github truefoundry/trueforge @truefoundry/trueforge@0.2.0-rc.1
on GitHub

latest releases: charts/trueforge@0.1.6-rc.1, @truefoundry/trueforge-ui@0.3.0-rc.1
pre-release4 hours ago

Minor Changes

  • 8491843: Add a slot-driven agent Metrics tab with aggregate cards, time-range filtering, and Harness-backed line charts.

  • a70543b: Agent access is decided only by the Authorizer: standalone/OIDC lets everyone list and use agents and restricts update/delete to the creator; TrueFoundry uses external permissions api.

    You can read a session, turn, events, metrics, schedule, or its runs if you created it, or if you manage the named agent it is bound to. Creating still requires permission to use that agent. Only the creator can update, delete, or cancel a session, create a turn, or download sandbox files. Only the creator can update, delete, pause, resume, or run a schedule. An OIDC settings admin can no longer see other users' schedules.

  • 49164e7: Add optional mutual TLS for the HTTPS listener and schedule controller→server hop via TRUEFORGE_MTLS_ENABLED / TRUEFORGE_MTLS_CERTS_DIR. Off by default; independent of ServiceFoundry TRUEFOUNDRY_MTLS_*.

  • 9bfcdaa: Replace string creator fields (created_by / triggered_by) with a non-null created_by_subject JSON object on agent, session, schedule, and schedule_run. Ownership and list filters use tenant_id + created_by_subject.subject_id.

  • a3a1395: Adds first-class cron schedules for existing agents: persist them, manage them via /api/v1/schedules, validate cron policy at write time, and advance due runs through a single-dispatcher claim path.

  • 4b1aa55: Enforce external agent authorization on agent list, get, snippets, update, delete, and referenced-agent use.

  • ef316d2: Add optional OIDC_ALLOWED_EMAILS allowlist (exact addresses and * globs) so OIDC logins can be limited to approved emails or domains.

  • 2025cef: Store Postgres app tables and Kysely migration bookkeeping in a dedicated trueforge schema, with an automatic one-time move from public so existing installs keep their data and migration history.

  • 8f1a2dc: Add a TrueFoundry-managed model registry. When TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL is set, models are listed from the TrueFoundry ServiceFoundry server and turns are routed through the tenant's default AI Gateway with the caller's token. Mutually exclusive with OIDC. Supports internal mutual TLS to the ServiceFoundry server via TRUEFOUNDRY_MTLS_ENABLED/TRUEFOUNDRY_MTLS_CERTS_DIR.

  • 4137af1: Unify request-scoped RequestContext across standalone, OIDC, and TrueFoundry auth. /auth/me returns { data: { type, tenant_id, subject, roles } } (type is oidc-connected | default; OpenAPI/SDK regen deferred to CI).

Patch Changes

  • d89b2ff: Persist zero-initialized metrics on agent sessions.
  • 172bf14: Add caller-scoped session metrics meters, charts, and chart-data under /internal/metrics via a server-owned ISessionMetricsStore.
  • d89b2ff: Fold session metrics totals on createTurn and terminal writes.
  • af40621: Add persisted agent.metadata on Postgres and SQLite; store updateAgent can patch manifest and/or metadata.
  • 1c67237: Add agent external_id (string | null on create) with a tenant-scoped partial unique index (Postgres and SQLite).
  • 38abb11: Sync ServiceFoundry remote agents on create/update/delete and store the remote id in external_id. Filter listAgents by external_ids. Keep general ServiceFoundry HTTP at 10s and agent CRUD calls at 3s.
  • 49360bc: Drop unused agent.metadata; remote identity is stored in external_id.
  • 38abb11: Reject reserved agent names tfg and trueforge in create requests.
  • 7968f59: Use injected db for TrueFoundryAgentStore advisory-lock transactions.
  • a60f4c2: Add GET /api/v1/agents/{agent_id}/code-snippets with TypeScript TrueForge SDK stream and non-stream samples.
  • 55cc5e7: Add a dedicated controller entry point (dist/controller-main.js) that runs the periodic control loops (schedule dispatch) as a single-replica process for distributed mode (STANDALONE=false). It targets the server API via the new SERVER_URL env (default http://localhost:$PORT). Standalone mode keeps running the controller inside the server process.
  • 2dcb3a0: Add created_by_me to list sessions and list schedules so callers can restrict results to resources they created (excluding managed-agent visibility).
  • 58940a7: Report a Daytona key that cannot register snapshots as missing key permissions (403) instead of an invalid API key (422), and name the grants to add in the Daytona dashboard.
  • c40129c: Cap Daytona status-refresh calls at 1 minute so a stalled provider cannot hang request handlers.
  • 9f3b4cd: Make optional VITE_BASE_PATH apply to both the UI public path and API/auth URLs (defaults to /).
  • 80d5bee: Move resolveInvokeHeaders onto IMcpServerWithAuthStore (not IMcpServerStore) so DB backends stay CRUD-only and turn/MCP invoke paths take the request-scoped with-auth store for configured headers and TrueFoundry gateway Bearer.
  • 541d65d: Split MCP server persistence (IMcpServerStore) from Connect UX auth (IMcpServerWithAuthStore / McpServerWithAuthStore) so DB backends stay CRUD + OAuth client columns while authorize/status/revoke compose in via a token store.
  • c65b813: Apply POSTGRES_SSL_MODE as sslmode on the Postgres connection URL.
  • f4fb4bd: Accept DATABASE_URL for hosted mode so managed Postgres (e.g. Railway) can be wired without discrete POSTGRES_* vars.
  • a37cdea: Add NOT NULL agent_id on schedule (backfilled from agent), FK to agent(id) ON DELETE CASCADE (replacing the (tenant_id, agent_name) FK), and (tenant_id, agent_id) index for per-agent listing.
  • 3bc2ed8: List schedules is token-paginated (limit / page_token) and filters by comma-separated agent_names.
  • feb94aa: Add GET /api/v1/schedules/{schedule_id}/runs to list a schedule's runs (newest scheduled_for first), with the same creator-or-admin access as other schedule routes.
  • 8e64757: Add POST /api/v1/schedules/runs to trigger an immediate schedule run
  • 4ced8ef: Dispatch schedule runs through the session/turn API: get-or-create a session keyed by run id, then create a turn only when that session has none.
  • 38ce068: Add tenant-unique optional session external_id, Sessions.getOrCreateByExternalId, and an idempotent POST /internal/sessions/get-or-create-by-external-id endpoint and SDK method.
  • b654052: Add caller-owned session metadata (Record<string, string> with size limits) on create, update, and read. Persist as a new session.metadata jsonb column; leave session custom unchanged.
  • 4c1260e: Wire TrueFoundry MCP authorize, status, and delete through ServiceFoundry; stub list auth_status; gate oauth2 invoke mid-turn with authRequired; paginate MCP server lists. UI treats SFY consent code/error on the FE landing like local DCR success/failure.
  • 32bf7d6: TrueFoundry MCP invoke headers are owned by the MCP store (resolveInvokeHeaders), so gateway Bearer comes from the request-scoped store rather than being threaded through turn/tools APIs.
  • 185dc04: Per-MCP-server request headers via x-tfg-mcp-headers, merged into the invoke headers for the named server. Lets a caller that authenticates as one identity give each MCP server the identity it should actually see.
  • f175245: Add TrueFoundry-managed MCP list/get (SFY registry, gateway proxy URL, create/update 424).
  • Updated dependencies [648273b]
  • Updated dependencies [d89b2ff]
  • Updated dependencies [648273b]
  • Updated dependencies [172bf14]
  • Updated dependencies [d89b2ff]
  • Updated dependencies [a70543b]
  • Updated dependencies [2dcb3a0]
  • Updated dependencies [9bfcdaa]
  • Updated dependencies [c40129c]
  • Updated dependencies [52987a7]
  • Updated dependencies [38ce068]
  • Updated dependencies [b654052]
  • Updated dependencies [4c1260e]
  • Updated dependencies [8f1a2dc]
  • Updated dependencies [f175245]
    • @truefoundry/trueforge-sdk@0.1.4-rc.1
    • @truefoundry/trueforge-core@0.2.0-rc.1
Check out latest releases or
releases around truefoundry/trueforge @truefoundry/trueforge@0.2.0-rc.1

Don't miss a new trueforge release

NewReleases is sending notifications on new releases.

Get notifications