This release introduces first-class plan management with a new CLI command group and TUI browser, adds YAML safety mode defaults, and includes several bug fixes for runtime stability and structured output handling.

What's New

• Adds docker agent plans CLI command group and a host-facing plan service package for managing plans from outside the agent runtime
• Adds a /plans browser, detail view, and action dialogs to the TUI for interactive plan management
• Adds YAML safety mode defaults to team runtime, individual agents, user settings, and aliases, with declarative precedence rules
• Adds an Active agents only option in TUI settings to filter the sidebar to agents participating in the current session
• Logs a warning when Docker Desktop serves an expired token to the models gateway

Bug Fixes

• Fixes runtime re-entry loop when a content-only turn ends with a bare EOF and no finish_reason from the provider
• Fixes structured output handling for Claude models served through OpenAI-compatible endpoints by reinforcing schema constraints in system instructions
• Fixes evaluation budget termination outcomes so budget_exceeded results are preserved correctly across transcripts, SQLite, and session JSON
• Hardens host plan management and stabilizes asynchronous TUI workflows for plans
• Fixes atomic file replacement on Windows to allow plan storage reads during open file operations

Technical Changes

• Exports ValidateName, CorruptPlanError, SharedStorage, and ChangeNotifier from the plan package
• Adds PlanChangedEvent emission on shared plan mutations in the runtime
• Centralizes plan editor handling in the TUI
• Adds plan storage testing on Windows as a CI gate
• Adds documentation for the Provider Credentials section in eval containers, clarifying GITHUB_TOKEN forwarding behavior

What's Changed

• docs: update CHANGELOG.md for v1.118.0 by @docker-read-write[bot] in #3861
• fix(openai): reinforce structured output for Claude proxies by @Sayt-0 in #3863
• feat(config): add YAML safety mode defaults by @Sayt-0 in #3860
• fix(eval): preserve budget termination outcomes by @Sayt-0 in #3862
• docs: explain GITHUB_TOKEN forwarding for eval containers by @priyanka25aug in #3857
• feat: add first-class host UX for plan management (#3844) by @Sayt-0 in #3853
• feat(tui): filter sidebar to active agents by @Sayt-0 in #3864
• fix(plans): address review follow-ups from #3853 by @Sayt-0 in #3865
• fix(runtime): stop content-only turns that end with a bare EOF (no finish_reason) by @awschmeder in #3669
• feat(desktop): log when Docker Desktop serves an expired token by @trungutt in #3867

New Contributors

• @priyanka25aug made their first contribution in #3857
• @awschmeder made their first contribution in #3669

Full Changelog: v1.118.0...v1.119.0

This release brings TUI animation infrastructure improvements, several bug fixes for session isolation, credential security, and model discovery, plus a new desktop token staleness logging feature.

What's New

• Adds a program-scoped animation runtime to the TUI, centralizing spinners, durations, and transitions for more consistent and robust animations
• Adds token staleness logging when Docker Desktop refresh recovery fails, promoting failure paths to Warn/Info level for better observability

Improvements

• Bounds progressive Markdown rendering in the TUI, enabling segmented output that avoids repeatedly re-processing completed blocks
• Adopts the program-scoped animation runtime across TUI animation consumers, migrating to elapsed-time updates and dirty-tick-driven root-view caching
• Compacts detailed sidebar metrics in the TUI to adapt to available width, using short forms (Eff, Ctx, Cost) at constrained widths and restoring full labels and gauges when space allows

Bug Fixes

• Fixes concurrent LoadWithConfig calls from sharing a working directory, preventing sessions from observing each other's working directory under concurrent load
• Fixes duplicated text in GitHub Copilot responses by deduplicating streamed content tracked by both item ID and output_index
• Unifies gateway model discovery between docker agent models and the interactive /model picker so that a non-empty /v1/models response is the source of truth
• Fixes safety modes (autonomous, legacy approval, YOLO state) not being preserved across session flows and /new transitions
• Fixes credential leaks in remote tool transports (MCP and A2A) by restricting bearer tokens and custom headers to requests whose origin matches the transport's configured origin

Technical Changes

• Removes unused dead TUI code including an unused lean TUI transcript reset method, package-level animation registration shim, and user-theme existence helper

What's Changed

• chore: remove dead TUI code by @Sayt-0 in #3836
• docs: update CHANGELOG.md for v1.117.0 by @docker-read-write[bot] in #3838
• fix: prevent concurrent LoadWithConfig calls from sharing working dir by @dgageot in #3842
• TUI - Program-scoped animation runtime by @krissetto in #3843
• fix(openai): deduplicate Copilot response text by @Sayt-0 in #3846
• fix(models): unify gateway model discovery by @Sayt-0 in #3847
• fix: preserve safety modes across session flows by @Sayt-0 in #3848
• fix: prevent credential leaks in remote tool transports by @dgageot in #3850
• chore: update docker-agent-action to v2.0.3 by @docker-agent in #3852
• TUI - enable segmented markdown rendering by @krissetto in #3851
• chore: bump direct go dependencies by @dgageot in #3854
• Adopt program-scoped animation runtime by @krissetto in #3855
• fix(tui): compact detailed sidebar metrics by @Sayt-0 in #3858
• feat(desktop): log token staleness when refresh recovery fails by @trungutt in #3859

Full Changelog: v1.117.0...v1.118.0

This release adds support for Claude Opus 5 and introduces a new three-mode safety policy system for tool approval control.

What's New

• Adds support for Claude Opus 5 (released 2026-07-24, 1M context window, 128k output)
• Adds a three-mode safety policy (strict / balanced / autonomous) with native shell classification, providing a middle ground between per-call approval and blanket session-wide approval

Technical Changes

• Refreshes the embedded models.dev catalog snapshot to 2026-07-24

What's Changed

• docs: update CHANGELOG.md for v1.116.0 by @docker-read-write[bot] in #3828
• feat: support Claude Opus 5 by @aheritier in #3830
• feat: three-mode safety policy (strict / balanced / autonomous) with native shell classification by @trungutt in #3835
• chore: refresh embedded models.dev snapshot by @github-actions[bot] in #3834

Full Changelog: v1.116.0...v1.117.0

This release adds sandbox authentication improvements, compaction-model context visibility in the TUI, MCP lifecycle enforcement, and a range of bug fixes across the TUI, CLI, and OpenAI integration.

What's New

• Adds sbx-login injection for gateway authentication in sandbox environments, replacing the previous file-based token-forwarding mechanism
• Defaults sandbox creation to the docker/docker-agent-sbx-templates:latest template
• Creates sandboxes under the canonical docker-agent name
• Makes oauth clientId optional for remote MCP toolsets, supporting Dynamic Client Registration and interactive credential flows
• Surfaces the compaction-model context-limit cap explicitly in the /context dialog and sidebar, so users can see when a dedicated compaction model is imposing a smaller context window than the primary model
• Adds segment-aware click detection on the sidebar Token Usage reading: clicking the token count/percentage opens /context, clicking the cost/⚠ capped area opens /cost; the "Token Usage" title is no longer clickable
• Enforces lifecycle.call_timeout for MCP tool calls, which was previously parsed but never acted on
• Exposes spawned TUI tabs (opened with ctrl+t) on the --listen control plane so control-plane clients can observe all active sessions
• Adds GitHub Copilot to docker agent setup and doctor, recognizing both GITHUB_TOKEN and GH_TOKEN

Bug Fixes

• Fixes copy buttons rendering in contexts where they were never wired up for hit-testing (reasoning blocks, elicitation dialogs, lean TUI, shell output, welcome messages)
• Fixes the "copied" flash background on user-message copy labels, which previously rendered with a transparent background
• Fixes mouse hit-testing falling out of sync when layout shifts without a terminal resize (e.g., after loading a past session with /session)
• Fixes an infinite loop in backgroundAt when encountering invalid UTF-8 bytes
• Fixes capability handlers (OAuth elicitation, etc.) not being forwarded to inner toolsets when code_mode_tools: true is set
• Fixes data races in deferred tools and the BM25 RAG strategy, and prevents a TUI editor panic
• Fixes wrapped URLs losing their clickability in tool output
• Fixes the ⚠ capped marker on the sidebar opening /cost instead of /context
• Fixes docker agent debug not appearing in the root help output
• Fixes docker agent setup provider path labels to clarify built-in cloud providers vs. custom OpenAI-compatible endpoints
• Fixes OpenAI Responses API function arguments not being recovered when providers omit response.function_call_arguments.delta

Technical Changes

• Refactors sandbox integration to assume the modern CLI surface shared by both backends
• Removes all references to the discontinued agentcatalog Docker Hub namespace, replacing examples with neutral myorg/agent placeholders
• Freezes config schema v14 and advances latest to v15
• Refactors board internals: deduplicates column lookup with a columnIndexLocked helper, deduplicates stored-project access with a projectsLocked helper, and consolidates per-card controller state into a single cardState map

What's Changed

• fix(tui): never render dead code-block copy buttons by @dgageot in #3789
• docs: update CHANGELOG.md for v1.115.0 by @docker-read-write[bot] in #3790
• sandbox: rely on sbx-login injection for gateway auth, modern sandbox CLI surface by @dgageot in #3791
• docs: update slash command and permission pattern docs for recent changes by @aheritier in #3794
• feat(config): make oauth clientId optional for remote MCP toolsets by @dgageot in #3796
• fix(tui): keep copy label background under "copied" flash by @dgageot in #3797
• fix(tui): guard backgroundAt against infinite loop on invalid UTF-8 by @dgageot in #3799
• fix(tui): keep mouse hit-testing in sync when the layout shifts without a resize by @dgageot in #3798
• chore: remove every trace of the discontinued agent catalog by @dgageot in #3804
• chore: bump direct Go dependencies by @dgageot in #3801
• fix(cli): add GitHub Copilot to setup and doctor by @stkevintan in #3793
• feat(config): freeze config v14 and start v15 as latest by @dgageot in #3807
• docs: auto-update for merged PRs (2026-07-23) by @aheritier in #3812
• docs: improve Ollama and local models discoverability by @aheritier in #3810
• fix(codemode): forward capability handlers to inner toolsets by @aheritier in #3809
• docs: auto-update for merged PRs (2026-07-24) by @aheritier in #3815
• feat(tui): open /context or /cost from the sidebar token-usage reading by @aheritier in #3813
• feat(tui): surface compaction-model context-limit cap in the TUI by @aheritier in #3811
• chore: bump direct Go dependencies by @dgageot in #3816
• refactor(board): simplify app and controller internals by @dgageot in #3817
• feat: enforce lifecycle.call_timeout for MCP tool calls by @jedp-docker in #3814
• feat(run): expose spawned TUI tabs on the --listen control plane by @dgageot in #3819
• fix: resolve data races in deferred tools and BM25 strategy, prevent TUI editor panic by @Piyush0049 in #3822
• fix(tui): keep wrapped URLs clickable by @Sayt-0 in #3823
• fix(setup): clarify model provider paths by @Sayt-0 in #3824
• fix(openai): recover final response tool arguments by @Sayt-0 in #3825
• fix(tui): open /context (not /cost) when clicking the ⚠ capped marker by @aheritier in #3826
• fix(cli): show debug command in help by @Sayt-0 in #3827

New Contributors

• @stkevintan made their first contribution in #3793

Full Changelog: v1.115.0...v1.116.0

This release fixes permission pattern parsing for colon-containing values, adds provider-level compaction model defaults, resolves agent-switch slash commands over HTTP, and includes several bug fixes and refactors.

What's New

• Adds X-Cagent-Compacting: 1 HTTP header on session-compaction LLM calls to allow gateway-side policies to distinguish compaction calls from regular chat completions
• Adds support for provider-level compaction_model default, so agents sharing a provider no longer need to repeat the setting individually
• Adds an optional description field to model config entries for human-readable annotations
• Resolves agent-switch slash commands in RunSession for HTTP/REST clients, enabling mid-session agent switches without requiring the two-segment route

Bug Fixes

• Fixes permission pattern parsing where colons in argument values (e.g. URLs or Windows drive paths) caused patterns to be silently truncated, resulting in deny rules never firing
• Fixes A2A tool silently succeeding when a sub-agent stream returns empty; also resolves cross-platform test instability on Windows
• Fixes compaction_model references not being resolved during first_available reachability checks and environment preflight
• Fixes model description not being preserved across first_available resolution and shorthand marshalling
• Fixes agent-switch pre-switch command resolution and rolls back partial switches on failure
• Fixes TUI history-search input not being restyled when a live theme change occurs, leaving stale styling after switching themes
• Fixes GatewayHTTPOptions panicking when model options are nil
• Reverts a WorkingDir containment check that broke callers running docker-agent as a long-lived daemon pointing sessions at arbitrary paths

Technical Changes

• Fixes log-injection (CodeQL go/log-injection) in pkg/telemetry/client.go by replacing string concatenation with structured key-value logging
• Sanitizes string arguments to close remaining log-injection taint paths and closes unbarriered passthrough in sanitizeLogArgs
• Refactors permission pattern parsing to use strings.Cut and then a regexp-based approach replacing the hand-rolled colon scanner
• Moves Desktop proxy HTTP transport to a new leaf package pkg/desktop/transport
• Moves Vertex AI support to anthropic/vertex subpackage to reduce transitive dependencies for library consumers

What's Changed

• docs: update CHANGELOG.md for v1.114.0 by @docker-read-write[bot] in #3775
• feat: add X-Cagent-Compacting header for session-compaction LLM calls by @dgageot in #3777
• refactor: trim transitive dependencies for library consumers by @dgageot in #3778
• chore: bump direct Go dependencies by @dgageot in #3776
• docs: update docs for config v14 and Mermaid state diagram directions by @aheritier in #3779
• fix(codeql): go/log-injection in pkg/telemetry/client.go:24 by @ronan-thibaut-glitch in #3755
• chore: bump github.com/anthropics/anthropic-sdk-go from v1.58.0 to v1.58.1 by @dgageot in #3781
• fix(permissions): keep colons in argument values from truncating patterns by @parveshsaini in #3767
• feat(config): add description attribute to models by @dgageot in #3783
• feat: support provider-level compaction_model default by @dgageot in #3785
• fix: A2A response error handling and cross-platform test stability by @Piyush0049 in #3745
• fix(tui): restyle history-search input on live theme change by @aheritier in #3786
• feat(server): resolve agent-switch slash commands in RunSession by @trungutt in #3782
• Revert "fix(codeql): go/path-injection in pkg/server/session_manager.go:542" (#3758) by @trungutt in #3788

Full Changelog: v1.114.0...v1.115.0

This release adds config flavors, Mermaid state diagram direction support, and Anthropic adaptive-thinking validation, along with several bug fixes for security, token refresh, and session handling.

Breaking Changes

• Moves the file-backed SQLite session store to session/sqlitestore (refactor(session)!:)

What's New

• Adds config flavors — named YAML patches declared in an agent config and applied at load time via the --flavor flag
• Adds support for Mermaid state diagram directions
• Adds fast-fail validation when thinking_display: display is set on Anthropic adaptive-thinking models (Claude Opus/Sonnet 4.6+), surfacing the error at startup rather than at inference time
• Makes standalone SSE usage in MCP tools configurable (defaults to false)

Bug Fixes

• Fixes path injection risk in CreateSession by validating WorkingDir against permitted roots before use
• Fixes incorrect integer conversion in DMR provider by adding bounds check when narrowing int64 context size to int32
• Fixes token refresh when Docker Desktop returns an expired JWT, and prevents the refresh nudge from starving the token polling budget
• Fixes Anthropic thinking_display validation to also apply against fallback models
• Fixes decoding of remote MCP prompts instead of type-asserting
• Fixes session store recovery to not overwrite an existing backup
• Hardens error paths in the OAuth flow

Technical Changes

• Splits model discovery into an OpenAI-free dmrmodels package
• Drops full go-git dependency from gitignore matching
• Decouples pkg/runtime and pkg/agent from the MCP toolset package
• Makes the JS command evaluator pluggable to drop the goja dependency
• Removes unreachable helpers left behind by earlier refactors (including Printer.PrintError, NewSourceLoader, ToolsetMetadata, workingdir.Default, and ExtractCoords)
• Freezes config schema v13 and opens v14 as the new latest
• Replaces context.Background() with t.Context() in tests

What's Changed

• docs: update CHANGELOG.md for v1.113.0 by @docker-read-write[bot] in #3763
• fix(codeql): go/path-injection in pkg/server/session_manager.go:542 by @ronan-thibaut-glitch in #3758
• fix(codeql): go/incorrect-integer-conversion in pkg/model/provider/dmr/configure.go:158 by @ronan-thibaut-glitch in #3756
• feat: support Mermaid state diagram directions by @rumpl in #3764
• docs: update API and TUI documentation for recent feature additions by @aheritier in #3765
• chore: remove unreachable helpers by @Sayt-0 in #3769
• feat: config flavors — named YAML patches enabled at run time via --flavor by @dgageot in #3768
• Make standalone SSE usage in mcp tools configurable by @krissetto in #3770
• refactor: cut heavy transitive deps (goja, expr, openai-go, go-git, sqlite) from the code-built embedder surface by @dgageot in #3771
• feat(anthropic): fail fast when thinking_display: display is set on adaptive-thinking models by @dgageot in #3772
• fix(desktop): force token refresh when Docker Desktop returns an expired JWT by @dgageot in #3773
• chore: freeze config v13 and start v14 as latest by @dgageot in #3774

Full Changelog: v1.113.0...v1.114.0

This release fixes compaction cost attribution by model, exposes agent command names in the API, and includes internal cleanup of unused code.

What's New

• Exposes root-agent command names in the /api/agents endpoint

Bug Fixes

• Fixes compaction summary costs being attributed to the wrong model — token spend from compaction_model is now correctly tracked per model in the cost breakdown
• Fixes FirstKeptEntry not being preserved when branching summary items during compaction
• Fixes missing defer for mutex unlock in the webhook setRuntime function

Technical Changes

• Removes unused TUI code, including the unreferenced cmdbatch and subscription packages and an orphaned attachment preview dialog

What's Changed

• chore: bump direct Go dependencies by @dgageot in #3759
• docs: update CHANGELOG.md for v1.112.0 by @docker-read-write[bot] in #3757
• fix: attribute compaction summary costs to the model that generated them by @dgageot in #3760
• Enhance the agents API by @trungutt in #3761
• chore: remove unused TUI code by @Sayt-0 in #3762

Full Changelog: v1.112.0...v1.113.0

This release adds several new built-in toolsets (git, webhook), budget limits, .agentsignore support, expanded Mermaid rendering, image rendering in the TUI, and numerous TUI improvements including per-agent usage details, session browser enhancements, and argument auto-completion for slash commands.

What's New

• Adds a read-only git toolset (git_status, git_log, git_branches, git_show, git_blame) giving agents structured access to the working repository without requiring a git binary
• Adds a webhook toolset with a send_webhook tool that lets agents send outbound notifications to a configured chat service without exposing the URL or secret to the model
• Adds budget configuration (budget / budgets) to cap what an agent may spend in cost, tokens, or working time, with live tracking in the TUI sidebar
• Adds .agentsignore support — a .gitignore-syntax file that prevents the agent from listing, reading, or writing matched files
• Adds image rendering in the TUI for tool result images and markdown images in agent responses (using the Kitty graphics protocol, with a setting to disable)
• Adds an image rendering preference to settings
• Adds Mermaid flowchart direction support and subgraph rendering
• Adds argument auto-completion for /toolset-restart, /drop, and /effort slash commands
• Adds per-agent usage details to the TUI sidebar, with a new sidebar info mode selector in /settings
• Adds fuzzy search matching for tool discovery via search_tool in the deferred toolset
• Adds Claude Code harness setup and diagnostics as a new docker agent setup path
• Adds explicit prompt cache breakpoint support for OpenAI (GPT-5.6+)
• Extends session browser search to match session IDs in addition to titles
• Groups the session browser by git repository root (worktree-aware)
• Allows configuring compaction_model directly on an agent as a sibling to compaction_threshold
• Opens the /cost dialog when clicking the sidebar cost/token usage reading
• Adds a self-maintaining llms.txt generated from nav.yml at Hugo build time

Improvements

• Fixes severe scrolling performance on very large sessions by caching rendered lines in the cost dialog and stopping message-list render cache thrashing
• Keeps the /cost dialog cache fresh on live updates and theme changes
• Shows usage and team roster in the collapsed sidebar band from startup
• Adds sidebar agent info modes

Bug Fixes

• Fixes RAG query embedding usage tracking so tokens are correctly attributed and emitted to the active session
• Fixes telemetry model dimension pollution and captures partial usage in RAG
• Fixes Anthropic system cache breakpoints being exceeded by capping them so requests never exceed the limit
• Fixes transcripts carrying cache checkpoint marks after compaction
• Fixes slash command inline completion to match on command value, not just label (e.g. typing /settings now surfaces the Settings command)
• Fixes TUI panic when the terminal reports a degenerate (0×0 or 1×1) size
• Fixes the /cost dialog cache not refreshing on live updates and theme changes
• Fixes the sidebar scrollbar clicks registering in content click zones
• Fixes the settings command label to display consistently as Settings
• Fixes right-to-left Mermaid connector rendering
• Fixes HTTP error statuses (4xx/5xx) being swallowed and treated as success in the API tool
• Fixes webhook tool to sanitize *url.Error to prevent secret URL leakage
• Fixes MCP OAuth clients with allow-private-ips to use a private connection pool instead of sharing http.DefaultTransport
• Fixes flaky OAuth tests by not sharing http.DefaultTransport across parallel tests
• Fixes the template Docker build stage to use COPY --from instead of an unauthenticated GitHub API call that hit rate limits
• Removes macOS Keychain and pass secret providers from DefaultSources

Technical Changes

• Freezes config schema v12 and opens v13 as the new latest
• Refactors Anthropic prompt-cache checkpoint handling into consolidated owners, making known failure modes structurally impossible
• Refreshes the embedded models.dev snapshot
• Drops the unused benchmarks/ folder
• Exposes the current agent's supported thinking levels from the runtime

What's Changed

• Render images by @rumpl in #3699
• feat(docs): self-maintaining llms.txt generated from nav.yml by @aheritier in #3695
• fix(docs): constrain content images and shrink demo GIF by @aheritier in #3696
• docs: update CHANGELOG.md for v1.111.0 by @docker-read-write[bot] in #3703
• docs: sync documentation with recent main merges by @aheritier in #3700
• test(mcp): fix flaky OAuth tests by not sharing http.DefaultTransport by @dgageot in #3704
• feat(tools): add read-only "git" toolset for structured repository inspection by @dwin-gharibi in #3637
• chore: bump direct Go dependencies by @dgageot in #3706
• fix(mcp): give allow-private-ips OAuth clients a private connection pool by @dgageot in #3707
• docs: add Sessions, Code Mode, headless/CI guide, and expand the CLI reference by @aheritier in #3694
• feat(tui): extend session browser search to match session IDs by @dgageot in #3708
• chore: drop benchmarks folder by @dgageot in #3709
• docs: add tour pointer, prompt-files subsection, and product-naming consistency by @aheritier in #3698
• perf(tui): fix horrendous scrolling on very large sessions by @dgageot in #3710
• refactor: consolidate and harden Anthropic prompt-cache checkpoint handling by @dgageot in #3712
• feat(env): remove macOS keychain and pass secret providers by @dgageot in #3713
• Mermaid flowchart directions by @rumpl in #3715
• Mermaid flowchart subgraphs by @rumpl in #3716
• fix: address Mermaid subgraph review findings by @rumpl in #3717
• Use golden files for Mermaid renders by @rumpl in #3718
• fix(rag): correctly attribute and track query embedding usage for active sessions by @Piyush0049 in #3603
• Render markdown images in agent responses by @rumpl in #3720
• feat(tui): show usage details per agent by @Sayt-0 in #3714
• fix(tui): address PR #3720 review feedback on markdown image rendering by @dgageot in #3721
• feat(openai): support explicit prompt cache breakpoints by @Sayt-0 in #3719
• fix(tui): match slash command value, not just label, in inline completion by @aheritier in #3723
• fix(tui): hide no-op slash commands (/settings) in lean mode by @aheritier in #3724
• fix(tui): label settings command consistently by @Sayt-0 in #3726
• fix(tui): show usage and team roster in the collapsed sidebar band from startup by @Sayt-0 in #3727
• revert: pkg/tui lean-mode machinery from #3724 by @aheritier in #3729
• feat(tui): argument auto-completion for /toolset-restart by @aheritier in #3728
• feat: add Claude Code harness setup and diagnostics by @Sayt-0 in #3722
• docs: update documentation for recent merged PRs by @aheritier in #3735
• fix(tui): don't panic when the terminal reports a degenerate size by @dgageot in #3736
• feat: group session browser by git repo root (worktree-aware) by @dgageot in #3737
• feat(deferred): add fuzzy search matching for tool discovery by @Piyush0049 in #3738
• feat(tui): argument auto-completion for /effort by @aheritier in #3734
• feat(tui): argument auto-completion for /drop by @aheritier in #3733
• fix: use COPY --from for mcp-gateway in template stage by @aheritier in #3744
• docs: sync documentation with recent code changes by @aheritier in #3741
• chore(deps): bump mcp from 1.23.0 to 1.28.1 in /examples/dhi/dhi_mcp_server in the pip group across 1 directory by @dependabot[bot] in #3740
• fix: propagate HTTP error statuses in API tool by @Piyush0049 in #3739
• feat(filesystem): add .agentsignore to keep files out of the agent's reach by @dwin-gharibi in #3743
• feat(budget): cap what an agent may spend in money, tokens, or working time by @dwin-gharibi in #3702
• chore: refresh embedded models.dev snapshot by @github-actions[bot] in #3747
• feat(tools): add "webhook" toolset for outbound notifications by @dwin-gharibi in https://...

This release adds a new scheduler toolset, inline Mermaid diagram rendering, model switching in the lean TUI, project config autodiscovery, and a range of bug fixes and performance improvements across the agent, TUI, and server.

What's New

• Adds a built-in scheduler toolset with create_schedule, list_schedules, and cancel_schedule tools, enabling agents to schedule instructions to run once at a time, after a delay, or on a recurring interval
• Adds prompt cache miss warnings via an opt-in warn_on_cache_miss user setting that emits notifications when cached input tokens are absent after the first session response
• Adds inline Mermaid diagram rendering in the TUI
• Adds model switching (/model) to the lean TUI and shares fuzzy model search between the lean and full TUIs
• Adds autodiscovery of docker-agent.yaml, docker-agent.yml, and docker-agent.hcl project config files for no-argument local docker agent run
• Surfaces background-job elicitation (user-input) requests in the TUI, ensuring each request opens exactly one dialog regardless of which runtime delivers it
• Makes a custom base_url on a model automatically imply bypass_models_gateway: true, removing the need to set it explicitly

Improvements

• Improves session cost details in the TUI: aligns layout, color-codes cost percentages per message, groups averages together, and puts "Total" on its own line
• Speeds up model switcher credential discovery by deduplicating credential names and resolving lookups concurrently, reducing model-picker latency
• Parallelizes toolset startup and prefetches the MCP catalog off the load critical path, reducing agent startup time

Bug Fixes

• Fixes glob wildcard matching in permissions so * and ? span path separators (/) in argument values such as file paths and URLs
• Fixes a bug where setting defer_all: true on a toolset caused the toolset's custom Instructions to be permanently dropped from the agent's context
• Fixes SafetyPolicy not persisting across turns, causing users to be re-prompted for tool approvals they had already opted into
• Fixes background elicitations over the API so requests from concurrent background jobs are replayable and answerable instead of being auto-declined
• Fixes Anthropic cache breakpoints exceeding the hard limit of 4 when deferred tools are present, which caused API errors at runtime
• Fixes the TUI editor not regaining focus after external editing (Ctrl+G), which caused Enter to route to the transcript instead of sending the composed message
• Fixes the scheduler schema so type: scheduler is accepted in agent config files (was previously rejected by JSON schema validation)
• Fixes foreground elicitations being delivered twice into the app event stream
• Fixes a mutex unlock in the scheduler's setRuntime method to use defer for safer lock release
• Fixes VCR cassette path normalization for portable prompt-file matching
• Fixes CI workflow YAML indentation that caused all CI runs to fail before any job could start

Technical Changes

• Adds MapSlice fan-out helper in the concurrent utilities package and uses it for parallel toolset operations
• Serializes interactive OAuth flows across toolsets to prevent concurrent conflicts
• Brings the documentation portal to WCAG 2.1 AA conformance across light and dark themes and adds a pa11y-ci CI gate to maintain it
• Adds new documentation pages for the scheduler toolset, sandbox templates, custom commands, user settings, context and compaction guide, and fixes stale command syntax in the Named Commands docs

What's Changed

• docs: update CHANGELOG.md for v1.110.0 by @docker-read-write[bot] in #3665
• fix: repair CI workflow YAML and failing AgentsMd e2e test on main by @dgageot in #3666
• feat(tools): add "scheduler" toolset to run instructions on a time or recurring interval by @dwin-gharibi in #3632
• fix(config): add scheduler toolset to agent-schema.json type enum by @aheritier in #3670
• feat: custom base_url implies bypass_models_gateway by @dgageot in #3667
• feat: add prompt cache miss warnings by @rumpl in #3671
• Improve session cost details by @rumpl in #3672
• perf: speed up model switcher credential discovery by @rumpl in #3673
• Add model switching to the lean TUI by @rumpl in #3674
• feat(tui,app): surface & correlate background-job elicitations (#3584) by @aheritier in #3624
• chore: bump go-isatty, openai-go, and libopenapi by @dgageot in #3675
• ci: bump golangci-lint-action to v9.3.0 and fix DeferMutexUnlock lint offense by @dgageot in #3676
• ci: bump pinned actions to latest same-major versions by @dgageot in #3677
• feat(server): session-scoped elicitation sink for API/server runtimes (#3584) by @aheritier in #3625
• Render Mermaid diagrams inline by @rumpl in #3679
• fix(server): surface background elicitations over API by @Sayt-0 in #3678
• fix(teamloader): preserve deferred toolset instructions by @Piyush0049 in #3680
• fix(permissions): match glob wildcards across path separators by @parveshsaini in #3605
• docs(agents): fix stale command syntax and sub_agents claim in Named Commands by @aheritier in #3684
• docs(sandbox): document Docker Sandboxes integration and published sbx templates by @aheritier in #3682
• docs: surface orphan pages and add compaction, commands, and user-settings docs by @aheritier in #3683
• fix(docs): WCAG 2.1 AA accessibility remediation for the docs portal by @aheritier in #3687
• fix(tui): refocus the editor after external editing so Enter sends the content by @dgageot in #3690
• Implements the path-aware, two-tier documentation accessibility CI gate by @aheritier in #3691
• feat(run): autodiscover project agent config by @HajimohammadiNet in #3681
• perf: parallelize toolset startup and prefetch MCP catalog by @dgageot in #3688
• fix(anthropic): keep cache breakpoints within Anthropic's limit of 4 with deferred tools by @dgageot in #3692
• fix(docs): render --link-hover on light-mode callout-link hover by @aheritier in #3693
• build(deps): bump the pip group across 1 directory with 2 updates by @dependabot[bot] in #3697
• fix(session): persist SafetyPolicy across turns by @trungutt in #3685

New Contributors

• @parveshsaini made their first contribution in #3605
• @HajimohammadiNet made their first contribution in #3681

Full Changelog: v1.110.0...v1.111.0

This release adds dynamic MCP HTTP headers, new shell safety policies, per-model custom pricing, and cache-stable dynamic prompts, along with fixes for elicitation delivery and session cost tracking.

What's New

• Adds dynamic MCP HTTP headers via a header factory, enabling context-aware HTTP header resolution instead of static headers fixed at startup
• Adds a safe-auto safety policy for shell operations, providing a middle ground between prompting for every tool call and --yolo mode; safe calls beyond shell are auto-approved under this policy, with an opt-in safer mode available via approve-safer resume
• Adds an optional cost block to model configuration, allowing explicit per-model token pricing for custom, locally-hosted, or uncatalogued models
• Adds opt-in cache-stable dynamic prompts (cache_stable_prompts user setting), persisting frozen instruction snapshots and appending chronological updates when trusted context changes

Bug Fixes

• Fixes elicitation requests from concurrent background jobs being silently dropped and blocking the requesting handler indefinitely
• Fixes session cost dropping after compaction (e.g., from $49 to $12) by keeping cost monotonic across compaction and preserving cost accounting across reload

What's Changed

• feat: implement dynamic MCP HTTP headers via header factory by @Piyush0049 in #3583
• fix(runtime): reliable, correlation-safe, non-blocking elicitation delivery (#3584) by @aheritier in #3587
• docs: update CHANGELOG.md for v1.109.0 by @docker-read-write[bot] in #3661
• Add opt-in cache-stable dynamic prompts by @rumpl in #3662
• fix(session): keep cost monotonic across compaction by @Sayt-0 in #3663
• feat(safer_shell): add safe-auto safety policy by @trungutt in #3647
• feat(config): declare explicit per-model token pricing with cost by @dgageot in #3664

Full Changelog: v1.109.0...v1.110.0