Security
- fix(agents): Require agent:update for the preset builder chat (#4056)
Deprecations
- feat(integrations): Expand CrowdStrike templates and fix list actions (#4049)
Case management
- perf(cases+engine): Index workflow and case task foreign keys (#4016)
- feat(cases+actions): Add delete case comment action (#4031)
- feat(cases+actions): Add core.cases.run_task to run a case task (#4032)
Agents
- perf(agents): Read MCP integrations once, discover servers in parallel (#4017)
- feat(agents): Resolve secret expressions in remote MCP headers (#3982)
- feat(agents): Emit per-backend agent turn and TTFT metrics (#4033)
- fix(agents): Stop session row locks blocking runtime writes (#4037)
- fix(agents): Pass system prompt by file and cap case chat payload (#4036)
- fix(agents): Check the backend entitlement on every turn (#4047)
- feat(agents): Let agent backends prepare and clean up session deletes (#4048)
- fix(agents+api): Allow managed skill saves and keep AWS mappings (#4055)
- refactor(agents): Remove the retired internal agent routes (#4053)
Tracecat MCP
- feat(mcp): Add create, update and delete workspace variable tools (#3945)
Integrations
- perf(integrations): Build the JSONPath parser on first use (#4039)
- fix(integrations): Promote the registry version after a long build (#4041)
- feat(integrations): Add incident.io API actions (#4007)
Engine
- perf(engine): Skip redundant reads on action, trigger and webhook paths (#4018)
- perf(engine): Resolve for_each credentials once per loop (#4015)
- fix(engine): Retry sandbox cgroup setup when a process races in (#4028)
- feat(engine): Trace phases inside action execution (#4038)
- perf(engine): Clone each sandbox jail into its memory cgroup (#4040)
- perf(engine): Return sandbox action results before the jail exits (#4042)
- fix(engine): Kill the whole jail and bound sandbox teardown (#4045)
- revert(engine): Back out the jail fast path and teardown changes (#4046)
API
- fix(rbac): Enforce grant limits on SCIM mappings and token issuance (#4020)
- feat(api+ui): Deploy managed resource packages to customer workspaces (#4025)
Infrastructure
- feat(infra): Run a lighter dev stack by default in just cluster (#4021)
- fix(infra+docs): Default Compose to latest image tag (#4024)
- fix(infra): Harden latest across image publishers (#4030)
- docs(infra): Verify all three images before a release (#4034)
- revert(infra): Restore the sandbox overlay's backend default (#4035)
- ci: Stamp a unique registry version on non-release images (#4029)
Contributors
@daryllimyt, @aaron-tracecat and devin-ai-integration[bot]
Full changelog: 1.3.1...1.4.0-alpha.1