npm / agents
agents
What changed in agents 0.3 to 0.28, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
11 breaking4 security23 new APIs and options10 behavior and defaults7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initagents 0.2816 changes
Breaking changes 4
Rejects a Legacy request when its factory returns an instance still serving another request without closing that instance.
Requests for a session ended with DELETE now receive 404 immediately instead of being served until deferred teardown runs.
MCP client transports now follow redirects only within the same origin.
OpenCodeHarness session.events() now streams a session snapshot followed by events translated into the kinds PiHarness reports; raw OpenCode events remain available and resumable from session.log().
New APIs and options 6
AI Gateway dynamic routes can be selected with ai("dynamic/<route>").
AI SDK models routed with your own vendor key can use vendorKey: "request".
Adds the zdr gateway option to createAI for AI SDK and Pi AI models.
Adds a tool for creating and manipulating a persistent browser session, available through the pi, ai-sdk, and tanstack-ai integrations.
Adds
browserTool()to the pi browser integration.Adds a tool that reads URLs as Markdown, JSON, or text, including HTML, PDF, and Office documents via Worker AI.
Behavior and default changes 6
The lifecycle capability is now stable.
The MCPClientManager capability is now stable.
The Scheduler capability is now stable.
The State capability is now stable.
ThinkHarness keeps sessions and operations in the shared
agents/harness/store; migrations run on first run.The WebSockets capability is now stable.
agents 0.2736 changes
Breaking changes 7
Removes the first-pass Channels entry points and API; Channels moves to agents/experimental/channels, and the old helpers and composites are removed.
Moves Email to the experimental Channels entry point while retaining verified ingress and normalization.
Moves Slack to the experimental Channels entry point while retaining verified ingress and normalization.
Moves Telegram to the experimental Channels entry point while retaining verified ingress and normalization.
Ingress Channels require a participant callback so the application identifies the sender; Channels does not choose an identity.
Rejects immediately when the supplied signal is already aborted instead of remaining pending until the operation settles.
send() and listConversations() reject after the client closes; follow() and close() cancel pending reconnects to avoid unwanted sockets.
Security 1
Adds a way to provide credentials outside the container, which only sees a placeholder key.
New APIs and options 17
Adds a draft harness interface for Channels; the interface may change.
Adds a terminal client for a conversation's Web Channel with live transcripts, approvals, client tool results, and turn cancellation.
Adds an AI SDK harness that runs messages with streamText and keeps sessions and transcripts in the Durable Object, enabling Channels.forHarness to serve an AI SDK model.
Adds a Worker entry point for verifying channel webhooks, routing Web Channel upgrades to conversation-owning agent objects, and delivering outbound messages.
Adds an experimental Lifecycle capability that serves harness sessions as conversations to joined surfaces, with durable, resumable responses on Streams.
Connects a harness to Channels using a channels configuration.
Adds an experimental harness that runs agent CLIs such as Claude Code or Codex in a Cloudflare Container and drives them from a Durable Object.
Adds an OpenCode plugin factory that serves Workers AI models through the AI binding.
Adds an AI SDK tool for sending a message to a surface through the gateway.
Adds headers to the WebSocket upgrade made by the terminal client.
Adds an experimental OpenCode v2 harness hosted in a Durable Object, with session recovery after eviction and hibernation when idle.
Adds a callback for sharing an agent object between participants or refusing them.
Adds a Think agent-loop harness with durable sessions, resumable turns, and the shared harness interface served by Channels.
Adds a Web Channel and client for browser and terminal access to conversations over agent WebSockets, including transcript, turns, approvals, client tool results, and conversation operations.
Adds a tool over Cloudflare's Web Search API for the pi harness, the AI SDK, and TanStack AI.
Adds an AI SDK ChatTransport over the Web Channel so AI SDK UIs can join a Channels conversation.
Adds use for protocol handlers that run before the configured WebSocket handlers.
Behavior and default changes 4
Gets a tool-specific description covering the cdp API, common mistakes, runtime limit, and screenshot result limit, so the model no longer runs codemode.search first.
AiSdkHarness passes tools to convertToModelMessages so each tool's toModelOutput shapes results on later turns instead of exposing raw JSON output.
Clears the removed server's saved OAuth state from Durable Object storage, including tokens and pending or discovery state, without affecting other servers or revoking provider tokens.
Handles Cloudflare Access by obtaining a token from cloudflared and sending it on the WebSocket upgrade; explicit credentials take precedence.
Fixes and other changes 7
Fixes startup with stored sessions so a restarted agent continues acknowledging messages.
Drops a URL fragment before connecting because WebSocket URLs cannot carry one.
Live read and readBatches re-poll before waiting for the next append, preventing readers from stalling when chunks arrive while a batch is being handled.
Rechecks that the v1 chunk table exists before using it, preventing append failures when another Streams instance folds rows and drops the table.
A routed wake whose owner facet is no longer registered ends quietly instead of throwing Invalid job outcome on the alarm.
Replaces a cut-off assistant reply with the server's copy after a mid-stream WebSocket disconnect when the server sends that copy on reconnect.
Reads payments from MCP SDK v2 servers and matches payment headers case-insensitively.
agents 0.33 changes
Security 3
Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing