Skip to main content

Release 0.5.53 — Configurable Session Lifetime and Deprecated-Agent Recovery

Sri Aradhyula
Sri Aradhyula
Erik Lutz
Erik Lutz
Shubham Bakshi
Shubham Bakshi

Released: 2026-07-15 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.53 Previous release: 0.5.52

Highlights​

0.5.53 extends default SSO session lifetimes so users are no longer signed out after eight hours of inactivity, and improves the experience when an agent has been deprecated — users can now pick a replacement or pick up a conversation where they left off without losing context.

New Features​

Longer default session lifetime​

The default Keycloak SSO session lifetime increases from 8 hours idle / 24 hours maximum to 7 days idle / 14 days maximum. Users who authenticate via an external identity provider (such as Duo SSO) are no longer forced to sign in again each day as long as they stay active within the window.

The idle timeout resets on each page visit, so a working user will not be interrupted. Operators can tune the values to match their organization's policy without modifying the chart — see the upgrade guide below.

Deprecated-agent recovery​

When a conversation is linked to an agent that has since been deprecated, the UI now shows the full conversation history and offers two clear recovery paths:

  • Choose agent — opens the agent selector so the user can link the conversation to a different agent and continue.
  • Resume with default agent — re-links to the platform default in one click.

Previously, deprecated-agent conversations showed a partial view with no clear way forward.

Bug Fixes​

  • Session recovery: Clearing a stale auth flag on successful token recovery prevents a stale error state from appearing after silent refresh completes.

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.52.

Upgrade Guide: 0.5.52 → 0.5.53​

Helm Values Changes​

No Helm values changes between 0.5.52 and 0.5.53.

Session lifetime behavior​

The updated SSO defaults take effect the next time keycloak-init runs (on pod start for Helm deployments, or docker compose run --rm keycloak-init for Compose). Existing realms that were already initialized retain their previous values until init-idp is re-applied.

To customize the limits without changing the chart, set any of these in your values.yaml under the keycloak subchart env block, or in .env for Compose:

VariableDefaultDescription
KEYCLOAK_SSO_SESSION_IDLE_TIMEOUT604800 (7 d)Idle timeout in seconds
KEYCLOAK_SSO_SESSION_MAX_LIFESPAN1209600 (14 d)Absolute max session length in seconds
KEYCLOAK_ACCESS_TOKEN_LIFESPAN3600 (1 h)Access-token TTL in seconds

Upgrade Runbook​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.53 \
  -f your-values.yaml