Skip to content

v0.0.13

Choose a tag to compare

View all tags
@AndrewGrachov AndrewGrachov released this 30 Oct 10:10
· 73 commits to main since this release
v0.0.13
3741db5

Highlights

  • Managed connections. Integrations now work through principal/grant connections, with personal defaults and execution bindings (BEL-59). A shared outbound OAuth lifecycle backs them (BEL-138), and runners fetch credentials from a lease-authenticated broker (BEL-60).
  • Jira Cloud OAuth replaces the Jira proxy (BEL-61). Members connect Jira through an Atlassian 3LO app; API-token connections end.
  • Runner permissions. The claude runner is pinned to auto mode on fresh and resumed sessions (#1107). The git guard is gone: every git and gh operation is allowed in the task checkout (#1109).
  • Env secrets. Writes are encrypted, with a one-shot conversion of existing plaintext (BEL-149).
  • Commerce groundwork (BEL-146): plan push and execution-usage reporting, off by default.

Fixes

  • k8s driver: a leftover pod stuck Terminating hands the claim back as blocked instead of expiring the lease (BEL-160).
  • Job store lock order: the claim try-locks the thread lock, retry never row-locks a live row, and thread writers lock the root row first (BEL-157, BEL-81, BEL-161).
  • Commerce store: enqueue stamps next_attempt_at with the store's clock (BEL-163).
  • Integrations: one clock for the authorization deadline and the claim lease; opencode image checks; a secrets fault flake (BEL-164, BEL-166, BEL-170).
  • Gates skill: drops the stale curl requirement (BEL-122).

Upgrade notes

  • Migrations 094–101 apply on boot (integration connections, commerce, grant lineage, integration authorization, Jira OAuth, operation receipts, legacy Jira tokens, finalized grant claim).
  • Jira API-token connections are disconnected and their tokens are scrubbed (migration 100). A queued thread bound to one waits on a Jira requirement until its member connects Jira through OAuth and binds it. Before upgrading:
    1. Set integrations.jira.clientId and secret.atlassianClientSecret (ATLASSIAN_CLIENT_ID / ATLASSIAN_CLIENT_SECRET).
    2. Add the board's callback URL to the Atlassian app.
    3. Ask Jira users to reconnect after the upgrade.
  • New chart values: integrations.jira.clientId, secret.atlassianClientSecret, dashboard.commerce.{enabled,url}, secret.commerceToken (commerce stays off unless enabled).
  • Run secrets:convert-env once after the deploy to encrypt existing plaintext env values (BEL-149).
  • Bump the executor image tags (claudeCode, opencode) together with the board and driver tags.

Validation

  • CI is green on the release commit. v0.0.13-rc and v0.0.13-rc-2 published, and the stage board runs rc-2.
  • Stage smoke task on the claude-code runner: auto mode active; a Jira read through the OAuth broker; git fetch, git switch, gh pr list.

Known limits

  • A repository's own .claude/settings.json deny rules still apply in the runner and win over auto mode (for example, a repo denying git rebase*).
  • The driver and dashboard can land on spot nodes; a spot reclaim drains the driver and costs the running tasks a lease takeover (recovered, not lost).
Assets 2
Loading