Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@truefoundry/trueforge@0.2.1

Patch Changes

• 13c7c4f: Keep TrueFoundry gateway metadata out of the turns engine behind a required per-turn headers resolver, and keep stamping harness tfg.* metadata on schedule-run turns.
• 6a97f6a: Block RFC1918, CGNAT, reserved, link-local, and loopback destinations on outbound MCP and model-provider HTTP, plus in-cluster hostnames, with optional host allow/block lists and NETWORK_POLICY_ENABLED (default on).
• 6b9b981: Resolve TrueFoundry MCP OAuth redirect origin from a cached tenant control-plane URL lookup instead of request context.
• Updated dependencies [f905d9f]
• Updated dependencies [6a97f6a]
• Updated dependencies [e5e651c]
  • @truefoundry/trueforge-core@0.2.1

@truefoundry/trueforge-core@0.2.1

Patch Changes

• f905d9f: Keep a shared remote MCP transport open while sibling tool calls are in flight so a session-expired reset cannot fail them with a non-retried close error.
• 6a97f6a: Block RFC1918, CGNAT, reserved, link-local, and loopback destinations on outbound MCP and model-provider HTTP, plus in-cluster hostnames, with optional host allow/block lists and NETWORK_POLICY_ENABLED (default on).
• e5e651c: Upload TFY sandbox files via POST /files/upload so large files are not stuffed onto exec argv.

@truefoundry/trueforge-ui@0.3.1

Patch Changes

• 56b3a59: Keep newly saved builders editable until the user leaves the build-agent page, then start fresh when they return.
• a122ba1: Show successful MCP authentication in chat, automatically continue after every required server connects, and indicate while the turn is starting. Confirm OAuth against the chat MCP connector read (getMcpConnector) so non-admins are not blocked by settings-only catalog GETs, and ignore authorize callbacks after the prompt unmounts.
• acad1a1: Add chat-history rename for servers that implement renameSession, including TrueForge harness title updates.
• a08c75a: Show absolute session activity timestamps on hover, label deferred MCP tools in the session timeline, and fix Safari collapsing contentSized modal bodies (flex-auto).

---

Note

Low Risk
The diff is release bookkeeping only (versions, changelogs, deleted changesets); functional risk lives in the already-merged patches, including default-on outbound network policy and MCP/OAuth behavior changes.

Overview
Changesets release PR that finalizes patch versions and npm publish metadata—no application source changes in the diff.

Removed nine consumed .changeset/*.md entries and bumped @truefoundry/trueforge-core and @truefoundry/trueforge to 0.2.1, and @truefoundry/trueforge-ui to 0.3.1, with matching package.json versions and new CHANGELOG sections documenting what ships in this release.

Core 0.2.1 (already on main): shared MCP transport kept open during parallel tool calls, outbound SSRF-style network blocking on MCP/model HTTP (NETWORK_POLICY_ENABLED default on), TFY sandbox uploads via POST /files/upload.

Server 0.2.1: per-turn gateway headers resolver (keeps TFY metadata out of the turns engine), same network policy, MCP OAuth redirect origin from cached tenant control-plane URL; depends on trueforge-core@0.2.1.

UI 0.3.1: build-agent save/edit flow, MCP auth UX and getMcpConnector OAuth verification, session rename via renameSession, session timeline/Safari modal fixes.

^{Reviewed by Cursor Bugbot for commit cbe420a. Bugbot is set up for automated code reviews on this repo. Configure here.}