Skip to main content
​
v2.1.39

​
Changelog

  • Fixed disabling SCIM/SSO via Helm having no effect. bifrost.scim.enabled: false skipped the scim_config block entirely, so the section was absent from the rendered config.json, the runtime never reconciled it, and SCIM stayed enabled from the previous state. bifrost.scim no longer has a chart default (the block is commented out in values.yaml), and scim_config is now rendered whenever bifrost.scim is declared at all — so enabled: false emits "scim_config": {"enabled": false} and the disable propagates. Installs that never declare bifrost.scim emit nothing, leaving dashboard-configured SCIM untouched.
  • Added bifrost.client.compat.azureDeepseek (default false) — converts Azure DeepSeek responses requests to chat completions so reasoning is preserved for coding harnesses. Renders into client.compat.azure_deepseek.
  • Updated bifrost.governance.complexityAnalyzerConfig for semantic Complexity Router configuration: set an embedding provider and model, add reference phrases for Simple, Medium, and Complex, and choose embedded or vector_store phrase storage. Bifrost detects the embedding dimension during warmup. Legacy four-tier lists remain valid: Simple stays Simple, Code and Technical merge into Medium, and Reasoning merges into Complex. Legacy tier_boundaries remain accepted during upgrades but are optional and ignored by semantic routing. Renders into governance.complexity_analyzer_config.
  • Added vectorStore.type: chromem plus a vectorStore.chromem block (path, compress) for the embedded in-process vector store used by semantic complexity routing. Renders into vector_store.config.
  • Added bifrost.governance.complexityAnalyzerConfig.session.enabled for session-aware Complexity Router behavior. Identified sessions retain their highest observed tier across normally sequential turns for 24 hours of inactivity; overlapping requests for the same session are best-effort and resolve by last writer wins. Renders into governance.complexity_analyzer_config.session.enabled.
  • Fixed postgresql.external.passwordCommand and storage.logsStore.postgres.passwordCommand being unusable: the mutual-exclusion rules in values.schema.json tested only for key presence, and values.yaml ships password: "" / existingSecret: "" as defaults, so any chart install that set passwordCommand failed validation with 'not' failed. They now check the value instead — password and existingSecret must be empty when passwordCommand is set — so RDS IAM auth renders password_command into config_store.config / logs_store.config without needing password: null overrides.
  • Added bifrost.scim.config.attributeAccessProfileMappings to every SCIM/SSO provider — attribute → access-profile grants (attribute/value/accessProfile, * and glob values supported). Every matching rule applies: the user holds the union of the matched profiles on top of whatever a role or the dashboard assigned, and Bifrost enforces the tightest limit across them. Renders into the provider’s attributeAccessProfileMappings.
  • Added bifrost.scim.config.enableBulkSync for the entra and google providers. Normally set by the SCIM verify step (turned off when the app registration lacks the Graph permissions / the service account lacks the Directory API scopes); declare it false to opt out of bulk user/group sync while keeping login-time claim sync. Renders into enableBulkSync.
  • Added bifrost.governance.projects — projects declared in config.json: access_rule, membership_mode, accounting_mode, split_policy, calendar_aligned, plus budgets, rate_limit, provider_configs (with model_budgets), mcp_configs, and virtual_mcps. Members are still added from the dashboard or the API. Renders into governance.projects.
  • Added bifrost.mcp.clientConfigs[].allowByDefault — when true the MCP server is available to every caller not explicitly assigned it, with all tools allowed; an explicit assignment still wins for that caller. Supersedes allowOnAllVirtualKeys, now deprecated and read only when allowByDefault is absent. The chart emits whichever key you declare, so the existing key keeps working untranslated. Renders into allow_by_default / allow_on_all_virtual_keys.
  • Added bifrost.mcp.clientConfigs[].endpointSlug — URL-safe, immutable slug serving the client at /mcp/<slug>. Derived from the client name when omitted; must be unique across MCP clients and Virtual MCPs. Renders into endpoint_slug.
  • Added bifrost.client.vkRotationCooldown (default 0) — grace period after a virtual key rotation during which the previous key value still authenticates. Go duration string (e.g. "5m"), max 30 days; 0 disables. Renders into client.vk_rotation_cooldown.
  • Added databricks_key_config (workspace_url, api_format, client_id/client_secret for OAuth M2M, forward_gateway_tags) to provider keys, with bifrost.providers.databricks examples in values.yaml.
  • Added allow_all_providers to bifrost.governance.projects[] and bifrost.accessProfiles[] (default false) — grant access to every provider, including ones without a provider_configs entry and providers added later; listed providers keep their own model, key, budget, and rate-limit rules. Renders into each entry’s allow_all_providers.