trigger.dev v4.8.4

trigger.dev v4.8.4

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.4

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-4

Highlights

• Add opt-in AWS session tags with awsCredentialProvider({ sessionTags: true }) for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow sts:TagSession before enabling them; existing integrations remain untagged. (c8ae1ffb5)

Improvements

• Logins made with trigger.dev login or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with CLI_LOGIN_IDLE_TIMEOUT_DAYS, or set it to 0 to turn it off for new logins. Logins made before this change aren't affected. (c8ee9e309)

• Add infisicalAccessToken at @trigger.dev/sdk/oidc/infisical to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. (63b58f329)

• Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. (9aafe6989)

• Use GitHub Actions trusted publishing with preview archive and promote, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. preview archive also supports Preview environment API keys through TRIGGER_ACCESS_TOKEN. (d9172638a)

  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.

• Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. (9422dc65d)

• Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a deleteSnapshots call for this. (95f4cbbad)

• Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading @electric-sql/client to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. (3900d8906)

• Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. (cd58c750b)

• chat.agent now accepts only two kinds of message from a chat client: user messages, and answers to tool calls the agent made. A tool approval or tool output is merged onto the stored call it answers and runs with the input from the agent's own history, so a client can't add tool calls or change a call's input. chat.headStart drops tool calls from the history the client sends, and upsertIncomingMessage only adds user messages. (44feaaff6)

• Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key. (306d960ca)

Bug fixes

• Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. (99a626aa3)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• API keys can have custom access: combine access presets or set a level for each area, such as Runs or Deployments, optionally limited to selected tasks. Edit access changes what an existing key can do without rotating it, and the API keys page marks keys whose access differs from their preset today.
• New API keys can expire on a custom date. Pick Custom date in the Expires menu and choose a day from the calendar; the key stops working at the end of that day in your local time zone.
• Restrict an API key to a list of IP addresses so requests using it from anywhere else are rejected. Set the list when creating a key or edit it later from the API keys page, which now also shows the IP address each key was last used from.
• Organizations can save custom API key access as a preset and reuse it when creating keys in any project. Saved presets appear under Your presets in the access picker, and organization Owners and Admins can save and delete them.
• Click an API key to see its access, when it last used each area, and its details in a side panel. From there you can narrow a key to what it used in the last 30 days, without changing its secret.
• Alerts can be grouped: select alerts in the list and create a group that raises when any or all of them fire, with its own channels and expiry. Members keep evaluating but notify only through the group. Groups can also be created through the API, with their members in one call.
• Health alerts can now watch a chosen subset of checks — flow, execution and liveness — instead of all three.
• Email the owner of a dashboard-created personal access token 7 days before it expires, and again when it has, so a CI deploy using it doesn't break by surprise. Set PERSONAL_ACCESS_TOKEN_EXPIRY_EMAILS_ENABLED=false to turn them off.
• Personal access tokens created on the dashboard now expire after the lifetime you choose (30, 90 or 365 days by default). Requests made with an expired token get an error that says when it expired and where to create a new one. Existing tokens keep working as before.
• Alerts now require at least one channel (email, Slack or webhook). The option to notify the Dashboard Agent chat has been removed.
• Choose an API key's expiry from presets or a calendar in one picker, with date previews and expiration at the end of the chosen day in UTC.
• The API keys page shows when each key expires and when it was revoked, and the "How to set env vars" dialog no longer displays your secret key. Custom access is now a table of levels for each area, and options a key can't use are shown disabled with the reason.
• The Environment variables page now filters by environment, opening on the environment you're in, with a picker for preview branches. Deleting a variable asks for confirmation first.
• The side menu has a new Security section, just above Manage, that groups API keys, Environment variables, Trusted publishing and OIDC.
• Alerts: Admins and Developers can delete alerts; health metric charts use straight segments.
• Alert charts and alert evaluation are no longer limited by the plan's query period.
• Project JWT minting now rejects expiration times longer than 24 hours.
• Dashboard sessions past their deadline now end on their next request, including background data requests and form submissions, not only on page navigation.
• Restore duration wait details and the Skip waitpoint action in the dashboard.
• Fix the Logs page redirecting to Tasks when Logs is visible in the sidebar.
• Fix a new project's first deploys failing with "Failed to get deployment image ref" when two of them start at the same time.
• Triggering a task with a payload over the offload threshold from inside a running task works again. Run-scoped tokens and restricted API keys upload offloaded payloads into their own namespace and may only trigger with payloads they uploaded, while pointers at other runs' stored payloads or outputs are still rejected.
• Stop runs that wait a long time for capacity from being requeued and started a second time while their first start is still pending.
• Long GitHub organization and repository names on the Trusted publishing page now stay on one line and truncate, with the full name shown on hover.

All packages: v4.8.4

@trigger.dev/build, @trigger.dev/convex, @trigger.dev/core, @trigger.dev/linear, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, @trigger.dev/slack, trigger.dev

Contributors

Eric Allam, Chris Arderne, @d-cs, @nicktrn, Wes Maso...

Helm Chart 4.8.4

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.4"

Changes

See commit history for detailed changes in this release.

trigger.dev v4.8.3

trigger.dev v4.8.3

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.3

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-3

What's changed

Improvements

• CLI and MCP logins are now bound to the machine that started them. Approving a login in your browser sends you back to the CLI automatically, or, when the browser is on another machine, shows a code to paste into the terminal (or pass with trigger.dev login --code). Older CLI versions will need to upgrade to log in. (1a36c23fb)
• Add trigger webhooks set-secret and trigger webhooks generate-secret, which store a webhook endpoint's signing secret without printing it. set-secret reads the secret from a pipe, an environment variable or a .env file, and generate-secret saves the new secret to an env file. When the endpoint already has a secret, both ask how long the old one keeps working (or take --previous-secret-ttl 24h in scripts). The MCP server's set_webhook_secret and generate_webhook_secret descriptions now point AI agents at these commands, so the secret stays out of the agent's context. (daaaa41db)
• Deprecates the legacy Bun runtime. runtime: "bun" (and its explicit spelling "bun-legacy"), which deploys Bun 1.3.3 with Node.js 20 alongside it, now prints a deprecation warning, and deploys that use it will be rejected from January 5, 2027. Switch to runtime: "bun-1.4" (Bun 1.4.4 on an image with no Node.js binary) and redeploy. (5f8171cab)
• Add trigger.refresh(ctx, id) to request an earlier status check for a Convex-tracked run, so applications using Trigger Realtime can publish results without waiting for the next scheduled poll. Requests are coalesced and rate-limited, use the existing completion callback, and retain polling as a recovery fallback. (ee5e5da40)
• Add private-beta OIDC authentication for deployed Cloud tasks, with an AWS credential provider and environment-specific setup instructions. Install @aws-sdk/client-sts to use @trigger.dev/sdk/oidc/aws, upgrade your deployment CLI, and redeploy. Contact us to enable access for your organization. (65352bc90)

Bug fixes

• Fix parent and root metadata updates being lost after one update could not be applied. Only that update is now skipped, and the rest are written. Metadata keys that name only the root, such as $. or $.., are now ignored on a run's own metadata instead of throwing, and rejected for parent and root metadata, which fails the whole request. (53441fd20)
• Fix reloading a chat mid-turn after its access token was refreshed. A token refresh during a streaming turn persisted a resume cursor from the middle of the turn, so a reload resumed past chunks the page needed and failed to rebuild the assistant message ("No tool invocation found for tool call ID"). The persisted cursor now stays at the start of the turn until it completes, so a reload replays the whole turn. (9fd1de656)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• The CLI and MCP login consent page now shows when and from which IP address the login was started, and you get an email whenever a new CLI or MCP login is authorized on your account.
• Searching, filtering to errors, and expanding or collapsing spans in the run trace view are faster on large traces.
• Guide switching from shared root keys to individually managed API keys, while keeping root key regeneration directly available.
• CLI and MCP login codes now work once, and every login mints its own personal access token instead of reusing an existing CLI token.
• Fix run traces occasionally going missing when a span recorded an exception with no message, type or stack trace.

All packages: v4.8.3

@trigger.dev/build, @trigger.dev/convex, @trigger.dev/core, @trigger.dev/linear, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, @trigger.dev/slack, trigger.dev

Contributors

Chris Arderne, Eric Allam, @Mariefay, Saadi Myftija, Oskar Otwinowski, github-actions[bot]

Full changelog: v4.8.2...v4.8.3

Helm Chart 4.8.3

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.3"

Changes

See commit history for detailed changes in this release.

trigger.dev v4.8.2

trigger.dev v4.8.2

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.2

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-2

What's changed

Breaking changes

• Query dashboard APIs reject run tokens and public access tokens without user delegation. Existing API key access, including restricted keys with the required query scopes, is unchanged. MCP dashboard access remains supported through delegated tokens for current organization members.
• The legacy clickhouse event store is retired: task events now go to clickhouse_v2. If you self-host with EVENT_REPOSITORY_DEFAULT_STORE=clickhouse, switch it to clickhouse_v2 and follow the self-hosting guide to copy older events, which no longer show until you do.

Improvements

• Deployed tasks now keep a valid short-lived run token for their whole run: the token is refreshed during long runs and before a run resumes from a checkpoint. A warm-started task no longer keeps the previous run's token when the next run has none, and run credentials are left out of runner debug logs. (aa9de9d94)

• Upgrade socket.io-client to 4.8.4 so projects using the SDK and CLI install ws 8.21 instead of 8.17.1, which has published advisories (GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx). The old pin blocked upgrading ws without a package manager override. (2df9860b4)

• Adds the bun-1.4 runtime. runtime: "bun-1.4" deploys on Bun 1.4.4 in a Bun-only image with no Node.js binary, and the run controller itself runs under Bun. runtime: "bun" is unchanged (Bun 1.3 with Node.js alongside it); bun-legacy is accepted as an explicit spelling of the same runtime. On Bun 1.4 the worker no longer crashes at startup on the --no-warnings=ExperimentalWarning flag. (a8a87850b)

• Add an experimental Convex component for triggering tasks transactionally and reading their status and results through reactive queries, without configuring webhooks. (3c1cf656c)

• Run metadata operations now reject JSON-path keys that use escaped dots to reach __proto__, constructor or prototype. (dce5048a8)

• Use short-lived run tokens for supported SDK operations inside deployed tasks when available, retaining environment-key compatibility for unsupported operations and missing or expired tokens. Explicit credentials still take precedence. Public-token helpers use server-side minting with run tokens rather than signing locally. (5a1c14239)

  Project and organization queries, and branch overrides targeting another PREVIEW or DEVELOPMENT environment, keep using compatibility credentials. Branch headers do not change credential selection in STAGING or PRODUCTION. Chat subscriptions reread implicit credentials for each connection.

• runs.subscribeToRun now ends after the run completes. The for await loop exits right after the update with the final status, and the subscription stops its connection, so a script that subscribes to a run exits on its own. Pass stopOnCompletion: false to keep the subscription open after completion. (485ab83aa)

• Add SupervisorHttpClient.releaseRun, which gives back a dequeued run the worker never started so the platform requeues it at once instead of after the pending execution timeout. (ba51e5573)

• The supervisor keeps its run notification subscriptions across reconnects to the webapp, and reconnects when the webapp turns its handshake away, so cancellations and resolved waits keep reaching running tasks after a webapp restart or deploy. (a9e69ab7d)

• Asymmetric webhook sources can now verify ECDSA P-384 signatures (algorithm: "ecdsa-p384", SHA-384) and providers that sign a SHA-256 digest of the signing string (prehash: "sha256"). ECDSA signatures are accepted in DER or raw r||s form. (4ed2e3780)

• The bundled trigger-cost-savings skill now notes that a webhook delivery starts no run when no subscriber's filter matches, so it costs no compute. (#5051)

• Stream a sub-agent's reply through a parent tool call with chat.forwardSubAgent. Each chunk is written to the parent chat once and the tool resolves with the sub-agent's final message, so streaming a sub-agent costs bytes in proportion to its reply. Yielding stream.messages() snapshots resends the whole message on every chunk, which grows with the square of the reply. (bdc994c4d)

  execute: async ({ topic }, { toolCallId, abortSignal }) => {
  const stream = await researcher.sendMessage(topic, { abortSignal });
  return await chat.forwardSubAgent(stream, { toolCallId });
  },

  Render it while it runs with useSubAgentMessages() from @trigger.dev/sdk/chat/react (or createSubAgentMessages() outside React).

Bug fixes

• Fix chat.inject messages added from a tool mid-turn being saved before the assistant's response. They now stay after the tool result, where the model saw them, so the next turn keeps the same prompt prefix. If you roll @trigger.dev/sdk back to an earlier version, chats saved by this version lose these mid-turn chat.inject messages from the model's context, though the chat history shown in the UI keeps them. (fc33769a5)
• Fix a chat.agent turn failing after a head start that ended with two or more parallel tool calls. When those tools finished out of call order, the agent sent their results to the model twice on the next step, and the provider rejected the request (Anthropic: "each tool_use must have a single result"). Each handed-over tool result is now sent once. (d06ee5825)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Add "Ignored paths" to the Git settings: pushes and pull request updates that only change files matching these patterns no longer create a deployment. Ignored paths don't apply while the Vercel integration is connected.
• The metrics query table now includes queue size (queue.size.*) and webhook limit metrics (webhook.waiters.*, webhook.processing.*, webhook.ingress.*), so you can chart and alert on queue capacity and webhook rate limits.
• New Limits alerts: watch the limits that can interrupt or degrade runtime flow, one at a time or combined into a single alert with "any" or "all" and the signals you choose (limit reached or approaching), in the dashboard, the API and the agent.
• Expand short-lived run-token support to task APIs, with permission checks for packets, metadata, streams and waits. Run tokens last one hour independently of root-key rotation and cannot be individually revoked. They can mint public access tokens for up to 30 days; those tokens may outlive the run token that minted them.
• Hosted webhook endpoints can verify ECDSA P-384 (SHA-384) signatures, ECDSA signatures in raw r||s form, and RSA signatures made over a SHA-256 digest of the signing string (prehash: "sha256").
• Older runs now load their trace, span details and run events faster. A span that finishes more than a week after its run shows as still in progress.
• The run page now loads large traces progressively and updates live runs incrementally, so big traces open faster and open run pages no longer reload the whole trace while a run is executing. The run trace API can also page large traces.
• Query alerts now accept queries whose columns are computed from other aggregate columns, such as a percentage of two aggregates. When a query can't be watched, the Watch button stays visible but disabled and explains why.
• Archiving unused queues from the Concurrency page is now available on all instances, including self-hosted.
• Runs whose container or pod could not be created, or whose pod failed before the run started, can now be requeued straight away instead of waiting for the pending execution timeout. Both are off by default: set RELEASE_UNSTARTED_RUNS_ENABLED=true on a supervisor for creates that fail, and RELEASE_FAILED_POD_RUNS_ENABLED=true for pods that fail.
• Session external ids can no longer contain a /channels path segment (for example chat-1/channels/support) or end in :channels, since both forms name a session's channels. Creating a session with one now returns a 422 validation error.
• Selecting a span that started a session now shows a link to that session in the span panel, so you can jump from an orchestrator's run to its sub-agents.
• Fix the batch results API returning an empty list of items for completed batches. It now re...

Helm Chart 4.8.2

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.2"

Changes

See commit history for detailed changes in this release.

trigger.dev v4.8.1

trigger.dev v4.8.1

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.1

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-1

What's changed

Bug fixes

• Fix trigger deploy failing on self-hosted instances with custom base images. Stages built on a custom image now keep the trust store that image ships with. (b5ed66b74)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Alerts can now watch the result of any supported query: raise when a value crosses a threshold, when matching rows stop appearing, or when new matching rows appear. Create them from the Query page, the Dashboard Agent or the API, and see the alert's values charted on its page.

All packages: v4.8.1

@trigger.dev/build, @trigger.dev/core, @trigger.dev/linear, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, @trigger.dev/slack, trigger.dev

Contributors

@Mariefay, Eric Allam, Wes Mason, github-actions[bot], @nicktrn, Katia Bulatova, Paul Cioanca

Full changelog: v4.8.0...v4.8.1

trigger.dev v4.8.0

trigger.dev v4.8.0

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.0

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-0

What's changed

Improvements

• Route verified webhooks into agent sessions with chat.event({ endpoint, key }), and connect external chat surfaces with chat.channels.custom({ endpoint }). Both subscribe to a shared webhook endpoint, so an agent and your other webhook tasks can use the same provider URL. Channels support reply delivery, session binding, conversation seeding, and lifecycle reactions, and a failed turn posts a short line instead of the error (errorMessage sets it, as a string or a function of the failure). Use chat.createWatchToken() to watch a session from another surface. (d6955ee9f)

  A connector can also stream replies natively (stream()), mirror the session's state into the surface (lifecycle()), show tool calls as they run (progress()), stop a running turn from the surface (onControl()), post approvals and tool controls and resume the run from a verified click, download files only the surface can read (download()), and acknowledge or fold in messages that arrive mid-turn (received(), pendingMessages).

• Add hosted webhooks: declare an endpoint once with webhooks.endpoint.define({ id, source }) and Trigger.dev hosts its URL, verifies every request, and routes each event to the endpoint's subscribers. Subscribe tasks with webhook({ endpoint, filter, onEvent }), each with its own type-safe filter, and pause a run until a matching webhook arrives with webhooks.waiter.create() and webhooks.waiter.wait(). (d6955ee9f)

  export const stripe = webhooks.endpoint.define({
  id: "stripe",
  source: webhooks.stripe(),
  });
  
  export const fulfill = webhook({
  id: "fulfill",
  endpoint: stripe,
  filter: "event.type == 'checkout.session.completed'",
  onEvent: async ({ event }) => {},
  });
  
  const waiter = await webhooks.waiter.create(stripe, {
  match: { "event.data.object.metadata.orderId": order.id },
  });
  const { event } = await webhooks.waiter.wait(waiter).unwrap();

  Sources cover presets (webhooks.stripe(), webhooks.github(), webhooks.svix(), webhooks.discord(), and others), named providers (webhooks.clerk(), webhooks.shopify(), and more) and webhooks.custom<T>(config), and most carry a setup prompt an AI coding agent can follow to register the endpoint. Retries are deduplicated on the provider's own event or delivery id where it sends one. Filters, keys and waiter match paths share the event., header. and webhook. namespaces, and filters accept == null / != null presence checks and event any (...) over a payload that is an array of events. webhook() takes task() options such as queue, machine and retry. The HTTP API lists endpoints and deliveries, replays deliveries, and creates and cancels waiters, and both it and the MCP server can read an endpoint's setup prompt and generate or store its signing secret.

• The generate_webhook_secret and set_webhook_secret MCP tools take an optional previousSecretTtlSeconds to keep accepting a webhook endpoint's old signing secret while the provider switches to the new one (up to 7 days), and report when the old secret stops working. (98adb6662)

• Realtime streams now reconnect and resume when the stream backend reports a failed read mid-stream, instead of ending early as if the stream had finished. This affects runs.subscribeToRun with streams, useRealtimeRunWithStreams, and chat streams. (23730b034)

• HMAC webhook verifier configs accept additionalSignatureHeaders: more headers that can carry a signature, matched as alternatives to signatureHeader. Providers that send a second signature during a secret rotation (Hookdeck's x-hookdeck-signature-2) keep verifying through the rotation. (08d1ddbd3)

• Add webhooks.hookdeck(), a source for deliveries relayed through a Hookdeck connection. It verifies the x-hookdeck-signature header with the project's signing secret, keeps verifying while the secret is being rolled (Hookdeck sends the previous secret's signature in x-hookdeck-signature-2), and deduplicates retries on x-hookdeck-eventid. The event is the original provider's payload, so pass its type: webhooks.hookdeck<Stripe.Event>(). If the Hookdeck project's header prefix was changed, pass it as webhooks.hookdeck({ headerPrefix }) so retries keep deduplicating. (51b39fbc6)

• Add @trigger.dev/linear: turn a chat.agent into a Linear agent. Assign it an issue or @mention it, and Linear's agent session becomes a durable Trigger.dev session: the reply posts back to Linear, tool calls show as activities, linearPlanTool() keeps the plan Linear shows as a checklist, and approvals are Approve and Deny options that resume the run. (1586c4a3f)

  import { linear, webhookSource } from "@trigger.dev/linear";
  
  const linearEvents = webhooks.endpoint.define({
  id: "linear",
  source: webhookSource(),
  });
  
  export const triage = chat.agent({
  id: "triage",
  channels: [
    linear({
      id: "linear",
      endpoint: linearEvents,
      token: process.env.LINEAR_ACCESS_TOKEN!,
    }),
  ],
  run: async ({ messages, signal, streamText }) =>
    streamText({ model, messages, abortSignal: signal }),
  });

  The first turn gets the issue's context and earlier comments, images and PDFs in the issue reach the model, a Stop in Linear winds the turn down, and errorMessage sets the text a failed turn shows.

• Add @trigger.dev/slack: turn a chat.agent into a native Slack agent. Each DM or channel thread is a durable session, the reply streams into the thread with the turn's tool calls shown as a plan, approvals are Approve and Deny buttons, and Slack's stop button stops the turn. (6e715da77)

  import { appMentions, slack, webhookSource } from "@trigger.dev/slack";
  
  const slackEvents = webhooks.endpoint.define({
  id: "slack",
  source: webhookSource(),
  });
  
  export const support = chat.agent({
  id: "support",
  channels: [
    slack({
      id: "slack",
      endpoint: slackEvents,
      token: process.env.SLACK_BOT_TOKEN!,
      startOn: appMentions(),
    }),
  ],
  run: async ({ messages, signal, streamText }) =>
    streamText({ model, messages, abortSignal: signal }),
  });

  startOn decides which channel messages start a session (appMentions() answers when the agent is @mentioned). Images and PDFs people share reach the model, messages sent while the agent is answering can be folded into the reply, tools can post their own buttons, and ownWorkspaceOnly ignores Slack Connect guests.

• The streamText passed to a chat.agent's run() now turns AI SDK telemetry on by default, so each model step and tool call shows up as a span in the run trace even when the agent doesn't store a prompt with chat.prompt.set(). An agent with telemetry: { recordUserMessage: false } gets these spans without prompt and response content, including when it stores a prompt (whose variables are left out of the span metadata). Pass experimental_telemetry: { isEnabled: false } at the call site to turn them off, or recordInputs: false / recordOutputs: false to keep them without content. (bd7cc3525)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
• Set KUBERNETES_POD_RESERVED_SOURCE_PORTS on the supervisor (for example 50080,50081) to stop runs using those ports for outbound connections, which is useful to avoid port clashes.
• Rotating a webhook endpoint's signing secret can keep the old one valid for a while, so you can rotate without failing deliveries that are still signed with it. The rotate and regenerate dialogs let you choose how long the old secret stays valid (up to 7 days, 24 hours by default). The rotate-secret and secret endpoints accept an optional previousSecretTtlSeconds and return previousSecretExpiresAt. With no value, the old secret stops working immediately, as before.
• Alerts are now checked every minute instead of every 5–10 minutes, so they raise and recover sooner.
• Run traces and trace APIs load faster for older runs.
• The API keys page now always lists your root API key, masked to its last 4 characters when it's hidden, so you can regenerate it and revoke the previous key. When the root key is hidden, the page points you to creating an API key for your backend.
• Runs whose deployment has no compute template now go to containers when they are triggered, instead of first passing through the compute worker queue.
• Runs now...

Helm Chart 4.8.1

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.1"

Changes

See commit history for detailed changes in this release.

Helm Chart 4.8.0

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.0"

Changes

See commit history for detailed changes in this release.