Skip to content

v1.4.0

Choose a tag to compare

View all tags
@jiashuoz jiashuoz released this 26 Jul 21:33
v1.4.0
13f4bf8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Additive release — no breaking changes to the public /v1 contract, no
schema migrations, and no Python or TypeScript SDK runtime changes.

Authentication and hosted sign-in

  • OIDC door parity (#721) preserves dashboard return_to destinations and
    CLI callback/state parameters through the OIDC sign-in handoff.
  • RFC 9207 issuer identification (#725) adds iss to OAuth authorization
    error redirects.
  • Configurable web sign-in door (#720) adds the build-time
    NEXT_PUBLIC_E2A_SIGN_IN_URL setting. Existing deployments keep their
    current sign-in behavior unless they opt in.

Server behavior and security

  • Idempotent internal user provisioning (#726) adds
    POST /api/internal/users/provision for trusted control planes. It is
    disabled by default and requires both E2A_PROVISIONING_ENABLED=true and an
    environment-only E2A_PROVISIONING_SECRET.
  • PII-safe centralized logging (#686) redacts sensitive process-log fields
    before logs are shipped.
  • Domain deletion errors now identify the blocking agents, including trashed
    agents (#722).
  • A genuine re-suppression now re-emits domain.suppression_added (#727).

Web and agent workflows

  • Feedback now defaults to the signed-in user's email and no longer asks the
    user to re-enter it (#705).
  • The new autopilot plugin skill starts headless agent sessions from e2a
    email triggers (#701).

Release confidence

This release substantially expands the live release gates:

  • Full advertised MCP surface coverage: 57 tools covered, with 3 deliberate
    allowlist entries (#694–#700, #703, #708).
  • Live ergonomic-surface gates for the Python and TypeScript SDKs and command
    coverage for the CLI (#707, #709, #710).
  • Production and staging coverage for inbound MX, SES feedback, domain,
    quota, billing, loopback, webhook-event, and failure-event behavior
    (#718, #719, #723, #728, #730, #732).
  • Per-workspace database isolation and hardened cleanup/test fixtures
    (#687, #692, #706, #717, #724, #729, #733, #736).
  • The production e2e harness now fails closed instead of silently defaulting
    to production (#693).

Clients

  • Server, web, MCP HTTP server, and prober images are co-versioned at 1.4.0.
  • The CLI package version is unchanged; the release workflow may report npm's
    expected benign refusal to republish an existing CLI version.
  • Python and TypeScript SDK package versions are unchanged and require no
    separate SDK tags for this release.

Full changelog: v1.3.0...v1.4.0

Assets 2
Loading