All notable changes to @blade-ai/agent-sdk are documented here.
- Add non-truncatable event quotas and serialize lease, model handoff, worker transition, and approval state changes.
- Strengthen file revision tracking, snapshots, atomic local persistence, CRLF offsets, Unicode truncation, and edit unescaping.
- Harden WebFetch, Hook output, OAuth, remote approvals, tenant identities, shell classification, and MCP tool namespaces against untrusted input.
- Bound background output, file tracking, lock waits, scheduler queues, and task persistence work.
- Report clear Agent lifecycle errors, release owned resources on destroy, and preserve MCP server source IDs.
- Preserve total Agent turn counts across turn-limit compaction and persist provider-specific non-text user content.
- Remove ModelMessage.metadata and introduce typed ConversationMessage provenance, correlation, telemetry, providerOptions, and extensions fields.
- Enforce canonical filesystem roots, bound compaction inputs, isolate shell environments, conservatively classify Bash commands, and serialize worker lease renewal with route transitions.
- Add dependency-minimal local and Web create-blade-agent presets while preserving the production default.
- Gate releases on complete failover RTO, throughput, event-loss, and four-point non-idempotent fault metrics with retained CI reports.
- Ship create-blade-agent with a five-minute full-stack verification path and an audited generated dependency tree.
- Add authenticated runtime health, queue metrics, uncertain-effect reconciliation, and payload-free Worker OpenTelemetry.
- Add a one-command Web-to-Docker production stack example with an automated end-to-end smoke check.
- Add the production AgentWorker, SessionRunner, EffectDispatcher, and ExecutionHost recovery loop; move PostgreSQL and OpenTelemetry adapters to explicit optional entrypoints.
- Replace overlapping chat, stream, transcript, and tool contracts with domain-owned model types, branded identifiers, explicit persistence ports, and the new browser-safe /model entry point.
- Use the PostgreSQL transaction clock for immediately available runtime effects so clock skew cannot delay worker claims.
- Add the ExecutionHost boundary, a Docker isolation reference host, bounded workspaces and network egress, checkpoints, and one-command ephemeral credential injection.
- Add PostgreSQL-backed worker heartbeats, Session routing and fencing, drain/handoff/preemption, and crash-safe effect recovery.
- Add a PostgreSQL Runtime Store with atomic command, event, effect, and projection commits plus a public conformance suite.
- Extract Session execution behind injectable SessionExecutor and InProcessSessionExecutor contracts.
- Add injectable Session repositories, protocol v1, and the tenant-aware AgentServer and browser AgentClient HTTP/SSE runtime.
- Split runtime defaults into a server facade without implicit host access and a local Node.js facade, replacing the local entry point with node.
- Add an instance-scoped Provider Registry for custom model adapters, with fail-closed routing across Sessions, subagents, and compaction.
- Persist provider, API adapter, and model provenance for assistant history, and safely downgrade reasoning when replaying across providers or models.
- Bound durable Journal, subscription, JSONL, and execution-lease Store calls with cooperative cancellation and typed fail-closed timeouts.
- Prevent cancelled file hooks from spawning, contain descendants in owned POSIX process groups or Windows Jobs, and fail closed when cleanup cannot be proven.
- Cancel queued tool concurrency and same-file lock waits with the active Request signal without leaking leases or disturbing FIFO order.
- Cancel permission and confirmation waits with the active Request signal, and retain Session ownership until uncooperative callbacks finish cleaning up.
- Bound Session inline hook events with configurable deadlines, propagate cancellation signals into callbacks, and fail closed while timed-out callbacks remain pending.
- Bound tool invocations to 10 minutes by default, expose SessionOptions.toolTimeoutMs, keep the deadline active across progress yields, and fail closed while timed-out cleanup remains pending.
- Bound stalled model calls with configurable request and stream-idle timeouts that abort the provider and preserve typed failure semantics.
- Add lease-aware onion model and tool middleware with declarative plugins, durable short-circuit settlement, and subagent propagation.
- Add Store-backed Session execution leases with automatic heartbeats, sticky monotonic fencing, atomic Journal, transcript, and subagent-state guards, process-tree cancellation, and controlled close or handoff release.
- Upgrade CI, release, and documentation workflows to Node.js 24-backed GitHub Actions.
- Add a controlled Session worker handoff barrier that seals background-work admission, settles local execution, preserves the unfinished durable frontier, and returns its recovery plan without closing the durable Session.
- Make running Session abort and close operations wait for Agent stream cleanup, model and tool settlement, request ownership release, and configured durable Request finalization without consumer deadlocks.
- Serialize local Session transcript access across processes, durably sync appends, recover torn crash tails, reject path-unsafe Session IDs, and fail closed on committed record corruption.
- Remove unused production packages, upgrade vulnerable dependencies to patched releases, and reject known production vulnerabilities in CI.
- Serialize JSONL durable-event reads and compare-and-append writes across Node.js processes with bounded waits and crash-released OS locks.
- Persist and deterministically settle model request attempts around provider calls, bind durable tool schedules to authoritative model responses, require explicit reconciliation for unknown outcomes, and advance the durable event wire format to schema v3 with schema-v2 read compatibility.
- Add atomic recovery for Requests that crash before their first Turn, with persist-before-preparation steering, stale-boundary fencing, and explicit Request outcome reconciliation.
- Add atomic active-turn rollover into provenance-linked continuation requests with stale-CAS protection and fail-closed non-idempotent boundaries.
- Add pull-based durable event subscriptions with validated reconnect cursors, replay barriers, bounded buffering, and live delivery.
- Add a durable recovery coordinator with idempotent tool-outcome and permission reconciliation, and automatically resume requests that were accepted before execution started.
- Require every tool to declare pure, idempotent, or non-idempotent side-effect semantics; durable event schema v2 persists the final execution input and resolved contract to distinguish replayable work from outcomes that require reconciliation.
- Make changelog fragments drive semantic-release version selection and recognize Conventional Commit bang headers so breaking changes cannot merge without a release.
- Integrate fail-closed, opt-in durable event journaling into Session request, turn, tool, permission, abort, close, and stream-cancellation lifecycles; Session.abort() now returns a Promise that settles pending-request durability.
- Add a command-oriented durable Session journal with lifecycle preflight, bounded CAS retries, idempotent replay, and unknown-write reconciliation.
- Add strict per-event durable lifecycle payloads and deterministic Session recovery projection with explicit tool and permission reconciliation states.
- Add awaited tool lifecycle hooks that enforce durable ordering around scheduling, permission prompts, side-effect start, and terminal result publication.
- Add the first Durable Event Store phase with versioned envelopes, compare-and-append sequencing, cursor reads, and a crash-tolerant JSONL adapter.
- Allow Session custom tools to accept complete
Toolinstances fromcreateTool()and the Memory tool helpers.
- Fail closed when Sandbox is enabled but no supported OS sandbox executor is available.
- Add durable
now,next, andlatersession inputs with safe-point steering and interruptible tool execution.
- Restore generated changelogs and add complete English and Simplified Chinese documentation.
- Require every tool
executefunction to returnToolExecution. - Replace the legacy
success,llmContent, anddisplayContentresult fields with the structuredstatus,model, anddisplaycontract.
- Add structured streaming tool progress, messages, and effects.
- Centralize tool concurrency limits and split built-in tools into capability groups.
- Initialize file facilities lazily and make local workspace discovery optional.
- Guard
send()against a concurrentstream()call with an explicit request phase.
- Replace the
SandboxCheckResultboolean fields with anoutcomediscriminant and requirereason.
- Cache known sessions to avoid scanning every JSONL file on each persistence write.
- Preserve tool results when resuming a persisted session.
- Clear stale MCP
lastErrorstate after a successful automatic reconnection.
- Preserve abort error classification in the web fetch tool.
- Improve custom tool type inference with the
toolscontainer and genericdefineTooldata.
- Re-export
JsonObjectandJsonValueand correct ESM and tool documentation. - Declare the GitHub repository used by npm provenance.
- Add browser-safe and server-only package subpath exports.
- Add session token budget configuration.
- Add model parameter configuration and complete tool allowlist handling.
- Add session observability traces.
- No user-visible changes.
- Add native DeepSeek provider support, reasoning output handling, and tool-call compatibility.
- Add DeepSeek cache accounting, cost optimization, long-context planning, and batch summaries.
- Add lazy tool loading and typed SDK error classes.
- Introduce branded identifiers and split tool type definitions.
- Improve lifecycle cleanup and remove unused internal APIs.
- Add concurrency scheduling for tool execution.
- Rework streaming responses and event queue handling.
- Rework streaming responses and event queue handling.
- Make message arrays readonly and standardize JSON value types.
- Replace
displayContentwithmetadata.summary.
- Document memory, tool source policies, and subagent collaboration.
- Replace
displayContentwithmetadata.summary.
- Document memory, tool source policies, and subagent collaboration.
- Introduce
ConversationStateandExecutionEpochas the message and transaction boundaries.
- Improve null checking and type safety.
- Refresh documentation for the 1.0 API.
- Expand integration coverage for persisted sessions, MCP, subagents, and multimodal input.
- Add session recovery and forward the
turn_endstream event.
- Add runtime tool catalogs, patch-based skill activation, context overflow recovery, token budgets, and background subagents.
- Add opt-in filesystem memory with deterministic ordering.
- Remove ACP and consolidate agent loop and runtime ownership.
- Persist image content in multimodal session messages.
- No user-visible changes.
- Support npm authentication through
.npmrcin the legacy release script.
- Harden the legacy package publishing flow.
- Migrate the repository from Bun to pnpm and Vitest.
- Refresh the README and community links.
- Remove the
BYPASSALLpermission mode.
- Launch the VitePress documentation site.
- Fix tag pushing in the legacy release script.
- Replace static-only utility classes.
- No user-visible changes.
- Expand hook events and control flow.
- Add inline commands and runtime effects to Skills.
- Allow sessions to disable persistence.
- Remove the built-in skill installer, version checker, default system prompt, and built-in API key management.
- Make storage roots configurable.
- Pass the selected registry to Bun publishing.
- Allow sessions to disable persistence.
- Stabilize logger routing across concurrent sessions.
- Remove the implicit dependency on
process.cwd()from filesystem access checks.
- Introduce
ContextSnapshotfor runtime context management.
- Add native OpenAI support and pass through custom headers.
- Improve JSON Schema to Zod conversion.
- Unify session runtime ownership and remove obsolete plugin, command, spec, and file-checkpoint systems.
- Rework the agent loop, context manager, and logging injection.
- Export the
ProviderConfigtype.
- Add declaration build configuration.
- Pin the public npm registry.
- Add error handling helpers.
- Standardize on the
AgentEventtype.
- Make providers lazy, split
Agent, and isolate MCP registries per instance.
- Extract
AgentLoop, remove the obsolete execution loop, and standardize event types.
- Add focused tests for the agent loop, skill loader, tool registry, and context compressor.
- Export model thinking capability detection utilities.
- Add in-process MCP servers.
- Set MCP server state to
CONNECTEDafter successful connect or reconnect.
- No user-visible changes.
- Add session forking, sandbox checks, MCP resources, and structured output.
- Add file checkpoint tracking, which was removed in a later release.
- Rework MCP and remove obsolete Copilot and Antigravity services.
- Unify agent events behind a single stream interface.
- Add coverage for hooks, token counting, path safety, matching, tool creation, and output parsing.
- Add
SubagentStartandTaskCompletedhook events.
- No user-visible changes.
- Initial release.