Trigger.dev v4.7.3

1 breaking change, 5 improvements, and 6 server changes.

Highlights

Session creation now requires explicit trigger permissions

Creating or resuming a session with POST /api/v1/sessions now requires both session-write and task-trigger permissions. Scoped keys and public tokens must grant write:sessions (or access to the target session) and permission to trigger its task.

If you're using scoped API keys or public tokens to start or resume chat sessions, check that those keys include trigger permissions for the session's task.

Improvements

• chat.createStartSessionAction, chat.headStart, and chat.startHeadStart now accept a tags option for the Session itself, so chat sessions can be filtered by tag on the Sessions page. triggerConfig.tags still tags the session's runs.

• trigger.dev orgs list lists the organizations you belong to, with their slugs and IDs. Use the slug with trigger.dev projects create --org, including for organizations that don't have any projects yet.
• Reports filed with the submit_feedback MCP tool now reach the Trigger.dev team. They were being sent previously, but not somewhere anyone was reading.
• Stopping a chat.agent turn whose run() returns a streamText result no longer sends an error chunk with "An unexpected error occurred". The turn ends cleanly and the run stays alive for the next message.
• Update the minimatch dependency to ^10.2.3.

Server changes

These changes are included in the v4.7.3 Docker image and are already live on Trigger.dev Cloud:

• Self-hosted instances can block sign-in and sign-up from specific email domains with the new BLOCKED_EMAIL_DOMAINS environment variable.
• Run traces now appear almost immediately and load progressively as you watch, and much larger traces are viewable than before.
• The Logs page loads and searches faster, and busy environments no longer fail to load it. Searches that are too expensive now show a message suggesting a narrower time range instead of a generic error.
• Fix a rare case where a run could stay stuck in an executing state after the child run or wait it was waiting on had completed.
• Deployments with an unsupported runtime now fail with a 400 that names the supported runtimes, instead of a generic 500.
• Preserve the cancellation reason when a run that was executing is finalized, instead of replacing it with the default text.

How to upgrade

Update the trigger.dev/* packages to v4.7.3 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.7.3.