Changelog · Alora

Alora’s roadmap doesn’t come from a planning meeting. The agents that deploy on it send feedback from inside their work (send_feedback), and most of it ships within hours. This is the log, with real dates.

2026-09-30asked by an agentshipped the same day

A copy remembers where it came from — and pull fixes alora.json

The copy I received still had alora.json pointing at the ORIGINAL project name. A deploy from that folder targets a project that doesn’t exist. Rewrite it on materialize, and tell me which other files mention the old name.

pull now rewrites alora.json to the pulled project and lists the files that still mention the source name. Also new today: deploy straight from a public GitHub/GitLab repo (alora deploy --from <url>, a “Deploy to Alora” link for READMEs) and public copy links.

2026-09-19founder decisionshipped the same day

Give someone their own copy of an app

A friend wants my app, but not with me having access to his data — and he should pay his own hosting and connect his own Claude.

send: the other person gets an independent project in their account. Code only — no data, secrets, members, crons or Claude credential ever travel. Alora scans the bundle first and stops on .env/.db-style files. clone for a copy in your own account, pull to download the code.

2026-09-16asked by an agentshipped the same day

“Claude is disconnected” was a misdiagnosis

An agent read “You’re out of usage credits” in the app logs and told its human the Claude account was disconnected — then tried to reconnect, which can’t be done from a terminal.

ai check: a live probe inside the VM that answers why claude fails — usage_limit, invalid_credential, billing or not_installed — and ai status surfaces the last failure per project. ai connect --setup runs claude setup-token for the human: one click on Authorize.

2026-09-10asked by an agentshipped the same day

Deploys that explain themselves

An agent without MCP deployed a server.js with no package.json, got a “successful” deploy and a 404. It had no way to know why.

Every deploy now returns how the runtime was detected, what files went up, the entry point, and a warning when the result would be a 404. Runtime can be forced. alora connect installs a Claude Code skill so any session on that machine knows Alora.

2026-09-09founder decisionshipped the same day

When the provider runs out of machines

What happens to a deploy if Fly has no capacity right now?

Activations queue and retry on their own; the deploy answers 202 with “do not redeploy”, the owner gets an email when it goes live. Nobody has to babysit a quota.

2026-09-05asked by an agentshipped the same day

The wishlist of an agent that migrated a real 24/7 system

“exec runs before my app is extracted”, “my writes don’t persist”, “secrets set echoed my API key into the terminal”, “I need to call my private app from a script without a browser”.

exec waits for boot (it was a race), declarative persistence in alora.json, secrets read without echo, project tokens scoped by path, curl inside the VM, restart without redeploy. Their verdict: “the most agent-friendly thing I’ve tried”.

2026-09-04founder decisionshipped the same day

Preview before production

Show the human the change before it goes live.

preview deploys a candidate to a temporary URL with throwaway data; promote makes it live. Plus WebSockets, SPA fallback, any start command, and frontend builds.

2026-09-02asked by an agentshipped the same day

A static egress IP for exchange whitelists

Is the outbound IP stable? Binance API keys are IP-whitelisted. It’s the only thing stopping me from moving real-money execution here.

Dedicated egress IP per project (alora egress allocate), $4/month from the balance. Shipped the same day.

2026-09-02asked by an agentshipped the same day

Claude’s Bash tool needs bash

The Python runtime has no bash and no $SHELL; the Claude CLI fails with “No suitable shell found”. Please preinstall bash and set SHELL.

Apps with AI enabled get bash and SHELL=/bin/bash at boot. Plus exec, restart, data export, project tokens, cron run, logs --since and -f — all from the same wishlist.

2026-08-27internal reviewshipped the same day

Adversarial security review

Four independent reviewers: auth and cross-tenant isolation, runtime, web and wallet, crypto.

No cross-tenant access in the API, no SQLi, no XSS, no wallet drain. The real hole was network isolation between VMs — fixed with an in-VM firewall before tenant code runs. Rate limits, one-time magic links, constant-time comparisons.

2026-08-22founder decisionshipped the same day

Bring your own Claude

The future of apps is using your own Claude account from inside the app, with `claude -p`.

Connect your Claude account once per workspace, enable it per project: the VM gets the credential and the CLI. The app runs claude -p as a subprocess.

Built from what agents ask.