Starstruk Logo MarkStarstruk

@cloudflare/codemode@0.3.5

cloudflare/agents@cloudflare/codemode@0.3.5May 13, 2026by github-actions[bot]

AI Summary

This patch release adds a browser-safe codemode export with an iframe sandbox executor and browser tool helper, while also hardening security around iframe message handling and tool name validation. It also resolves OpenAPI specs inside the sandbox to avoid Worker Loader RPC size limits and fixes OpenAPI sandbox reference handling.

Key Highlights

  • Added browser-safe codemode export with iframe sandbox executor
  • Hardened iframe message handling with nonce-scoped messages for security
  • Implemented rejection of sanitized tool name collisions
  • Resolved OpenAPI specs inside codemode sandbox to avoid Worker Loader RPC size limits
  • Fixed OpenAPI sandbox reference handling

New Features

  • New iframe sandbox executor for browser environments
  • Browser tool helper for codemode operations
  • Nonce-scoped iframe message handling for improved security
  • Tool name collision detection and rejection
  • Preservation of tools with `needsApproval: false` flag
  • OpenAPI spec resolution inside sandbox to handle heavily-referenced specs

Full Release Notes

### Patch Changes

-   [#1468](https://github.com/cloudflare/agents/pull/1468) [`186a2a4`](https://github.com/cloudflare/agents/commit/186a2a45700fbd9680b69e8b72ea062fd325d077) Thanks [@mattzcarey](https://github.com/mattzcarey)! - Add a browser-safe codemode export with an iframe sandbox executor and browser
    tool helper. Harden iframe message handling with nonce-scoped messages, reject
    sanitized tool name collisions, and keep tools with `needsApproval: false`.

-   [#1470](https://github.com/cloudflare/agents/pull/1470) [`1033fa2`](https://github.com/cloudflare/agents/commit/1033fa28786d1e70a55a0455a6092a4a604be03c) Thanks [@mattzcarey](https://github.com/mattzcarey)! - Resolve OpenAPI specs inside the codemode sandbox to avoid Worker Loader RPC size limits for heavily-referenced specs.

-   [#1508](https://github.com/cloudflare/agents/pull/1508) [`13acffe`](https://github.com/cloudflare/agents/commit/13acffee172fcd0d40ecfcd3ba9c5088b474286e) Thanks [@threepointone](https://github.com/threepointone)! - fix(codemode): harden OpenAPI sandbox ref handling