cloudflare/agents @cloudflare/think@0.9.0

@cloudflare/think@0.9.0

Repository: cloudflare/agents

Tag: @cloudflare/think@0.9.0

Published: 2026-06-12T16:46:15Z

Prerelease: no

Release notes:

Minor Changes

• #1656 `4c2d1a7` Thanks @cjol! - Rebuild the Think execute tool on the codemode connector runtime, with built-in human-in-the-loop approvals.

Unified execute tool. createExecuteTool now builds on createCodemodeRuntime with connectors instead of a bare executor: state.* (the agent's workspace filesystem via @cloudflare/shell's StateConnector), cdp.* (browser automation via agents/browser's BrowserConnector, included automatically when env.BROWSER is bound), and tools.* (any AI SDK ToolSet adapted via @cloudflare/codemode's ToolSetConnector). Executions are durable — recorded on a CodemodeRuntime facet with abort-and-replay — and completed results are truncated for the model while the full value stays on the execution record.

• Agent one-liner — createExecuteTool(this) infers ctx, env.LOADER, env.BROWSER, and the workspace-backed state backend from the Think agent, and accepts an overrides object for custom tools and options. createExecuteRuntime(this) returns the underlying { runtime, connectors, tool } for host-side wiring. The runtime handle is exposed on the agent as this.codemode.
• Human-in-the-loop. Tools with needsApproval: true pause the execution durably. The paused tool output (with bounded pending-call args) flows to the model, which reports and waits. Think gains built-in callables — pendingExecutions(), approveExecution(executionId), rejectExecution(executionId, reason?) — that resolve the pause on the codemode runtime, replace the paused output in the transcript via pausedExecutionUpdate, and auto-continue the conversation so the model sees the outcome. Approval UIs must render args from pendingExecutions() (authoritative, full) rather than the transcript's pending (a truncated preview bounded for model context). Approvals survive Durable Object restarts and are safe against double-approval, expiry (expirePaused), and stale UIs. If the paused tool part is no longer in the transcript when the approval lands (e.g. compacted away), the outcome is appended as a system note instead of being dropped.
• The Think framework's generated worker entry exports the CodemodeRuntime facet class automatically (also re-exported from @cloudflare/think/server-entry).
• Think's createBrowserTools follows the rebuilt agents/browser connector model (single durable browser_execute tool, session modes, stable attach handles) — see the agents changeset.
• Model-facing guidance. createExecuteTool now renders per-namespace usage hints in the execute tool description (state.* object-argument filesystem calls, the actual tools.* method names, cdp.*), so models stop inventing a host.*/fs.* API. The load_extension description clarifies that its host bridge exists only inside extension source. The workspace bash tool description now states the workspace is mounted at / (no /workspace), and the bash sandbox no longer persists its synthetic /bin, /usr, /dev, /proc paths into the workspace (previously the first bash call wrote ~160 shell-builtin stubs into the user's workspace and flooded changedFiles).

Patch Changes

• #1740 `6c9de59` Thanks @threepointone! - Defer one-shot scheduled callbacks (and chat-recovery give-ups) on platform transients instead of consuming them mid-deploy (#1730).

A mid-execution Durable Object code-update reset surfaces storage failures in two shapes: the verbatim reset/supersede messages (already deferred) and SqlError: SQL query failed: Network connection lost. — a wrapper that drops the CF retryable flag and dodges the reset matcher. The second shape burned the in-process retry budget inside the same few-seconds reset window (which outlasts the retry schedule by design) and then consumed the one-shot row on exhaustion, freezing the turn for minutes until incident re-detection — in the reported production capture, storage was healthy again 15 ms after the final attempt.

• `agents` — new cause-aware isPlatformTransientError classifier (exported, alongside isDurableObjectCodeUpdateReset): reset/supersede messages, retryable-flagged platform errors (excluding overloaded), and "Network connection lost.", looked up through wrapper cause chains. _executeScheduleCallback keeps in-process retries for connection-lost transients (a genuine blip heals fast) but on exhaustion of a one-shot row it now re-throws instead of swallowing, so the row survives and the alarm re-runs it in the healthy window that follows. Genuine application errors are still abandoned after maxAttempts exactly as before.
• `@cloudflare/think` — _handleRecoveryCallbackError now defers (re-throws) on any platform transient instead of terminalizing through a give-up whose own seal needs the storage that is down; the bookkeeping write on the defer path is best-effort. The defer path no longer marks the recovered submission error (which made the deferred re-run skip with submission_not_running — a self-defeating defer); it stays running for the re-run to pick up. The give-up now seals the incident exhausted only after the terminal writes succeed, so a transient mid-seal defers the whole give-up for an idempotent re-run instead of half-sealing.
• `@cloudflare/ai-chat` — same give-up seal ordering: the incident is sealed only after _exhaustChatRecovery (incl. the durable terminal record) succeeds, so a transient mid-seal preserves the one-shot row and the give-up re-runs in full on a healthy isolate.

• #1737 `bc43133` Thanks @cjol! - Fix the two remaining #1575 gaps in how in-band stream errors ({type: "error", errorText} chunks inside an otherwise-healthy provider stream) are...