Skip to content

Release 2.1.240 (2026-10-13)

Bug fixes

  • report GitHub API failures as named errors instead of a traceback (#3208) vrg-pr-await now catches GitHubAPIError around wait_for_settle. A permission failure (HTTP 403 / Resource not accessible by integration on the checks or Actions reads) is reported as a GitHub App permissions problem for the PR's owner/repo, pointing at the Checks and Actions read permissions. Any other API failure is printed plainly with its gh output, and a missing token uses the shared missing-token message. All exit 1; the underlying gh error text is always shown. Ref #2862

  • link ci-sync tasks per-org and discard the probe worktree on failure (#3209) vrg-ci-sync hardcoded the vergil-project epic, so vrg-issue-create refused every repo in another org as a cross-org link. It now passes epic=None, linking each repo under its own org's ad-hoc epic, matching vrg-fleet-sync and vrg-xdist-sync.

The fleet-sweep driver stranded .worktrees/probe- when a repo failed before the probe was renamed, so the next sweep of that repo failed at worktree add. A failure in the probe phase now removes the probe; if that removal fails too, the error names both failures. A worktree already renamed to issue-- is never removed.

Documentation

  • add routine App private key rotation procedure (#3210) Add a Rotating an App private key section to credential-management.md covering the user and audit agent Apps: generate a second key, repoint private_key_path in identities.toml, re-inject via vrg-vm restart (Lima) or vrg-vm rebuild (off-platform), verify with a token-minting vrg-gh read, then delete the old key. Repoint the compromise-response Restore step at the new section instead of issue #779. The classic-PAT half of #779 is obsolete; agents no longer use PATs.

CI Evidence: All gates passed — full audit bundle available. Download →