Changelog

The search box in the top bar (or press /) now searches everything on the platform and groups what it finds by source: skills, hosted apps, publishers, topics, pages, blog posts and scan rules. Each group shows its top hits with the full count and a “View all” link, and a scope bar under the input narrows the list to one source — click a chip or press Tab. Skill rows carry stars, installs and the scan verdict; app rows carry the pricing label, model and visits; publisher rows carry skill count and reach, so results can be compared without opening each one.

Matching is typeahead: the word still being typed matches as a prefix, so form finds formatter. Type @name to jump to a publisher.

For integrations, the same data is available from GET /v1/search?q=… (skills, apps and publishers in one round trip, top hits plus a total per source), and the app directory endpoint GET /v1/apps/search gained a q substring filter and sort=popular.

Every run used to carry a fixed $0.001 (10-credit) per-job overhead inside its base, described as covering the queue, storage and ledger work a run does regardless of model. That figure was never a measured cost — the platform’s real marginal infrastructure per run is a small fraction of it — and on the cheapest models it was most of the price. It has been removed.

What a run costs now. A run’s base is the model provider’s list cost for the tokens it actually used, and nothing else. The platform takes 10% of that base; the app’s owner takes their markup — also a percentage of the same base — and keeps 100% of it. Both cuts are unchanged; only the base shrank.

Cheap runs get much cheaper. A Workers AI Gemma chat turn (1,500 in / 400 out) goes from 16 credits to 4 at the default 10% markup. A GPT-5 mini run of 3,000 / 1,000 tokens goes from 45 credits to 33. On premium models the difference is a rounding error: a gpt-5.6-terra run of 6,000 / 1,684 tokens goes from 496 credits to 484.

BYOK runs now bill the 1-credit minimum. The flat 10-credit BYOK charge existed only to recover the overhead. With the overhead gone, a run on the publisher’s own provider key bills 1 credit ($0.0001) — the smallest billable unit — with the platform fee and markup still disabled.

Creator earnings on cheap models are smaller in absolute terms, because the markup is a percentage of a smaller base — on that Gemma turn, $0.000027 instead of $0.000127. Sub-credit markup accrues in micro-dollars and flushes to your balance as whole credits, so nothing is lost to rounding. On any model where the tokens are the cost, earnings are essentially unchanged.

Batch runs (POST /v1/app-api/run-batch) previously charged the overhead once across the batch; every input now holds and settles identically.

API change: GET /v1/models still reports pricing.job_overhead_micros and pricing.byok_overhead_micros; both are now 0. POST /v1/app-api/estimate is unchanged in shape — base_micros now equals the provider list cost.

Free accounts now host 100 apps (was 5) and Pro hosts 2,000 (was 200). The 5-shared-skill cap on Free is gone — publish as many public skills as you like on any plan — and agents and snapshots are uncapped on every tier (a single snapshot is still bounded: 1 MB on Free, 10 MB on Pro). None of these were saving money: what they hold is bytes, and bytes are already governed by your one storage quota — 50 MB on Free, 10 GB on Pro, seats × 10 GB pooled on Team. Storage is the free tier’s real limit, and it is the only one you can outgrow. Details on the pricing page.

Credit top-ups and subscriptions now accept stablecoin alongside cards — USDC on Base, Ethereum, Solana, Polygon or Tempo, plus USDP and USDG for US payers. Pick it on the checkout page; nothing else changes. Credits stay priced in US dollars at the same face value ($1 = 10,000 credits, no purchase fee), we never hold a balance for you in any cryptocurrency, and a refund returns stablecoin to the wallet it came from.

Payouts go the other way too: request a redemption as USDC instead of PayPal, on Base, Ethereum, Polygon or Solana. Same dollar amount, sent 1:1, still no payout fee and still nothing deducted from your markup — which matters most if you publish from somewhere PayPal serves badly or not at all. You supply the network and wallet address, and because an on-chain transfer cannot be recalled the way an unclaimed PayPal payout bounces back, the address is validated on the way in and every payout still passes through manual review.

Details on the pricing page, or request a payout from your redeem page.

POST /v1/apps accepts skill_ids — an ordered list of owned skills composed into a single prompt under a preamble that states the app’s goal and frames each skill as a procedure serving it. An app is built for a goal and usually needs several skills, each recording how to do some of the steps; pasting SKILL.md files end to end makes an agent treat them as alternatives, and the preamble is what prevents that. A single skill_id is still snapshotted verbatim. Up to 8 skills, 64 KB composed. An app’s contributing skills each link back to it, so someone who finds the skill can also just run the app.

Apps can now run on a schedule with no server function and nothing open. POST /v1/apps/:slug/schedules with "kind": "agent" submits the app’s own prompt as a job on each tick — this is how “run my skill every morning” works. Timing is a 5-field cron expression evaluated in the schedule’s own timezone (so 9am survives DST), or a plain interval_minutes (15 min–7 days). The platform tick is every 15 minutes, so nothing fires more precisely than that. Output can be emailed to the publisher or POSTed to an https webhook; a failing delivery never disables a working schedule. Runs are billed to the owner at markup 0.

Apps have a third visibility, private: only the publisher can load the page, mint a session, or run it. Set it at create time with "visibility": "private" on POST /v1/apps, or switch later via PATCH. Unlike unlisted (undiscoverable but runnable by anyone who knows the slug), private is a real access boundary — enforced at the gateway, the preview host, guest-token minting, and every data route, and answered with 404 so a private slug is never confirmed to exist. Private apps force markup_bps to 0 (a markup to yourself is a no-op) and can’t be forked. This is now the default when an agent deploys on your behalf: your work is never made world-runnable as a side effect.

Hosted apps can now generate images. Two models join the catalog, configurable like any other (model on the app, or a per-run $model override):

• gpt-image (→ gpt-image-2, OpenAI) — the premium option, ~$0.005–0.21 per 1024×1024 image depending on what the run actually consumes.
• flux-klein (→ @cf/black-forest-labs/flux-2-klein-4b, Workers AI) — the cheap option at ~$0.0017 per image.

Each run produces one 1024×1024 image, returned as base64 in the job output (output.images[0]) on GET /v1/app-api/jobs/:id, the SSE done event, and the SDK. The app’s agent prompt and the run input are joined into a single text prompt.

Billing is per image, not per token. The hold reserves the worst-case cost of one image and settles down to actual — flux runs settle at a flat per-image rate; gpt-image settles on provider-reported usage. Same base, same 10% platform margin, same owner markup as text runs. Image runs are never truncated, don’t budget-scale, and don’t accept $files attachments (text-to-image only for now).

GET /v1/models marks both with "modality": "image" and a new image_rates object; the model catalog shows per-image pricing.

The maximum markup an app owner can set drops from 500% to 100% of a run’s base cost. At the ceiling a user now pays base + the platform’s 10% + your 100%, instead of base + 10% + 500%.

No existing app is affected. The highest markup in use across the directory is 25%, and the Settings-tab dropdown already stopped at 100% — nothing was rescaled, and no app had to be clamped.

API change: PATCH /v1/apps/:slug (and POST /v1/apps) now rejects a markup_bps above 10000 with a 400. GET /v1/models reports pricing.markup_bps_max: 10000.

Run pricing is now one base with two equal cuts. A run’s base is the model provider’s list cost for the tokens it actually used plus a $0.001 per-job overhead — sized so that 10% of the overhead alone is exactly one credit, the minimum billable unit, which stops either cut from rounding to nothing on a cheap model. The platform takes 10% of that base; the app’s owner takes their markup — also a percentage of the same base, defaulting to 10% — and keeps 100% of it. The 10% platform fee that used to come out of publisher earnings is gone.

What this replaces: compute was billed at a 1.2× multiplier, the owner’s markup was a percentage of that already-marked-up figure, and the platform then took 10% of the markup. On a representative gpt-5.6-terra run that meant the platform earned about twice what the creator did. Now the two are equal at the default markup.

What a run costs now. A representative gpt-5.6-terra run (6,000 in / 1,684 out) goes from $0.0532 to $0.0496, and the creator’s take goes from $0.004352 to $0.004126. Expensive runs get a little cheaper; very cheap runs get dearer, because the $0.001 overhead is now a bigger share of a small base — a Workers AI chat turn moves from 4 credits to 15 at a 0% markup, or 16 at the new 10% default. The /models/ catalog shows list price + 10% rather than list × 1.2.

Existing apps: your stored markup is now measured against a different number. Markup used to be a percentage of the marked-up billable amount and is now a percentage of the base. On the terra run above that is $0.004352 → $0.004126; on a cheap model it goes up, because the overhead is inside the base your markup is figured on. We did not silently rescale anyone’s rate, because “10%” now cleanly means 10% of a run’s base cost. Adjust it on the slider any time.

New apps start at a 10% markup instead of 0%, so a published app earns from its first run without anyone having to find the setting. Forks do the same.

Markup is now a slider on your app’s Settings tab, with a live preview of what each setting pays you per run — priced against your app’s own average run once it has traffic — plus a 30-day projection.

In-app purchases and app subscriptions have been removed. POST /v1/app-api/purchase, /subscribe, /entitlements, the subscription-cancel endpoint, the matching SDK methods (ss.purchase, ss.subscribe, ss.entitlements), and owner-declared plans are all gone. They were the only lanes that moved credits directly between wallets with no metered compute involved, which is exactly what made a card top-up convertible into redeemable earnings once the fee on earnings went to zero. Publisher earnings now arise only from usage markup, where an owner pays compute plus margin to receive markup — strictly lossy at every markup level, so there is no round trip to arbitrage. Free promotional credits still can never become cash.

API change: GET /v1/models renames pricing.cost_multiplier_bps to pricing.platform_margin_bps (now 1000), and pricing.job_overhead_micros is 100. POST /v1/app-api/estimate additionally returns base_micros, platform_micros, and markup_micros so a client never has to re-derive the split.

Storage is now one unified quota per account covering skill files, app files, app data records, and agent snapshots — Free accounts get 50 MB. Pro is back at $9/month for 10 GB; Team orgs pool 10 GB per seat — every member’s own storage draws on the shared org total, and each member’s limit is the whole pool — and every seat receives $10 of app credit monthly (31-day expiry, spent before your own balance). Hosted-app caps are now per-tier — 5 on Free, 50 on Pro, unlimited on Team and Enterprise — and apps can read the caller’s real quota meters via GET /v1/app-api/storage. Details on the pricing page.

Apps can now carry up to 3 curated tags from a predefined set (game, productivity, writing, dev-tools, and more), filterable in the directory, plus an official source-repo link (repo_url) shown on the detail page. Sharing got easier too: every app page has share buttons (X, LinkedIn, copy link) and publishers can set a per-app og:image so links unfurl with a proper social card.

The app-owner dashboard grew a real analytics story: visitor traffic (GET /v1/apps/:slug/traffic) with visit/visitor trends and referrer + country rollups — aggregate-only, no IPs stored — plus segmented daily active users (anonymous vs. registered) and run failures surfaced directly on the Overview. Owners can also author a custom panel tab (GET/PUT/DELETE /v1/apps/:slug/panel): a declarative card spec resolved against the app’s data collections, with no owner-supplied HTML or JS.

Apps can now opt in to forking with the allow_fork flag. A forkable app exposes its complete source — the pinned prompt snapshot plus every file in its latest release — via GET /v1/apps/:slug/source, and any verified account can clone it into their own account with POST /v1/apps/:slug/fork. Forks record forked_from lineage, start unlisted with markup reset to 0, and re-run the same security scan as a fresh upload. What never copies: pricing, BYOK provider keys, subscription plans, and secret values (secret names carry over as empty placeholders for the new owner to fill).

Bookmarks are now unified across skills and apps, backed by your account instead of the browser. Bookmark any public app from its detail page (POST /v1/apps/:slug/bookmark) and it shows up alongside your bookmarked skills on the dashboard, on every device you sign in from — app cards open the live app directly. GET /v1/apps/bookmarked lists them for API callers.

Custom-frontend apps can now sign users in without losing the page’s state: ss.loginPopup() opens the SkillSafe SSO dialog in a popup and posts the app token back to the page — an open document or half-filled form survives sign-in (the redirect ss.login() flow remains as the fallback). Apps also gained POST /v1/app-api/import-url, which fetches a .pptx from a link (Google Slides exports included) with a 25 MB cap and the same SSRF discipline as /extract.

The daily active-user grant is now $0.20 (2,000 credits), up from $0.10 — credited once per day on days you use the platform while signed in. The $0.30 signup grant and the 7-day expiry on free credits are unchanged.

A run whose worst-case hold exceeds your balance no longer fails with a 402. The hold now scales down to what your balance can cover — the run executes with a reduced output cap instead of not executing at all. Runs still settle at actual usage, so you only ever pay for tokens the model consumed.

Hosted apps can now run Claude Sonnet 5 and the GPT-5.6 family (Sol, Terra, and Luna) alongside the existing Claude, GPT, and Workers AI models. Pick a model per app, or let callers override it per run with the $model input. Rates, caps, and time limits for every model are on the model catalog.

Publishers can now attach their own Anthropic or OpenAI API key to an app. BYOK runs bill users a flat 1 credit per run — the publisher’s key pays for inference, and markup is disabled — making it a pure cost-recovery lane. Keys are write-only and managed from the per-app dashboard.

Run holds and their refunds are now folded into a single activity row showing the exact settled cost, instead of a confusing hold/refund pair. The billing page also gained app-subscription status cards and a source filter for the activity ledger.

Credits moved to a finer denomination — $1 now equals 10,000 credits (1 credit = $0.0001) — so cheap runs are billed exactly instead of rounding up to a whole cent. Existing balances were converted in place at no change in dollar value, and peer-to-peer transfers gained a 100-credit (one cent) minimum.

Every new verified account starts with a $0.30 signup credit, and signed-in accounts earn a $0.10 grant on each day they use the platform — enough to try any app without adding funds. Free grants expire after 7 days (purchased credits and earnings never expire), and the billing page now separates promotional credit from earned and purchased balance.

App creators can now sell subscription plans (recurring credit grants, renewed automatically) and one-off in-app purchases on top of per-run markup. Payments run on the platform’s credit system — no Stripe integration to write — with a 10% platform fee per sale; earnings mature 14 days and cash out at face value.