chore: release v4.8.3 (#5085)

## Summary
8 improvements, 4 bug fixes.

## Improvements
- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))

## Bug fixes
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The CLI and MCP login consent page now shows when and from which IP
address the login was started, and you get an email whenever a new CLI
or MCP login is authorized on your account.
- Searching, filtering to errors, and expanding or collapsing spans in
the run trace view are faster on large traces.
- Guide switching from shared root keys to individually managed API
keys, while keeping root key regeneration directly available.
- CLI and MCP login codes now work once, and every login mints its own
personal access token instead of reusing an existing CLI token.
- Fix run traces occasionally going missing when a span recorded an
exception with no message, type or stack trace.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## trigger.dev@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
  - `@trigger.dev/schema-to-json@4.8.3`
## @trigger.dev/convex@4.8.3

### Patch Changes

- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
## @trigger.dev/core@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
## @trigger.dev/linear@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/python@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
## @trigger.dev/react-hooks@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/redis-worker@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/rsc@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/schema-to-json@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/slack@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/sdk@4.8.3

### Patch Changes

- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release v4.8.3 (#5085)

## Summary
8 improvements, 4 bug fixes.

## Improvements
- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))

## Bug fixes
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The CLI and MCP login consent page now shows when and from which IP
address the login was started, and you get an email whenever a new CLI
or MCP login is authorized on your account.
- Searching, filtering to errors, and expanding or collapsing spans in
the run trace view are faster on large traces.
- Guide switching from shared root keys to individually managed API
keys, while keeping root key regeneration directly available.
- CLI and MCP login codes now work once, and every login mints its own
personal access token instead of reusing an existing CLI token.
- Fix run traces occasionally going missing when a span recorded an
exception with no message, type or stack trace.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## trigger.dev@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
  - `@trigger.dev/schema-to-json@4.8.3`
## @trigger.dev/convex@4.8.3

### Patch Changes

- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
## @trigger.dev/core@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
## @trigger.dev/linear@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/python@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
## @trigger.dev/react-hooks@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/redis-worker@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/rsc@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/schema-to-json@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/slack@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/sdk@4.8.3

### Patch Changes

- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release v4.8.3 (#5085)

## Summary
8 improvements, 4 bug fixes.

## Improvements
- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))

## Bug fixes
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The CLI and MCP login consent page now shows when and from which IP
address the login was started, and you get an email whenever a new CLI
or MCP login is authorized on your account.
- Searching, filtering to errors, and expanding or collapsing spans in
the run trace view are faster on large traces.
- Guide switching from shared root keys to individually managed API
keys, while keeping root key regeneration directly available.
- CLI and MCP login codes now work once, and every login mints its own
personal access token instead of reusing an existing CLI token.
- Fix run traces occasionally going missing when a span recorded an
exception with no message, type or stack trace.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## trigger.dev@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
  - `@trigger.dev/schema-to-json@4.8.3`
## @trigger.dev/convex@4.8.3

### Patch Changes

- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
## @trigger.dev/core@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
## @trigger.dev/linear@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/python@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
## @trigger.dev/react-hooks@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/redis-worker@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/rsc@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/schema-to-json@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/slack@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/sdk@4.8.3

### Patch Changes

- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Publish docs: webhooks public beta, CLI webhooks and login commands, …

…workload identity, ignored paths for GitHub builds

fix(sdk): keep the persisted chat cursor at the turn start while stre…

…aming

Fix reloading a chat mid-turn after its access token was refreshed.

`TriggerChatTransport` persists a resume cursor (`lastEventId`) so a
reloaded page can reconnect to `.out`. Sends persist it before the turn
streams, so a reload normally replays the whole turn. A token refresh
during a streaming turn (the 401 retry on a steering send or on an
`.out` reconnect) persisted the latest record's cursor instead, from the
middle of the turn. A reload then resumed past the turn's opening
chunks, and `useChat` failed to rebuild the assistant message: "No tool
invocation found for tool call ID".

The transport now remembers the cursor from before each turn's first
record, set when the turn is sent or, after a reconnect, when its first
record arrives (so it also holds for apps that don't persist
`isStreaming`). It persists that cursor in place of the live one until
the turn ends, then persists the latest cursor as before. `getSession()`
returns the same value, and the frontend docs describe it.

Mono-RevId: 13ad0c6f4d89f44707f9683a6faa7b362268d9f4

chore: release v4.8.2 (#5073)

## Summary
5 new features, 19 improvements, 23 bug fixes.

## Breaking changes
- Query dashboard APIs reject run tokens and public access tokens
without user delegation. Existing API key access, including restricted
keys with the required query scopes, is unchanged. MCP dashboard access
remains supported through delegated tokens for current organization
members.
- The legacy `clickhouse` event store is retired: task events now go to
`clickhouse_v2`. If you self-host with
`EVENT_REPOSITORY_DEFAULT_STORE=clickhouse`, switch it to
`clickhouse_v2` and follow the self-hosting guide to copy older events,
which no longer show until you do.

## Improvements
- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Add an experimental Convex component for triggering tasks
transactionally and reading their status and results through reactive
queries, without configuring webhooks.
([`3c1cf656c`](3c1cf65))
- Run metadata operations now reject JSON-path keys that use escaped
dots to reach `__proto__`, `constructor` or `prototype`.
([`dce5048a8`](dce5048))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))
  
Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.
- `runs.subscribeToRun` now ends after the run completes. The `for
await` loop exits right after the update with the final status, and the
subscription stops its connection, so a script that subscribes to a run
exits on its own. Pass `stopOnCompletion: false` to keep the
subscription open after completion.
([`485ab83aa`](485ab83))
- Add `SupervisorHttpClient.releaseRun`, which gives back a dequeued run
the worker never started so the platform requeues it at once instead of
after the pending execution timeout.
([`ba51e5573`](ba51e55))
- The supervisor keeps its run notification subscriptions across
reconnects to the webapp, and reconnects when the webapp turns its
handshake away, so cancellations and resolved waits keep reaching
running tasks after a webapp restart or deploy.
([`a9e69ab7d`](a9e69ab))
- Asymmetric webhook sources can now verify ECDSA P-384 signatures
(`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256
digest of the signing string (`prehash: "sha256"`). ECDSA signatures are
accepted in DER or raw `r||s` form.
([`4ed2e3780`](4ed2e37))
- The bundled `trigger-cost-savings` skill now notes that a webhook
delivery starts no run when no subscriber's filter matches, so it costs
no compute.
([#5051](#5051))
- Stream a sub-agent's reply through a parent tool call with
`chat.forwardSubAgent`. Each chunk is written to the parent chat once
and the tool resolves with the sub-agent's final message, so streaming a
sub-agent costs bytes in proportion to its reply. Yielding
`stream.messages()` snapshots resends the whole message on every chunk,
which grows with the square of the reply.
([`bdc994c4d`](bdc994c))
  
  ```ts
  execute: async ({ topic }, { toolCallId, abortSignal }) => {
  const stream = await researcher.sendMessage(topic, { abortSignal });
  return await chat.forwardSubAgent(stream, { toolCallId });
  },
  ```
  
Render it while it runs with `useSubAgentMessages()` from
`@trigger.dev/sdk/chat/react` (or `createSubAgentMessages()` outside
React).

## Bug fixes
- Fix `chat.inject` messages added from a tool mid-turn being saved
before the assistant's response. They now stay after the tool result,
where the model saw them, so the next turn keeps the same prompt prefix.
If you roll `@trigger.dev/sdk` back to an earlier version, chats saved
by this version lose these mid-turn `chat.inject` messages from the
model's context, though the chat history shown in the UI keeps them.
([`fc33769a5`](fc33769))
- Fix a `chat.agent` turn failing after a head start that ended with two
or more parallel tool calls. When those tools finished out of call
order, the agent sent their results to the model twice on the next step,
and the provider rejected the request (Anthropic: "each tool_use must
have a single result"). Each handed-over tool result is now sent once.
([`d06ee5825`](d06ee58))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Add "Ignored paths" to the Git settings: pushes and pull request
updates that only change files matching these patterns no longer create
a deployment. Ignored paths don't apply while the Vercel integration is
connected.
- The `metrics` query table now includes queue size (`queue.size.*`) and
webhook limit metrics (`webhook.waiters.*`, `webhook.processing.*`,
`webhook.ingress.*`), so you can chart and alert on queue capacity and
webhook rate limits.
- New Limits alerts: watch the limits that can interrupt or degrade
runtime flow, one at a time or combined into a single alert with "any"
or "all" and the signals you choose (limit reached or approaching), in
the dashboard, the API and the agent.
- Expand short-lived run-token support to task APIs, with permission
checks for packets, metadata, streams and waits. Run tokens last one
hour independently of root-key rotation and cannot be individually
revoked. They can mint public access tokens for up to 30 days; those
tokens may outlive the run token that minted them.
- Hosted webhook endpoints can verify ECDSA P-384 (SHA-384) signatures,
ECDSA signatures in raw `r||s` form, and RSA signatures made over a
SHA-256 digest of the signing string (`prehash: "sha256"`).
- Older runs now load their trace, span details and run events faster. A
span that finishes more than a week after its run shows as still in
progress.
- The run page now loads large traces progressively and updates live
runs incrementally, so big traces open faster and open run pages no
longer reload the whole trace while a run is executing. The run trace
API can also page large traces.
- Query alerts now accept queries whose columns are computed from other
aggregate columns, such as a percentage of two aggregates. When a query
can't be watched, the Watch button stays visible but disabled and
explains why.
- Archiving unused queues from the Concurrency page is now available on
all instances, including self-hosted.
- Runs whose container or pod could not be created, or whose pod failed
before the run started, can now be requeued straight away instead of
waiting for the pending execution timeout. Both are off by default: set
`RELEASE_UNSTARTED_RUNS_ENABLED=true` on a supervisor for creates that
fail, and `RELEASE_FAILED_POD_RUNS_ENABLED=true` for pods that fail.
- Session external ids can no longer contain a `/channels` path segment
(for example `chat-1/channels/support`) or end in `:channels`, since
both forms name a session's channels. Creating a session with one now
returns a 422 validation error.
- Selecting a span that started a session now shows a link to that
session in the span panel, so you can jump from an orchestrator's run to
its sub-agents.
- Fix the batch results API returning an empty list of items for
completed batches. It now returns every run's result in trigger order.
- Fix the batch results API returning "Batch not found" for some batches
that the batch retrieve API could see.
- Fix the run page continuing to live-update forever for some cancelled
runs. These runs now show as finished, and loading their trace is
faster.
- Fix fetching the trace of a child run through the API sometimes being
very slow or failing. These requests now return quickly.
- Run metadata changes sent with an attempt's completion, such as
increments and appends, are no longer applied a second time when a
completion that already went through is retried.
- Changing your email address now requires clicking a confirmation
button after opening the emailed link.
- Fix intermittent read and subscription errors when multiple clients
first open the same realtime stream.
- Fix intermittent subscription failures and missed records when reading
newly created realtime streams.
- Fix the dashboard's task list and task filters occasionally going
stale when several `trigger dev` sessions register at the same time.
- Deleting an organization now cancels its billing subscription.
- Fix the dashboard agent's suggested threshold and window being dropped
when it prefills a query alert.
- Queries now reject an alias that reuses a table's alias in the same
SELECT, unless the aliased expression contains an aggregate or window
function (`count() AS runs FROM runs` still works).
- Queries using `WITH <expression> AS <name>` now run instead of failing
with a syntax error, and the name can be used in the rest of the query.
The name can't reuse a table alias used anywhere in the query.
- Fix a rare case where clock skew between run engine instances could
leave a run executing after its task finished, or stop a wait from ever
resuming. A run's state changes are now always ordered in the order they
happened, regardless of clock skew.
- A run whose attempt start was interrupted no longer gets stuck
executing without its task ever running, then failing as stalled.
- Fixed dropdowns sometimes picking an option by themselves when typing
with some on-screen keyboards or autofill.
- New runs a session starts are now always linked to their session, so
their Agent tab no longer fails to load because the link was missing.
- Runs no longer lose their worker's token when the cluster answers the
worker's create with a 408, so the worker starts instead of waiting for
a requeue.
- Runs no longer lose their worker's token when a concurrent delivery or
a lost answer leaves a failed worker create's token behind: the worker
that took the name keeps it, and a token nothing will use is cleaned up
instead of being kept.
- Deleting an organization now uninstalls its Vercel integration. A
Vercel installation disabled on Vercel's side is reported as such
instead of as an expired connection, and removing it no longer reports
success.
- Promoting or rolling back a deployment now updates your webhook
endpoints to match the deployment that's now current.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## trigger.dev@4.8.2

### Patch Changes

- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
  - `@trigger.dev/build@4.8.2`
  - `@trigger.dev/schema-to-json@4.8.2`
## @trigger.dev/convex@4.8.2

### Patch Changes

- Add an experimental Convex component for triggering tasks
transactionally and reading their status and results through reactive
queries, without configuring webhooks.
([`3c1cf656c`](3c1cf65))
## @trigger.dev/core@4.8.2

### Patch Changes

- Run metadata operations now reject JSON-path keys that use escaped
dots to reach `__proto__`, `constructor` or `prototype`.
([`dce5048a8`](dce5048))
- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))

Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.

- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- `runs.subscribeToRun` now ends after the run completes. The `for
await` loop exits right after the update with the final status, and the
subscription stops its connection, so a script that subscribes to a run
exits on its own. Pass `stopOnCompletion: false` to keep the
subscription open after completion.
([`485ab83aa`](485ab83))
- Add `SupervisorHttpClient.releaseRun`, which gives back a dequeued run
the worker never started so the platform requeues it at once instead of
after the pending execution timeout.
([`ba51e5573`](ba51e55))
- The supervisor keeps its run notification subscriptions across
reconnects to the webapp, and reconnects when the webapp turns its
handshake away, so cancellations and resolved waits keep reaching
running tasks after a webapp restart or deploy.
([`a9e69ab7d`](a9e69ab))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Asymmetric webhook sources can now verify ECDSA P-384 signatures
(`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256
digest of the signing string (`prehash: "sha256"`). ECDSA signatures are
accepted in DER or raw `r||s` form.
([`4ed2e3780`](4ed2e37))
## @trigger.dev/linear@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/python@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
  - `@trigger.dev/build@4.8.2`
## @trigger.dev/react-hooks@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/redis-worker@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/rsc@4.8.2

### Patch Changes

- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/schema-to-json@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/slack@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/sdk@4.8.2

### Patch Changes

- Fix `chat.inject` messages added from a tool mid-turn being saved
before the assistant's response. They now stay after the tool result,
where the model saw them, so the next turn keeps the same prompt prefix.
If you roll `@trigger.dev/sdk` back to an earlier version, chats saved
by this version lose these mid-turn `chat.inject` messages from the
model's context, though the chat history shown in the UI keeps them.
([`fc33769a5`](fc33769))
- The bundled `trigger-cost-savings` skill now notes that a webhook
delivery starts no run when no subscriber's filter matches, so it costs
no compute.
([#5051](#5051))
- Stream a sub-agent's reply through a parent tool call with
`chat.forwardSubAgent`. Each chunk is written to the parent chat once
and the tool resolves with the sub-agent's final message, so streaming a
sub-agent costs bytes in proportion to its reply. Yielding
`stream.messages()` snapshots resends the whole message on every chunk,
which grows with the square of the reply.
([`bdc994c4d`](bdc994c))

  ```ts
  execute: async ({ topic }, { toolCallId, abortSignal }) => {
    const stream = await researcher.sendMessage(topic, { abortSignal });
    return await chat.forwardSubAgent(stream, { toolCallId });
  },
  ```

Render it while it runs with `useSubAgentMessages()` from
`@trigger.dev/sdk/chat/react` (or `createSubAgentMessages()` outside
React).

- Fix a `chat.agent` turn failing after a head start that ended with two
or more parallel tool calls. When those tools finished out of call
order, the agent sent their results to the model twice on the next step,
and the provider rejected the request (Anthropic: "each tool_use must
have a single result"). Each handed-over tool result is now sent once.
([`d06ee5825`](d06ee58))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))

Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release v4.8.2 (#5073)

## Summary
5 new features, 19 improvements, 23 bug fixes.

## Breaking changes
- Query dashboard APIs reject run tokens and public access tokens
without user delegation. Existing API key access, including restricted
keys with the required query scopes, is unchanged. MCP dashboard access
remains supported through delegated tokens for current organization
members.
- The legacy `clickhouse` event store is retired: task events now go to
`clickhouse_v2`. If you self-host with
`EVENT_REPOSITORY_DEFAULT_STORE=clickhouse`, switch it to
`clickhouse_v2` and follow the self-hosting guide to copy older events,
which no longer show until you do.

## Improvements
- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Add an experimental Convex component for triggering tasks
transactionally and reading their status and results through reactive
queries, without configuring webhooks.
([`3c1cf656c`](3c1cf65))
- Run metadata operations now reject JSON-path keys that use escaped
dots to reach `__proto__`, `constructor` or `prototype`.
([`dce5048a8`](dce5048))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))
  
Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.
- `runs.subscribeToRun` now ends after the run completes. The `for
await` loop exits right after the update with the final status, and the
subscription stops its connection, so a script that subscribes to a run
exits on its own. Pass `stopOnCompletion: false` to keep the
subscription open after completion.
([`485ab83aa`](485ab83))
- Add `SupervisorHttpClient.releaseRun`, which gives back a dequeued run
the worker never started so the platform requeues it at once instead of
after the pending execution timeout.
([`ba51e5573`](ba51e55))
- The supervisor keeps its run notification subscriptions across
reconnects to the webapp, and reconnects when the webapp turns its
handshake away, so cancellations and resolved waits keep reaching
running tasks after a webapp restart or deploy.
([`a9e69ab7d`](a9e69ab))
- Asymmetric webhook sources can now verify ECDSA P-384 signatures
(`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256
digest of the signing string (`prehash: "sha256"`). ECDSA signatures are
accepted in DER or raw `r||s` form.
([`4ed2e3780`](4ed2e37))
- The bundled `trigger-cost-savings` skill now notes that a webhook
delivery starts no run when no subscriber's filter matches, so it costs
no compute.
([#5051](#5051))
- Stream a sub-agent's reply through a parent tool call with
`chat.forwardSubAgent`. Each chunk is written to the parent chat once
and the tool resolves with the sub-agent's final message, so streaming a
sub-agent costs bytes in proportion to its reply. Yielding
`stream.messages()` snapshots resends the whole message on every chunk,
which grows with the square of the reply.
([`bdc994c4d`](bdc994c))
  
  ```ts
  execute: async ({ topic }, { toolCallId, abortSignal }) => {
  const stream = await researcher.sendMessage(topic, { abortSignal });
  return await chat.forwardSubAgent(stream, { toolCallId });
  },
  ```
  
Render it while it runs with `useSubAgentMessages()` from
`@trigger.dev/sdk/chat/react` (or `createSubAgentMessages()` outside
React).

## Bug fixes
- Fix `chat.inject` messages added from a tool mid-turn being saved
before the assistant's response. They now stay after the tool result,
where the model saw them, so the next turn keeps the same prompt prefix.
If you roll `@trigger.dev/sdk` back to an earlier version, chats saved
by this version lose these mid-turn `chat.inject` messages from the
model's context, though the chat history shown in the UI keeps them.
([`fc33769a5`](fc33769))
- Fix a `chat.agent` turn failing after a head start that ended with two
or more parallel tool calls. When those tools finished out of call
order, the agent sent their results to the model twice on the next step,
and the provider rejected the request (Anthropic: "each tool_use must
have a single result"). Each handed-over tool result is now sent once.
([`d06ee5825`](d06ee58))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Add "Ignored paths" to the Git settings: pushes and pull request
updates that only change files matching these patterns no longer create
a deployment. Ignored paths don't apply while the Vercel integration is
connected.
- The `metrics` query table now includes queue size (`queue.size.*`) and
webhook limit metrics (`webhook.waiters.*`, `webhook.processing.*`,
`webhook.ingress.*`), so you can chart and alert on queue capacity and
webhook rate limits.
- New Limits alerts: watch the limits that can interrupt or degrade
runtime flow, one at a time or combined into a single alert with "any"
or "all" and the signals you choose (limit reached or approaching), in
the dashboard, the API and the agent.
- Expand short-lived run-token support to task APIs, with permission
checks for packets, metadata, streams and waits. Run tokens last one
hour independently of root-key rotation and cannot be individually
revoked. They can mint public access tokens for up to 30 days; those
tokens may outlive the run token that minted them.
- Hosted webhook endpoints can verify ECDSA P-384 (SHA-384) signatures,
ECDSA signatures in raw `r||s` form, and RSA signatures made over a
SHA-256 digest of the signing string (`prehash: "sha256"`).
- Older runs now load their trace, span details and run events faster. A
span that finishes more than a week after its run shows as still in
progress.
- The run page now loads large traces progressively and updates live
runs incrementally, so big traces open faster and open run pages no
longer reload the whole trace while a run is executing. The run trace
API can also page large traces.
- Query alerts now accept queries whose columns are computed from other
aggregate columns, such as a percentage of two aggregates. When a query
can't be watched, the Watch button stays visible but disabled and
explains why.
- Archiving unused queues from the Concurrency page is now available on
all instances, including self-hosted.
- Runs whose container or pod could not be created, or whose pod failed
before the run started, can now be requeued straight away instead of
waiting for the pending execution timeout. Both are off by default: set
`RELEASE_UNSTARTED_RUNS_ENABLED=true` on a supervisor for creates that
fail, and `RELEASE_FAILED_POD_RUNS_ENABLED=true` for pods that fail.
- Session external ids can no longer contain a `/channels` path segment
(for example `chat-1/channels/support`) or end in `:channels`, since
both forms name a session's channels. Creating a session with one now
returns a 422 validation error.
- Selecting a span that started a session now shows a link to that
session in the span panel, so you can jump from an orchestrator's run to
its sub-agents.
- Fix the batch results API returning an empty list of items for
completed batches. It now returns every run's result in trigger order.
- Fix the batch results API returning "Batch not found" for some batches
that the batch retrieve API could see.
- Fix the run page continuing to live-update forever for some cancelled
runs. These runs now show as finished, and loading their trace is
faster.
- Fix fetching the trace of a child run through the API sometimes being
very slow or failing. These requests now return quickly.
- Run metadata changes sent with an attempt's completion, such as
increments and appends, are no longer applied a second time when a
completion that already went through is retried.
- Changing your email address now requires clicking a confirmation
button after opening the emailed link.
- Fix intermittent read and subscription errors when multiple clients
first open the same realtime stream.
- Fix intermittent subscription failures and missed records when reading
newly created realtime streams.
- Fix the dashboard's task list and task filters occasionally going
stale when several `trigger dev` sessions register at the same time.
- Deleting an organization now cancels its billing subscription.
- Fix the dashboard agent's suggested threshold and window being dropped
when it prefills a query alert.
- Queries now reject an alias that reuses a table's alias in the same
SELECT, unless the aliased expression contains an aggregate or window
function (`count() AS runs FROM runs` still works).
- Queries using `WITH <expression> AS <name>` now run instead of failing
with a syntax error, and the name can be used in the rest of the query.
The name can't reuse a table alias used anywhere in the query.
- Fix a rare case where clock skew between run engine instances could
leave a run executing after its task finished, or stop a wait from ever
resuming. A run's state changes are now always ordered in the order they
happened, regardless of clock skew.
- A run whose attempt start was interrupted no longer gets stuck
executing without its task ever running, then failing as stalled.
- Fixed dropdowns sometimes picking an option by themselves when typing
with some on-screen keyboards or autofill.
- New runs a session starts are now always linked to their session, so
their Agent tab no longer fails to load because the link was missing.
- Runs no longer lose their worker's token when the cluster answers the
worker's create with a 408, so the worker starts instead of waiting for
a requeue.
- Runs no longer lose their worker's token when a concurrent delivery or
a lost answer leaves a failed worker create's token behind: the worker
that took the name keeps it, and a token nothing will use is cleaned up
instead of being kept.
- Deleting an organization now uninstalls its Vercel integration. A
Vercel installation disabled on Vercel's side is reported as such
instead of as an expired connection, and removing it no longer reports
success.
- Promoting or rolling back a deployment now updates your webhook
endpoints to match the deployment that's now current.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## trigger.dev@4.8.2

### Patch Changes

- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
  - `@trigger.dev/build@4.8.2`
  - `@trigger.dev/schema-to-json@4.8.2`
## @trigger.dev/convex@4.8.2

### Patch Changes

- Add an experimental Convex component for triggering tasks
transactionally and reading their status and results through reactive
queries, without configuring webhooks.
([`3c1cf656c`](3c1cf65))
## @trigger.dev/core@4.8.2

### Patch Changes

- Run metadata operations now reject JSON-path keys that use escaped
dots to reach `__proto__`, `constructor` or `prototype`.
([`dce5048a8`](dce5048))
- Deployed tasks now keep a valid short-lived run token for their whole
run: the token is refreshed during long runs and before a run resumes
from a checkpoint. A warm-started task no longer keeps the previous
run's token when the next run has none, and run credentials are left out
of runner debug logs.
([`aa9de9d94`](aa9de9d))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))

Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.

- Upgrade `socket.io-client` to 4.8.4 so projects using the SDK and CLI
install `ws` 8.21 instead of 8.17.1, which has published advisories
(GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked
upgrading `ws` without a package manager override.
([`2df9860b4`](2df9860))
- `runs.subscribeToRun` now ends after the run completes. The `for
await` loop exits right after the update with the final status, and the
subscription stops its connection, so a script that subscribes to a run
exits on its own. Pass `stopOnCompletion: false` to keep the
subscription open after completion.
([`485ab83aa`](485ab83))
- Add `SupervisorHttpClient.releaseRun`, which gives back a dequeued run
the worker never started so the platform requeues it at once instead of
after the pending execution timeout.
([`ba51e5573`](ba51e55))
- The supervisor keeps its run notification subscriptions across
reconnects to the webapp, and reconnects when the webapp turns its
handshake away, so cancellations and resolved waits keep reaching
running tasks after a webapp restart or deploy.
([`a9e69ab7d`](a9e69ab))
- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Asymmetric webhook sources can now verify ECDSA P-384 signatures
(`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256
digest of the signing string (`prehash: "sha256"`). ECDSA signatures are
accepted in DER or raw `r||s` form.
([`4ed2e3780`](4ed2e37))
## @trigger.dev/linear@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/python@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
  - `@trigger.dev/build@4.8.2`
## @trigger.dev/react-hooks@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/redis-worker@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/rsc@4.8.2

### Patch Changes

- Adds the `bun-1.4` runtime. `runtime: "bun-1.4"` deploys on Bun 1.4.4
in a Bun-only image with no Node.js binary, and the run controller
itself runs under Bun. `runtime: "bun"` is unchanged (Bun 1.3 with
Node.js alongside it); `bun-legacy` is accepted as an explicit spelling
of the same runtime. On Bun 1.4 the worker no longer crashes at startup
on the `--no-warnings=ExperimentalWarning` flag.
([`a8a87850b`](a8a8785))
- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/schema-to-json@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/slack@4.8.2

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.2`
  - `@trigger.dev/core@4.8.2`
## @trigger.dev/sdk@4.8.2

### Patch Changes

- Fix `chat.inject` messages added from a tool mid-turn being saved
before the assistant's response. They now stay after the tool result,
where the model saw them, so the next turn keeps the same prompt prefix.
If you roll `@trigger.dev/sdk` back to an earlier version, chats saved
by this version lose these mid-turn `chat.inject` messages from the
model's context, though the chat history shown in the UI keeps them.
([`fc33769a5`](fc33769))
- The bundled `trigger-cost-savings` skill now notes that a webhook
delivery starts no run when no subscriber's filter matches, so it costs
no compute.
([#5051](#5051))
- Stream a sub-agent's reply through a parent tool call with
`chat.forwardSubAgent`. Each chunk is written to the parent chat once
and the tool resolves with the sub-agent's final message, so streaming a
sub-agent costs bytes in proportion to its reply. Yielding
`stream.messages()` snapshots resends the whole message on every chunk,
which grows with the square of the reply.
([`bdc994c4d`](bdc994c))

  ```ts
  execute: async ({ topic }, { toolCallId, abortSignal }) => {
    const stream = await researcher.sendMessage(topic, { abortSignal });
    return await chat.forwardSubAgent(stream, { toolCallId });
  },
  ```

Render it while it runs with `useSubAgentMessages()` from
`@trigger.dev/sdk/chat/react` (or `createSubAgentMessages()` outside
React).

- Fix a `chat.agent` turn failing after a head start that ended with two
or more parallel tool calls. When those tools finished out of call
order, the agent sent their results to the model twice on the next step,
and the provider rejected the request (Anthropic: "each tool_use must
have a single result"). Each handed-over tool result is now sent once.
([`d06ee5825`](d06ee58))
- Use short-lived run tokens for supported SDK operations inside
deployed tasks when available, retaining environment-key compatibility
for unsupported operations and missing or expired tokens. Explicit
credentials still take precedence. Public-token helpers use server-side
minting with run tokens rather than signing locally.
([`5a1c14239`](5a1c142))

Project and organization queries, and branch overrides targeting another
PREVIEW or DEVELOPMENT environment, keep using compatibility
credentials. Branch headers do not change credential selection in
STAGING or PRODUCTION. Chat subscriptions reread implicit credentials
for each connection.

- Updated dependencies:
  - `@trigger.dev/core@4.8.2`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Publish docs: alerts, webhooks, self-hosting, Bun runtime and chat up…

…dates

Publish docs: webhook pricing/limits, bun-1.4 runtime, trace paging, …

…chat.forwardSubAgent, chat.inject history, deployment index storage

chore: release v4.8.1 (#5057)

## Summary
1 new feature, 1 bug fix.

## Bug fixes
- Fix `trigger deploy` failing on self-hosted instances with custom base
images. Stages built on a custom image now keep the trust store that
image ships with.
([`b5ed66b74`](b5ed66b))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Alerts can now watch the result of any supported query: raise when a
value crosses a threshold, when matching rows stop appearing, or when
new matching rows appear. Create them from the Query page, the Dashboard
Agent or the API, and see the alert's values charted on its page.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## trigger.dev@4.8.1

### Patch Changes

- Fix `trigger deploy` failing on self-hosted instances with custom base
images. Stages built on a custom image now keep the trust store that
image ships with.
([`b5ed66b74`](b5ed66b))
- Updated dependencies:
  - `@trigger.dev/build@4.8.1`
  - `@trigger.dev/core@4.8.1`
  - `@trigger.dev/schema-to-json@4.8.1`
## @trigger.dev/linear@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
  - `@trigger.dev/sdk@4.8.1`
## @trigger.dev/python@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/build@4.8.1`
  - `@trigger.dev/core@4.8.1`
  - `@trigger.dev/sdk@4.8.1`
## @trigger.dev/react-hooks@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## @trigger.dev/redis-worker@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## @trigger.dev/rsc@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## @trigger.dev/schema-to-json@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## @trigger.dev/slack@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
  - `@trigger.dev/sdk@4.8.1`
## @trigger.dev/sdk@4.8.1

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.1`
## @trigger.dev/core@4.8.1

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>