chore(deps): update minor dependencies (minor) by renovate[bot] · Pull Request #34 · agntn/tools

renovate · 2026-10-05T00:05:42Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@modelcontextprotocol/client (source)	`2.2.0` → `2.4.0`	pnpm.catalog.deps	minor
@modelcontextprotocol/server (source)	`2.2.0` → `2.4.0`	pnpm.catalog.dev	minor
@types/node (source)	`26.2.0` → `26.6.6`	pnpm.catalog.dev	minor
agents (source)	`0.24.0` → `0.32.0`	pnpm.catalog.deps	minor	`0.33.0`
node (source)	`v26.10.0` → `26.13.0`		minor
typebox	`1.3.34` → `1.4.3`	pnpm.catalog.dev	minor
vite (source)	`1.0.0` → `1.4.0`	pnpm.catalog.default	minor
vite-plus (source)	`1.0.0` → `1.4.0`	pnpm.catalog.default	minor
wrangler (source)	`4.128.0` → `4.156.0`	pnpm.catalog.dev	minor	`4.157.0` (+2)

Release Notes

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/client)

`v2.4.0`

Compare Source

Minor Changes

#3057 c05225a Thanks @steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.
#3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.
- @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
- @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
- @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
- @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.
SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

#3083 ef38c67 Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.
#2960 43c45f4 Thanks @claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.
#3081 5820f79 Thanks @claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.
#3057 c05225a Thanks @steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.
#3005 b381559 Thanks @chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.
#3002 895007f Thanks @Hugo-DDT! - createMcpHandler now sends Allow: POST on every 405 it answers to a non-POST request, with legacy: 'stateless' (the default) and with legacy: 'reject'.
#2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.
Updated dependencies [46d9c99]:
- @modelcontextprotocol/core@2.4.0

`v2.3.1`

Compare Source

`v2.3.0`

Compare Source

Minor Changes

#2901 433eb41 Thanks @claude! - The HTTP client transports and the OAuth client helpers now follow a redirect only when it stays within the origin of the request (same scheme, host and port, or http to https on the same host with default ports) and keeps the method (a 307 or 308, or any redirect of a GET). Any other redirect is not followed. A transport then fails the request with an error that names the target; the session is kept and later messages still send. OAuth metadata discovery moves on to the next well-known URL, and any other OAuth request fails with an error that gives the status. Same-origin redirects that keep the method keep working on Node, up to five in a row, and no code changes are needed there. If your endpoint redirects to another origin, configure the transport with the URL it redirects to. A requestInit.redirect of 'error' or 'manual' is passed to fetch as it is for the requests a transport sends to the server (POST, GET and DELETE of the Streamable HTTP transport, POST of the SSE transport); for its OAuth requests, and for any other value, requestInit.redirect is not consulted by default. Browsers do not expose the target of a redirect to a page, so there a redirected request fails instead of being followed. Setting redirectPolicy: 'follow' on a transport leaves its redirects to the fetch implementation, as before this change.

Patch Changes

#2599 5238fba Thanks @freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.
#2846 63c0fca Thanks @Sthreal! - Receiving a large message as a single SSE event over Streamable HTTP, such as a tool result of tens of megabytes, is now fast: a 50 MB result that took about 13 seconds arrives in under a second. The client now requires eventsource-parser 3.0.8 or later. SSEClientTransport reads through the eventsource package and gets the same speed-up once that also resolves eventsource-parser 3.0.8 or later.
#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.
#2903 e765b3b Thanks @claude! - With versionNegotiation in 'auto' or pin mode, a server/discover probe answered with a 2xx that carries no usable reply (a body that
is not JSON under application/json, a bare 204, a missing or unaccepted content type) still rejects connect() with
EraNegotiationFailed; an empty SSE stream or a 202 surfaces as the probe timeout instead. The message now says
the server answered with an unusable reply (...) instead of reading like a network failure. To connect to a 2025 server behind a front that
answers the probe this way, pass connect(transport, { prior: { kind: 'legacy' } }) or use mode: 'legacy'.
#2905 c0cd01a Thanks @claude! - SSEClientTransport now retries the SSE connection once after onUnauthorized() resolves, as documented. If the retry is also answered with 401, start() rejects with SdkHttpError (ClientHttpAuthentication) instead of calling onUnauthorized() again. A 401 on a later reconnect of a stream that had opened still gets one refresh.
Updated dependencies [633dd3e]:
- @modelcontextprotocol/core@2.3.0

cloudflare/agents (agents)

`v0.32.0`

Compare Source

Minor Changes

#2752 34cbd30 Thanks @mattzcarey! - Add experimental_registerOpenTelemetry() to agents/observability, which records spans from OpenTelemetry-instrumented libraries as Workers trace spans. Experimental and subject to change.
#2771 54ae3e8 Thanks @mattzcarey! - Breaking: agents/skills now loads Agent Skills from Computer Workspace files (workspace()), R2 (r2()), or code (manifest()), checks SKILL.md against the Agent Skills spec, and replaces SkillRegistry with loadSkillCatalog() and createSkillTools() (from agents/skills/tools/ai-sdk); parseSkill() follows the spec's guide for agents, loading skills that break a rule with warnings; runner() moved to agents/skills/runner; the agents:skills Vite import and agents/skills/compile are removed. See Agent Skills.

Patch Changes

#2763 df85805 Thanks @mattzcarey! - Agents SDK spans (agent lifecycle, wrapAISDK, Think) now set span status error on failure, where the Workers runtime supports Span.setStatus(); attributes are unchanged. See Observability.
#2737 08747d9 Thanks @mattzcarey! - Mark the package side-effect free (apart from the CLI), so bundlers drop the modules a Worker doesn't use. import { routeAgentRequest } from "agents" no longer bundles the MCP client.
#2744 a2d371e Thanks @mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.4.0 and @modelcontextprotocol/sdk to 1.32.2, and add a clientMetadataUrl option to DurableObjectOAuthClientProvider for OAuth Client ID Metadata Documents. See MCP client.
#2740 8cf6da1 Thanks @mattzcarey! - agents/models/pi-ai parses streamed chat-completions tool-call arguments incrementally, instead of re-parsing the whole argument text on every delta.
#2766 b372289 Thanks @github-actions! - Allow @tanstack/ai 1.x in the optional peer dependency ranges, and type the TanStack AI tools so they compile against both 0.x and 1.x. See TanStack AI.

`v0.31.0`

Compare Source

This release adds internal hostnames to the browser. Give a Browser Run browser hostnames such as preview.internal, and its requests to them go to your agent instead of the internet, so the model can open a dev server, a workspace folder or another Worker in the same browser it uses for the web.

Highlights

Internal hostnames: pass up to 8 hostnames to browserRun() as internalHosts. Serve each one from a fetch function on your agent or from another Worker. See Internal hostnames.
Hosts the model points: give a host a target schema, and the model chooses what it serves with browser.assignHost(), such as a container port or a folder in its workspace. Without a target, a host always serves the same thing.
Lighter installs without MCP servers: @modelcontextprotocol/sdk and @modelcontextprotocol/server are now optional peer dependencies, so apps that don't serve MCP no longer install them.
Stable models: agents/models/ai-sdk and agents/models/pi-ai are no longer experimental. See Models.
Other changes: createMcpHandler passes the verified token from @cloudflare/workers-oauth-provider 1.x to tool callbacks as context.http.authInfo. createAI from agents/models/pi-ai sends pi-ai's Anthropic betas for catalog Claude models. PiWhenBusy accepts "reject".
browserTool improvements: the model's code runs in its own Dynamic Worker instead of on codemode, and is stopped from outside that Worker if it overruns its timeout. It can no longer close the browser or create a Live View link. this.browser.session() lets your own code drive the same browser. createBrowserTools, createBrowserRuntime, BrowserConnector and the Quick Action helpers are deprecated in favour of browserTool.

Upgrading

You only need to make changes if you serve MCP or use browserTool.

If you serve MCP or use agents/x402 or agents/experimental/webmcp:

Add the MCP packages to your package.json at the versions this release expects, since your package manager no longer installs them. Until you do, builds fail with an unresolved import.
- agents/mcp (McpAgent, WorkerTransport, createLegacyMcpHandler) and agents/x402: @modelcontextprotocol/sdk@1.32.1 and @modelcontextprotocol/server@2.3.1
- agents/mcp/server (createMcpHandler): @modelcontextprotocol/server@2.3.1
- agents/experimental/webmcp: @modelcontextprotocol/sdk@1.32.1
See Upgrading an existing McpAgent server.
Import client helpers such as RPCClientTransport from agents/mcp/client instead of agents/mcp. MCP client code needs neither package.

If you use browserTool:

Remove the CodemodeRuntime export from your Worker unless createBrowserTools still uses it, and remove ctx from browserTool's options. Keep the LOADER binding and keep @cloudflare/codemode installed for now.

Update instructions of your own that mention cdp.send, such as a system prompt. The tool's description already teaches the new call:

- await cdp.send({ method: "Page.navigate", params: { url }, sessionId: "active" });
+ await browser.cdp({ method: "Page.navigate", params: { url }, sessionId: "active" });

Read notice instead of restarted, newTabs and calls if your code inspects results. notice says in sentences whether the browser restarted, the page opened tabs, or another chat closed or shares the tab. PiBrowserToolDetails now has only executionId and status.

Minor Changes

#2673 865a57e Thanks @ben-reitz! - Add internalHosts to browserRun() provider: set internal hostnames the browser can reach through your agent. Allow the model to point these hostnames at specific targets like container ports or workspace folders with browser.assignHost(). See Internal hostnames.
#2667 03b4609 Thanks @ben-reitz! - browserTool now runs the model's code in its own Dynamic Worker instead of on codemode, so it needs no ctx or CodemodeRuntime export (keep @cloudflare/codemode installed for now) and its output has no calls log; browser.session() gives your own code the same connection to the browser. See Persistent browser.
#2634 565e37c Thanks @mattzcarey! - @modelcontextprotocol/sdk and @modelcontextprotocol/server are now optional peer dependencies, so add them to your package.json if you use agents/mcp, agents/mcp/server, agents/x402 or agents/experimental/webmcp. See Upgrading an existing McpAgent server.

Patch Changes

#2668 183c141 Thanks @ben-reitz! - browserTool's model code now calls a browser global (browser.cdp(...), browser.spec({ domain })) instead of cdp.send(...), and the result's notice replaces the restarted and newTabs fields. See Persistent browser.
#2666 57c7813 Thanks @ben-reitz! - createBrowserTools, createBrowserRuntime and BrowserConnector are deprecated; use browserTool. See Persistent browser. The Quick Action helpers (createQuickActionTools, runQuickAction, browserMarkdown and the rest) are deprecated too and will not change.
#2743 f049ee1 Thanks @mattzcarey! - agents/models/ai-sdk and agents/models/pi-ai are no longer experimental. See Models.
#2718 916c0e3 Thanks @ben-reitz! - createAI from agents/models/pi-ai now sends pi-ai's betas as the anthropic-beta header for catalog Claude models on /run, as it already did on the provider-native path. See #2714.
#2717 4d7734a Thanks @ben-reitz! - PiWhenBusy accepts "reject", which PiHarness.submit() already passed through to pi-durable. See Pi harness.
#2680 2a25d88 Thanks @mattzcarey! - createMcpHandler now reads the verified token that @cloudflare/workers-oauth-provider 1.x sets as ctx.auth, so tool callbacks receive context.http.authInfo (token, client ID, scopes, expiry and resource) behind OAuthProvider and OAuthResourceServer. getMcpAuthContext().props is unchanged.

`v0.30.1`

Compare Source

Patch Changes

#2684 9c79ba1 Thanks @ben-reitz! - Fix PiHarness with onWake not resuming a sleeping Pi task, such as a compaction retry, while another task is running (#2683). See How recovery works.

`v0.30.0`

Compare Source

This release adds support for Pi 1.4 and makes PiHarness recover more reliably from evictions, crashes and storage errors.

Highlights

Pi 1.4 support: agents/harness/pi now runs on Pi 1.4.
Hibernation while Pi's tasks sleep: PiHarness passes Pi's onWake through your harness factory, so a Durable Object sleeps until Pi's next task is due instead of staying in memory.
One wake job per object: PiHarness wakes from Pi's wake(), so a task stopped by Pi's restart limit no longer keeps the object awake.
Parked tasks: tasks stopped by Pi's restart limit show as parked in pending(), and retry() runs them again.
Recovery: Pi reopens after a storage error instead of failing every call until the object restarts, and the wake job survives failed steps with backoff.
Fixes: Lifecycle no longer keeps evicted Durable Objects in memory, and it arms a fallback alarm when startup fails. pi-ai now reports cut-off model streams with wording Pi treats as transient, so Pi retries them.

Upgrading

Update Pi to ~1.4.0 (@earendil-works/pi-durable, pi-ai, pi-agent-core) and install @earendil-works/chord alongside them. Pi 1.4 migrates session storage to a schema Pi 1.3 cannot open, so a deployment cannot roll back past this release.
Check pi-durable's 1.4.0 changelog for its breaking changes, such as the removal of TaskRuntime.sleep(), the new sleeping task status, and the restart limit that parks a crash-looping task after 5 restarts.
Pass onWake to Harness.open, as in the diff below. Without it, the harness still works but logs a warning, and the object stays in memory while Pi's tasks sleep.

If you create Pi's registry at module scope, move it into your class, as a field or in the factory. Our tool examples showed module scope before this release. Pi keeps every Harness subscribed to its registry until it closes, and an evicted object never closes it, so a module-level registry keeps every evicted object's harness in memory.

- const registry = createRegistry();
  export class Assistant extends Agent<Env> {
+   registry = createRegistry();
    harness = new PiHarness({
      harness: ({ storage, context, onWake }) =>
-       Harness.open(storage, { models, registry }, context)
+       Harness.open(storage, { models, registry: this.registry, onWake }, context)
    });
  }

Keep the harness factory safe to run more than once. It now runs again when Pi reopens after a storage error.
Handle the new parked status if you switch on PiPendingOperation.status.

Existing objects need no migration step. Wake jobs left by earlier releases are handed over to the new wake job on first start.

Minor Changes

#2617 cfe9d0f Thanks @ben-reitz! - Support Pi 1.4: the Pi peer range is now ~1.4.0. Pi 1.4 migrates SQLite session storage to a schema that Pi 1.3 cannot open, so a deployment cannot roll back past this release. See Pi harness.
#2619 4b535dc Thanks @ben-reitz! - PiHarness hands its factory an onWake to pass to Harness.open, so the Durable Object can hibernate while Pi's tasks sleep. Add it to your factory: harness: ({ storage, context, onWake }) => Harness.open(storage, { ...options, onWake }, context). Without it the harness still works and logs a warning. See Pi harness.
#2624 3954859 Thanks @ben-reitz! - PiHarness shows operations stopped by Pi's restart limit as parked in pending(), and retry() runs them again. See Pi harness.

Patch Changes

#2644 f404547 Thanks @ben-reitz! - Lifecycle arms a fallback alarm while its job queue holds jobs, before startup runs in an alarm and after a startup that queued jobs throws, so a failed startup cannot leave queued jobs without a wake. See Lifecycle.
#2653 fc4cd24 Thanks @ben-reitz! - Stop Lifecycle startup keeping an evicted Durable Object in memory when a capability's startup leaves a promise pending, as PiHarness does when it opens Pi. See Pi harness.
#2643 e117121 Thanks @ben-reitz! - agents/models/pi-ai reports a cut-off or idle model stream with wording pi's retry policy treats as transient, so pi retries the turn instead of failing it. See Models with pi-ai.
#2617 cfe9d0f Thanks @ben-reitz! - agents/harness/pi now uses chord's own context helpers, so install @earendil-works/chord alongside pi-durable and pi-ai. See Pi harness.
#2648 000fcaf Thanks @ben-reitz! - PiHarness opens pi again after a storage error closes it, instead of failing every call until the object restarts. See How recovery works.
#2618 3e91ded Thanks @ben-reitz! - PiHarness wakes from Pi's wake() with one job per object, so a task parked by Pi's restart limit no longer keeps the Durable Object awake. See Pi harness.
#2649 91a8f61 Thanks @ben-reitz! - PiHarness keeps its wake job when a step fails, retrying with a backoff up to 10 minutes, and counts a memory-limit reset during the job's wait against the alarm memory-limit breaker. See How recovery works.

`v0.29.0`

Compare Source

Minor Changes

#2560 8c720d3 Thanks @mattzcarey! - Agent Skills read and write a @cloudflare/computer Workspace, for both projection and skills.runner(). See Upgrading to a Computer workspace.

Patch Changes

#2584 3b3a88e Thanks @ben-reitz! - Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.
#2615 05843e4 Thanks @mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.
#2604 5d6f5d6 Thanks @mattzcarey! - createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.
#2622 2c68a71 Thanks @mattzcarey! - createAI transcribes with @cf/deepgram/nova-3. See the models docs.
#2576 b048873 Thanks @mattzcarey! - createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.
#2589 841cc18 Thanks @mattzcarey! - createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.
#2594 cc34652 Thanks @ben-reitz! - agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.
#2594 cc34652 Thanks @ben-reitz! - Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.
#2621 e80a201 Thanks @ben-reitz! - PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.
#2616 65ddec8 Thanks @ben-reitz! - openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

`v0.28.1`

Compare Source

Patch Changes

#2571 1bd2bc5 Thanks @mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.
#2572 b7c6ab9 Thanks @mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.
#2573 80719a5 Thanks @mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.
#2574 131af4b Thanks @mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.
#2574 131af4b Thanks @mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.
#2568 46570f5 Thanks @mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

`v0.28.0`

Compare Source

Minor Changes

#2484 dedbee4 Thanks @ben-reitz! - Add browserTool() to agents/browser/pi. See Persistent browser.
#2473 6614955 Thanks @mattzcarey! - Make agents/lifecycle stable along with the Scheduler (agents/schedules), State (agents/state), WebSockets (agents/websockets) and MCPClientManager (agents/mcp/client) capabilities. See Lifecycle.

Patch Changes

#2540 b65956e Thanks @mattzcarey! - ThinkHarness now keeps its sessions and operations in the shared agents/harness/store. Migrations are performed on first run. See ThinkHarness: Recovery.
#2522 bcf5d20 Thanks @ben-reitz! - Add agents/webfetch, a web_fetch tool that reads a URL as Markdown, JSON, or text (HTML, PDF, and Office documents via Worker AI). See Fetch the Web.

`v0.27.0`

Compare Source

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.
New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.
Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.
Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

#2434 0ebeae5 Thanks @cjol! - Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.
#2431 6393265 Thanks @cjol! - Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.
#2429 df4cbd6 Thanks @cjol! - Breaking: remove the first pass of agents/channels and move Channels to agents/experimental/channels.

The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.
#2432 752cdc3 Thanks @cjol! - Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.
#2436 062d091 Thanks [@cjol](https://r

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coldtea-pr-lens · 2026-10-05T00:05:46Z

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

cloudflare-workers-and-pages · 2026-10-05T00:08:29Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-minor-dependencies-agntn-tools.oritwoen.workers.dev (commit `eaa310f`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		`baf838a`	2026-10-10T18:01:40.626Z	View logs ↗
Build: Failed ❌ View logs ↗		`4e815f0`	2026-10-10T04:56:18.098Z	View logs ↗
Build: Failed ❌ View logs ↗		`ee41336`	2026-10-10T00:49:29.998Z	View logs ↗
Build: Failed ❌ View logs ↗		`c137e44`	2026-10-09T14:31:04.399Z	View logs ↗
Build: Failed ❌ View logs ↗		`4333d41`	2026-10-09T02:29:44.547Z	View logs ↗
Build: Failed ❌ View logs ↗		`6b54476`	2026-10-08T20:04:41.920Z	View logs ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://e2d3e9d1-agntn-tools.oritwoen.workers.dev	`eaa310f`	2026-10-08T14:24:35.135Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://a038bda5-agntn-tools.oritwoen.workers.dev	`51574b5`	2026-10-06T10:01:26.039Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://28afae1e-agntn-tools.oritwoen.workers.dev	`b65c468`	2026-10-05T22:35:02.601Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://debcfed8-agntn-tools.oritwoen.workers.dev	`a2e21fe`	2026-10-05T13:19:40.425Z	Visit the dashboard ↗

View all previews: View all previews ↗

renovate Bot requested a review from oritwoen as a code owner October 5, 2026 00:05

renovate Bot added the dependencies label Oct 5, 2026

renovate Bot force-pushed the renovate/minor-dependencies branch 12 times, most recently from baf838a to 7527af7 Compare October 11, 2026 20:40

renovate Bot force-pushed the renovate/minor-dependencies branch 8 times, most recently from c7ade05 to dd97546 Compare October 19, 2026 10:41

renovate Bot force-pushed the renovate/minor-dependencies branch 6 times, most recently from 4a83be6 to e393ec6 Compare October 25, 2026 08:30

renovate Bot force-pushed the renovate/minor-dependencies branch 6 times, most recently from 13a6ed4 to cb90e89 Compare November 1, 2026 11:34

renovate Bot force-pushed the renovate/minor-dependencies branch 2 times, most recently from c205ffe to a9f305f Compare November 2, 2026 12:38

oritwoen approved these changes Nov 2, 2026

View reviewed changes

renovate Bot force-pushed the renovate/minor-dependencies branch 2 times, most recently from c739e57 to eb06a81 Compare November 2, 2026 21:11

chore(deps): update minor dependencies

f83286d

renovate Bot force-pushed the renovate/minor-dependencies branch from eb06a81 to f83286d Compare November 2, 2026 21:32

oritwoen merged commit 2a3dc26 into main Nov 3, 2026
3 checks passed

oritwoen deleted the renovate/minor-dependencies branch November 3, 2026 13:56

Navigation Menu

Repository navigation

chore(deps): update minor dependencies (minor) - #34

chore(deps): update minor dependencies (minor)#34
oritwoen merged 1 commit into
mainfrom
renovate/minor-dependencies

renovate Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

coldtea-pr-lens Bot commented Oct 5, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Highlights

Upgrading

Minor Changes

Patch Changes

Patch Changes

Highlights

Upgrading

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Configuration

Uh oh!

coldtea-pr-lens Bot commented Oct 5, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-minor-dependencies-agntn-tools.oritwoen.workers.dev (commit eaa310f)

This URL reflects your latest Preview deployment

Preview Deployments by commit

View all previews: View all previews ↗

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 5, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Oct 5, 2026 •

edited

Loading

Preview URL: https://renovate-minor-dependencies-agntn-tools.oritwoen.workers.dev (commit `eaa310f`)