A patch release: four fixes to how Terrapod reports its own state, one addition for AI agents, and routine security maintenance. Drop-in — no migrations, no configuration changes, nothing removed or renamed.
Fixes
-
A failed plan's pull-request comment no longer says "Plan in progress" — it said so directly above the AI failure analysis explaining why the plan had failed. The run had errored and the commit status was correct; a later writer rewound the comment. The AI summary is enqueued while a run is still planning, and re-enqueued after a model call taking tens of seconds — carrying the status the run had when the summary started. It now re-reads, and the dispatcher additionally prefers a terminal run status over a stale one, because that comment is shared per pull request and written last-wins.
-
Module-PR comments no longer render a plan result that has not landed. Two speculative runs on one module PR, both with no changes, could report differently — one "No changes", the other "Plan finished" — depending on which lost a race with the database commit. The result is now snapshotted at the transition, as the ordinary VCS path already did.
-
A VCS provider outage is legible instead of a bare 500. Queueing a run while GitHub was degraded returned
Internal server error, indistinguishable from a Terrapod bug or your own misconfiguration. It now returns 502 (504 on timeout) naming the provider, repository, ref and upstream status — and distinguishes your budget is exhausted from the provider is failing, which decides whether you poll less or wait it out. A missing repository or branch stays a 422, because that is yours to fix. The web UI no longer retries provider failures, which previously multiplied load on an already-failing provider. -
The VCS budget window is recorded, so a connection's consumption is reported as a true share of its allowance. GitHub refills hourly and GitLab.com per minute; the window was computed but never stored, which would have overstated a GitLab connection's utilisation.
Added
terrapod_run_logs— the MCP server can now fetch a run's plan or apply log. An agent could previously see that a run failed, with its exit code and structured plan, but not why. Returns the end of the log by default (a failure is reported last, and an apply log can be megabytes), ANSI stripped, with paging back throughoffset.
Security
- CVE-2025-47273 (setuptools) and GHSA-6v7p-g79w-8964 (msgpack) cleared from all images. Both came from
pip's vendored bundle, which no pip release fixes, so pip — unused at runtime — is removed from the runtime images. - Third-party base images are now mirrored daily rather than weekly, so base-image security updates that
apt-get upgradecannot reach are picked up within a day. - Dependency updates across the web and CI toolchains.
Fixes to the release process itself
- A security patch for an older line no longer takes the "Latest release" badge from a newer version. GitHub picks latest by publish time, so v1.4.2 had claimed it from v1.5.0.
- The scheduled re-scan no longer re-raises code findings that have already been reviewed and dismissed, which previously produced an issue that could not be discharged.
Full Changelog: v1.5.0...v1.5.1