chore: release v4.5.0-rc.8

[github-actions]

Summary

5 new features, 13 improvements, 4 bug fixes.

Breaking changes

• Remove the unused worker group management API endpoints (GET and POST /api/v1/workers). (#4029)

Improvements

• Adds trigger.dev mint-token, which mints a short-lived delegated token from your stored personal access token. The token authenticates against the API as you, can be narrowed with --cap and given a lifetime with --ttl, and prints to stdout so it can be captured. (#3997)

  UAT=$(trigger.dev mint-token --ttl 3600 --cap read:runs)

• Runner debug logs are now disabled by default. Set SEND_RUN_DEBUG_LOGS=true on the supervisor to re-enable them. (#3992)

• Add request and response schemas for the new Errors API (error groups). These back the env-scoped HTTP endpoints for listing error groups, retrieving a single group, and changing its state (resolve, ignore, unresolve), plus a filter[error] option on the runs list to fetch the runs behind a group. Exported from @trigger.dev/core/v3 so the SDK can reuse them. (#4005)

• Add an optional skipBodyParsing flag to the internal HTTP server route definition, letting a route respond without reading or parsing the request body. (#4009)

• chat.headStart now accepts an apiClient option (base URL + access token), so the head-start route can create the session and trigger the agent run against a different project/environment than the warm server's ambient Trigger config. Useful when your chat.agent lives in a separate project from the app serving the route. Mirrors the apiClient option on chat.createStartSessionAction; your LLM provider keys stay in the run callback and are unaffected. (#4018)

  export const POST = chat.headStart({
    agentId: "my-agent",
    apiClient: { baseURL, accessToken },
    run: async ({ chat }) =>
      streamText({ ...chat.toStreamTextOptions({ tools }), model: anthropic("claude-sonnet-4-6") }),
  });

• chat.createStartSessionAction now accepts an apiClient option, so you can scope a chat session start to a specific environment's API config (baseURL / accessToken) without setting a global TRIGGER_SECRET_KEY. Useful when one server starts chats across more than one environment. (#4018)

  const startSession = chat.createStartSessionAction("my-chat", {
    apiClient: { baseURL, accessToken },
  });
  
  await startSession({ chatId, clientData });

Bug fixes

• Fix chat.agent / AgentChat when the agent is deployed to a Trigger.dev preview branch. The realtime message-append and stream-subscribe calls now send the x-trigger-branch header (sourced from the same resolver sessions.start uses), so messaging a preview-branch chat agent no longer fails with x-trigger-branch header required for preview env. (#4018)
• Fix Head Start handovers breaking when a chat.agent also defines a prepareMessages hook. A handover hands the first turn's pending tool call to the agent as a tool-approval round whose trailing tool message must reach the model untouched. A prepareMessages hook that rewrites the last message (for example the recommended prompt-caching breakpoint) could disturb it, so the turn failed with "tool_use ids were found without tool_result". The agent now preserves that approval tail across prepareMessages, so caching and Head Start compose cleanly. (#4018)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Add a RUN_ENGINE_DEQUEUE_DISABLED_WORKER_QUEUES setting that refuses worker dequeue requests for the listed worker queues (or base regions), so their runs stay queued instead of being handed to workers that can't run them. (#4030)
• Enforce role-based permissions across the dashboard and API. New permission boundaries cover: runs (cancel, replay, bulk actions), deployments (rollback, promote, cancel), prompt versions, organization members (invite, resend, revoke), billing and seat purchases, integrations (GitHub and Vercel), and environment variables and API keys (restricted by environment tier). Roles without access can no longer read or change these, gated controls are disabled with a tooltip, and gated pages show a permission-denied panel instead of redirecting away. Behaviour is unchanged in the default configuration, where permissions stay permissive. (#3948)
• Agent sessions started from the Test playground are now flagged with a real Session.isTest boolean instead of a "playground" tag, surfaced as a dedicated "Test" column (check icon) in the Sessions table on both the Sessions and Agent pages, plus a matching property on the session detail page. The legacy "playground" tag is hidden from the Tags display on pre-existing sessions. (#4011)
• SAML/OIDC single sign-on: SSO login with optional per-domain enforcement, JIT provisioning, and periodic re-validation against the IdP. (#3911)
• The supervisor can pause dequeuing when the Kubernetes cluster is saturated, based on the cluster's total pod count. Opt-in and off by default. (#4027)
• Refresh the task and cached-task span icons shown in the run trace view with new SVG artwork. (#4014)
• Add a currency unit to the agent dashboard "LLM spend" chart label, so it now reads "LLM spend ($)". (#3988)
• Route Postgres task run reads through the run store so they can be retargeted to a different backing store without changing call sites. (#3990)
• Update the dashboard task icons with a new glyph design. (#4013)
• Store the run's plan type on the runs analytics table so reporting can group runs by plan. (#3978)
• Replace the Task type filter on the Tasks page with a segmented control: "All" plus icon-only Agent, Standard, and Scheduled segments (each with a tooltip showing its label and number-key shortcut). Filtering is now single-select (one task type at a time) instead of multi-select. Shortcut keys 0–3 select each segment. (#3985)
• Optionally report worker queue length metrics continuously (enabled per-service via the RUN_ENGINE_WORKER_QUEUE_OBSERVER_ENABLED env var) so a queue's depth keeps being emitted even when nothing is dequeuing from it. (#4029)
• Keep logs search within bounded ClickHouse memory when browsing long time ranges, and fix pagination that could skip or duplicate entries sharing a timestamp. (#4012)
• Log Prisma infrastructure errors (P1xxx) centrally and obfuscate their messages (which carry the DB hostname) on API responses that previously returned the raw message, without changing status codes or headers. (#3960)

Raw changeset output

⚠️⚠️⚠️⚠️⚠️⚠️

main is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on main.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@trigger.dev/build@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

trigger.dev@4.5.0-rc.8

Patch Changes

• Adds trigger.dev mint-token, which mints a short-lived delegated token from your stored personal access token. The token authenticates against the API as you, can be narrowed with --cap and given a lifetime with --ttl, and prints to stdout so it can be captured. (#3997)

  UAT=$(trigger.dev mint-token --ttl 3600 --cap read:runs)

• Runner debug logs are now disabled by default. Set SEND_RUN_DEBUG_LOGS=true on the supervisor to re-enable them. (#3992)

• Updated dependencies:

  • @trigger.dev/core@4.5.0-rc.8
  • @trigger.dev/build@4.5.0-rc.8
  • @trigger.dev/schema-to-json@4.5.0-rc.8

@trigger.dev/core@4.5.0-rc.8

Patch Changes

• Add request and response schemas for the new Errors API (error groups). These back the env-scoped HTTP endpoints for listing error groups, retrieving a single group, and changing its state (resolve, ignore, unresolve), plus a filter[error] option on the runs list to fetch the runs behind a group. Exported from @trigger.dev/core/v3 so the SDK can reuse them. (#4005)
• Add an optional skipBodyParsing flag to the internal HTTP server route definition, letting a route respond without reading or parsing the request body. (#4009)

@trigger.dev/python@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.5.0-rc.8
  • @trigger.dev/core@4.5.0-rc.8
  • @trigger.dev/build@4.5.0-rc.8

@trigger.dev/react-hooks@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

@trigger.dev/redis-worker@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

@trigger.dev/rsc@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

@trigger.dev/schema-to-json@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

@trigger.dev/sdk@4.5.0-rc.8

Patch Changes

• Fix chat.agent / AgentChat when the agent is deployed to a Trigger.dev preview branch. The realtime message-append and stream-subscribe calls now send the x-trigger-branch header (sourced from the same resolver sessions.start uses), so messaging a preview-branch chat agent no longer fails with x-trigger-branch header required for preview env. (#4018)

• Fix Head Start handovers breaking when a chat.agent also defines a prepareMessages hook. A handover hands the first turn's pending tool call to the agent as a tool-approval round whose trailing tool message must reach the model untouched. A prepareMessages hook that rewrites the last message (for example the recommended prompt-caching breakpoint) could disturb it, so the turn failed with "tool_use ids were found without tool_result". The agent now preserves that approval tail across prepareMessages, so caching and Head Start compose cleanly. (#4018)

• chat.headStart now accepts an apiClient option (base URL + access token), so the head-start route can create the session and trigger the agent run against a different project/environment than the warm server's ambient Trigger config. Useful when your chat.agent lives in a separate project from the app serving the route. Mirrors the apiClient option on chat.createStartSessionAction; your LLM provider keys stay in the run callback and are unaffected. (#4018)

  export const POST = chat.headStart({
    agentId: "my-agent",
    apiClient: { baseURL, accessToken },
    run: async ({ chat }) =>
      streamText({ ...chat.toStreamTextOptions({ tools }), model: anthropic("claude-sonnet-4-6") }),
  });

• chat.createStartSessionAction now accepts an apiClient option, so you can scope a chat session start to a specific environment's API config (baseURL / accessToken) without setting a global TRIGGER_SECRET_KEY. Useful when one server starts chats across more than one environment. (#4018)

  const startSession = chat.createStartSessionAction("my-chat", {
    apiClient: { baseURL, accessToken },
  });
  
  await startSession({ chatId, clientData });

• Updated dependencies:

  • @trigger.dev/core@4.5.0-rc.8

@trigger.dev/plugins@4.5.0-rc.8

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.5.0-rc.8

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.