v0.122.10

Highlights

• Clearer run failures. When an agent run fails in the playground, the failure now reads like an agent answer. The full server message is shown, and the ways to recover (add a key, buy credits, change the plan) stay next to the run.
• Fewer stuck question forms. A question form with a bad schema no longer leaves a stuck card in the composer. The agent's lead-in text no longer shows as the answer while the run waits for you.
• No false "add your key" prompt. Workspaces that run on credits no longer see the add-key strip, and the strip no longer flashes on reload.
• New link preview card. Links to the website, the docs and the app now show the same preview image.
• Sign-in rate limit. The API now limits sign-in code and sign-up requests per client IP. Behind a proxy or load balancer, set AGENTA_ACCESS_TRUSTED_PROXY_HOPS to the number of proxies in front of the API, so the API reads the real client IP. AGENTA_ACCESS_TRUST_CLOUDFLARE_IP is off by default. AGENTA_AUTH_CODE_RATE_LIMIT_ENABLED turns the limit off.
• Sign-up blocklist cache. AGENTA_ACCESS_BLOCKLIST_CACHE_TTL sets how long the API keeps the blocked-domains list. The default is 60 seconds.
• Abuse checks for free credits (Enterprise). The Enterprise edition can check new sign-ups and new API keys for credit farming with TypeSafe Jev. It runs only when TYPESAFE_API_KEY is set, and it allows the request when the check service does not answer. When the work-domain sign-up cap refuses a free grant, the wallet floor is raised so the account can't spend free credits.
• Branded emails held back. The branded sign-in, invitation and password reset emails (#7668) were reverted before this release (#7720). Sign-in codes are still sent by SuperTokens, as in v0.122.9.

What's Changed

• [fix] Hide unrenderable question forms and keep lead-in text in the fold by @ashrafchowdury in #7625
• [fix] Hide the add-key strip while loading or when credits fund runs by @ashrafchowdury in #7699
• [feat] Show run failures as an agent message with in-place recovery by @ashrafchowdury in #7684
• [feat] Use the workspace card for website, docs and app link previews by @ashrafchowdury in #7685
• fix(api): make the sign-up blocklist flag cache configurable, default 60s by @mmabrouk in #7706
• [feat] Check signups and API key creation for credit farming with Jev by @mmabrouk in #7707
• [fix] Rate-limit sign-in code and sign-up requests per IP in the API by @mmabrouk in #7710
• fix(api): raise the wallet floor when the work-domain signup cap refuses by @mmabrouk in #7709
• fix(api): read the fraud check policy and thresholds from the flag payload by @mmabrouk in #7714
• [feat] Brand the sign-in, invitation and password reset emails by @ashrafchowdury in #7668 (reverted by #7720, not in this release)
• [revert] Keep sign-in code emails on SuperTokens for v0.122.10 (reverts #7668) by @mmabrouk in #7720

Full Changelog: v0.122.9...v0.122.10