Release notes

Every entry names the version, its build date, and the exact sources the composed binary was built from (the four commit ids fgai --version prints). Install or upgrade with the command in Installation.

v0.1.89 — 2026-10-12

Composed from: fgai-cli 87c9e04 · DotID d3e6311 · trustmint bcd5987e · bazaar 1b4644c4

Verified against the published channel: a fresh install on macOS using the documented command, the installed binary’s SHA-256 matching the published archive byte-for-byte, the sign-in and refusal paths exercised against production, and this release’s own post-publish check proving both the plain and the cache-busted download paths serve this build on both channels.

What this build carries

  • CLI — sign-in fixes: workforce sessions issued by the current shared sign-in service are accepted, and signing in against an account with no workforce directory now names the command that works (fgai auth service-user configure). A malformed account ID now gets a clear invalid-input error instead of an access-denied error. New releases are proven to be the ones the download channel serves before the release can report success. The install command is documented where developers look for it (see Authentication).

  • DotID — self-service sign-up works: the verification email now reaches your inbox. Real-time console notifications work, and notification feeds verify your account context before serving anything — a caller-supplied account header is never treated as proof of who you are. Factory-service registration’s consent grant is one-time and self-serve: sign in as your account root and run the two grant calls (guide, Step 1).

  • Trustmint — no CLI surface change since the previous release.

  • Bazaar — no CLI surface change since the previous release.

Known limits

  • Parallel identical read requests sent within the same second may return 401 (THM-20150); retry the request.

  • Permission boundaries attached to Identity Center permission sets are not yet enforced; this arrives in the next update. Until then, use permission boundaries set on users, which are enforced.

  • fgai signing-keys platform returns 404 — the command ships but the service behind that route is not serving yet.

  • A subscription, once active, has no cancel path on the released CLI.

  • Deleting a service user does not remove its policy attachments; the orphaned attachment remains listable.

  • If a command fails with ‘workforce renewal session is unavailable’, your saved workforce session expired: run fgai auth logout --force, then sign in again.

v0.1.78 — 2026-10-07

Composed from: fgai-cli bde284c8 · DotID 78677813 · trustmint bcd5987e · bazaar 1b4644c4

Verified against the published channel: a fresh install on macOS using the documented command (a temporary prefix), all 47 documented command invocations in this guide resolving against the installed binary, and the channel-current check reporting zero drift between the served archive and the composed sources.

What this build carries

  • CLI — clearer credential-failure guidance (fgai-cli#35): when no signed credential is found, the failure names the --auth selector that chooses a stored one, and fgai auth status notes when credentials exist but none is named default. See Troubleshooting and Authentication.

  • DotID — the shared-identity cutover completed upstream: CLI operations that touch accounts, organizations, identity-center and STS run against the platform’s shared identity services, and account-console surfaces read the canonical account record.

  • Trustmint — no CLI surface change since the previous release.

  • Bazaar — no CLI surface change since the previous release.