10) instead of one run per repository. For a shared section library and the themes that vendor it, or a monorepo split across repositories, the agent sees both sides of a change. Every tool takes a repository argument, each repository the agent edits gets its own pull request against its default branch, and the pull requests name each other.
Read more →Settings → Audit log shows owners and admins who changed what on the team: key changes, Directives edits, members and invitations, billing, every Apps and Auditor action, and webhooks. Each event names who acted, a member, a management key or Inference Bureau, with the reason when one was given, and opens to the fields it changed, before and after.
Read more →A proposal's edits are now checked in a Sandbox with the repository's own type checker, linter, Semgrep or Theme Check before the pull request opens; what the tools report on the changed lines goes back to the agent for one more round, and the pull request says what was checked. Four new outputs: a comment on the pull request's ticket in Linear, Jira or Shortcut (or a tracker issue in a team or project you name), an email digest per firing, a Slack message per firing through an incoming webhook, and a signed POST per run to a URL of yours.
Read more →On a phone the console no longer stacks the whole sidebar above the page or keeps the rail beside it. A tab bar at the bottom opens Gateway, Apps and Auditor where you last left each, and its Menu opens a sheet with the team switcher, the section's pages, Docs, the team balance and your account. The top bar keeps the project or app and environment switchers and Deploy, an app's assistant gets the row below them, and it opens full screen.
Read more →Two more triggers for automations. Check failed fires when a GitHub Actions workflow run, or any other CI's check, ends in failure, and the agent gets the failed job's log around the first error (or the check's own output) along with the failing commit; filter by workflow or check name, branch, and whether only pull requests count. Issue fires when an issue is opened or labeled, with the issue's title and text as the run's context; filter by label, title and author. A comment goes on the pull request or the issue the run is about.
Read more →Team → Auditor has an Automations tab. An automation is a trigger (a schedule, a pull request opened, made ready, pushed or labeled, or a push to a branch), an instruction in your words, a scope (every repository, a name pattern such as acme/*-theme, or a list), a permission (read, propose a pull request, or push) and what it may post: a comment, an issue or a pull request. One firing runs once per repository in scope, and a repository can opt out or replace the instruction from its settings drawer.
Read more →When something fails in an app's production, an action that threw or didn't answer, a job that gave up, a deploy that failed, a release Shopify refused or a route that answered 5xx, the team's owners, admins and the members who can see the app now get an email naming what failed and why, each line linking to its event in Logs. The first failure after a quiet spell is sent within a minute.
Read more →A pull request into a branch an app's environment follows now gets a check on its head commit saying what deploying it would do to production: the files it changes, each model change and how many of production's records it reaches. A removed field still holding values, a new type some values can't take, or a new required or unique rule existing records break fails the check, so it shows before the merge. Web apps can also turn on preview environments: each pull request gets pr-<number>, following its branch, with its address on the pull request, deleted at merge or close.
Read more →Connect your team's 1Password service account on Settings → Integrations, and any environment variable's value can be a secret reference, op://vault/item/field, instead of the secret. The app's code reads the secret as process.env.NAME; it's read from 1Password at every build, so the secret stays in your vault.
Read more →Open tabs in Files now reorder by dragging, or with ⌥⇧← and ⌥⇧→ on a focused tab, and keep their order through a reload. Right-clicking a file or folder in the tree opens a menu: New file and New folder inside a folder, Rename in place, Duplicate, Copy path, Collapse and Delete.
Read more →A new Shopify app with Polaris admin pages now loads polaris-2.js, Shopify's Polaris 2.0, which matches the redesigned admin and takes later 2.x releases, with @shopify/polaris-types ^2.0.0. AutoTable and AutoForm from @inferencebureau/apps-sdk/polaris work on both.
Read more →An action run against development whose dev server was asleep used to fail at once with "Development's dev server is starting. Try again in a minute." Runs from the API, the MCP server, Playground and Files' Run action now wake it and wait up to 150 seconds for it to start, so the first run after a quiet spell is slow instead of failed.
Read more →Run action in Files now opens a drawer beside the editor instead of a JSON box above it. Its params are a form built from the file's export const params, each field typed like the record form in Data, or JSON with completion from the same params, as in Playground; switching keeps what you typed. A model action picks its record from the model's newest or by search, a Shopify app's run can go as one of its installed stores, and the last run's answer stays in the drawer with the call as SDK code.
Read more →inferencebureau.com/status shows whether the Gateway, Apps, Auditor and the console are working right now, checked every 15 minutes, with 90 days of uptime for each and every incident and maintenance window we post. It's linked from the footer of every page.
Read more →An app's environment can now follow a GitHub branch from Settings → Git. A push to the branch syncs the environment's files, as ib-apps push would, and production deploys from a development environment that takes the push, so a merge to main ships with no CI workflow or API key.
Read more →For team owners and admins, ib-apps dev now runs next dev on your own machine over a mirror of your folder, with the environment's variables, and points the app's development address, its actions, the app proxy and its jobs at it through a tunnel started for you. Your own debugger and tools, no sandbox wake, and no dev server hours used. Ctrl-C hands the environment back to the hosted dev server, and so does closing the laptop, within a minute.
Read more →The record grid now has Export CSV and Import CSV beside its pages. Export downloads the records the grid shows, with its filter and sort; Import reads a file, shows what it would do (columns matched to fields, new and updated records, rows with problems and why), and imports it in the background once you confirm.
Read more →When a read sorts, takes a range, a startsWith or contains, or searches a model of 50,000 records or more without an index, and is slow, Problems now shows a warning on the model's schema with the indexes entry that would serve it, such as { fields: ["shop", "createdAt"] }. It covers the REST API, actions' api and the MCP server, in development and production.
Read more →api.<model>.aggregate answers questions like reviews per product per month or revenue by status without reading every record. Name each aggregate (count, sum, avg, min, max), group by up to four fields or by hour, day, week, month, quarter or year in a time zone, and filter and search as in findMany. Calls held to a store or role count only what they can read. It's on the REST API, the MCP server, and app pages through useAggregate; a global action that returns one makes a report the app calls by name.
Read more →The React hooks now take the app's generated types the way api does: useFindMany, useFindOne, useFindFirst, useAggregate, useAction and useGlobalAction know each model's fields, filters, sorts and actions, so a typo fails the type check, and select types the records it picks. useFindMany pages by cursor with nextPage and previousPage, and a new useEnqueue queues an action as a background job through the records route, for the actions its enqueueActions lists.
Read more →An app's pages can now show records as they change: pass live to AutoTable or to useFindMany, useFindOne and useFindFirst, and the read runs again whenever the model's records change, whoever changes them, a Shopify sync, a job or another staff member included.
Read more →An Apps text search without a sort now puts the best matches first instead of only lifting records that hold the whole phrase. The words together as typed beat the words apart, a word that starts or is a whole word beats one found inside another word, and a match in a short text field (a title, a name) beats one in rich text; ties still go newest first. Which records match is unchanged, so a declared search index still serves the search.
Read more →Apps puts an app's models, actions and Next.js pages in one folder, and Inference Bureau stores the records, runs the code and serves the pages, on the same bill as your models. Each app has development and production environments, and the ib-apps CLI and SDK are on npm.
Read more →Theme previews, theme documentation and the guide's settings now sit on one Shopify tab. The store, its credential, the storefront password and the preview theme limit are set once at the top and used by everything below, previews on or off.
Read more →Invite someone as a Viewer to let them read the projects and Auditor repositories you give them, with their Logs, usage and reviews, without changing anything. Viewers don't see Members, Webhooks, Management keys, billing or the team balance, so a client can look at their own work without seeing the rest of the team.
Read more →Articles at /articles go deeper than the docs, starting with tool-call reliability across providers, image generation prices and Auditor's Shopify theme previews and store checks. Ask about Inference Bureau, at the top of any article or with ⌘K, answers from the docs, articles and changelog and links its sources.
Read more →The docs now have a section for each product, Auditor and Gateway, plus Platform for what they share (projects, members, billing and webhooks) and the API reference. Switch between them at the top of any docs page, and each section's sidebar shows only its own pages. Every page keeps its address.
Read more →POST /v1/images/generations takes the OpenAI images shape, so client.images.generate works with a base URL change. 22 image models are certified, from Recraft V4.1 Flash at $0.007 an image to Recraft V4 Pro at $0.25, each billed per image at the provider's list price plus your platform fee.
Read more →Twelve new language models are certified: Claude Haiku 5.5, Mistral Large 4, Gemini 4 Argon, Mercury 3, MiniMax M3.1 Flash, DeepSeek V4.1 Flash 1017, Muse Spark Open, Muse Wonder 1.0, Nemotron 3.5 Super VL, LFM2.5 24B, Apex and Glimpse. POST /v1/embeddings adds Voyage 4, Cohere Embed v5, Gemini Embedding 2, Qwen3 Embedding, Titan Text v2, Codestral Embed, Perplexity and more.
Read more →Six new webhook events: key.created and key.revoked, topup.succeeded and topup.failed, autoreload.paused, and auditor.review.completed. Endpoints can now be edited, scoped to one project, and given a new signing secret that overlaps the old one, and every delivery is listed with its body and can be replayed.
Read more →Providers of the same open model differ in how well they return tool calls and follow a JSON schema. Certified routes are now probed for both, and a request that sends tools or a json_schema tries the model's most reliable providers first and skips ones that fail most probes. A new routing.minPrecision Directive keeps requests off providers that serve fp4 or fp8 weights.
Read more →POST /v1/responses now keeps a response when you send store: true, so the next turn can send previous_response_id instead of the whole conversation, and GET, DELETE and input_items read it. OpenAI models can search the web with the hosted web_search tool and max_tool_calls. Codex can compact long sessions through /v1/responses/compact, and /v1/suggest takes Responses bodies.
Read more →Pause a key on the API Keys page, or with POST /v1/keys/{id}/pause: its requests get 401 until you resume it, and its secret, Directives and budgets are kept. Turn on Pause keys on unusual spend in Directives and a key whose last hour cost at least $1 and five times its usual is paused for you, so a leaked or runaway key stops within the hour instead of when someone reads the email.
Read more →Set Re-reviews to Verify, and post only new High, and reviews after a pull request's first resolve what was fixed and post only new High findings, so a fix-and-push loop stops raising new nits each round. The walkthrough comment now keeps the review state: what is open, what was resolved since the last review, and what earlier reviews missed. Skip pull requests by branch, title or author, or review only those with a label, and comment @auditor pause on one to stop its reviews.
Read more →Turn the merchant content check off per repository on its Theme preview tab or through the API. A pull request that removes a section's last preset is now reported, and stores with more than 250 metafield definitions are checked too.
Read more →Every finding's comment now ends with Fix in your agent, and each row of the review comment's table has a Fix link: a prompt for one finding, written for a coding agent, which opens in Cursor with one click or copies into Claude Code, Codex or any other agent. Agents connected to the Inference Bureau MCP server can also read findings themselves with list_findings, get_finding and get_review, for any repository Auditor reviews, and close each with resolve_finding once it's fixed.
Read more →Auditor now flags translation keys a pull request adds that aren't in the theme's default locale files, before the storefront shows "translation missing". Theme vendors can turn on Theme Store readiness to check a theme against the Theme Store requirements on every review, and start a team ruleset from the Theme Store template for the ones that need judgement. The deep review also knows how theme blocks (as in Horizon) and theme app extensions behave.
Read more →npm install @inferencebureau/ai-sdk-provider and use any model your Directives allow from the Vercel AI SDK: chat, Claude on the Messages API, and embeddings, with sessions, end users, tags and model suggestions as provider options, and the request id and suggestion back in providerMetadata. New guides cover the AI SDK and setting up Claude Code, Codex and Cursor. Teams still on the signup rate limits now get 600 requests and 2,000,000 tokens a minute, up from 120 and 120,000, so a coding agent's long turns fit; limits you set yourself are unchanged.
Read more →Reply under an Auditor finding and it answers in the thread: it explains the finding when you ask why, concedes and resolves the thread when your pushback holds up, and keeps the finding when it doesn't, saying why. "Intentional" and "won't fix" dismiss the finding for the pull request, and "leave it open" keeps later reviews from resolving it.
Read more →Comment @auditor fix and Auditor applies the suggested changes as before, then fixes up to 8 open findings that have none: it reads and edits the code, checks the result with the repository's own type checker, linter, Semgrep and Theme Check in a Sandbox, and opens a pull request into your branch with what it fixed and why it skipped the rest.
Read more →Set a monthly cap and a cap per pull request under Spending on the Auditor page's Reviews tab. Once one is reached, new reviews are skipped with a neutral check run that says which cap and links to raise it, so a busy repository or a bot opening pull requests can't run up a surprise bill.
Read more →The deep review now reads the instructions your repository already gives coding agents (AGENTS.md, CLAUDE.md, .github/copilot-instructions.md and .cursor/rules) as its conventions, so it stops flagging what they ask for. They're read from the base branch, and the walkthrough comment lists the files used. Turn off Coding agent instructions on the Auditor page to review without them.
Read more →Monthly add-on fees, such as the Auditor white label, now come with one invoice on the 1st listing last month's fees, marked paid from your balance. Teams that need to pay by invoice can ask for postpaid billing: requests run past zero up to an agreed limit, and a Net 30 invoice arrives on the 1st.
Read more →Team settings, Account and Members now run full width with the same titled sections, cards and footer actions. Members invites from a card on the page instead of a popover, lists everyone with search and a role filter, and explains each role underneath. Account saves name and email together and changes the password in a dialog.
Read more →Define a routing profile in Directives, a pool of models with a baseline, and point an alias at it. Each request then runs on the cheapest pool model, or the best scoring one, that it and your Directives allow, above an optional quality floor. No classifier runs and nothing extra is billed.
Read more →Every top-up now has a Stripe invoice and a receipt to download from Billing. Checkout collects your billing address and tax ID, a PO number can go on every invoice, and a saved card tops up in one click. Billing → Spend and export shows spend over any date range by project, model, key or day, and downloads every charge as CSV.
Read more →A new project's Overview walks through adding credit, creating a key and sending the first request, with a ready-to-copy snippet in curl, TypeScript or Python, and ticks each step off as it happens. New teams can claim $5 of starter credit by saving a card, which isn't charged, so the first requests work before paying.
Read more →Members now has a role picker on every row and an Access column. Give a member some projects instead of all of them, and set their Auditor access to none, View or Manage, on every repository or only some, picked by search or covered by rules like acme-labs/*. Invitations can start with chosen projects, and every change is in the audit trail.
Read more →Team → Management keys now shows at a glance what every key can do, what needs the Team Directives permission and what no key can reach. New key opens a dialog with the expiry, the permission as a switch and the endpoints the key will reach; the secret appears once with ready-to-paste .env, GitHub Actions and test snippets. Keys sit under Active and Revoked and expired tabs, each with a bar of its lifetime left that turns amber in its last two weeks, and rotating explains each overlap.
Read more →Sign in with a passkey instead of a password, or add a 6-digit code from an authenticator app after it. The new Account page, in the account menu, changes your name, email and password, lists the browsers signed in and signs them out, and deletes the account. Owners and admins can require two-factor for their team.
Read more →When turns sent as an alias such as org/fast accept the same cheaper suggested model at least 5 times in 7 days and save money, the project's Savings page offers owners and admins Point org/fast at that model. It changes the alias only after you confirm, as a Directives edit at the level that defines it, checked against the version you saw and recorded in the audit log.
Read more →Give an alias deprecatedAt and replacedBy (another alias or a model). Until the date its responses carry ib-alias-deprecated: <date>; replaced-by=<target> and the request's Logs page shows it as deprecated; from the date its requests run as the replacement, recorded on the receipt as a migration, or are refused with a 400 naming the date when there is none.
Read more →allowedModels now takes vendor/* as well as model ids, like deniedModels: anthropic/* allows every Anthropic model, including new ones. Levels still intersect as sets of models, so a team's openai/* and a project's openai/gpt-5 allow just openai/gpt-5. Tick vendor/* under a vendor in the allowlist drawer.
Read more →Give a key the new Read logged content permission and it can fetch the prompt and response Log content kept for any request of its project, from a script, a test or an agent. Off by default, and every read is in the audit log under the key.
Read more →Send org/fast as the model and define once, in Directives, what it runs: a model id, or a preset with fallback models and defaults for temperature, top_p, max output tokens and reasoning effort. Swap the model behind an alias without a redeploy. deniedModels and deniedProviders block a model or provider whatever the allowed lists say.
Read more →Turn on Require no training in the Data group (data.requireNoTraining) and requests go only to provider endpoints listed upstream as not training on request content. It narrows the pool less than zero data retention; set both to require both.
Read more →The Log content Directive now works. Turn it on for a team, project, environment or key, and each request's page in Logs gets a Content section with the request body as sent and the response, or a stream's output, for 7 or 30 days. Off by default, encrypted at rest, and readable only by owners and admins.
Read more →Read the team's own Directives with any management key, and change them with one created with the new Team Directives permission. Creating keys, rotating them and adding webhooks take an Idempotency-Key, so a retried call never makes a second one.
Read more →Cap what a feature or job can spend: tagBudgets gives a tag such as inference-bureau-search a daily and a monthly budget, on the team, a project, an environment or a key. Requests carrying the tag are held against it like any budget; untagged requests are unaffected.
Read more →The Directives table has an End users group for per-end-user rate limits, daily quotas, budgets and the end-user requirement, with a new limit on each end user's concurrent requests. A new end_user.budget_exhausted webhook tells you when an end user's budget refuses a request.
Read more →Create, rotate and revoke project keys, edit project, environment and key Directives, and add webhooks from Terraform, CI or your own platform, with a team management key. In the console, keys can now expire, be renamed and be rotated.
Read more →Name your own user on each request with the ib-user header or the user field (metadata.user_id on /v1/messages). Logs filter by it, usage export and receipts show it, the project Overview lists your top end users, and Directives can cap each end user on its own.
Read more →Send up to ten tags with the ib-tags header or ib.tags, such as search or summarize. Logs filter with tag = search, usage export and receipts carry them, and the project Overview shows spend by tag. Tags stay with Inference Bureau, so they add nothing to the cost of a request.
Read more →Open an environment or a key on the Directives page to give it its own budgets, rate limits, allowed models and providers, and data rules, in the same table as the team and project. A new Alerts group sets the budget percentages that send alerts and, for the team, the balance below which a low-balance alert is sent.
Read more →Each request now shows how long its first token took and how fast the answer came, for every call upstream. The project Overview and Dispatch show p50 and p95 time to first token and latency, and median output tokens per second, for each model and provider.
Read more →Point the OpenAI SDK's responses.create, or Codex, at Inference Bureau. Requests pass through natively with the same Directives, holds, failover, idempotency and receipts as chat completions, including streaming, function tools and structured output.
Read more →A request's page opens with its status and one sentence on what served it and what it cost. Each call upstream shows its tokens, finish reason, status and cost in one list, the charge reads like a bill on every request, and the model, key, session, latency and versions in effect sit in a panel beside them.
Read more →When a pull request removes or renames a section, block, setting id or alternate template, Auditor reads the store's published theme and says what merchants would lose: "12 products use product.bundle". Only Shopify theme repositories with a store chosen are checked.
Read more →Static analysis now runs Shopify's Theme Check on a theme repository, with its own .theme-check.yml, and posts offenses on the lines the pull request added. Other repositories are unchanged.
Read more →The sample session shows each turn on its own lines instead of narrow columns, code fits the screen without sideways scrolling, text is larger, and a menu in the header reaches the pages the phone layout used to hide.
Read more →Add notes to a guide's overview or to any section, block or group of theme settings, above what Auditor wrote, below it, or in place of its summary. Write them in the dashboard, or keep them in the repository under .ib/.
Read more →Turn on versions and a guide keeps how it read at the end of each day a run changed it. Links always open the latest; a date picker opens an earlier day, with what that day changed.
Read more →A link to a guide or one of its pages now previews with that page's name, what it is for and a picture of it, in the guide's colours and logo, instead of Inference Bureau's home page. A guide behind a password previews only its name.
Read more →When a theme's Liquid renders an image setting at a set width or height, the guide shows that size beside the setting, so merchants know what to upload.
Read more →Four new MCP tools, also in the Auditor CLI: preview_deploy, store_drift, template_assignments and page_screenshot.
Read more →Pictures are taken on the store's myshopify.com address, so a storefront domain that refuses automated browsers no longer leaves a guide without them. When a store still refuses, the guide says so instead of reporting the section missing.
Read more →One name for it in the console, in the API's refusal and in the docs.
Read more →Colour only when the output is a terminal, so piped output stays plain.
Read more →Agents read a theme's outline, section schemas, the merchant content that names a setting, and metafield definitions, before they rename or remove anything. Read-only, and nothing is billed.
Read more →Add a repository and change its settings with the API or the auditor CLI, without opening the console.
Read more →Vote on what comes next and suggest ideas. When the team plans an idea you suggested, your team gets $10 in credit.
Read more →Each colour scheme in a guide can carry its own logo, shown at the size you set.
Read more →The repositories table shows everything a repository cost, with a breakdown on hover.
Read more →One predictable price for each guide replaces paying for the model usage of every run.
Read more →A public guide written from a store's published theme: a page per section, preset and block, named as the theme editor names them and pictured at every width.
Read more →Guides behind a password open on a page of their own, in the style of the app's sign-in page.
Read more →The run drawer shows each step of a regeneration while it runs.
Read more →The white label add-on posts reviews from your team's own GitHub App, with your name and logo, and can hide review cost.
Read more →Each pull request deploys its theme to the store as a preview named after the branch, linked from the deployments box. @auditor preview deploys one without a review.
Read more →Step back through earlier months to see what each project spent.
Read more →Get an email or a signed webhook when spend passes a budget or a balance runs low.
Read more →Certified routes now serve embeddings as well as completions.
Read more →Page through usage with a cursor, filter it, and download it as CSV.
Read more →