Core Platform Release Notes

August, 2026

New Features

• New source connector: Adobe Commerce (Magento): Deterministic catalog extraction directly from a customer's Adobe Commerce (Magento) store — taxonomy, typed attribute glossary, and products — with no hand-authored spreadsheets. Products, categories, and attributes are read from the Adobe REST API and rebuilt as catalog_v2 for the agent, driven end-to-end through a self-serve workflow with a dry-run preview and human-approval gate.

• .7z archive ingestion: .7z archives now expand and ingest end-to-end from SharePoint, Box, Google Drive, and URL/list sources — on par with existing .zip and .tar support.

• Per-hub policy for unattended Forge Agent runs: A hub can now set what Forge Agent is allowed to do when it runs unattended — the permissions it holds, the commands it may run, and the outbound domains it may reach — so those limits can be widened or tightened for one hub without changing the defaults everywhere else.

Improvements

• Resilient ingestion for IP-blocked sites: Web ingestion now automatically falls back through a proxy service when the origin site refuses the request because it is rate-limiting or blocking our traffic. Sources that had gone dark behind an origin block are ingesting reliably again.

• Streaming downloads and bounded local staging for large sources: Google Drive, Box, and large-sitemap ingestions now stream file downloads to disk with a bounded local staging budget. This ends out-of-memory failures on multi-GB documents and keeps long transfers from timing out.

• Per-hub rate-limit ceiling: Agent traffic is now rate-limited per visitor and per hub, on top of existing network-level protection. Each hub gets a predictable capacity floor and is insulated from a burst on a neighbouring hub.

• Fetch-fallback rescues blocked sitemap ingestions: Sitemap crawls that were being refused at the TLS/edge-network layer (some CDN-fronted publisher sites) now fall through to the browser-emulating fallback fetcher automatically, restoring ingestion for sources that had been silently failing every run.

• More reliable PDF extraction on large datasheet corpora: Batch of extractor hardening — better handling of figure captions with nested brackets, orphaned figures, transient VLM retries, invalid-bounding-box crops, and per-PDF cache cleanup — improves the reliability and completeness of PDF extraction, especially on large datasheet ingestions.

Bug Fixes

• Source statistics are available again: Fixed an issue where source statistics failed to load, because the request was being rejected before it reached the service. Statistics now load reliably in the dashboard and through the Rapidflare MCP server.

• Trustworthy ingested-document counts: Source listings and detail views now report accurate document counts, and a count that could not be determined is shown as unknown rather than as zero — so an empty source is no longer indistinguishable from a failed lookup.

• PDF ingestion from Google Drive sources recovered: Fixed an issue where PDFs were silently dropped from Google Drive sources while other file types ingested normally — so a run reported partial success, but the PDFs were simply missing. PDFs from Google Drive now ingest and extract reliably again.

• Similarity search returns results again: Fixed an issue where similarity search returned nothing for every query, because the default similarity threshold was set unrealistically high. The default is now sensible, the threshold and result limit are configurable, and a search with no matches is clearly distinguished from a knowledge base with no content.

• Catalog product counts and attribute renames are correct on large catalogs: Fixed an issue where any catalog larger than 1,000 products was only ever read up to that first 1,000 — so product counts were reported far lower than the real total, and renaming an attribute quietly applied to part of the catalog and left the rest unchanged. Large catalogs are now read in full, and read much faster: a 121,000-product catalog now loads in under 10 seconds, down from over three minutes.

• Catalog v2 pages load on newly-onboarded hubs: Fixed an issue where the vendors, relation types, and catalog relations pages showed an error on a hub whose catalog had not been set up yet, after a long delay. These pages now show an empty state straight away.

• Catalog v2 admin taxonomies load reliably: Fixed an issue where Catalog v2 admin taxonomies were not loading for some hubs, because the list was sorted on a field those catalogs do not have. The list is now sorted by slug, which every catalog has.

• Agents stay up through brief upstream slowdowns: Fixed an issue where a busy hub re-read the same source information many times a second, so a momentary slowdown upstream turned into a burst of errors for people talking to the agent. That information is now held briefly between reads, and a slow read is retried once. Behaviour note: enabling or disabling a source now takes up to 60 seconds to take effect in the agent.

• Bot protection no longer blocks legitimate visitors: Fixed an issue where an unfamiliar response from the bot-protection service failed the visitor's request outright instead of being ignored. Unrecognised responses are now logged and treated as harmless.

July, 2026

New Features

• Box is a self-serve knowledge source: Customers can now connect Box as a knowledge source — root folders, shared links, and recursive folder crawls — via OAuth. Available from the Add Source dialog.

Improvements

• Embedded widget configuration hardening: A small round of hardening on the embedded widget's configuration surface — the widget now validates the origin of incoming configuration postMessage events before applying them, the API-key domain allowlist match is now case-insensitive, and the theme API strictly validates its payload rather than accepting empty values. No customer action required.

Bug Fixes

• Sitemap ingestion recovery for browser-restricted sources: When a sitemap URL returns an empty response (typically because the origin filters non-browser user agents), ingestion now transparently falls back to the browser-emulating fetcher and continues successfully. Previously such sources failed with an XML parse error.

• RAPID catalog ingestion unblocked for legitimate overlapping term values: Fixed a duplicate-term detection issue that was blocking RAPID customers whose catalog sheets had legitimately overlapping values across term type and family.

June, 2026

New Features

• VLM-based PDF extraction backend: PDF extraction can now be configured per source to route through a Vision Language Model (VLM) backend, in addition to the existing OCR and document-understanding backends. Useful for visually rich datasheets and diagram-heavy PDFs where layout fidelity matters. Selectable via the source's PDF provider configuration with either rendered-page or single-page-PDF input modes.

• Migration tooling for legacy catalog and glossary sources: A new CLI command walks operators end-to-end through migrating a legacy Catalog + Glossary source pair into the new unified RAPID_CATALOG model — building the migration plan, creating the new source, triggering ingestion, and retiring the old pair on approval. Unblocks customer-side migration off the legacy schema.

• Archive uploads as an ingestion source: Customers can now upload archive files — ZIP, TAR, TAR.GZ / TGZ, TAR.BZ2, TAR.XZ, GZ, BZ2 — and every extractable member (PDF, HTML, Word, images embedded in HTML, and more) flows through the normal extraction, chunking, and indexing pipeline. Large PDF members are automatically routed through the large-PDF pipeline. Guarded against path-traversal and configurable member-count and total-uncompressed-size caps.

Improvements

• Clearer staging progress and structured logs during long ingestions: Improvements to how workflow progress is propagated and how batch logs are emitted during long-running ingestions — the staging UI shows in-flight progress more clearly and batch logs are easier to scan and grep.

• Catalog and glossary sheet matching is now case-insensitive: Catalog and glossary spreadsheets no longer fail ingestion-time validation just because the sheet tab name doesn't match the exact case the platform expects (for example, Catalog vs catalog). Eliminates spurious "sheet missing" errors.

• Legacy embed widget retired: The older iframe-based embed widget (agent.js) has been formally deprecated in favor of the unified Embed SDK, which is now the single canonical embed surface. A long-standing CSP-violation footgun from the legacy inline-script injection path is gone with it. Customers already on the Embed SDK are unaffected.

• Embed SDK now runs inside Salesforce Lightning Web Security: Some embedding hosts — notably Salesforce LWS — throw when JavaScript reads document.fullscreenEnabled / document.pictureInPictureEnabled (a typeof guard is not enough), which was crashing the embedded widget on mount. The reads are now defensively guarded so fullscreen and picture-in-picture degrade gracefully on any restrictive-CSP or sandboxed host. Normal hosts are unaffected.

• Embed SDK survives strict consent managers and storage-blocking hosts: When a host page blocks all browser storage (for example, OneTrust "Decline all", or Chrome's per-site "Not allowed to save data" setting), reading sessionStorage or cookies throws a SecurityError — which was crashing the embed SDK entirely on load. The SDK now wraps those accesses and falls back to in-memory defaults, so the widget mounts and operates correctly with all storage blocked, with no impact on the host page.

• doNotTrack opt-out on the Embed SDK: The Embed SDK config now accepts a doNotTrack: true flag. When set, product analytics and per-visitor fingerprinting are not initialized for that session — useful for hosts that want to honor user consent without dropping the embedded widget entirely. Default behavior (analytics enabled) is unchanged. See the Web deployment guide for details.

• Large-archive ingestion robustness: Archives with over a thousand extractable members now ingest end-to-end without dropping members. Three cascading failure modes have been fixed: activity-payload overflow when returning a large child-document list, workflow-history overflow when dispatching hundreds of children, and a fail-fast behavior that could silently drop the remaining members if one member was corrupt. Archive ingestion is now best-effort: a single bad member is recorded as failed but never aborts the rest.

• Base64-embedded images in HTML content are now described: HTML documents with inline data: URI images (common in exported wikis and documentation dumps) are now decoded and passed to the image description pipeline instead of being skipped as "unsupported URL scheme".

Bug Fixes

• Conversation history privacy hardening: Closed a latent path on the new conversations-search endpoint where a non-admin caller filtering by user IDs could see conversations belonging to other users in the same organization. The conversation-counts endpoint is now also locked to admin-only callers.

• Rapid Catalog ingestion handles multi-family product rows: Catalog ingestion no longer fails validation on products whose family or type column carries a comma-separated list of values — the validator now correctly splits multi-value cells before checking them against the glossary.

• Excel "NA" catalog values preserved: Excel-based catalog and glossary ingestion no longer treats the literal string "NA" as an empty cell. Row indices in validation error messages also now match the row numbers shown in the spreadsheet.

May, 2026

New Features

• Per-domain publishable API keys for embedded widgets: Each whitelabel domain configured for an embedded widget can now carry its own publishable API key, enabling per-domain auth scope and independent key rotation without changing the hub-level key.

Improvements

• Large-source ingestion reliability: Hardened ingestion workflows recover automatically from network issues and other stalls. This helps progress more reliably through ingestions that process hundreds to thousands of documents. Cancellation is reliable end-to-end (no more stuck CANCELLING), accidental duplicate re-ingestion attempts are blocked.

• Cloud Run reliability under heavy ingestion load: Follow-on stability work after a very large customer ingestion exposed remaining failure modes — stage-progress logs are now bounded, large image fetches release on-disk copies as they go (Cloud Run's writable filesystem is in-memory), system monitoring is cgroup-aware so high-RSS workers are visible before the OOM kill, and all worker and API services now run with application-container liveness probes. Wedged workers auto-recycle instead of staying "alive" indefinitely.

• Embedded widget reliability on multi-key host pages: Customer pages that ship their own reCAPTCHA Enterprise key alongside ours no longer hit a silent 401 race when our key resolves first. Token minting is now key-scoped with per-key retry, shadow-DOM-aware deduplication, and badge isolation — so the embedded widget is reliable across pages that mix multiple reCAPTCHA Enterprise tenants.

• Auth refresh hardening: Closed several long-tail session bugs — expired JWTs no longer block a refresh, super-admin context is preserved across token rotation, and browser-native preflight requests (without an Authorization header) now fall back cleanly to the session cookie. Net result: fewer stranded sessions, no more refresh loops on unknown customer slugs.

• Higher-fidelity product analytics: Auto-tracked SDK events (page opens, dead clicks) on the embedded agent now carry the same custom-property metadata (customer slug, hub ID, conversation ID) that hand-rolled events carry. Closes a multi-week gap where dashboards under-counted conversations vs. our own analytics.

Improvements

• Security hardening: A round of penetration-testing discovered no major issues. Low priority findings were remediated across the dashboard and API surfaces:

  • Strict nonce-based Content Security Policy now replaces permissive defaults across page and API responses, materially reducing XSS attack surface.

• Large-source ingestion stability: Several reliability improvements for very large sitemaps and PDF-heavy crawls:

  • Indexing progress rows are now bounded, preventing workflow progress tracking bloat on multi-thousand-document crawls.
  • Sitemaps that begin with a UTF-8 BOM but lack an explicit charset header are now parsed correctly (previously caused a hard ingestion failure).

• Ingestion cleanup on cancellation: Cancelling or timing out an ingestion now reliably tears down orphaned workflow state and clears the source's running-workflows record, so admins can re-trigger ingestion on a previously-cancelled source directly from the dashboard without manual cleanup.

• Embedded widget authentication resilience: The widget's reCAPTCHA token minting path is now hardened with a two-attempt retry, a settled-state guard, and linear backoff — addressing a rare silent-failure mode that surfaced as a "No reCAPTCHA token" error on certain whitelabel pages.

Bug Fixes

• Hub-config key-cache hardening: Closed a privilege-escalation footgun on the embedded-widget hub-config endpoint where a caller-supplied API key could be substituted into the cached hub record, plus an accidental raw-key-in-CI-logs leak on the same path.

• doc, docx and pptx ingestion reliability restored: Resolved a production regression where Word and PowerPoint extraction failed with a missing-package error because the ingestion worker image was overwriting upstream extraction packages during build. Office-document sources extract cleanly again.

April, 2026

New Features

• New connector: Khoros Community: Khoros Community forums are now a supported ingestion source, enabling community knowledge bases to flow into the platform.

• Partial re-ingestion: Retry specific failed documents without a full source re-crawl, supported across major connectors.

• Scheduled ingestions live (end-to-end): Recurring source ingestion is now fully operational, with overlap protection and throttling safeguards to prevent duplicate or runaway runs.

• Public evaluation API: New non-streaming hub agent endpoint for programmatic evaluation workflows.

• Jira OAuth in production: Jira Cloud and Data Center ingestion now authenticates via centralized OAuth (Cloud) and PAT (Data Center) replacing manual static credential handling.

Improvements

• Stronger tenant isolation: Cross-domain email authorization hardened with explicit logging for unauthorized cross-tenant access attempts.

• Embed reCAPTCHA scoping: Badge visibility is now tied to the active hub's reCAPTCHA key, preventing interference with other reCAPTCHA instances on customer pages.

• Web crawler performance boost: Shared browser context caching for headless crawls reduces repeated asset downloads by ~80% on subsequent page loads, plus explicit HTTP 307 redirect handling fixes previously missed content.

• Extraction cache is code-change aware: Cache keys now include the extraction recipe version, so logic changes auto-invalidate stale output.

Bug Fixes

• Textract extraction quality fix: Figure bounding boxes now expand to include intersecting caption text, fixing clipped images and captions in datasheet-style documents.