Aller au contenu principal

Changelog

Quoi de neuf dans Tale ?

Les notes de version de Tale, de la plus récente à la plus ancienne — publiées depuis GitHub Releases.

Source : GitHub Releases.

v0.4.10

0.4.10 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy --stop. One non-destructive Convex backfill applies automatically. Recreate the knowledge database (db on the CLI stack) so conversation_id exists; a default tale deploy leaves that container on the old image and every private knowledge search returns nothing.

Highlights

Chat can list the board, conversations, and emailed attachments — under the same assignment privacy as the Inbox. Asking "are there any open tasks?" used to match a random project description; it now lists in-scope work newest-first. Conversations are searchable (message bodies are not). Emailed attachments appear newest-arrival-first with a corpus ref for rag_fetch, and their chunk header carries the mail's subject and correspondent so "CVs for the sales role" can match a file that never says "sales". A project-bound thread is told which project it is in. Archived work stays searchable and is labelled archived. (#3002, #3003, #3006, #3007, #3008, #3014, #3029, #3033, #3035)

Task-agent work keeps going after a blip. Retry, Request changes, and a later @mention resume the same harness conversation instead of rebuilding a 10-message brief. A retryable failure re-kicks itself immediately, up to three consecutive times; dead ends (deadline, park_deadline, agent_deleted, agent_model_missing) never retry. The run error shown is the harness's own final text. (#3026, #3030)

A tale API key can run the unattended worker journey end to end. New Projects and Tasks routes find or create a client project, prepare folders, upload files, bind an automation, create and start a task, then read comments and filed results. Auth is Authorization: Bearer; visibility is re-checked per request; misses are opaque 404s. Project uploads skip RAG by default and never appear in the Hub document family. (#3032)

Breaking changes

  • Knowledge-db must pick up conversation_id. Platform now selects private_knowledge.documents.conversation_id. If the column is absent, both search legs return empty and the log tells you to restart the knowledge database container (it runs dbmate at start). On the CLI single-node stack that corpus lives in db, and db is stop-gated — recreate it with tale deploy --stop (or recreate knowledge-db on a split compose). Per-org BYO corpora apply pending dbmate files on first touch from the new platform image; the bundled corpus does not. (#3011)
  • X-Organization-Slug is now read. It was documented and ignored. A client that sent a slug different from the key user's last-active org now hits that slug (membership-checked) instead of silently following the dashboard. New Projects/Tasks routes never guess: a multi-org key without the header gets 400 ORG_SLUG_REQUIRED. Single-org keys are unchanged. (#3032)

Security

Dependency bumps. Mermaid is rendered from chat and docs markdown; the others are hygiene — this repo does not call the affected Hono or undici APIs.

  • mermaid 11.16.1 — CVE-2026-71436 (XY chart axis loop) and CVE-2026-71437 (architecture-beta prototype pollution). (#2934)
  • hono 4.12.34 — CVE-2026-71848 (languageDetector quadratic DoS) and CVE-2026-71849 (hono/proxy hop-by-hop forward). (#2831)
  • undici 7.29.0 — CVE-2026-13697 (shared-cache private="") and CVE-2026-16728 (interceptors.retry() Content-Length desync). (#2899)
  • postcss 8.5.23 — CVE-2026-69153 (source map path when from is unset). Build pipeline, not a running-instance HTTP path. (#2859)

Behaviour changes

  • rag_search is two verbs. action: "search" is unchanged retrieval; action: "list" browses one kind. Missing action + a query still searches; missing action + a kind still lists. Old transcript rows stay valid. (#3029)
  • Archived projects and their tasks stay visible to chat, labelled archived / projectArchived. The Documents UI still hides archived rows. (#3007)
  • Failed task-agent runs auto-retry (three immediate kicks) unless the failure is a named dead end. The UI shows "Auto-retry n of 3". No org kill switch in this release. (#3030)
  • Emailed files index at bind, conversation-scoped, assignment-live. A reassignment moves who may read them with no rewrite. Quiet old mail stays unindexed until a poll touches it (listing ≠ indexing). (#3010, #3011, #3012)
  • Inbox shows Content-ID attachments unless the HTML actually references that cid. Re-polling the cursor message reuses stored pointers instead of minting a new blob every five minutes. Assigned-mailbox ingest works again (closed validators had dropped assignee fields and killed sync). (#3000, #3009, #3013)
  • REST project uploads default skipRagIndexing: true. (#3032)
  • Project → Knowledge → Files can Delete from the row (legal-hold and connector-sourced still refused). "Remove from project" still detaches to org-wide — that is no longer the only path. (#3004)
  • Forms mark optional fields with (optional) instead of a red asterisk on required ones. (#2994)
  • Upload allowlist grows json, yaml, yml, py, md, ac2. Automation Uploads is a real collapsed tree; with subdir it lists only that subtree. (#3001, #3031)
  • A dead knowledge search (no embedding model) warns with the org id and points at Settings → Data residency; the raw error no longer reaches the user. (#3005)

Migration notes

tale deploy applies one new non-destructive Convex migration automatically; tale migrate status lists it afterwards:

  • 0.4.1/05_backfill_mail_attachment_received_at — stamps mailReceivedAt from _creationTime on bound fileMetadata rows that lack it, so attachments bound before the field existed appear in the mail-arrival index. Updating from 0.4.0 still applies 01–04 on the way, then 05.

Knowledge Postgres (not the Convex chain):

  • private_knowledge/00000000000008_knowledge_private_conversation_scope.sql — adds conversation_id and a partial index. Applies when the knowledge-db container starts on an image that contains the file. Default tale deploy does not recreate db. migrate:down is empty on purpose: dropping the column would silently widen conversation-scoped attachments to org-hub.

Upgrading

tale update         # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.10
tale deploy --stop  # pulls the 0.4.10 images, recreates db/proxy, applies migrations

tale deploy without --stop updates the app images and the Convex backfill, but leaves db on the previous image. Private knowledge search then returns nothing until you recreate that container.

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.9

0.4.9 is a fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it.

Highlights

Chat web_fetch pages like rag_fetch — a long page is no longer a dead end. The tool used to clip to the first 20,000 characters with no way to continue, so a longer page (a 39.7k-char weather JSON, a long docs article) sent the model into refetch loops until the turn's step limit. Optional offset/limit now select a window of up to 20,000 characters of the extracted text, and a truncated read reports totalChars plus the nextOffset to continue from. (#2982)

Behaviour changes

  • web_fetch accepts offset and limit. Same contract as rag_fetch: limit is 1–20,000 (default 20,000); offset indexes the extracted text (HTML goes through htmlToText), not response bytes. Each window re-fetches the live page and slices — an HTTP Range request could never line up after extraction. (#2982)
  • A truncated read reports nextOffset. The model is told to keep fetching until nextOffset is absent, or to say which part it read. truncatedAt is gone from the result; the two fetch tools share one paging contract. (#2982)

Migration notes

No new data migrations in 0.4.9 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.9
tale deploy    # pulls the 0.4.9 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.8

0.4.8 is a fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it.

Highlights

Authenticated requests no longer pay a JWKS fetch on every call, and a chat turn opens in one write. Convex validates the caller's JWT on every request that carries one — including every ctx.run* from a 'use node' action — and the JWKS endpoint returned no cache headers, so the backend's HTTP cache treated every 200 as instantly stale. Production sat at 677–900 ms of "Setup before model" for three ~12 ms mutations; the same tax hit get-session, composer models, and every other authenticated surface. The exact-path JWKS route now stamps Cache-Control: public, max-age=300, so validation serves keys from memory. The turn open (user message + assistant placeholder + generation row) is one internal mutation instead of three sequential authenticated syscalls — and a beginGeneration throw that used to land outside the turn's try can no longer strand an orphan placeholder the recovery sweeper cannot see. (#2981)

Behaviour changes

  • JWKS responses are cacheable for 300 seconds. Key-rotation staleness is bounded by that max-age (JWTs themselves live 15 minutes). Deployment-wide, JWT validation stops costing an isolate execution per request. (#2981)
  • A chat turn opens atomically. User message, assistant placeholder, and generation row commit together. Sequence numbers are assigned in-transaction. In the deferred-send lane an open failure is now all-or-nothing — the window where the user's text could previously survive a partial setup (writes 2/3 failing) now loses it the same way a write-1 failure always did. The interactive lane is unaffected; the composer keeps the text. (#2981)

Migration notes

No new data migrations in 0.4.8 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.8
tale deploy    # pulls the 0.4.8 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.7

0.4.7 is a fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it.

Highlights

Chat no longer dies mid-plan when the tool-round budget runs out, and reply ceilings follow the model catalog. A document-heavy turn that hit MAX_TOOL_ROUNDS used to withhold tools on the forced last round and say nothing — the model announced its next lookup and stopped. The last offered round now tells it to batch every remaining lookup as parallel calls; the forced round tells it the budget is spent, to answer from what it read, and to state coverage honestly. The reply ceiling was a constant 4096 whatever the catalog declared — a 1M-context / 384k-output model still got max_tokens: 4096 and cut off mid-sentence. Default and thinking maxTokens now follow the declared maxOutputTokens; 4096 survives only as the undeclared-entry fallback. (#2980)

Behaviour changes

  • The tool-round budget is steered on the wire, not enforced silently. Two user-role notices (truncation-notice pattern; never persisted): the last offered round asks the model to batch remaining lookups as parallel calls; the forced round says the budget is spent and to answer from what it already read. Tool docs declare the per-reply lookup budget up front. (#2980)
  • Reply and history ceilings come from the catalog. maxTokens follows declared maxOutputTokens; the remaining structural rule is the output share (half the window) so a huge declared output cannot starve the history slice. Governance that shrinks the effective window re-fits sampling so the maxTokens > budgetTokens wire invariant survives. (#2980)
  • The flat 96k history cap is gone. The history slice is the effective window minus output reserve and system prompt. Cost control is the explicit governance maxContextTokens cap, not a hidden constant — long threads on 1M-window models now replay what the window allows. (#2980)

Migration notes

No new data migrations in 0.4.7 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.7
tale deploy    # pulls the 0.4.7 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.6

0.4.6 is a fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it.

Highlights

Chat Auto no longer picks a draft model for a document. A short prompt plus a PDF used to score as draft because attachments were invisible to the band heuristic — a 491-page statute was summarized from one 20k-character window. A document attachment now floors the band at standard. The rag_fetch tool description now says: never present a partial read as a summary of the whole source — keep fetching until nextOffset is absent, or say exactly which part was read. (#2979)

Behaviour changes

  • Messages with a document attachment (not image, audio, or video) never land below the standard band on Auto. The floor applies on every path (bare file send, trivial greeting), outranks the light-work discount, and never lowers what the text already earned. Follow-ups without re-attaching re-score on text. (#2979)
  • rag_fetch is steered to keep fetching until nextOffset is absent, or to name exactly which part was read. (#2979)

Migration notes

No new data migrations in 0.4.6 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.6
tale deploy    # pulls the 0.4.6 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.5

0.4.5 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it.

Highlights

OpenAI GPT-5 family works on a native OpenAI or Azure credential. Connecting a real key and picking gpt-5.5 400'd: the rewrite always sent max_tokens and temperature: 0.7, both hard-rejected by the GPT-5 reasoning family on api.openai.com and Azure v1. wireDialect: openai-modern on the shipped openai and azure connectors restores the 0.3 behaviour — output cap is max_completion_tokens, custom temperature only for models known not to reason. Third-party OpenAI-compatible hosts keep the classic fields (DeepSeek silently ignores max_completion_tokens). gpt-5.5 also refuses function tools with any effort above none; the catalog declares that, the picker offers no effort levels, and title generation sends the off value so a short title does not burn its budget thinking. Provider 400s now show the full body in Technical details instead of a lone {. Catalog: gpt-5.3-chat → gpt-5.3-chat-latest, gpt-5.6 luna / luna-pro / sol added, gpt-5.5 context corrected to 1,050,000. (#2976)

Short replies stream immediately. Empty-filter replies emit and persist on the first tokens instead of waiting for 120 characters or finalize, so TTFT is first provider SSE text. Thinking stays up until the typewriter paints a glyph. Message information separates You waited (click → first paint) from server Duration / TTFT. (#2977)

Native DeepSeek catalog is V4. deepseek-chat / deepseek-reasoner stopped resolving on 2026-07-24. The picker lists V4 Flash and V4 Pro; thinking is an effort knob, not a second model. A leftover sticky pick of the old id falls back to Auto. (#2978)

Behaviour changes

  • Shipped OpenAI and Azure connectors speak openai-modern. A custom connector that talks to api.openai.com or Azure v1 should declare wireDialect: openai-modern or it will keep sending max_tokens + temperature: 0.7 and 400 on GPT-5 reasoning models. Third-party OpenAI-compatible endpoints should stay on the default dialect. (#2976)
  • gpt-5.5 effort is locked off when tools are present (chat always carries tools). The picker explains why instead of offering levels that 400. (#2976)
  • Technical details shows the full provider error body (redacted, stack frames stripped). Toasts get a one-line summary. (#2976)
  • Native DeepSeek ids changed. deepseek-chat / deepseek-reasoner are gone; pick V4 Flash / V4 Pro. A sticky old id already falls back to Auto. (#2978)
  • Message information clocks are named. You waited is click → first paint; Duration / TTFT start at the server, not at send. (#2977)

Migration notes

No new data migrations in 0.4.5 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.5
tale deploy    # pulls the 0.4.5 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.4

0.4.4 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it. Update the CLI first: the 0.4.3 binary refused in-place 0.4.x deploys when the running image had no OCI version label.

Highlights

In-place 0.4.x deploys work again. tale deploy of 0.4.3 onto a live 0.4.2 instance was refused as a 0.3 → 0.4 breaking cutover because GHCR image labels: replaced the Dockerfile LABEL and never set org.opencontainers.image.version. The CLI now reads the compose image tag (then TALE_VERSION) when that label is missing, and 0.4.4 images carry the label. (#2973)

Chat defaults to Auto. A session with no model pick lets Tale choose per message — draft / standard / frontier from the text, then governance pin → curated band → cheapest by output price — and records the concrete model on the reply. An existing explicit pick is untouched; pinning a model turns Auto off. Tasks, automations, Arena, and the API stay explicit-only. (#2974)

Follow or silence a task. A Follow / Following control with a mute toggle sits in the task sheet. Bulk edits now notify like a single-card move — status, assignment, and the review gate — with the same per-subject collapse. (#2970)

Plus: forms mark optional fields instead of starring required ones, and a few ad-hoc alerts/badges move onto the design-system components (#2965). Website content search no longer shows an unbounded BM25 score caption (#2975).

Behaviour changes

  • Update the CLI before deploying. A 0.4.3 CLI still cannot read the running version from a 0.4.2/0.4.3 image that lacks the OCI label, and will refuse the deploy. tale update first, then tale deploy. If you already wrote $DEPLOY_DIR/.tale/deployment-previous-version, that workaround stays valid. (#2973)
  • Chat opens on Auto for anyone who never picked a model. The resolved model is what governance judges and what messages.model records. An unresolvable Auto (empty catalog, policy leaves nothing, no vision model while images are staged) refuses with a toast. (#2974)
  • Required fields no longer show a red asterisk. Optional fields are labelled "(optional)"; the HTML required attribute still carries the meaning for assistive tech. (#2965)
  • Bulk task edits notify. A multi-card drag fans out per card, collapsed per subject. (#2970)

Migration notes

No new data migrations in 0.4.4 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.4 — do this first
tale deploy    # pulls the 0.4.4 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.3

0.4.3 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it. Behaviour changes below are worth a scan if you run project agents, automations, or lean on the notification inbox.

Highlights

Agents you configure, not hard-code. Project agents and automation agent nodes now take a grantable catalog of workspace tools — first-party reads (task/document/knowledge/contact/product/website find, task get) and writes (task create/comment/update status/upsert by external ref, document create) — next to Skills & Connectors. Named org secrets inject into a turn as environment variables, the escape hatch for a service with no connector. A blank New automation lane scaffolds a single-agent canvas you wire by hand, the counterpart to the AI builder. (#2964)

Chat attachments that stay in the conversation. Drag-and-drop or pick documents onto a message; they index thread-scoped (retrievable only inside that conversation's lineage, never through org knowledge). A send while files are still processing parks above the composer and goes out on its own when ready. Pasted YouTube/Vimeo/Bilibili links fetch captions (or transcribe) in the background. Assistant steering moved onto the tool descriptions: when to search, when not to, when to fetch. (#2971)

Notifications that tell you the current state. Unread assignment, review, status, and deadline events on the same subject collapse into one row and one email (60s debounce); an unread assignment undone before you see it disappears. Unassignment now notifies. Task start/due/overdue alerts have their own Settings group instead of riding status-change and agent-escalation. The review gate opens whenever a task reaches In review — a person parking the card, an agent settle, or an automation — and designating a reviewer subscribes them and tells them. (#2967, #2968, #2969, #2972)

Plus: task start and due dates sit beside their labels on wide panels (#2966).

Behaviour changes

  • A write-tool grant is the authorization. Project agents and automation agents that hold a write tool run it without a per-call approval on the async lanes. Authority is the session's binding (project-pinned for task ops); a user chat session stays read-only. Secrets are developer-gated. (#2964)
  • Chat uploads are thread-scoped. They are not visible to org knowledge search. (#2971)
  • Unread notifications collapse per subject and dimension. A burst of reassignments becomes one row naming the current assignee; a comment or mention never collapses. Email follows the same rule. (#2968)
  • The review gate follows the card, not the agent. Moving a task to In review opens a review request for the designated reviewer whether a person or an agent did the work. Requesting changes returns the card to In progress. (#2967)
  • Deadline alerts are their own preference. Muting board status-change no longer mutes start/due/overdue; those email. Unassignment is bell-only, on the assignment toggle. (#2969)
  • Knowledge search is stricter, and a turn takes fewer tool rounds. rag_search drops dense hits below 0.45 similarity; same-round duplicate tool calls run once; the turn loop caps at 4 tool rounds (was 8). (#2971)

Migration notes

No new data migrations in 0.4.3 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.3
tale deploy    # pulls the 0.4.3 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.2

0.4.2 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy. No data migrations ship with it. One default behaviour change is listed below — read it if you want to know what knowledge your agents can reach.

Highlights

Pick the provider that serves an agent's model. The agent dialog's Model field is now a searchable picker with one entry per (provider, model) pair, the serving provider named under every option — with an Anthropic subscription broker and an OpenRouter key configured side by side, claude-sonnet-5 — Anthropic · Subscription and anthropic/claude-sonnet-5 — OpenRouter are two distinct, honest choices. A picked model is pinned: the run resolves exactly that provider and fails with the reason if it can't, instead of silently serving (and billing) through whichever connector matched first. Task agents can now also run on subscription credentials (e.g. an Anthropic subscription driving Claude Code) — flat-rate vendor serving with no per-token metering. (#2959)

Agents come with organization knowledge built in. Task-agent and automation runs now carry rag_search and rag_fetch by default, so a managed run can search organization knowledge and read a matched document or crawled page in full — no per-agent tool configuration. Access follows the run's binding: a project-bound run reads its project, shared team libraries, and the org hub; an org-level automation run reads the hub only. (#2957)

Plus: an automation run whose output is null or a bare value now shows that value instead of an ERROR placeholder — the same fix covers every JSON panel (run input/output, step detail, effects, approvals) (#2958); and a UI polish pass tightens the export-chat dialog, adds a way back from the shared-chat preview, sits the archive banner and sidebar section flush, and drops the redundant "Suggested follow-ups" label (#2960).

Behaviour changes

  • Task and automation agents can retrieve organization knowledge by default. Every managed run now holds rag_search + rag_fetch, scoped to what its binding already sees (project + shared team libraries + hub for project-bound runs, hub only for org-level automations) — no wider than the humans in the same scope, but agents that previously had no knowledge access now do. (#2957)
  • A newly saved model pick is pinned to its provider, fail-closed. If the pinned provider's credential is later removed, the run fails with that reason rather than falling back to another connector. Existing agents keep the previous resolution until they are re-saved with a pick from the new picker. (#2959)

Migration notes

No new data migrations in 0.4.2 — tale deploy is an image update only. Updating straight from 0.4.0 applies the four 0.4.1 migrations automatically on the way.

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.2
tale deploy    # pulls the 0.4.2 images

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.1

0.4.1 is a feature and fix release on the 0.4 line — an in-place update: tale update, then tale deploy. Four non-destructive data migrations ship with it and apply automatically during deploy; there are no manual steps. Two deliberate behaviour changes are listed below — read them if your organization leans on org-wide knowledge search or a shared inbox pool.

Highlights

Inbox, synced from real mailboxes. Every connected mail credential now syncs into the shared Inbox for triage, each on its own watermark so repeat syncs pick up where they left off, per mailbox (#2915, #2916). Email attachments are stored at ingest and follow the conversation (#2914), and a mailbox's "From" mirrors the IMAP login instead of guessing at an address (#2924, #2925).

Agent runs you can steer and review. Write into a live agent run and it picks your message up mid-flight instead of waiting for the next run (#2921). Agent task work can name a human reviewer: approving settles the task, requesting changes sends it back to the agent with the comment (#2927). Runs whose finishing step died mid-flight now recover instead of stranding the task (#2920), and a running run's badge keeps spinning (#2926).

A provenance layer for regulated processes. Every settled agent run writes one immutable entry to the organization's tamper-evident audit chain: the models actually served, the capability snapshot the run held, spend, produced outputs with checksums, the knowledge it read, approvals raised, and the reviewer linkage (#2947). Project agents and automation nodes accept an autonomy tier (a1 declares posture, a2 parks every outbound write for approval, a3 refuses outbound writes outright), admins can grant competence records, and a review policy can require an independent, competent reviewer. Documents gain opt-in controlled records — draft → in-review (frozen) → approved (immutable), with checksum-addressable approved versions — visible and manageable from the project Files tab (#2954).

Tasks and projects. Tasks get a start date (#2930) and notify assignees when a task starts or comes due (#2943); labels are promoted from freeform strings to a project-scoped catalog with colours (#2929, migrated automatically); your own assignments stand out at a glance (#2944). The projects list shows live open/done task and agent counts (#2939, backfilled), a project with a bound automation gets an Automations tab (#2952), and the list's bulk delete is replaced by reversible bulk archive (#2953).

Plus: conversation privacy is built-in (#2923, see below), skills drop the retired usage-mode and — for new skills — private visibility (#2922), the share-chat dialog is redesigned with neutral feedback buttons (#2946), error toasts say what went wrong (#2935), the dark-mode date picker is readable again (#2945), and row actions are named for screen readers (#2937).

Behaviour changes

  • Knowledge retrieval now enforces document visibility. Team- and project-scoped documents were documented as scoped but remained retrievable org-wide through knowledge search; after the automatic backfill they are returned only to users who can see the document. If someone relied on the org-wide behaviour, share those documents with their team or move them to the org hub. (#2947)
  • Conversation privacy is built-in, not a policy. A thread assigned to a team or person is visible to exactly them (admins and owners see everything); unassigned mail is admin triage, no longer visible to every member. If inbound mail should reach a group on arrival, point conversation routing at a team queue. The old opt-in conversation_access policy is ignored. (#2923)

Migration notes

tale deploy applies four non-destructive migrations automatically; tale migrate status lists them afterwards:

  • 01_automation_pins_to_bindings — automation project pins become explicit binding rows; an automation can now be bound to several projects.
  • 02_task_labels_to_catalog — freeform task labels become the project's label catalog, and tasks reference it.
  • 03_backfill_project_rollup_counts — pre-existing projects get their open/done/agent counters computed.
  • 04_backfill_corpus_document_scope — knowledge-corpus rows inherit their document's team/project scope (the retrieval change above).

Upgrading

tale update    # a 0.4.x CLI stays on the 0.4 line and picks up 0.4.1
tale deploy    # pulls the 0.4.1 images and applies the migrations

On 0.3.x? The 0.3 → 0.4 cutover is a fresh deployment, not an upgrade — read the v0.4.0 release notes and Upgrades → 0.3 → 0.4: breaking cutover before moving.

What's Changed

Voir sur GitHub

v0.4.0

0.4.0 is a breaking minor: it requires a fresh deployment. There is no upgrade path between 0.3.x and 0.4 — in either direction. If you operate a 0.3.x instance, read the breaking changes below before touching anything.

Highlights

0.4 rebuilds Tale's AI backend, and with it the data model, from a clean baseline on a minimal YAML-config core (#2857). Automations are versioned configurations you upload and deploy in one click; task agents work a task end to end, with a live step timeline, run details, and output attachments on the board; and chat is scoped to what it does best — ask and retrieve — with complex jobs handed to tasks and automations (#2877). The "integration" concept is retired in favour of rebuilt credential and skill catalogs (#2876, #2889).

Knowledge ingestion, the website crawler, chat image attachments, and audio transcription were rebuilt on the new backend — the crawler now also handles documents, URL lists, and JS-rendered pages. The versioned-migration framework restarts at the 0.4.0 baseline: 0.4+ releases carry migrations for what they ship, and nothing older.

Breaking changes

  • No 0.3 → 0.4 in-place upgrade — 0.4 requires a fresh deployment. The versioned-migration history was reset at the 0.4.0 baseline; no 0.4+ binary carries the pre-0.4 migrations. Nothing from a 0.3 instance is carried over: chats, automations and their run history, knowledge entries, task history, users and sign-ins. Files in a BYO-S3 bucket physically remain in the bucket, but the new instance has no references to them.
  • Guard rails, if you skip this: tale deploy with a 0.4 CLI refuses to touch an instance whose running version is below 0.4.0, before pulling an image or writing anything; a container booted over pre-0.4 data exits fatally with the [migrations][breaking-cutover] log marker. The expert override — tale deploy --accept-data-loss, or TALE_ACCEPT_DATA_LOSS=1 on the container — exists for deliberately reusing a host whose old volumes you have already dealt with: pre-0.4 data on that instance becomes permanently unreadable.
  • Downgrading below 0.4.0 is equally unsupported. A 0.3.x release cannot read data created by 0.4+ — restore a pre-0.4 snapshot or deploy 0.3.x fresh instead.

Staying on 0.3.x

Staying on 0.3.x for a while is a supported choice: the release/0.3 branch keeps receiving security and critical fixes. Check your CLI version first (tale --version):

  • 0.3.12 or newer — you are set: tale update stays within the 0.3.x line and never crosses to 0.4 on its own.
  • 0.3.11 or older — pin the line explicitly with tale update --version 0.3.12. CLIs older than 0.3.12 target the newest release regardless of line, so a bare tale update fetches the 0.4 CLI. That is harmless for your data — a 0.4 CLI refuses to deploy over a 0.3 instance — but you would then have to downgrade the CLI the same way.

Moving to 0.4

Moving is a re-onboarding, not an upgrade — the full walk-through is in Upgrades → 0.3 → 0.4: breaking cutover.

# 1. Leave the 0.3 instance untouched (it keeps serving).

# 2. Get the 0.4 CLI (a 0.3.12+ CLI never offers 0.4 on its own — cross lines explicitly):
tale update --version 0.4.0
# ...or on a fresh machine:
curl -fsSL https://raw.githubusercontent.com/tale-project/tale/main/scripts/install-cli.sh | bash

# 3. Deploy fresh in a NEW project directory:
mkdir tale-04 && cd tale-04
tale init
tale deploy

# 4. Re-onboard: organizations, users (invite / SSO), configuration,
#    documents and knowledge re-upload.
# 5. Decommission the 0.3 instance once the new one is accepted.

What's Changed

Voir sur GitHub

v0.3.12

Upgrade behaviour change: tale update now stays on your release line

tale update (without --version) now targets the newest release within your current x.y release line — a 0.3.x instance updates to the newest 0.3.x and never crosses to a newer line on its own. When a newer line exists, the command says so and prints the exact tale update --version <ver> command to move deliberately. Explicit --version behaves as before (any version, up or down).

Why this matters now: the upcoming 0.4.0 is a breaking, fresh-deploy-only release with no 0.3 → 0.4 upgrade path. Update your CLI to 0.3.12 before 0.4.0 ships, so a routine tale update keeps your instance safely on 0.3.x. Details: Upgrades docs.

What's Changed

Voir sur GitHub

v0.3.11

What's Changed

Voir sur GitHub

v0.3.10

What's Changed

Voir sur GitHub

v0.3.9

What's Changed

Voir sur GitHub

v0.3.8

What's Changed

Voir sur GitHub

v0.3.7

What's Changed

Voir sur GitHub

v0.3.6

What's Changed

Voir sur GitHub

v0.3.5

What's Changed

Voir sur GitHub

v0.3.4

What's Changed

Voir sur GitHub

v0.3.3

What's Changed

Voir sur GitHub

v0.2.99

What's Changed

Voir sur GitHub

v0.2.98

What's Changed

Voir sur GitHub

v0.2.96

What's Changed

Voir sur GitHub

v0.2.94

What's Changed

Voir sur GitHub

v0.2.93

Highlights

Attach images and documents to tasks

Tasks can now carry attachments. Attach images and documents (PDF / Office / CSV / text — no audio or video) when creating a task, and add or remove them from a task's detail view. Up to 10 files per task, validated against an images/documents MIME allow-list, with each storage id verified to belong to your org. Removing an attachment or deleting a task purges the underlying blob. The attachment array is self-described on the task row, so the board and detail views render without an extra join. (#2168)

One-click prompt library

With an empty composer there is nothing to save as a draft, so the bookmark button's dropdown only ever offered "Prompt library". The bookmark now opens the Prompt library dialog directly when the composer is empty — one click instead of two. When the composer has text it is unchanged: the dropdown still offers Save prompt draft plus Prompt library. (#2166)

Fixes

  • Chat — org isolation on switch: Switching organizations with a chat thread open kept rendering the previous org's chat. The by-id thread queries now authorize against the org you are acting in (not the thread's own org), and their query keys are org-scoped so the switch-time cache purge drops them. Tenant isolation was never broken — non-members could not read the data; this fixes context coherence for members of multiple orgs. (#2170)
  • Issue desk — issues now render: The issue desk showed no issues even when untracked GitHub issues existed, because the integration list reader looked for data / pagination at the top level while the connector payload lives under .result. A shared readIntegrationListPage helper now unwraps the envelope (and tolerates a flat payload for forward compatibility). (#2175)
  • Actionable error messages: Convex redacts raw throw new Error(...) to "Server Error" in production, so clients that branched on the message text were silently dead in prod. Expected-failure throws on knowledge/website duplicates, approval and human-input cards, and automation triggers now use ConvexError({ code }) mapped to localized, actionable messages in en/de/fr. (#2172, closes #2056)
  • Project chat list: Task and project discussion threads no longer leak into a project's chat folder — listProjectThreads now applies the shared isHiddenFromChatHistory guard already used by the main chat list. (#2168)

For operators

Both items below are operator-facing but require no data migration. Upgrade as usual — tale upgrade then tale deploy — and compose is regenerated for you.

  • llm-gateway renamed to sandbox-llm-gateway (#2178). The bare name over-claimed scope: in-sandbox coding agents (Claude Code / OpenCode) are its only clients — regular chat calls providers directly from Convex and never touches it. The service, container, image (tale-llm-gateway → tale-sandbox-llm-gateway), build context, and LLM_GATEWAY_* env family are all renamed. Backward compatible for one release: tale upgrade migrates your LLM_GATEWAY_* vars to SANDBOX_LLM_GATEWAY_* in place — the gateway admin password is preserved, never regenerated — and a transitional network alias plus env fallback keep in-flight sandbox sessions resolving across the deploy. The llm-gateway-data volume keeps its name (derived cache, re-provisioned per session). The transitional shims are removed next release.
  • Sandbox drops blue-green for in-place drain (#2179). The sandbox tier becomes a single container reached via the bare sandbox alias, deployed roll-in-place after a drain — exactly like convex. The platform tier keeps its blue-green flip. This removes the deploy-time colour concept from the data layer and fixes a class of "fetch failed" chat turns: after a flip tore down a colour, a chat session pinned to the now-gone sandbox-<colour> host hard-failed its liveness probe forever. The spawnerColor schema fields are kept deprecated-optional, so existing rows still read — no migration this release (a follow-up clears the values and drops the fields).

Full changelog: https://github.com/tale-project/tale/compare/v0.2.92...v0.2.93

Voir sur GitHub

v0.2.92

Highlights

Faster sandbox container builds (opt-in)

DinD sandbox sessions used to rebuild every Docker layer from scratch — each session got an ephemeral inner /var/lib/docker. A new shared, persistent BuildKit daemon (sandbox-buildkitd) gives every session on a host one content-addressed build cache, so docker build / docker compose up --build in one session reuses the layers another already built — transparently, with no per-build flags or hardcoded IPs. Build steps stay egress-fenced like the rest of the sandbox. Off by default; enable with SANDBOX_DOCKER_BUILD_CACHE=true (only meaningful with DinD). (#2164)

Issue resolution desk: self-closing and multi-repo

The Issue desk now finishes its own work and is no longer hardcoded to a single repository. Tasks parked at in_review auto-close when their PR is merged out of band (GitHub UI, CI automerge, a teammate) instead of being stranded forever, and each install configures its own target repo. Built as app data plus small generic platform primitives — no per-vertical backend code. (#2153)

Fixes

  • Sandbox / deploy: A tale deploy blue-green flip that left an old colour lingering kept the bare sandbox network alias, so session creates failed with a persistent 503 draining on every retry — not just a transient flip-window race. The flip now revokes the alias from the lingering colour, with a drain-retry on session create. (#2162)
  • Chat attachments: Audio/video files in the 100–200 MB band were wrongly rejected because the per-file gate clamped the media ceiling back down to the 100 MB generic cap; media now uses its own ceiling (the 200 MB total cap and 4-hour duration check remain the real gates). Unsupported types with no configured upload policy now show the correct rejection toast. (#2156)
  • Chat: Thread titles fall back to the user's first message when no title is generated. (#2161)
  • Chat i18n: Resolved-state status badges on approval cards are now translated, and missing chat-panel, canvas, and live-browser keys were added across all locales. (#2157, #2159)
  • Export: Fixed the export-dialog nested-button hydration warning and relabeled the PDF export option. (#2160)
  • Issue desk: Stopped the desk's first page rendering empty. (#2151)
  • Enterprise SSO: Seed the SSO form's select/switch controls with defined defaults. (#2099)
  • Reliability: Log and surface failures that were previously swallowed in empty catch blocks. (#2158)

Developer experience

  • Boot the dockerized dev stack with zero .env config, and forward host env into the docker:dev container. (#2163, #2165)

For operators

Upgrading adds a new optional service image, sandbox-buildkitd. Run tale upgrade then tale deploy as usual — compose is regenerated to include it. The shared build cache is off by default; enable it with SANDBOX_DOCKER_BUILD_CACHE=true (DinD only). No data migration is required.

Full changelog: https://github.com/tale-project/tale/compare/v0.2.91...v0.2.92

Voir sur GitHub

v0.2.91

Bug fixes for the Researcher (deep-research) chat experience.

Fixes

  • Researcher chat no longer flickers or gets stuck. Deep-research runs that delegate to the Researcher could crash-loop the chat and leave it stuck on "Thinking" — a delegated sub-thread's live stream returned a payload the chat client couldn't read. Sub-threads are now authorized via their parent thread and stream cleanly, restoring the nested delegation timeline.

  • The research plan stays visible. The live to-do plan could appear and then vanish mid-run once the assistant made its own web/integration calls — an empty integration-tracking record was shadowing the delegate's real plan. The plan now persists and tracks progress through the whole run.

  • The plan-approval gate actually holds. request_human_input (e.g. the Researcher's "confirm plan" card) now hard-stops the turn and waits for your response, instead of being auto-retried straight past into execution.

  • Delegated agents no longer strand an approval. A delegated sub-agent's approval request previously left a pending card that locked the composer with no way to resume it; the gate is now handled by the agent you're talking to.

Full changelog: #2152

Voir sur GitHub

v0.2.90

Highlights

Chat & workspace files

  • Unified canvas file viewer. Every file in the workspace canvas now sits under one action card with a single, consistent set of controls — download, a Source / Preview toggle, and line-wrap. The Source/Preview and wrap choices are sticky: pick Preview (or turn on wrapping) on one file and it carries to the next file you open, while any file you've explicitly toggled keeps its own choice. (#2135)
  • "Save as" for workspace files. Downloads honor the real workspace filename for both agent-generated text (code/markdown/svg held in memory) and remote files in storage (images, oversized attachments) — no more saving under a storage UUID.
  • Chat file-panel UX polish across the file panel, viewers, and code rendering. (#2148)

Apps

  • App details page plus assorted platform UI polish fixes. (#2136)

Sandbox — document toolchain baked into the runtime image

Agents running in the sandbox can now convert and render documents out of the box; these OS-level tools are baked into the sandbox-runtime image (they can't arrive via the per-execution uv pip install path): (#2148)

  • LibreOffice (Writer / Calc / Impress) for faithful Office → PDF conversion of .docx / .xlsx / .pptx and xlsx formula recalc.
  • poppler-utils (pdftoppm, pdftotext) for PDF rasterization and text extraction.
  • pandoc for clean .docx → markdown/text extraction.
  • XeTeX (texlive-xetex + latex/fonts-recommended + lmodern) so pandoc --pdf-engine=xelatex produces publication-grade PDFs with a real table of contents, page numbers, headers/footers and a title page — including Chinese documents via texlive-lang-chinese.

Reliability & correctness

  • No more spurious "Index failed" badge on sandbox attachments. Files uploaded to an external-agent (sandbox) conversation are file-staged directly into the sandbox rather than indexed into the knowledge base, so they now skip RAG indexing entirely. (#2141)
  • Agents no longer leak internal <untrusted_source> markers into their replies. These tags are internal-only; agents now extract the facts and cite sources as ordinary markdown links. (#2149)

No database migrations, no new environment variables, and no operator action required to upgrade.

Voir sur GitHub

v0.2.89

Patch release on top of v0.2.88. Enterprise SSO/SCIM security hardening, chat attachments for sandboxed agents, and issue-desk PR de-duplication. No data migrations and no required configuration changes.

Highlights

  • Enterprise SSO & SCIM hardening (#2118).

    • Open-redirect protection on the auth flows: a user-influenced redirect target must resolve to a path on our own origin. Absolute, protocol-relative (//host), and backslash-smuggled (/\host) targets are rejected and fall back to a safe default (issue #2037).
    • SCIM active: false now soft-deactivates a user — the IdP's usual de-provisioning signal. The org membership is kept with a disabled role and is fully restored on a later active: true.
    • A hard SCIM DELETE fully deprovisions — subsequent GET/PATCH return 404, per RFC 7644 §3.6.
    • The org owner is protected from SCIM deprovisioning, and duplicate user creation returns 409 Conflict. SCIM group-membership PATCH now applies replace → add → remove deterministically.

  • Chat attachments delivered to sandboxed external agents (#2119). Files attached in chat are now staged for Claude Code / OpenCode agents on the persistent /user volume under /user/uploads — outside the agent's workspace, so uploads never pollute project files — under their real file names (so "summarize report.pdf" just resolves), with read access granted via --add-dir. A per-turn cap guards against abuse.

  • Issue desk reuses an existing PR (#2122). Re-running the desk on an issue that already has an open pull request now updates that PR instead of opening duplicates.

Fixes & polish

  • Settings UX polish (#2126): data-residency header actions and layout refinements across the settings surfaces (2FA, API keys, providers, deployment, personalization, user env).
  • Drop overlay (#2121): the full-page drag-and-drop overlay now clears correctly after a file is dropped on the composer.

Operator notes

  • New optional SANDBOX_BROWSER_VIEW (default OFF). When set to 1, agent browser sessions run a headed Chromium with a read-only VNC mirror streamed into the chat UI; the platform attaches Playwright MCP over CDP. Left unset, behaviour is unchanged (headless, no live preview). The CLI env generator now emits it commented-out.
  • Graceful shutdown in compose.yml. stop_grace_period is now set for the platform (45s) and sandbox (30s) services, so docker compose up drains in-flight chat streams / executions before SIGKILL instead of using Docker's 10s default. This already matched the CLI compose generator.
  • No data migrations and no required configuration changes in this release.

Voir sur GitHub

v0.2.88

What's Changed

Voir sur GitHub

v0.2.87

Highlights

Enterprise SSO & SCIM provisioning (#1936)

Unified, file-based Enterprise SSO replacing the old per-provider config: a single connection covering OIDC, OAuth2, and SAML, plus SCIM 2.0 user/group provisioning. Configured from the admin UI (Settings → Enterprise SSO). See the new Enterprise SSO docs.

Two-tier sandbox concurrency limits (#1971)

Sandbox concurrency is now governed at two levels: global environment caps and per-org governance. Default caps were lowered to suit a small host — operators on larger boxes should set these explicitly:

  • SANDBOX_MAX_CONCURRENT default 4 → 2
  • SANDBOX_MAX_SESSIONS default 10 → 2
  • SANDBOX_MAX_SESSIONS_PER_ORG remains 50

Unified chat panel + branch-aware workspace inheritance (#1934)

Consolidated chat experience into a single panel, with sandbox workspaces that inherit from their parent branch.

Fixes

  • Sandbox-agent 401 responses no longer launder into a fake success (#2100).
  • Website scan no longer spins indefinitely on un-markable (canonical) URLs.

Operator notes

Migrations run automatically on tale deploy (auto-detected, confirmed at deploy). This release adds:

  • Fold legacy audit_retention policy into retention_policy (destructive, reversible)
  • Migrate ssoProviders into the file-based Enterprise SSO connection (reversible)
  • Export orgPackagePolicy → file-based run_code governance policy (reversible)
  • Export modelSyncSettings → file-based model_sync governance policy (reversible)
  • Drop legacy orgPackagePolicy rows, post-export cleanup (destructive, reversible)
  • Drop legacy modelSyncSettings rows, post-export cleanup (destructive, reversible)

Upgrade with tale upgrade, then tale deploy.

Voir sur GitHub

v0.2.86

Tale v0.2.86

Website crawling now runs in-process (#1935)

Registered websites are now re-crawled by an in-process Convex cron (scan due websites, every 5 minutes) — the replacement for the former standalone crawler service's poll loop. Without it, registered websites never re-crawled after the standalone service was removed. Full-site sitemap discovery is also restored (the interim 100-URLs-per-scan cap was a regression); the discovery ceiling is tunable via the optional CRAWLER_MAX_DISCOVER_URLS env var.

Deploy fix: knowledge-db schema convergence

The private_knowledge and public_web baselines now idempotently add later columns (metadata, org_slug, the chunk overlap columns, …) onto pre-existing tables. Deployments whose knowledge databases were created by the old per-service RAG/crawler migrations — before the baseline consolidation in #1883 — previously crash-looped at deploy with column "metadata" does not exist. The change is metadata-only (every column is nullable or defaulted) and safe on populated tables.

Release pipeline now ships the controller and LLM-gateway images

tale-controller and tale-llm-gateway are now built and pushed as part of a release (11 service images total, native amd64 + arm64). They were previously built in CI but absent from the release image set.

Operators: upgrade with tale upgrade, then tale deploy. The schema convergence runs automatically via dbmate; no manual steps.

Voir sur GitHub

v0.2.85

v0.2.85 — Apps platform, the AI Workforce, and persistent sandbox agents

This is a large release. It introduces a config-driven Apps platform (installable packs that bundle app-scoped agents, workflows, and sandbox-agent steps), the AI Workforce (an agent company with an organigram, task operations, and Discussions), and persistent sandbox agent sessions that run Claude Code with docker-in-sandbox, browser human-takeover, BYO credentials, and rotating token sources. It also ships SSO/identity hardening (generic OIDC claim mapping + PKCE, passkey/2FA controls, server-side idle timeout), a zero-friction guided setup, and a knowledge-platform refactor that moves RAG into the Convex backend behind a dedicated knowledge-db container.

🔒 Security & Identity

  • Generic OIDC claim mapping, role-mapping rules, and PKCE — map arbitrary identity-provider claims to Tale roles and use PKCE for the auth-code flow (#1857)
  • Passkey admin revocation, configurable 2FA-wall enforcement options, and sign-in audit events (#1859)
  • Server-side session idle-timeout enforcement (#1862)
  • Knowledge entries are now written through an approval-gated knowledge_write path (#1866)
  • Audit-log retention and PII-scrub checkpoints are signed with a new TALE_AUDIT_SIGNING_KEY (HMAC-SHA256), making the audit hash chain tamper-evident; the key supports rotation via TALE_AUDIT_SIGNING_KEY_PREVIOUS (#1879)
  • Sensitive form fields are masked in the UI (#1912)
  • Ratcheted the dependency CVE gates from CRITICAL down to HIGH (#1856)

💥 Breaking Changes (operator-facing)

  • The tale-crawler and tale-rag containers are removed. RAG/knowledge processing now runs inside the Convex backend (node-actions), backed by a new dedicated knowledge-db container (ParadeDB: pg_search + pgvector). A new optional KNOWLEDGE_DATABASE_URL (or KNOWLEDGE_DB_NAME, default tale_knowledge) points at it; it defaults to the bundled knowledge-db service and is split out so it can be relocated for data residency (#1907)
  • RAG cross-encoder re-ranking is now API-only. RAG_RERANKING_PROVIDER=local is no longer supported and fails fast — set RAG_RERANKING_PROVIDER=api pointing at an external Cohere/Jina-compatible /rerank endpoint (RAG_RERANKING_API_BASE_URL + RAG_RERANKING_API_KEY) (#1869)
  • Metrics endpoints consolidated. /metrics/crawler and /metrics/rag are removed; scrape /metrics/platform instead. Update any Prometheus scrape config that targeted the old paths

🚀 Features

Apps platform

  • Config-driven Apps platform: installable packs that bundle app-scoped agents, workflows, and sandbox-agent steps, isolated from the global catalog under a composite <app>/<name> slug (#1911)
  • Install/readiness wizard with inline integration-connect, per-agent dependency readiness (managed ↔ BYO), multi-project installs (one app → many projects), and durable task runs (#1927)

The AI Workforce

  • Workforce foundations: task operations, an org organigram, and per-agent logs (#1877)
  • The AI Workforce — an agent company with Discussions and human controllability over what agents do (#1907)
  • Task views split, @-mention descriptions, and per-agent metrics (#1878)

Persistent sandbox agents

  • Persistent agent sessions for Claude Code — a durable, resumable sandbox session per (org, user) (#1872)
  • Sandbox agents can use any connected org integration, with credentials that never enter the container (#1880)
  • Native docker/compose inside a session via configurable runtime tiers (runc/gVisor/sysbox/kata) (#1881)
  • Read-only sandbox observability in chat: a live browser view and a workspace file explorer (#1890)
  • External-agent BYO credentials plus per-user env vars and secrets (#1892)
  • Agent-initiated browser human takeover — an agent can hand the browser to a person (e.g. to solve a CAPTCHA) and resume (#1895)
  • Token sources: broker-fetched pools of rotating LLM credentials for BYO agents, with random pick and 401/429/529 failover (#1930)

External-agent chat

  • External-agent interactive/autonomous modes with incremental answer streaming (#1900)
  • Agent editor: switch an agent between internal/external types, with a folder breadcrumb (#1918)

Automations & workflows

  • Step-by-step debug mode for automations (#1871)
  • Per-step error feedback in the automation test panel (#1870)

Setup & operations

  • Zero-friction setup: guided CLI install, an onboarding wizard, and guided create flows (#1879)
  • Pre-migration volume snapshots and a new tale backup command (#1863)
  • Adaptive chat reliability and blue-green deploy tiers (#1914)
  • Cross-terminal clean-output rework for tale and bun run dev (#1904)

UI & UX

  • Settings full-width sweep, banner alerts, and login-UX refresh (#1910)
  • Refined settings layouts and onboarding-wizard UX (#1903)
  • Interactive PDF links and a branch-aware automation canvas (#1912)
  • Settings migrated to a left-rail sidebar across all pages (#1839)
  • Model capability details in an info popover (#1885)
  • Clearer notifications with locale-safe actor names (#1876)
  • Org deletion moved into the settings danger zone (#1891)

⚡ Performance

  • Single-source chat timeline with reduced render churn (and a fix for the reaped-turn error) (#1906)
  • Cut cross-component round-trips in getOrganizationMember (#1898)
  • Provider request-body mapping and max_completion_tokens for reasoning models (#1905)

🐛 Fixes

  • Per-project task dedup, stopped-run step settling, and sandbox stream-idle recovery (#1929)
  • Surface the raw provider error and stop mislabeling provider param rejections as user errors in chat (#1894)
  • Knowledge-db local-dev wiring and pdfjs extraction in the Convex node runtime (#1902)
  • Stop a long document name from overflowing adjacent columns (#1901)
  • Derive the dev builtin-config catalog from TALE_CONFIG_DIR (#1893)
  • Recover stuck websocket auth on cold start and fix skeleton-mask sizing (#1873)
  • Gate RAG queueing on a shared indexability allowlist (#1853)
  • Route all pdfjs consumers through a shared loader, fixing a DOMMatrix indexing failure during PDF extraction (#1933)

📝 Other

  • Switched raw <table> usage to the shared Table component (#1882)
  • Added a Playwright E2E suite with a mock LLM and CI workflow (#1860)
  • E2E/test tooling, the Opengrep SAST gate, and package cleanup (#1883)
  • Weekly model-catalog sync (#1884)
  • Rewrote the subprocessor tables for EU/EEA AI processing (#1874)
  • Added the /release skill and a Claude Code chat-agent config (#1928)
  • Pruned the remaining standalone crawler/rag service references across compose, docs, README, and CI; the sandbox LLM gateway ships as a first-class llm-gateway service (#1931)
  • Added a regression test verifying the web client passes the Mozilla Observatory security-headers check (#1932)

Upgrade

Run tale upgrade to update the CLI, then tale deploy to apply the new version.

This release contains a multi-step governance data migration and a container topology change — review before deploying:

  • Governance policies move from the database to per-org JSON files (3 migration steps). Steps 1–2 are non-destructive (export to files + split staged DSAR changes into a dedicated table). Step 3 drops the legacy governancePolicies rows and is gated behind explicit operator confirmation during tale deploy; it is reversible (each row is snapshotted before deletion). Run it only after verifying the exported governance files look correct.
  • Knowledge/RAG topology change. The tale-crawler and tale-rag containers are gone; a new knowledge-db container holds the corpus. See the updated container-architecture and data-residency docs before upgrading a deployment with an existing indexed corpus.
  • New audit signing secret. TALE_AUDIT_SIGNING_KEY is auto-generated and written to .env during deploy if missing (the deploy preflight verifies it). Back it up with your other secrets and keep it stable across deploys.
  • If you used local RAG re-ranking, switch RAG_RERANKING_PROVIDER to api (see Breaking Changes).
  • If you scrape metrics, update any scrape config pointing at /metrics/crawler or /metrics/rag to /metrics/platform.
  • The sandbox LLM gateway is now a first-class llm-gateway compose service. Its management-API password (LLM_GATEWAY_ADMIN_PASSWORD) is auto-generated on deploy if missing; set LLM_GATEWAY_ADMIN_USERNAME / LLM_GATEWAY_ADMIN_PASSWORD only to pin your own values.

Contributors

@larryro, @yannickmonney, @AdeolaAdekoya, @Israeltheminer

Voir sur GitHub

v0.2.84

Kubernetes sandbox backend, adaptive reasoning, and audit hardening

v0.2.84 — Kubernetes sandbox backend, adaptive reasoning, and audit hardening

This release adds a Kubernetes execution backend for the sandbox alongside the existing Docker path, a major LLM-pipeline upgrade (adaptive reasoning budgets, prompt caching, and a redesigned Auto router), and new knowledge-base workflows in chat. It also hardens audit-log access, clears the transitive HIGH dependency advisory backlog, and makes tale rollback safe by design.

🔒 Security

  • Audit-log reads are now restricted to org admins and owners. The public queries listAuditLogs, listAuditLogsPaginated, and getActivitySummary reject non-admin roles, the unused public getResourceAuditTrail query was removed, and the row-level-security matrix drops developer/editor audit-log access to write-only (#1852)
  • Cleared the transitive HIGH dependency advisory backlog: picomatch ReDoS (GHSA-c2c7-rcm5-vvqj), lodash _.template code injection (GHSA-r5fr-rjxr-66jc, overridden to 4.18.1), and the tar path-traversal advisory family via removal of an orphaned canvas lockfile entry (#1854)

🤖 Model & Provider

  • Adaptive reasoning governor: thinking budgets now adapt per (model, agent type) profile with self-calibrating difficulty thresholds. Output truncation no longer counts as thinking starvation, and wasteful reasoning (high thinking, tiny answer) trims the budget (#1838)
  • The Auto router is now a config-defined agent backed by a fast classifier model, replacing the hardcoded lexical heuristics. Routing decisions are cached, and models with missing keys or broken configuration are skipped at resolution time instead of producing a doomed request (#1838)
  • Updated OpenRouter provider catalog and a new coder example agent for fresh deployments (#1838)

💥 Breaking Changes

  • tale rollback no longer accepts an arbitrary -v/--version flag. The only valid target is the recorded previous version, and only when it shares major.minor with the running platform (patch-only rollback). On refusal the command prints the snapshot-restore runbook instead of proceeding. Update any operator scripts that pass --version (#1861)

🚀 Features

  • The sandbox service can now run on Kubernetes: SANDBOX_BACKEND=docker|kubernetes selects between the unchanged Docker Compose backend (still the default) and a new exec-free Pod-per-exec Kubernetes backend that needs no docker.sock or host-path workspace (#1841)
  • @-mention knowledge-base documents in chat: an anchored picker in the composer pins up to 5 indexed documents to a turn, scoping that turn's retrieval to exactly those documents (#1864)
  • Folder-scoped RAG search: retrieval can be limited to a single Document Hub folder and all of its subfolders (#1865)
  • Live per-node execution status on the workflow canvas, driven by a single reactive query (#1868)
  • New integration_processing_records workflow action for incremental, deduplicated processing of external SQL/REST integration data, with four incremental strategies (#1858)

⚡ Performance

  • Generic prompt caching with per-model strategies (explicit cache breakpoints for Anthropic/Gemini via OpenRouter, deterministic cache keys for OpenAI/DeepSeek) plus cache pre-warming on composer focus, reducing latency and cost on repeat prompts (#1838)

🛠 Improvements

  • Smoother streamed-text rendering: chat responses now reveal at clause boundaries instead of raw token chunks (#1838)

🐛 Fixes

  • Workflow execution step journals rendered empty for roughly 75% of runs due to a component shard-routing bug; journal loads now resolve the execution's actual shard (#1868)
  • Inline chat token count now shows output tokens instead of input/total (#1838)

📝 Other

  • RAG indexing status is consolidated onto fileMetadata.ragStatus as the single source of truth inside Convex; documents.ragInfo and documents.indexed are deprecated but remain readable for existing rows (#1840)

Upgrade

Run tale upgrade to update the CLI, then tale deploy to apply the new version.

No manual migration is required. During tale deploy you will be prompted to confirm two automatic data backfills (RAG status consolidation and folder-path indexing); the RAG database schema migration applies automatically when the database container starts.

Contributors

@larryro, @yannickmonney

Voir sur GitHub

Dernière mise à jour le 22 août 2026.

Voir Tale sur ta stack

Réserve une démo guidée ou parle à l’équipe du déploiement auto-hébergé, des prix et du matériel.

Demander une démoNous contacter