Skip to content

Tale v0.5.87

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 07:06
v0.5.87
715dc15
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Automation tests now run from the editor with per-test failures and path coverage. Try the draft or an individual step, save a run as a regression test, and see test counts on saved versions and deployments.
  • MCP automation editing can page version history, compare saved versions and restore an older version as the newest. Deployment replies distinguish a rollback from another deployment. Agents can also run a draft on simulated outputs or one step at a time, and run the tests they name and read each run's output, effects and steps; both draw from the organization's budget for runs that are never stored.
  • Coding agents can read which writes an automation may make without a person approving each run and, with an owner's or admin's key, allow or withdraw them. The plan of an allowance names that it removes a person's approval, and the audit log records the change as made through MCP.
  • Release pipelines can read version history in pages, compare saved versions and read the deployment history over REST, then deploy a saved version — naming the one they expect to replace — or restore an older one. A deploy still passes the version's checks and tests. They can also run a saved version's tests, all or by name, and read the verdict the version carries and who made it.
  • Testing and version controls now keep selected tabs and keyboard focus visible in contrast themes. Code fields in dialogs let keyboard users reach the next control, and run playback fits phone screens. Automation authors can choose Save as test… directly from a Runs row menu.
  • Chat can make downloadable files and use skills from your library. Text files need no sandbox; documents, spreadsheets and charts use a light sandbox when code is needed.
  • Person-started standard agent tasks can make files and search knowledge on the shared chat engine without starting a full workspace. Work needing a repository, browser or hours hands over to the agent's full workspace with its brief and files.
  • OpenAI subscription credentials can carry the ChatGPT account identity Codex harness runs need in tasks and automations.
  • Resumed harness task turns receive their current execution identity, and resumed Codex turns receive the current organization and agent guidance. Retries and restarts open with this update before the task brief, even when the conversation retained older guidance.
  • SSO discovery skips unreadable saved connections in unrelated organizations. Signing in to an explicitly selected organization still reports its own connection errors.
  • Saved PII custom rules survive mode changes and disable/re-enable, including policies that use only custom rules. Unreadable rules show Retry and prevent edits from replacing the saved array.
  • After a successful deployment recovery, removing the takeover declaration allows configuration-only updates without an unnecessary runtime rollout when the retained receipt proves the unchanged basis.
  • Admins can set retention for automation versions, keeping versions needed by live deployments, runs, recent history and legal holds.
  • Historical package publication can fill missing ui-vX.Y.Z and marketing-ui-vX.Y.Z tags from their immutable release source without rewinding dist/ui or dist/marketing-ui. Publication uses maintained tooling and reads historical source as data.

Upgrade notes

  • Previously lost custom PII rules are not restored automatically. In Governance > Guardrails, review PII protection and re-enter any missing custom patterns before relying on the policy.
  • The backend applies migrations 0200_automation_test_reports.sql, 0201_provider_subscription_account_id.sql and 0202_agent_run_engine.sql at boot. The first two add nullable fields; earlier test verdicts remain readable without a detailed report. Migration 0202 adds a non-null engine defaulting to harness, keeping existing runs and old-image inserts on that route during a roll, plus nullable transcript/handoff fields and a native-run index. No manual data backfill is required. Include them in the normal deployment and database backup procedure.
  • To use an OpenAI Subscription key, provide its ChatGPT account ID; OpenAI broker tokens must supply the vendor's account_id. Restrict models to those your subscription supports and verify a Codex harness task. Subscriptions use their provider-bound harnesses in tasks and automations; the native engine requires an API-key or environment credential.
  • With Agent runtime on Automatic, person-started standard agents can use the native engine. Starts by automations, schedules or other agents use the full workspace, as do custom agents and runs with equipped connectors, platform tools or secrets, subscription models or pinned runtimes. To require it from the start, pin the standard agent's runtime. Each organization runs at most four native task runs concurrently; further native runs queue. Full-workspace workers keep their configured Agent workers limits.
  • Review Chat tools before rollout: Files, Skills and Code default to on and govern chat only. The new Light sandboxes quota defaults to two per organization, is shared by chat and native task code, and counts toward allocated capacity. Clients reading chat messages must accept the additive artifact part introduced in API contract 3.36.0.
  • The current API contract is 3.43.0. The MCP endpoint can answer the codes INSUFFICIENT_SCOPE and ORG_MISMATCH, and a sign-in challenge on its 401, but only where an operator lets coding agents sign in; no deployment does by default. MCP clients that read settings should accept the kind automation-approval, which has a read-only config and changes by the acts grant and revoke, the plan action unchanged for an act that changes nothing, and the code APPROVAL_ALLOWANCE_INVALID. They should also accept cursors beside get_settings' nextCursor, which is now set only after a read of one kind, and the codes USE_SUBSCRIPTION_FLOW (a subscription credential) and SETTINGS_NOT_FOUND (a provider Tale ships). MCP clients should accept the added version-history and comparison metadata, plus deployment kind values deploy, rollback and unchanged; test_automation and run_automation take new optional arguments, test_automation may answer recorded and detailOmitted, and both may answer RATE_LIMITED with data.retryAfterMs when the organization's budget for runs that are never stored is spent. REST clients should accept the added version fields; GET /api/v1/automations/{name}/versions also answers isDone and continueCursor, and still answers the whole history when no limit is named. POST and GET /api/v1/automations/{name}/versions/{version}/tests are new. Restoring an automation creates a new latest version; it does not rewrite saved history.
  • Automation-version cleanup stays off until an admin enables it. Review and apply retention bounds before enabling deletion; older organization files use bundled bounds for the new category until you add their own. Cleanup preserves the live version, the last ten deployments' versions, versions used by runs, the newest twenty, the versions those were based on or restored from, and legal holds.
  • After bundle recovery reaches Ready, remove supersedesPendingBundle and prepare again before a configuration-only apply. Preserve the Ready receipt and recovery snapshot. New pending rollouts allow at most 64 takeovers; legacy journals with 65 entries remain recoverable. At the limit, recover the exact pending bundle before selecting another rollout.
  • Adopt the service images and CLI as one validated cohort. Release publication admits one new full cohort per UTC day and permits same-version recovery. Retry or backfill package tags from main with both release_tag and the tag's full source_sha; identical existing tags are kept, and conflicting tags require reconciliation without moving them.

API contract changes

The contract moved from 3.35.0 to 3.43.0 (155 → 161 operations). Read the API reference's versioning section before upgrading a pinned client.

Added operations:

  • GET /api/v1/automations/{name}/compare
  • GET /api/v1/automations/{name}/deployments
  • GET /api/v1/automations/{name}/versions/{version}/tests
  • POST /api/v1/automations/{name}/deployments
  • POST /api/v1/automations/{name}/versions/{version}/restore
  • POST /api/v1/automations/{name}/versions/{version}/tests

Removed operations: none.

Changelog

3.43.0 — 2026-10-13: the MCP endpoint takes a coding agent's access token in place of an API key where the operator lets agents sign in (off unless set). Its 401 then carries the challenge RFC 9728 describes — resource_metadata and scope — and a credential that was presented and refused adds error="invalid_token". A token opens the MCP endpoint alone; on every other route it is read as an API key. A call made through a connection acts in the organization the connection was made for (naming another in X-Organization-Slug answers 403 ORG_MISMATCH) and holds the access its person allowed: a request that calls a tool needing access the connection lacks is refused whole with 403 INSUFFICIENT_SCOPE and the challenge error="insufficient_scope", which names what to ask for, and a call that the person's role could never be given the access for answers the same code as a tool error. tools/list is unchanged. The codes INSUFFICIENT_SCOPE and ORG_MISMATCH join the registry. No REST operation changes.

What's Changed

Full Changelog: v0.5.86...v0.5.87

Contributors

Israeltheminer and yannickmonney
Assets 8
Loading