Prepare release 0.4.0-beta

.changes/v0.4.0-beta.md

@@ -0,0 +1,38 @@
+## v0.4.0-beta (July 23, 2026)
+
+
+NEW FEATURES:
+
+* Adds the `harness exec` command, which lets a human grant session-scoped, noninteractive `tfctl` delete permissions to a wrapped command (such as a coding agent) via `--allow-delete`. The grant is tied to the wrapped process, auto-reverts when it exits, and never covers the irreversible `organizations` and `projects` classes unless they are named explicitly.
+
+
+ENHANCEMENTS:
+
+* Adds a `--plan-only` flag to `run start` that creates a speculative plan-only run which is never applied, regardless of the workspace's auto-apply setting.
+
+* Positional arguments and API path parameters are now checked for basic input hygiene, rejecting control characters and invalid UTF-8. This keeps malformed values out of requests and out of terminal/audit output. This is not a security boundary; authorization is still enforced by your API token.
+
+* The config directory can now be overridden with the TFCTL_CONFIG_DIR environment variable. Profiles and exec sessions both resolve against this directory, making it easy to isolate tfctl state (for example, in CI or eval harnesses).
+
+
+BUG FIXES:
+
+* Don't attempt to retry telemetry transmission on server errors, like rate limiting 429 errors.
+
+* Detect Terraform's `TF_TOKEN_<hostname>` environment variables (such as `TF_TOKEN_app_terraform_io`) during authentication, matching Terraform CLI's resolution. This includes punycode hostnames and the interchangeable dash encodings (literal `-` or double underscore). Previously these tokens were not detected.
+
+* Clarify the not-found (404) API error message to point at verifying the request path and resource IDs instead of suggesting an authentication problem.
+
+* Fix `api --all` returning no output when the result fits in a single page. The response body was consumed while checking for additional pages and not restored, so single-page responses rendered empty.
+
+* Fix `api` `--json` and `--jq` output incorrectly including one-to-one relationship IDs under `attributes`. Those IDs are surfaced for table and pretty output only, and are no longer written back into the raw JSON payload.
+
+* Redacts customer data within HTTP paths in telemetry payloads, such as organization and workspace names.
+
+* Using the --quiet argument no longer suppresses api command rendering for GET requests.
+
+
+NOTES:
+
+* For developers of tfctl, added CONTRIBUTING.md, developer setup automation, and `make help`
+

CHANGELOG.md

@@ -1,3 +1,41 @@
+## v0.4.0-beta (July 23, 2026)
+
+
+NEW FEATURES:
+
+* Adds the `harness exec` command, which lets a human grant session-scoped, noninteractive `tfctl` delete permissions to a wrapped command (such as a coding agent) via `--allow-delete`. The grant is tied to the wrapped process, auto-reverts when it exits, and never covers the irreversible `organizations` and `projects` classes unless they are named explicitly.
+
+
+ENHANCEMENTS:
+
+* Adds a `--plan-only` flag to `run start` that creates a speculative plan-only run which is never applied, regardless of the workspace's auto-apply setting.
+
+* Positional arguments and API path parameters are now checked for basic input hygiene, rejecting control characters and invalid UTF-8. This keeps malformed values out of requests and out of terminal/audit output. This is not a security boundary; authorization is still enforced by your API token.
+
+* The config directory can now be overridden with the TFCTL_CONFIG_DIR environment variable. Profiles and exec sessions both resolve against this directory, making it easy to isolate tfctl state (for example, in CI or eval harnesses).
+
+
+BUG FIXES:
+
+* Don't attempt to retry telemetry transmission on server errors, like rate limiting 429 errors.
+
+* Detect Terraform's `TF_TOKEN_<hostname>` environment variables (such as `TF_TOKEN_app_terraform_io`) during authentication, matching Terraform CLI's resolution. This includes punycode hostnames and the interchangeable dash encodings (literal `-` or double underscore). Previously these tokens were not detected.
+
+* Clarify the not-found (404) API error message to point at verifying the request path and resource IDs instead of suggesting an authentication problem.
+
+* Fix `api --all` returning no output when the result fits in a single page. The response body was consumed while checking for additional pages and not restored, so single-page responses rendered empty.
+
+* Fix `api` `--json` and `--jq` output incorrectly including one-to-one relationship IDs under `attributes`. Those IDs are surfaced for table and pretty output only, and are no longer written back into the raw JSON payload.
+
+* Redacts customer data within HTTP paths in telemetry payloads, such as organization and workspace names.
+
+* Using the --quiet argument no longer suppresses api command rendering for GET requests.
+
+
+NOTES:
+
+* For developers of tfctl, added CONTRIBUTING.md, developer setup automation, and `make help`
+
 ## v0.3.0 (June 22, 2026)
 
 

version/VERSION

@@ -1 +1 @@
-0.3.0
+0.4.0-beta

version/version.go

@@ -42,7 +42,7 @@ var (
 
 // IsDev returns true if the current version is a development version.
 func IsDev() bool {
-	return strings.HasSuffix(version, "-dev")
+	return strings.HasSuffix(Version, "-dev")
 }
 
 // Commit returns the git commit used for this specific version.
@@ -68,7 +68,7 @@ func mustParseTime(ts string) time.Time {
 // version, we will ensure it is prefixed with a `v`. If not, we will leave the
 // version as is and return it.
 func publicVersion(v string) string {
-	sv, err := goversion.NewSemver(v)
+	sv, err := goversion.NewSemver(strings.TrimRight(v, "\r\n"))
 	if err != nil {
 		return v
 	}