v3.2.0

What's Changed

• Apply application-level roles on snapshot routes by @cstns in #8865
• Document tool permissions on MCP tokens by @andypalmi in #8863
• [8710] Add expert to team overview homepage by @n-lark in #8795
• [8710] Add expert to team homepage - contents by @n-lark in #8834
• Log a dedicated audit entry when AI flow deploy is toggled by @cstns in #8862
• Add MCP tool to create a team database by @andypalmi in #8772
• [8710] Expert homepage - hide the tasks list by @n-lark in #8866
• [8867] MCP button disappears after a page refresh by @n-lark in #8868
• Stop the AI connector modal reappearing on login and wait for the tour by @cstns in #8799
• Keep accounts older than a week out of AI onboarding by @cstns in #8797
• Use application role on pipeline create and stage pages by @cstns in #8872
• Add an MCP tool to set the target snapshot of a remote instance by @andypalmi in #8811
• Reject path-breaking ids in MCP tool inputs by @andypalmi in #8843
• Let user tokens use the team shared library by @andypalmi in #8858
• chore: Remove redundant id checks from MCP delete tools by @andypalmi in #8875
• [8710] Expert homepage - typing in the composer starts a new chat by @andypalmi in #8873
• Render unknown stack properties by @hardillb in #8838
• Let application Owners create instances from the team pages by @cstns in #8874
• Return 400 for an invalid audit log cursor by @andypalmi in #8887
• Name the disabled feature in git and shared library 404s by @andypalmi in #8886
• Tell the Expert when the user is in a build conversation by @cstns in #8822
• Add a building surface variant for the Expert chat by @cstns in #8823
• Pull the full page Expert panel out of the onboarding page by @cstns in #8824
• Add a full page build conversation with the Expert by @cstns in #8825
• Add an expert kind to ff-button by @cstns in #8826
• Offer Build with the Expert next to the create actions by @cstns in #8827
• Track clicks on the Build and create buttons by @cstns in #8860
• Send Expert chat messages one at a time by @andypalmi in #8876
• Allow flow-building tools by default by @andypalmi in #8877
• Hold the Expert's next send until a stopped turn has ended by @andypalmi in #8888
• Validate git token updates and return 404 for unknown ids by @andypalmi in #8885
• Refuse to delete a git token that pipeline stages use by @andypalmi in #8881
• Ask for a schema when a table name exists in several schemas by @andypalmi in #8883
• Validate shared library entries on create by @andypalmi in #8884
• Audit log git token and shared library changes by @andypalmi in #8882
• fix: Use a valid flows body in the shared library overwrite audit test by @andypalmi in #8891
• Add MCP tools to create a shared library entry and rename a git token by @andypalmi in #8856
• Match shared library folders literally and reject an empty delete path by @andypalmi in #8878
• Return 400 for an invalid cursor on paginated lists by @andypalmi in #8890
• Send the pinned tab's capabilities and versions on MCP calls by @andypalmi in #8892
• Answer a failed editor action instead of resetting the Expert chat by @andypalmi in #8893
• Update introduction.md by @Esmewieringa in #8833
• build(deps): bump fast-copy from 4.0.3 to 4.1.2 by @dependabot[bot] in #8801
• build(deps): bump pino from 10.3.1 to 10.4.0 by @dependabot[bot] in #8782
• build(deps): bump postcss-selector-parser, postcss-modules-local-by-default and postcss-modules-scope by @dependabot[bot] in #8802
• build(deps): bump handlebars from 4.7.9 to 4.7.10 by @dependabot[bot] in #8894
• build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #8912
• build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot[bot] in #8911
• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #8910
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #8909
• Report a failed team database delete by @andypalmi in #8880
• Add MCP tools to delete database tables, team databases, shared library entries and git tokens by @andypalmi in #8857
• build(deps): bump google-auth-library from 11.1.0 to 11.2.0 by @dependabot[bot] in #8905
• build(deps): bump @aws-sdk/client-sesv2 from 3.1146.0 to 3.1149.0 by @dependabot[bot] in #8903
• build(deps): bump pino-pretty from 13.1.3 to 13.2.0 by @dependabot[bot] in #8897
• build(deps): bump marked from 18.0.10 to 18.1.1 by @dependabot[bot] in #8902
• build(deps-dev): bump mocha from 11.8.0 to 12.0.3 by @dependabot[bot] in #8786
• build(deps): bump nodemailer from 10.0.9 to 10.1.0 by @dependabot[bot] in #8896
• Keep the focused global search in its header slot by @andypalmi in #8918
• Track starting and suspending states for the team broker agent by @cstns in #8917
• fix: default a missing module version to any version by @andypalmi in #8927
• Reject pipeline stages that would break the stage chain by @cstns in #8913
• Return an empty description for device groups stored without one by @cstns in #8914
• Report the team broker agent's real status by @cstns in #8915
• Require a snapshot when rolling back an instance by @cstns in #8930
• Show streamed Expert tool calls, reasoning and progress messages by @andypalmi in #8895
• Report empty success replies from MCP tools as okay by @andypalmi in #8940
• Return the created table from the create table route by @cstns in #8937
• Apply date column defaults when creating a table by @cstns in #8934
• Only render the device editor drawer once the device has loaded by @cstns in #8929
• Send the user home when onboarding ends while they are on the onboarding page by @cstns in #8942
• Write an audit log entry when a pipeline stage is deleted by @cstns in #8920
• Write an audit log entry when a pipeline stage is updated by @cstns in #8924
• Log on the instance when it is put on or taken off a pipeline stage by @cstns in #8925
• Stop advertising generated and maxLength when creating a table by @cstns in #8936
• Decide AI onboarding per team in one place on the server by @cstns in #8941
• Return MCP tool results that have no response body by @andypalmi in #8947
• Stop the team broker suspend timer outliving the test app by @andypalmi in #8948
• Let the admin users search match a user hashid by @andypalmi in #8967
• build(deps): bump @fastify/helmet from 13.1.1 to 13.2.0 by @dependabot[bot] in #8974
• build(deps): bump google-auth-library from 11.2.0 to 11.3.1 by @dependabot[bot] in #8971
• build(deps): bump @aws-sdk/client-sesv2 from 3.1149.0 to 3.1152.0 by @dependabot[bot] in #8972
• Reject device target snapshots the device cannot deploy by @cstns in #8943
• Skip the redeploy when a device's target snapshot is unchanged by @cstns in #8944
• Restrict the MCP HTTP endpoint to token holders only by @cstns in #8960
• Ensure all TeamBroker clients have an ACL by @hardillb in #8952
• Point the env update tool at the read that returns env vars by @cstns in #8950
• Show the target node for nr-assistant.inject audit entries by @Steve-Mcl in #8980
• Attribute nr-assistant.inject audit events to agent actions by @Steve-Mcl in #8981
• Rename AI Flow Deploy to AI Flow Deploy and Inject by @Steve-Mcl in #8979
• Roll back a failed FF Tables database create and surface the error by @andypalmi in #8986
• Refuse MCP tokens on the REST API outside the MCP door by @andypalmi in #8985
• [8982] @vue/server-renderer: XSS via missing CR in attribute-name blacklist by @n-lark in #8983
• Show old and new values for pipeline stage edits in the audit log by @cstns in #8949
• Update neostandard to include .vue + .ts files by @n-lark in #8993
• [8990] Upgrade @babel/core + @babel/preset-env to 8.0.6 together by @n-lark in #8991
• Ensure provisioned LDAP users are assigned roles on first login by @hardillb in #8988
• Add fixes for linter issues uncovered by dependabot upgrade of neostandard by @n-lark in #8994
• Keep the instance delete dialog open until the delete completes by @cstns in #8992
• build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #8976
• Treat a session that hasn't finished logging in as anonymous on public routes by @cstns in #8964
• Fix linter error for new cap rule from eslint upgrade by @n-lark in #8998
• build(deps-dev): bump eslint from 9.39.4 to 10.13.0 by @dependabot[bot] in #8785
• build(deps-dev): bump eslint-plugin-cypress from 6.4.4 to 7.0.2 by @dependabot[bot] in #8779
• build(deps): bump posthog-node from 5.52.1 to 5.56.2 by @dependabot[bot] in #8969
• build(deps): bump launch-editor from 2.14.1 to 2.14.2 by @dependabot[bot] in #9002
• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 by @dependabot[bot] in #9003
• build(deps): bump fastify-metrics from 13.2.1 to 14.1.1 by @dependabot[bot] in #8970
• build(deps): bump @fastify/swagger from 9.8.1 to 9.9.2 by @dependabot[bot] in #8907
• Resume broker schema collection when the monitor toggle is switched back on by @cstns in #8997
• Let Expert users rate an answer and share the conversation by @andypalmi in #8987
• Stop the broker schema monitor spinning on "starting" when the agent is unreachable by @cstns in #9001
• Escape user-controlled values in notification messages by @cstns in #8984
• Use the standard session validation on the OAuth authorize and complete routes by @cstns in #8965
• fix(api): require a non-empty name when creating a personal access token by @andypalmi in #9014
• Rework oauth consent flows by @knolleary in #9015
• Release 3.2.0 by @hardillb in #9021

Full Changelog: v3.1.1...v3.2.0