Trigger.dev v4.6.2

4 improvements and 5 server changes.

Improvements

• Authorize stored realtime payload and output downloads against their owning run. Large packet hydration continues to work for run-, task-, tag-, and batch-scoped public tokens without permitting arbitrary packet reads.
• Show warm idle time and durable waits separately in chat agent traces. Durable waits now open the waitpoint inspector while waiting and after completion. Message span names are shorter, and repeated session IDs no longer crowd message-wait and default output-stream spans.
• The between-turns compaction check in chat.agent now receives the last step's token usage (the context the model actually held) instead of the turn's sum over every tool-calling step, so a single tool-using turn no longer compacts a short conversation. The summed figure is still available as turnUsage on the event.
• Validate resource IDs when creating scoped public tokens. Explicitly empty IDs are now rejected instead of being interpreted as type-wide permissions.

Server changes

These changes are included in the v4.6.2 Docker image and are already live on Trigger.dev Cloud:

• The billing limit banner now lets you choose to run without one, so you don't have to open billing settings to dismiss it.
• Org member invites now match emails case-insensitively, so an invite whose email casing differs from the invitee's account email can be accepted. (#3849)
• Public access tokens created through the JWT endpoint are now limited to the API key's permissions and a maximum 24-hour lifetime. Rotated environment keys can no longer create tokens during their grace period.
• Realtime session writers now receive authorization limited to the requested session channel.
• Public session access tokens can no longer authorize durable chat snapshot uploads.

How to upgrade

Update the trigger.dev/* packages to v4.6.2 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.6.2.