v0.2.70

v0.2.70 — Data-protection hardening, self-hosted docs, provider passthrough

This release lands a 14-phase data-protection and retention hardening cornerstone (legal hold, audit-chain checkpoints, RAG bearer auth + SSRF guards, GDPR Art. 17 erasure end-to-end, per-category retention floors), replaces Mintlify-hosted docs with a self-hosted tale-docs service that shares chrome and i18n with the marketing site, and adds providerOptions passthrough so OpenRouter quantization, OpenAI service_tier, Together safety_model, and similar provider features can be configured without code changes.

🔒 Security

• Data-protection & retention hardening (14 phases) — opt-in RAG bearer auth (RAG_AUTH_TOKEN), 169.254.0.0/16 + 0.0.0.0/8 + fc00::/7 CIDR blocklist + cloud-metadata hostname blocklist on RAG_URL (with redirect: 'manual' to block IMDS pivots), audit-log HMAC-SHA256 chain with checkpoint rows, env-tunable per-category retention floors (audit min hardcoded at 365d), legal hold with maker-checker release flow, cascade-correct thread deletion, RLS gap fix for trashed/expired threads (#1676)
• Provider host policy + developer-settings gate — IMDS hard-block + RFC1918 opt-in (TALE_ALLOW_PRIVATE_PROVIDER_HOSTS) on provider base URLs, developerSettings ability gate on all provider mutations/probes, secrets-first delete order, audit logging on provider changes (#1694)
• Quantization variant validation — agent JSON @quant suffixes validated against declared quantizations; bogus variants rejected with UNKNOWN_MODEL_VARIANT (#1697)

🤖 Model & Provider

• providerOptions passthrough — provider- and model-level JSON forwarded verbatim into LLM request bodies (OpenRouter quantization/routing, OpenAI service_tier, Together safety_model); Zod deny-list blocks body-overwrite keys (model, messages, max_tokens, …) (#1694)
• Quantization variants as first-class selectable models — each quantizations entry shows up as its own pickable model (e.g. GLM 5.1 FP8 vs GLM 5.1 FP4) in chat, arena, and agent editors; encoded as provider:base@quant end-to-end (#1697)
• Catalog refresh — GLM 5.1 / 5-turbo / 5v-turbo, Kimi K2.6, Qwen 3.6 max-preview/plus/flash/35b-a3b, Gemma 4 31b-it / 26b-a4b-it added to OpenRouter (#1694)
• OpenRouter model list, prices, and pricing adjustments refreshed (multiple chore commits)
• nvidia/nemotron-3-super repointed to the live OpenRouter id nvidia/nemotron-3-super-120b-a12b; pricing aligned with the live API

🚀 Features

• GDPR Art. 17 admin UI — self-serve data-subject-requests page under Settings > Governance, structured reasonCode capture, single-grant Art. 12(3) extension (1–60 days), SLA countdown badge, audit timeline, inline legal-hold block panel (#1696)
• Self-hosted docs service — Mintlify Cloud replaced by services/docs/ (TanStack Start), shared @tale/webui chrome with the marketing site, Mintlify-compatible MDX components, ⌘K search, per-page .md endpoints, /llms.txt + /llms-full.txt, AI page-actions menu (Open in ChatGPT/Claude/Cursor) (#1680)
• Server-side locale detection + cross-subdomain cookie redirect — first-time de/fr browsers get 302'd to /de / /fr and a tale_locale cookie is set; cookie domain configurable via LOCALE_COOKIE_DOMAIN so tale.dev and docs.tale.dev share the preference (#1690)
• Legal pages moved to marketing site with PDF downloads — privacy-policy, terms-of-service, DPA, personalization now at /legal/<slug> with a Playwright-generated dist/<slug>.pdf per locale (#1679)
• Pricing-page user-count slider — 25–1000 with manual override; per-user breakdown on the Enterprise card (#1677)
• Standalone tale-web / tale-docs container publishing — both sites get independent compose stacks and ship to ghcr.io/tale-project/tale/tale-{web,docs} on tagged releases; Discord webhook replaces Microsoft Teams for marketing form submissions (#1683)

⚡ Performance

• Docs cold-load cut ~60% — mermaid-vendor (719 KB gzipped) stripped from the entry preload graph and lazy-loaded only when a Mermaid diagram is on the page; ~30 individual lucide-react icon chunks coalesced into a single lucide-vendor chunk (#1689)

🛠 Improvements

• Multi-language provider/model descriptions — resolveProviderLocale + resolveModelLocale mirror the agent-resolver fallback chain; per-locale tab editor in the provider edit panel; every model description in examples/providers/*.json translated into de + fr
• Provider models search + UX polish — search input + empty state on the provider detail page (filters id, display name, description, tags — raw + localized); separate "Default models" panel; "Webhook" renamed to "Workers" in agent settings (#1693)
• @tale/markdown package extracted — chat, docs, and marketing share one Shiki singleton, one component set, and one styling pass; streaming primitives (incremental reveal, mid-stream repair, CJK plugin) move in; fixes code-block line-number drift on trailing-newline blocks and Mermaid parse-error fragment accumulation (#1692)
• Docs URL configurable — WEB_DOCS_URL, DOCS_BASE_URL, DOCS_SITE_URL Dockerfile build args let docs mount at any path on any host; WEB_DOCS_URL now applies to the mobile-nav button and dist/robots.txt (#1684, #1685, #1686, #1687)
• Toast positioning + automations table polish — top-center toasts for auth flows (log in, sign up, 2FA, forgot-password); automations table replaces version column with localized created date; raw <select>/<input> migrated to shared Select / Input / SearchableSelect; click-to-toast hint replaces forgot-password helper text (#1678)

🐛 Fixes

• Prefixed-locale routes + /docs redirects — services/web switches base: './' → base: '/' so the SPA shell is self-contained at any depth (fixes blank /de/pricing after locale rollout); services/docs now prepends DOCS_BASE_URL to the Location header so Caddy-mounted /docs no longer redirects to the wrong origin (#1691)
• Web header/footer styling restored + /llms{,-full}.txt served in dev — globals.css now imports @tale/webui/globals.css so its @source directive picks up shared layout utilities; LLM artifacts written into public/ so Vite dev serves them (#1682)

💥 Breaking Changes

• de-AT and fr-CH locale tracks removed — only de, fr, and de-CH remain across @tale/webui, services/{platform,docs,web}, agent terminology, and the plop service template. Agents and user profiles previously pinned to de-AT or fr-CH should be re-targeted to de or fr (#1682)
• Audit-log retention floor enforced at 365 days — orgs with auditLogRetentionDays < 365 are runtime-clamped to 365 with a one-time warn log per org; explicit re-configuration via the new bounded retention editor required to silence the warning (#1676)

📝 Other

• CI builds container images once and reuses them across smoke/validate/scan jobs (#1695)
• All CI jobs moved to free GitHub-hosted runners (#1674)
• Design file refresh: AI providers, personalization, integrations panels (#1681)

Migration Guide

Most operators only need:

tale upgrade
tale deploy

If you fall into any of the cases below, take the corresponding action before or right after tale deploy:

1. Enable RAG bearer auth (recommended for production)

The RAG service gains opt-in Bearer-token auth. Behavior is presence-based — no token is baked into the image:

• Unset (default): RAG accepts unauthenticated requests on the container network; both RAG and platform log a one-time [SECURITY] RAG_AUTH_TOKEN unset warning at startup. Existing deployments continue to work without changes.
• Set: Every platform → RAG request carries Authorization: Bearer ${RAG_AUTH_TOKEN}; RAG rejects mismatches with 401.

For production posture, set the same value on both containers:

# In your .env or compose override (same value on both)
RAG_AUTH_TOKEN=<a long random secret>

The token is re-read from the env on every call, so rotation takes effect on the next request without a process restart.

2. RAG_URL private-host check

RAG_URL is now validated against the IMDS (169.254.0.0/16) and the "this network" (0.0.0.0/8) blocklists at platform startup. If your RAG_URL points to anything in those ranges (it should not under any normal deployment), update it to a routable internal address before deploying.

3. Audit-log retention floor (operators with auditLogRetentionDays < 365)

Orgs with auditLogRetentionDays under the new 365-day floor will be runtime-clamped on first read and a warn log emitted. To fix permanently, open Settings > Governance > Retention and re-save with a value >= 365 (the editor now enforces bounds and shows the floor inline).

4. de-AT / fr-CH locales removed

If any agents, users, or org-level defaults were pinned to de-AT or fr-CH, repoint them to de or fr respectively (or to de-CH if you want the Swiss German overlay). The narrow-BCP-47 resolver still falls back to the base locale at runtime, so nothing 500s — but text that previously came from de-AT.json / fr-CH.json will now come from de.json / fr.json.

5. Docs deployment (self-hosters who pointed external DNS at docs.tale.dev Mintlify)

If you previously had a CNAME pointing at Mintlify Cloud for your docs subdomain, switch it to your Caddy/reverse-proxy host. The bundled compose.docs.yml brings up the new tale-docs service on port 3002; Caddy is already configured for docs.tale.dev in Caddyfile. No action needed if you don't expose a public docs site.

Upgrade

tale upgrade
tale deploy

Contributors

@larryro, @AdeolaAdekoya, @Israeltheminer, @yannickmonney

---

Full Changelog: v0.2.69...v0.2.70