agents

Minor Changes

• Agent Skills read and write a @cloudflare/computer Workspace, for both projection and skills.runner(). See Upgrading to a Computer workspace.

Patch Changes

• Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.

• deprecated

  Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

• createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.

• createAI transcribes with @cf/deepgram/nova-3. See the models docs.

• createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.

• createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.

• agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.

• Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.

• PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.

• openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

Patch Changes

• createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

• createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

• Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

• Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

• McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

• OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

This release adds two new tools, browser via agents/browser/{pi,ai-sdk,tanstack-ai} allowing an agent to create and manipulate a persistent browser session and web_fetch via agents/webfetch/{pi,ai-sdk,tanstack-ai} that can retrieve most document formats converted into markdown.

Minor Changes

• Add browserTool() to agents/browser/pi. See Persistent browser.

• Make agents/lifecycle stable along with the Scheduler (agents/schedules), State (agents/state), WebSockets (agents/websockets) and MCPClientManager (agents/mcp/client) capabilities. See Lifecycle.

Patch Changes

• ThinkHarness now keeps its sessions and operations in the shared agents/harness/store. Migrations are performed on first run. See ThinkHarness: Recovery.

• Add agents/webfetch, a web_fetch tool that reads a URL as Markdown, JSON, or text (HTML, PDF, and Office documents via Worker AI). See Fetch the Web.

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

• New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.

• New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.

• Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.

• Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

• Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.

• Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.

• breaking

  remove the first pass of agents/channels and move Channels to agents/experimental/channels.

  The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.

• Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.

• Add WebChannelChatTransport (agents/experimental/channels/web/ai-sdk), an AI SDK ChatTransport over the Web Channel, so AI SDK UIs can join a Channels conversation.

• Add the Web Channel (agents/experimental/channels/web) and its client (agents/experimental/channels/web/client), which connect browsers and terminals to a conversation over the agent's WebSockets: live transcript and turns, approvals, client tool results, and creating, forking, resetting, listing and following conversations. WebSockets gains use for protocol handlers that run before the configured ones.

• Add agents/websearch, a web_search tool over Cloudflare's Web Search API for the pi harness, the AI SDK, and TanStack AI. See Search the Web.

Patch Changes

• AiSdkHarness: session.wait(operationId, signal) now rejects straight away when signal is already aborted, instead of staying pending until the operation settles.

• AiSdkHarness no longer fails to start when it has stored sessions. onStart listed sessions while listing each one's pending work, and Durable Object storage allows one open kv.list() at a time, so a restarted agent stopped acknowledging messages.

• AiSdkHarness passes its tools to convertToModelMessages, so a tool's toModelOutput also shapes its results on later turns instead of the model getting the raw output as JSON.

• browserTool now has its own tool description instead of codemode's generic one. It covers the cdp API, common CDP mistakes, and the run time limit, so the model no longer runs codemode.search first. It also explains how to take a smaller screenshot when one is over the 1 MB result limit. See Persistent browser.

• Add npx agents tui <url>, a terminal client for a conversation's Web Channel.

  It streams the transcript with highlighted Markdown, collapsible reasoning and tool cards, and shows messages and turns from every surface live. It answers approvals inline, lets a person type a client tool's result, and cancels the running turn with Esc. --header adds headers to the WebSocket upgrade, and CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET are sent as an Access service token. Its dependencies are bundled into dist/cli.js, so installing agents adds none.

• Add experimental agents/harness/container, agents/harness/container/daemon, agents/harness/container/runtime and agents/harness/store. Everything in them may change before it stabilizes.

  ContainerHarness runs an agent CLI such as Claude Code or Codex in a Cloudflare Container (ctx.container) and drives it from a Durable Object, with the same interface as PiHarness (prompt, submit, wait, abort, messages, pending, session(id), sessions). Typed presets (claudeCode(), codex(), containerAgent()) say what runs: the harness builds the container from cloudflare/debian-trixie at runtime and snapshots it, so there is no image to build, and ContainerEgress adds credentials (apiKey, baseUrl, headers) outside the container, which only ever sees a placeholder key. The container stops after an idle timeout (five minutes by default) and the next prompt starts a new one in which the CLI resumes its own session; a container lost mid-run settles that run as container_lost (or reruns it with onContainerLost: "retry"), and an object evicted mid-run reattaches and replays what it missed. agents/harness/container/runtime is the daemon's Node runtime with cliAdapter, for images that bring their own CLI; agents/harness/container/daemon is its runtime-agnostic core; and agents/harness/store is a session store on the object's SQLite that any harness can use.

• MCPClientManager.removeServer() (and Agent.removeMcpServer()) now clears the server's saved OAuth state from Durable Object storage: tokens and client information (including those under earlier client IDs), verifiers, pending states and discovery state. This also works when the server's connection was already closed. Other servers' credentials are untouched, and tokens are not revoked at the OAuth provider. Custom auth providers get invalidateCredentials("all").

• Add experimental agents/harness/opencode and agents/models/opencode. OpenCodeHarness hosts OpenCode v2 (@opencode/sdk/workerd) in a Durable Object behind the same interface as PiHarness: OpenCode's tables are kept under an opencode_ prefix, a Lifecycle wake job per session brings runs back after eviction, and the harness closes OpenCode when it is idle so the object can hibernate. createAI({ binding }) from agents/models/opencode returns an OpenCode plugin that serves Workers AI models through the AI binding. Both APIs are experimental and will change.

• Streams: a live read/readBatches no longer misses chunks appended while the consumer is still handling the previous batch. It re-polls before waiting for the next append, so a reader no longer stalls until a later append or the stream's end.

• Streams rechecks that the v1 chunk table still exists before using it. Two Streams instances on one object, such as a host's own and the one ThinkHarness keeps, each remembered the table separately, so after one folded the last v1 rows and dropped the table the other failed its next append with no such table.

• A routed Task wake whose owner facet is no longer in the root's registry now ends quietly instead of throwing Invalid job outcome on the alarm.

• Add ThinkHarness from the new experimental agents/harness/think entry point. It runs Think's agent loop as a Lifecycle capability with the same shape as PiHarness (prompt, submit, wait, abort, sessions, session(id)), and implements the shared harness interface Channels serves.

  The harness owns its storage: transcripts in the Sessions tables, with branches(), search() and compact() on each session, and in-flight model output in the Streams tables, so a host installs only the harness. Each session has one Lifecycle wake job, so a turn interrupted by an eviction picks up from its last durable write: a cut-short model call is rebuilt from its stream and continued in the same message, and a cut-short tool call is reported to the model, or rerun when the tool carries recovery: "rerun". ThinkChat serves a session over Think's useAgentChat WebSocket protocol. See Think harness.

• agents tui now handles Cloudflare Access: for a URL behind Access, it gets a token from cloudflared (logging in through the browser the first time) and sends it on the WebSocket upgrade. CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET and explicit --header credentials still take precedence.

• agents tui drops a #fragment from the URL it is given, since a WebSocket URL cannot carry one. Previously such a URL made the client exit before connecting.

• useAgentChat replaces a cut-off assistant reply with the server's copy after the WebSocket drops mid-stream. Think sends that copy on reconnect; AIChatAgent doesn't yet.

• WebChannelClient: send() and listConversations() now reject once the client is closed instead of waiting forever. follow() and close() also cancel a reconnect still waiting after a dropped connection, so it no longer opens a second socket that replaces the followed one or reconnects a closed client.

• withX402(...).paidTool now reads the payment from MCP SDK v2 servers, and matches the PAYMENT-SIGNATURE / X-PAYMENT headers case-insensitively.