chore(deps): bump agents from 0.7.9 to 0.11.4

[dependabot]

Bumps agents from 0.7.9 to 0.11.4.

Release notes

Sourced from agents's releases.

agents@0.11.4

Patch Changes

• #1222 3ebd966 Thanks @​Muhammad-Bin-Ali! - Add experimental WebMCP adapter (agents/experimental/webmcp) that bridges MCP server tools to Chrome's native navigator.modelContext API, enabling browser-native AI agents to discover and call tools registered on a Cloudflare McpAgent.

agents@0.11.3

Patch Changes

• #1330 b4d3fcf Thanks @​threepointone! - Fix subAgent() cross-DO I/O errors on first use and drop the "experimental" compatibility flag requirement.

  subAgent() cross-DO I/O fix

  Three issues in the facet initialization path caused "Cannot perform I/O on behalf of a different Durable Object" errors when spawning sub-agents in production:

  • subAgent() constructed a Request in the parent DO and passed it to the child via stub.fetch(). The Request carried native I/O tied to the parent isolate, which the child rejected.
  • The facet flag was set after the first onStart() ran, so broadcastMcpServers() fired with _isFacet === false on the initial boot.
  • _broadcastProtocol(), the inherited broadcast(), and _workflow_broadcast() iterated the connection registry without an _isFacet guard, letting broadcasts reach into the parent DO's WebSocket registry from a child isolate.

  Replaces the fetch-based handshake with a new _cf_initAsFacet(name) RPC that runs entirely in the child isolate, sets _isFacet before init, and seeds partyserver's __ps_name key directly. Adds _isFacet guards to _broadcastProtocol() and overrides broadcast() to no-op on facets so downstream callers (chat-streaming paths, workflow broadcasts, user this.broadcast(...)) are covered. Removes the previous internal _cf_markAsFacet() method — _cf_initAsFacet(name) is the correct entry point (it sets the flag before running the first onStart(), which _cf_markAsFacet did not).

  "experimental" compatibility flag no longer required

  ctx.facets, ctx.exports, and env.LOADER (Worker Loader) have graduated out of the "experimental" compatibility flag in workerd. agents and @cloudflare/think no longer require it:

  • subAgent() / abortSubAgent() / deleteSubAgent() — the @experimental JSDoc tag and runtime error messages no longer reference the flag. The runtime guards on ctx.facets / ctx.exports stay in place and now nudge users toward updating compatibility_date instead.
  • Think — the @experimental JSDoc tag no longer references the flag.

  No code change is required; remove "experimental" from your compatibility_flags in wrangler.jsonc if it was only there for these features.

• #1332 7cb8acf Thanks @​threepointone! - Expose createdAt on fiber and chat recovery contexts so apps can suppress continuations for stale, interrupted turns.

  • FiberRecoveryContext (from agents) gains createdAt: number — epoch milliseconds when runFiber started, read from the cf_agents_runs row that was already tracked internally.
  • ChatRecoveryContext (from @cloudflare/ai-chat and @cloudflare/think) gains the same createdAt field, threaded through from the underlying fiber.

  With this, the stale-recovery guard pattern described in #1324 is a short override:

  override async onChatRecovery(ctx: ChatRecoveryContext): Promise<ChatRecoveryOptions> {
    if (Date.now() - ctx.createdAt > 2 * 60 * 1000) return { continue: false };
    return {};
  }

  No behavior change for existing callers. See docs/chat-agents.md (new "Guarding against stale recoveries" section) for the full recipe, including a loop-protection pattern using onChatResponse.

agents@0.11.2

Patch Changes

• #1326 d5042a9 Thanks @​threepointone! - fix(mcp): block full IPv6 link-local range fe80::/10 in SSRF check

... (truncated)

Changelog

Sourced from agents's changelog.

0.11.4

Patch Changes

• #1222 3ebd966 Thanks @​Muhammad-Bin-Ali! - Add experimental WebMCP adapter (agents/experimental/webmcp) that bridges MCP server tools to Chrome's native navigator.modelContext API, enabling browser-native AI agents to discover and call tools registered on a Cloudflare McpAgent.

0.11.3

Patch Changes

• #1330 b4d3fcf Thanks @​threepointone! - Fix subAgent() cross-DO I/O errors on first use and drop the "experimental" compatibility flag requirement.

  subAgent() cross-DO I/O fix

  Three issues in the facet initialization path caused "Cannot perform I/O on behalf of a different Durable Object" errors when spawning sub-agents in production:

  • subAgent() constructed a Request in the parent DO and passed it to the child via stub.fetch(). The Request carried native I/O tied to the parent isolate, which the child rejected.
  • The facet flag was set after the first onStart() ran, so broadcastMcpServers() fired with _isFacet === false on the initial boot.
  • _broadcastProtocol(), the inherited broadcast(), and _workflow_broadcast() iterated the connection registry without an _isFacet guard, letting broadcasts reach into the parent DO's WebSocket registry from a child isolate.

  Replaces the fetch-based handshake with a new _cf_initAsFacet(name) RPC that runs entirely in the child isolate, sets _isFacet before init, and seeds partyserver's __ps_name key directly. Adds _isFacet guards to _broadcastProtocol() and overrides broadcast() to no-op on facets so downstream callers (chat-streaming paths, workflow broadcasts, user this.broadcast(...)) are covered. Removes the previous internal _cf_markAsFacet() method — _cf_initAsFacet(name) is the correct entry point (it sets the flag before running the first onStart(), which _cf_markAsFacet did not).

  "experimental" compatibility flag no longer required

  ctx.facets, ctx.exports, and env.LOADER (Worker Loader) have graduated out of the "experimental" compatibility flag in workerd. agents and @cloudflare/think no longer require it:

  • subAgent() / abortSubAgent() / deleteSubAgent() — the @experimental JSDoc tag and runtime error messages no longer reference the flag. The runtime guards on ctx.facets / ctx.exports stay in place and now nudge users toward updating compatibility_date instead.
  • Think — the @experimental JSDoc tag no longer references the flag.

  No code change is required; remove "experimental" from your compatibility_flags in wrangler.jsonc if it was only there for these features.

• #1332 7cb8acf Thanks @​threepointone! - Expose createdAt on fiber and chat recovery contexts so apps can suppress continuations for stale, interrupted turns.

  • FiberRecoveryContext (from agents) gains createdAt: number — epoch milliseconds when runFiber started, read from the cf_agents_runs row that was already tracked internally.
  • ChatRecoveryContext (from @cloudflare/ai-chat and @cloudflare/think) gains the same createdAt field, threaded through from the underlying fiber.

  With this, the stale-recovery guard pattern described in #1324 is a short override:

  override async onChatRecovery(ctx: ChatRecoveryContext): Promise<ChatRecoveryOptions> {
    if (Date.now() - ctx.createdAt > 2 * 60 * 1000) return { continue: false };
    return {};
  }

  No behavior change for existing callers. See docs/chat-agents.md (new "Guarding against stale recoveries" section) for the full recipe, including a loop-protection pattern using onChatResponse.

0.11.2

Patch Changes

... (truncated)

Commits

• 3dd0ab5 Version Packages (#1338)
• 6c8b485 update deps
• 3ebd966 feat(experimental): Add WebMCP Adapter (#1222)
• f4d7dd0 fix(tests): clear alarm in hung-schedule helpers to remove race (#1337)
• 68e2fd6 Version Packages (#1331)
• 7cb8acf feat: expose createdAt on fiber and chat recovery contexts (#1332)
• b4d3fcf fix(agents): sub-agent cross-DO I/O + drop "experimental" compat flag (#1330)
• 469d6fe Version Packages (#1327)
• d5042a9 fix(mcp): block full IPv6 link-local range fe80::/10 in SSRF check (#1326)
• 1e939f2 Version Packages (#1320)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #21.