v0.2.84 — Kubernetes sandbox backend, adaptive reasoning, and audit hardening

v0.2.84 — Kubernetes sandbox backend, adaptive reasoning, and audit hardening

This release adds a Kubernetes execution backend for the sandbox alongside the existing Docker path, a major LLM-pipeline upgrade (adaptive reasoning budgets, prompt caching, and a redesigned Auto router), and new knowledge-base workflows in chat. It also hardens audit-log access, clears the transitive HIGH dependency advisory backlog, and makes tale rollback safe by design.

🔒 Security

• Audit-log reads are now restricted to org admins and owners. The public queries listAuditLogs, listAuditLogsPaginated, and getActivitySummary reject non-admin roles, the unused public getResourceAuditTrail query was removed, and the row-level-security matrix drops developer/editor audit-log access to write-only (#1852)
• Cleared the transitive HIGH dependency advisory backlog: picomatch ReDoS (GHSA-c2c7-rcm5-vvqj), lodash _.template code injection (GHSA-r5fr-rjxr-66jc, overridden to 4.18.1), and the tar path-traversal advisory family via removal of an orphaned canvas lockfile entry (#1854)

🤖 Model & Provider

• Adaptive reasoning governor: thinking budgets now adapt per (model, agent type) profile with self-calibrating difficulty thresholds. Output truncation no longer counts as thinking starvation, and wasteful reasoning (high thinking, tiny answer) trims the budget (#1838)
• The Auto router is now a config-defined agent backed by a fast classifier model, replacing the hardcoded lexical heuristics. Routing decisions are cached, and models with missing keys or broken configuration are skipped at resolution time instead of producing a doomed request (#1838)
• Updated OpenRouter provider catalog and a new coder example agent for fresh deployments (#1838)

💥 Breaking Changes

• tale rollback no longer accepts an arbitrary -v/--version flag. The only valid target is the recorded previous version, and only when it shares major.minor with the running platform (patch-only rollback). On refusal the command prints the snapshot-restore runbook instead of proceeding. Update any operator scripts that pass --version (#1861)

🚀 Features

• The sandbox service can now run on Kubernetes: SANDBOX_BACKEND=docker|kubernetes selects between the unchanged Docker Compose backend (still the default) and a new exec-free Pod-per-exec Kubernetes backend that needs no docker.sock or host-path workspace (#1841)
• @-mention knowledge-base documents in chat: an anchored picker in the composer pins up to 5 indexed documents to a turn, scoping that turn's retrieval to exactly those documents (#1864)
• Folder-scoped RAG search: retrieval can be limited to a single Document Hub folder and all of its subfolders (#1865)
• Live per-node execution status on the workflow canvas, driven by a single reactive query (#1868)
• New integration_processing_records workflow action for incremental, deduplicated processing of external SQL/REST integration data, with four incremental strategies (#1858)

⚡ Performance

• Generic prompt caching with per-model strategies (explicit cache breakpoints for Anthropic/Gemini via OpenRouter, deterministic cache keys for OpenAI/DeepSeek) plus cache pre-warming on composer focus, reducing latency and cost on repeat prompts (#1838)

🛠 Improvements

• Smoother streamed-text rendering: chat responses now reveal at clause boundaries instead of raw token chunks (#1838)

🐛 Fixes

• Workflow execution step journals rendered empty for roughly 75% of runs due to a component shard-routing bug; journal loads now resolve the execution's actual shard (#1868)
• Inline chat token count now shows output tokens instead of input/total (#1838)

📝 Other

• RAG indexing status is consolidated onto fileMetadata.ragStatus as the single source of truth inside Convex; documents.ragInfo and documents.indexed are deprecated but remain readable for existing rows (#1840)

Upgrade

Run tale upgrade to update the CLI, then tale deploy to apply the new version.

No manual migration is required. During tale deploy you will be prompted to confirm two automatic data backfills (RAG status consolidation and folder-path indexing); the RAG database schema migration applies automatically when the database container starts.

Contributors

@larryro, @yannickmonney

---

Full Changelog: v0.2.83...v0.2.84