Repository navigation
[release] v0.124.0 - #7779
Merged
Merged
[release] v0.124.0#7779
Conversation
Domain and SSO provider routes now need the organization owner or an organization admin. Provider validity is set only by the provider test, and a provider can be turned on only after it is valid. Sign-in loads a provider only when it is both active and valid. An organization SSO provider signs in only emails in the verified domains of that organization. The verified-domain lookup ignores case. PATCH /auth/session/identities returns the current session identities and no longer changes them. The sign-in callbacks record identities, and the organization policy check counts only identities the user has.
The sessions turn routes now store agent_session_id and sandbox_id only when the request carries the runner token. Other callers can still write turns; the API drops these two fields from them. The runner now sends its token on the turn append and complete calls, so it keeps resuming the harness and reusing the sandbox.
fix(api, sdk): tighten organization admin checks, SSO domains, and turn runtime ids
chore(release): bump version to v0.123.1
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Closed
The 01 workflow can now set every package to an exact X.Y.Z version instead of a semver bump. This cuts a hotfix release branch while another release branch is still open. The run refuses a release branch that already exists, and the release PR always targets main.
…failed branch check Without a base input, create-pull-request builds the release branch on the checked-out branch, so a hotfix cut from a release branch keeps its fixes. A later step points the release PR at main. The existing-branch check now stops on any git ls-remote failure other than exit 2 (branch absent).
ci: let the release branch workflow take an exact version
Contributor
Author
Website previewPreview URL: https://pr-7779-agenta-website-preview.mahmoud-637.workers.dev Built from |
Contributor
Author
Railway Preview Environment
Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting. Post |
…ver names - The sandbox liveness probe no longer follows redirects; a 3xx answer counts as alive. - MCP server names __proto__, constructor and prototype are refused in the runner run plan, at session materialization and in the Python SDK config model. The Daytona MCP header placeholder map is built without a prototype. - Subscription login files (auth.json, meta.json) over 1 MiB are refused before they are read, locally and through the sandbox file API; nothing is published for them.
…hecks - Vertex credentials must be an inline service-account document, in the LLM gateway and in the SDK provider settings. - A password reset link is made only for a member of the caller's project. - test_run applies a delta with the parameters-only scope for every delta form, including ordered operations. - SSO sign-in reads the issuer's discovery document through the egress check, checks every endpoint it names, and passes those endpoints to SuperTokens. - The org SSO policy counts only identities of the org's own active and valid providers.
…lve OIDC hosts off the event loop, keep non-scope delta errors unchanged
…nd to the bytes read
…hecks fix(api, sdk): tighten credential, password reset, SSO and test_run checks
fix(runner): bound sandbox reads and probe redirects, reserve MCP server names
fix(api): cache miss locks expire after their TTL in seconds
fix(api): workspace creation finds the caller by their user id
…r, 0.124.0 upgrade notes
The job runs the same statements once per batch or page through prepared statements. After five executions Postgres may switch to a cached generic plan; on the batch that holds a very large organization the P2b candidate query then took about 15 minutes instead of 0.3 s. Every transaction of the job now starts with SET LOCAL plan_cache_mode = force_custom_plan. The job also prints how long the per-organization entitlement reads took.
The events stream rechecks VIEW_SESSIONS every live_auth_recheck_seconds. Its generator runs in a copy of the request context and shared the access memo that the check at connect filled, so a recheck answered from that memo. Each check now runs with a fresh memo (fresh_request_memo) and reads the current principal and membership.
…tled owner An EE organization without the RBAC entitlement lets every member pass by design. On EE the owner's account is now pinned to a plan with the entitlement, as test_rbac_enforcement_ee.py does, so the viewer checks test the role rule and not the plan.
The release already resolves the test_run delta with PARAMETERS_ONLY and answers an out-of-scope change with PlatformToolHandlerRefused, so this commit keeps that code and adds tests only: an ordered set or merge on url, uri or headers is refused before any invoke, and an ordered change inside parameters still runs. The fake resolver applies the real change-set engine with the scope it receives. The release's two test_run tests pass the run envelope that test_run needs since M2.
The admin accounts path wrote the owner's organization row with the column default viewer before M1, and M1 reads the organization role. oss000000044 gets a set-based step that sets role = owner on the owner's organization rows where it differs. An ownership transfer (app and admin tool) still gives the former owner the new owner's previous roles, and now sets the new owner to owner on every organization, workspace and project row of the organization, whatever the swap moved over. A unit test pins that the admin accounts path writes the given role.
…run engine result
…e rows Both transfer paths seeded only the missing project rows. They now also add an owner workspace row in every workspace of the organization where the new owner has none, as the signup and oss000000044 do.
On EE the owner's organization is now pinned to a plan with the RBAC entitlement and no project limit, so the role-change test checks the role rule and the two tests that create a second project can create it.
A 403 on a session call of a running turn (a record write, a heartbeat, the record-log read) now ends the turn with access_denied and a sentence that says the caller no longer has access to the project. Before, the 403 on a record write counted as a lost record, marked the record log incomplete, and the turn ended with "record log is unreadable".
…e 403s The LLM gateway's permission refusal (policy_denied) during a turn now ends it with access_denied instead of a provider refusal. A live-frame write answered 403 ends the turn too, and an ingest retry stops waiting once the turn is denied.
The LLM gateway answers both its permission check ("Denied
use_llm_endpoints") and its spending check ("Entitlement ... exceeded")
with policy_denied. Only the first means the caller lost access. The
spending check now gets its own sentence instead of the provider's
"you can keep going" advice. MCP-plane denials keep their handling.
fix(runner): a run whose access was removed ends with access denied
docs(sharing): sharing program contract, OpenSpec changes and milestone designs
Contributor
Author
📘 Docs preview
Pages changed in this pull request
This comment updates in place on every push. |
feat(api): resolve project membership in one place and check project route permissions
Add mounts.storage_prefix (revision oss000000050): a BEFORE INSERT trigger that fills the project layout for inserts from previous-release pods, a one-statement backfill under lock_timeout, then NOT NULL.
Mount carries storage_prefix (Field(exclude=True), never serialized). MountsService._storage_key builds every key, credential scope and teardown prefix from it, so the key no longer depends on project_id.
The Postgres MountsDAO mints the mount id and writes project_storage_prefix(...) in the same insert or upsert; on conflict the existing row keeps its prefix. The sign upsert stays one statement.
Invite, resend, role change, member removal and workspace update already check the workspace's default project, so an API key of another project is refused. Organization rename, ownership transfer, deletion and workspace creation, the EE domain and SSO provider writes, and the EE billing writes now apply the same rule through check_organization_write, which runs check_action_access on the organization's default project for an API key or a run credential. Browser sessions are not confined. get_default_project_by_organization_id now returns the oldest default project, so the answer is stable for an organization with several workspaces.
…ization's default project These routes check the workspace's default project and then change the member across the whole organization. An API key or a run credential must now also be of the organization's default project (check_organization_write). Browser sessions are not affected.
Self-host key layout note, runner and web comments, and the M4a interfaces and technical design.
oss000000044 P6 (copy the workspace role into the organization role) picked a nested-loop plan because the planner misestimates the two HAVING count(*) = 1 CTEs. Turn nested loops off for that one statement only. The revision runs in its own transaction (transaction_per_migration), so SET LOCAL is scoped to it.
fix(api): keep the membership repair migration fast on large databases
feat(api): give every run a principal and decide access in one place
feat(api): store each mount's storage prefix
mmabrouk
added
the
migration:destructive-approved
mmabrouk
approved these changes
Oct 25, 2026
mmabrouk
left a comment
mmabrouk
left a comment
Member
There was a problem hiding this comment.
🤖 The AI agent says: Approved on Mahmoud's instruction ("it's time to finish the release") after the v0.124.0 production deploys went green: live-us (runs 40172032945 and 40173516559) and live-eu (run 40178803345), both verified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New version v0.124.0 in
Final QA