chore(main): release 1.0.0

[github-actions]

🤖 I have created a release beep boop

1.0.0 (2026-08-20)

Features

• add agent-specific model constraints and refactor generation (3f9ccf7)
• add ai-based project type detection and workflow support (f753f8b)
• add app visibility check for preview deployment (3c4f203)
• add blueprint parsing utilities and enhanced session state tracking to SDK (96168d5)
• add bonk ai code reviews (189dc48)
• add bonk ai code reviews (e16961b)
• add clarifying questions flow for Think agent (a52cf10)
• add common pitfalls and dependency documentation to phase implementation prompt (0184e5f)
• add completion detection and dependency-aware tool execution (0f85a7d)
• add completion detection and loop prevention to agentic builder and debugger (e926e18)
• add concurrency control and cleanup for Claude review workflow (b5a76da)
• add dedicated AI changelog workflow and improve release-please gating (4e97d5a)
• add ENABLE_EMAIL_AUTH flag and surface oauth conflict error (fd052ac)
• add feature modules and capabilities discovery (0534a95)
• add HTTP retry logic with exponential backoff to SDK client (b02025e)
• add integration test controls and exclude from pre-commit hooks (e68369b)
• add Login with Cloudflare and per-user AI Gateway toggle (VIBE-22) (0ebf48d)
• add missing environment variables to .prod.vars template generation (7127cad)
• add missing environment variables to deployment workflow and script (965381c)
• add new model definitions (e73a089)
• add phase timeline change subscription and event handling (a1c7404)
• add phase timeline change subscription and event handling (f8b14cd)
• add pre-deploy safety gate with automated code fixing (611eb8e)
• add presentation and documentation preview modes (#234) (e9a31da)
• add project mode selector with agentic behavior support (b34c707)
• add query length validation with 20k character limit (8927bf0)
• add query length validation with 20k character limit (715d21f)
• add read-only Artifacts HTTP router (cfcfb70)
• add read-only Artifacts repo viewer for think apps (4b75d88)
• add release-live deployment workflow and vitest bun:test alias (a71e382)
• add retry logic and blank screenshot detection for browser rendering (c30a422)
• add SDK documentation and usage example to main README (3b11517)
• add the client and React surfaces (0e1f72f)
• agentic streaming presentations finally working (00fc51c)
• bring app actions to chat page as well from app page (f33e163)
• bug fixes + save manifest and slides proactively upon generation (ff47fc8)
• change the official preview domain to cloudflarepreviews.net (516f92c)
• chat: ordered reasoning + tool trace across all agent behaviors (942b581)
• chat: revamp tool calls ui (2201ebe)
• chat: revamp tool calls ui (21c55d7)
• client sdk + tests + docs (46d7769)
• cloudflare oauth connect with usage limits and BYOK inference (6fc180c)
• Cost optimizations via model configs and prompt improvements (#247) (2b3a901)
• deploy: backend-error-driven CF connect popup (8422857)
• deploy: backend-error-driven CF connect popup and ENABLE_USER_ACCOUNT_DEPLOY platform deploys (dda43bd)
• enable Agent SDK for all Claude Code Action workflows (4aa6f5f)
• enforce template write-protection in simple code generator (4f0dccf)
• enhance CI/CD workflows with security and automation improvements (d86377e)
• enhance Claude review workflow with comment-based triggers and sticky comments (9716c42)
• enhance Claude review workflow with improved PR description handling and streamlined review process (6f6dc84)
• enhance rate limit result with exceeded limit details and limit values (aceac60)
• enhance rate limit result with exceeded limit details and limit values (721b9e8)
• enhance type exports and improve utility functions for better type safety (47eba5f)
• example: add a Cloudflare Workers demo with five themes (a9c4c9e)
• example: demonstrate renderStatus across the themed designs (5aa205d)
• example: route artifacts through Hono at /api/artifacts (88b73cb)
• expand drizzle types script on sdk bundle (96b709e)
• expand drizzle types script on sdk bundle (33eb39f)
• faster blueprint for minimal templates (1321e43)
• finish most refactor and get it to build (d2a7e02)
• gemini 3 flash (6452622)
• general agent (45eb5c0)
• implement phase timeline management and state tracking in SDK (dbcf51f)
• implement signed URL security for screenshot access (6da9166)
• implement WebSocket ticket authentication and management system (1fe8640)
• improve GitHub Actions workflow reliability (1e49bb3)
• improve phase generation and React render loop prevention prompts (edc9deb)
• improve SDK error handling and resource cleanup (17f1d4e)
• improve workflow metadata handling and cryptographic security (5869e41)
• improve workflow reliability and add nightly branch support (07d2d09)
• increase temperature and reasoning effort for blueprint (f0ec7c9)
• integration tests with worker (f565aff)
• integration tests with worker (a68d9cb)
• introduce @cloudflare/kumo, theme toggle and ui fixes (942832c)
• introduce @tanstack/query and use it in sidebar apps list fetches (16142fc)
• introduce kumo, other ui fixes (35114e8)
• latest packages updated (e5496e0)
• Login with Cloudflare + Security Fixes (a72acdd)
• manage feature toggles outside Wrangler vars (0bfd169)
• more ui updates, fixes (74b28cd)
• new zero knowledge vault implementation (fd28396)
• optimize phase context and reduce max phases to 10 (0557bf7)
• optimize pre-commit hook with selective typecheck and related tests (1cab335)
• persist tanstack query in IndexedDB (dae555d)
• persist tanstack query in IndexedDB (a904751)
• phase implementation propmt rewrite - v78 prompt variant (ffa547e)
• presentation specific prompts + prompts restructuring (b6abaca)
• prompt tuning for shorter blueprints (e9041f1)
• react: let consumers replace loading, empty, and error markup (7dec701)
• readme update (33f72ab)
• reduce limits (9f810e7)
• reduce limits (8299ba5)
• reduce side of blueprint infer for minimal templates (3eb0039)
• refactor client methods to include app management functionalities (b9f0416)
• refactor file manager to separate state recording from git operations (e3d0862)
• refine agent model configurations and phase generation strategy (69c8642)
• remove redundant message and fix file saving in code generation (6f170e1)
• replace CLI token authentication with SDK API key management (30ba991)
• replace template manager with ai template selector (ca8e7e4)
• rewrite presentation preview system (09653ba)
• rewrite process monitoring and error handling (b0db701)
• route owned apps to editor and prefer Think live preview (6678715)
• route owned apps to editor and prefer Think live preview (1a6ad37)
• sdk tests (a841168)
• sdk ws ticket auth and auto reconnect (932271f)
• security: enforce app visibility at the dispatch layer (124720e)
• security: rate-limit space previews and cache the asset manifest (b92ecae)
• security: revoke space-preview tokens on visibility change (d74e17a)
• set up LinkProvider and use it in homepage view all btn (1c65db8)
• settings: add connected accounts UI for multi-provider linking (d446c19)
• short project titles with live refresh + Think set_title tool (d3b04f1)
• some prompt improvements (e136129)
• some prompt improvements in agentic project builder (7faf0e0)
• space: back SpaceDO filesystem with Cloudflare Artifacts (419d37d)
• space: gate Cloudflare Artifacts behind a per-app filesystem backend (e341e04)
• space: require ARTIFACTS binding and fix think editor file sync (645bb5b)
• static analysis for browser rendered preview projects (22be3f8)
• static analysis for browser rendered preview projects (320fc84)
• suppress AI Gateway token in CI and limit template deploy environment variables (ee7a83f)
• think-based agent + code space (16670af)
• think: isolate model and trim context (37b1cd7)
• think: isolate model and trim context (1abd92a)
• truncate exec command output to prevent token overflow (2d05283)
• ui: redesign profile page and add orange gradient button (ef4d30a)
• ui: refresh app shell with Kumo (741178d)
• ui: refresh app shell with Kumo (7431cf7)
• update model configurations and enhance inference handling (f7960d5)
• upgraded to sandbox sdk version 0.5.2 (9f9cc7a)
• use agentic builder directly for handling user messages (681bbbe)
• use original worker types in sdk (6745f04)
• use original worker types in sdk (0bc7db9)
• wrap global fetch to preserve context in Workers runtime (b7be5db)

Bug Fixes

• add cf limits gate (da3386e)
• add cloudflare beacon url to csp (90561ad)
• add logs and ownership check for github export (271b339)
• add missing lock changes (b567804)
• add noopener,noreferrer to _blank targets to prevent reverse tab… (16d7119)
• add noopener,noreferrer to _blank targets to prevent reverse tabnabbing (70441b8)
• add optional chaining to prevent runtime errors in blueprint rendering (2a2d86c)
• agents: prevent RCE via bootstrap command whitelist bypass (ae792a2)
• agents: prevent RCE via bootstrap command whitelist bypass (5dca3ab)
• ai gateway config issue (01de759)
• alias vendored artifacts-viewer for the Worker deploy build (2509dfa)
• allow editing package.json in scratch templates (ee69533)
• allow labeling fork pull requests (1a83c48)
• app and chat layouts (c0c39af)
• apps: harden public app endpoints against disclosure, DoS, view tampering (1023f68)
• apps: harden public app endpoints against disclosure, DoS, view tampering (3600f72)
• ask_questions tool call wording (ce86f8d)
• auth: close OAuth account-takeover via email-based identity binding (2303dcf)
• auth: enforce ALLOWED_EMAIL allowlist on OAuth callback (a39e4e4)
• auth: harden session/API-key revocation and secret generation (54fc4e0)
• auth: harden session/API-key revocation and secret generation (7c4e0bf)
• bonk model name (57d83c0)
• bring back some radix deps (57472fb)
• bug where preview url did not use tunnel url (61291d0)
• bug where preview url did not use tunnel url when getting instance state (d2abffe)
• cf oauth client ci (3842b66)
• chat: full-width tool trace + slide-style clarifying questions (3016918)
• ci: use canonical gemini-3-pro-preview slug (9d22900)
• ci: use canonical gemini-3-pro-preview slug (63e78b1)
• ci: use gemini in bonk ai-pr-review workflow and fix vuln (17f56d6)
• ci: use gemini in bonk ai-pr-review workflow and fix vuln (277dbad)
• cleanup chat.tsx for build (d80c416)
• cleanup settings up and ui refresh (612c8be)
• clear local state when signing out (7d21236)
• compact prompt box spacing and remove blueprint placeholder (1ee7285)
• convo id uniqueness and improve message deduplication (d4ae61d)
• correct indentation in vault-context unlock error handler (f908d31)
• create new orange gradient button and use it (af0b220)
• create query client in app level, not at module scope (7f9410f)
• Critical OAuth State Manipulation Vulnerability in GitHub Export (340c332)
• design tokens cleanup and design updates (9de4b25)
• detect module-level JSX anti-pattern in safety gate (37e5ef5)
• discover page input components use kumo (f3f90b6)
• do not allow non owner to export code to github repo after oauth callback (0b30b38)
• do not log the entire conversation history (102cbfa)
• do not log the entire conversation history (4785fa7)
• ensure workspace directory exists before writing files (17258f3)
• exclude auth/account queries from persisted query cache (ed011f2)
• expose artifacts setting as a worker variable (a651a52)
• expose artifacts setting as a worker variable (1f2c099)
• files format (da31e76)
• filter protected files (ff3a302)
• fix general agent app creation (fa080ec)
• fixed github bot's commit mistakes (a729366)
• gate artifacts binding on ENABLE_ARTIFACTS during deploy (98e619d)
• gate artifacts binding on ENABLE_ARTIFACTS during deploy (8191265)
• general design updates in homepage, auth-button (15fd104)
• harden AI Gateway proxy against unbounded requests (CWE-770) (f8077b3)
• harden AI Gateway proxy against unbounded requests (CWE-770) (12b7059)
• homepage, settings page design updates and fixes (8fd50b6)
• icons in settings gateway dropdown (fb6ce57)
• ignore useEffect deps lint error (72a8a86)
• improve browser rendering checking logic (fa397bb)
• improve cross-method sign-in for shared emails (ec29a67)
• improve font loading (7d82ca0)
• improve shell safety and variable handling in claude-reviews gating (f656cf0)
• improve shell safety and variable handling in claude-reviews gating (31a1820)
• improve ui, search behavior (46f1b2d)
• improved process monitoring, failure detection and restarts (ca7d309)
• increase max-width for chat box when main area not visible (0e14a7a)
• increase z-index on hero text on homepage (7c0a922)
• jwt oauth state for github oauth to prevent manipulation (e3a25a8)
• layout: use global header with sidebar toggle and sign-in button (3bfa0fd)
• make database table responsive instead of stretching parent (62165df)
• make database table responsive instead of stretching parent (ad363d7)
• make email allowlist test self-contained (f5fdec4)
• make globe also gradient filled (538565a)
• make remote database migrations required during deploy (a318f08)
• make remote database migrations required during deploy (af33ab2)
• manual template selection (e440372)
• max-width on title, move buttons around (5ed143d)
• monaco perf and file tree ui (25d7dfe)
• more visibility for containers and workers (a632039)
• mutations are scoped to appIds (8e91f38)
• new build button colors (ecfdac6)
• OAuth and login fixes (434c5b3)
• only app owner should be able to deploy preview (ba22bf8)
• opencode version issue (7842ab9)
• page load improvements (3ae3d92)
• pass manually selected template and skip ai flow (ad7ae4e)
• prevent duplicate agent session creation and improve error handling in chat initialization (40103ef)
• prevent platform API key leak via user-supplied AI gateway baseUrl (854676e)
• prevent platform API key leak via user-supplied AI gateway baseUrl (d8a2526)
• preview update fixes + navigation (5b96591)
• preview: add CORS headers to space preview responses (d4ab976)
• preview: token+cookie auth for space previews and Safari banner (402ab7c)
• preview: token+cookie auth for space previews and Safari banner (cf88d69)
• publish: install pnpm via action-setup for pack (e853fe0)
• publish: pack with pnpm so catalog ranges resolve (4cc22c2)
• race condition between instance start and static analysis (befdde7)
• redesign profile page and fix routes and link it (a00703a)
• reduce chat max-width when main view is visible (ac890c1)
• refine preview switching logic and fix code generation prompt (a658282)
• refresh Cloudflare AI Gateway list without reconnecting (074924d), closes #398
• refresh Cloudflare AI Gateway list without reconnecting (#398) (04811ed)
• reload chat session when switching apps in the sidebar (076f3d1)
• remove and ignore tsbuildinfo file (2cf7ff5)
• remove app creation initialization bottleneck (1ac531f)
• remove explicit header background (71cacf9)
• remove opencode ref (e358598)
• remove redundant width/height styles from preview iframe (f1efe5b)
• remove unused google fonts (96dd6cc)
• remove vault provider and its code in frontend (981286f)
• resolve babel traverse import compatibility and disable phase parameter in safety gate (c33a972)
• resolve require("buffer") deploy error 10021 in Workers bundle (f14b40c)
• search and deploy for preview screen (30ce835)
• secure immediate Cloudflare connection (69cb053)
• security: block prompt-injection data exfiltration via chat (f6c475f)
• security: block prompt-injection data exfiltration via chat (b6ab895)
• security: harden bootstrap command validation against postinstall RCE (31bfc6f)
• security: key anonymous rate limit on IP, remove dead email-OTP … (b20cf32)
• security: key anonymous rate limit on IP, remove dead email-OTP flow (0548ff3)
• security: strip browser credentials at sandbox proxy and redact git logs (b3db5dc)
• security: verify per-port token before sandbox preview access (34e3bb4)
• set a max-width on app and chat page titles (efbd8d7)
• set mobile breakpoint to 0 temporarily (d589a95)
• settings page bg not filling full height (be7dc8a)
• settings ui use kumo (5964a64)
• show 24 recent public apps on homepage (80ee28c)
• show password validation error (4c86278)
• show running tool call at end separately (f5251d3)
• sidebar and app, chat route ui fixes (72810a5)
• sidebar component usage and improvements (e33519c)
• sidebar menu icons collapsed ui (9de97df)
• sidebar: sidebar, app header and chat route ui fixes (aee3d18)
• space: checkpoint flush reads overlay, replay checkpoint in state fast-path (15ebbec)
• space: durable workspace files and git history across DO resets (ff8f53c)
• space: stabilize artifacts sync and preview deploys (f7e3123)
• space: strip Service-Worker-Allowed from preview responses (918e974)
• space: strip Service-Worker-Allowed from preview responses (22f1900)
• stabilize legacy chats and preview rendering (61421ed)
• streamline deploy button configuration (61bc5f7)
• styling housekeeping, minor UI improvements (5821919)
• styling housekeeping, minor UI improvements (c5cd2f1)
• support markdown in monaco (11c19ed)
• support markdown in monaco editor (6716b94)
• template cache clear before import + init meta in behavior constructor (c6a329e)
• template import and state init (9f5f787)
• template initialization (7db6ca2)
• think: align deploy action styling (c37a2b1)
• think: charge credits for model steps (e5839d0)
• think: end max-steps wrap-up on a user turn (64d6a93)
• truncate long project title in Agent-mode preview header (#394) (4051aad)
• truncate long project title in preview header (fb67d6c), closes #394
• udiff: insert diff replacement content literally (ea1c7be)
• udiff: insert diff replacement content literally (avoid $-substitution) (6fdd77e)
• ui and convo state management (0323c7a)
• ui and logging imp for cf oauth (fd8f281)
• ui and logging imp for cf oauth (86ebbdb)
• ui auto focus, preview hiding and blueprints (cfe24e3)
• ui issues (3774ee0)
• unintended change leading to bad behaviour (7a586cc)
• update favicon (42bd828)
• update private clone button design (5d0d908)
• upgrade framer-motion and monaco-editor to latest (ca61644)
• upgrade kumo (9f40750)
• upgrade vite to v8 which uses rolldown-vite (c8fb2dd)
• use current AI Gateway credit balance endpoint (7d28ac6)
• use funky-mono font for settings headers (d5fb118)
• use global-header with sidebar-toggle and sign in button (24eedaa)
• use kumo tabs for visibility filter in apps page (e9d8c4e)
• use kumo-subtle instead of text-tertiary (9d61861)
• use per page titles as per context (d8e50e7)
• use safeFiles instead of finalFiles for phase implementation logging and broadcast (849fdce)
• use sidebar persisted state as default (ac280a6)
• use tanstack query for all fetch calls (3c1bb93)
• use tanstack query for discover page and homepage (121b8a7)
• use tanstack query for usage limits api calls (3d737ac)
• variable name mismatch in simple code generation operation (22b8f00)
• wire cf oauth encryption key and per-env jwt/oauth secrets in ci (d0256b0)
• wire up onConnect to coding agent (318f6e2)
• wrangle rupdate (9666d98)

Performance Improvements

• lazy load monaco editor (61afce2)
• prune unchanged subtrees when computing commit diffs (bd5572c)

Reverts

• remove USE_AGENT_SDK flag from Claude Code Action workflows (1380279)

---

This PR was generated with Release Please. See documentation.

[OMTAP]

done

[diydan]

Closing in favor of #432, which promotes staging → main and already includes the v1.6.0 version bump and CHANGELOG entries. The autorelease branch will be regenerated for the next release after #432 merges.

[diydan]

Closing in favor of #432, which promotes staging → main and already includes the v1.6.0 version bump and CHANGELOG entries. The autorelease branch will be regenerated for the next release after #432 merges.