fix: resolve Workers runtime compatibility issues for Cloudflare Browser Rendering

[ebrainte]

Summary

The Cloudflare example (cloudflare/example/) fails to deploy because of three interrelated runtime compatibility issues in the Workers environment. This PR fixes all three.

Bug 1: fs.mkdtemp not available in Workers

Root cause: vite.config.ts aliases both fs and node:fs to @cloudflare/playwright/fs, but that shim does not implement mkdtemp. When @cloudflare/playwright calls fs.promises.mkdtemp() during browser launch, it crashes.

Fix:

• Alias fs → node:fs instead of @cloudflare/playwright/fs (removes the node:fs alias too — only fs alias needed)
• Update externals to mark node:fs (not @cloudflare/playwright/fs)
• Patch @cloudflare/playwright@1.1.2 to replace mkdtemp calls with mkdir + random suffix (3 locations in browserType.js and chromium.js)

Bug 2: compatibility_date too old for fs.mkdir

Root cause: wrangler.toml has compatibility_date = "2025-03-10", but node:fs.mkdir requires >= 2025-09-23.

Fix: Update compatibility_date to 2025-09-23.

Bug 3: Durable Object hibernation crash — "Already connected to a transport"

Root cause: When the McpAgent Durable Object hibernates and wakes up, onStart() calls server.connect(transport) but the MCP Server instance still thinks it's connected from before hibernation. It throws "Already connected to a transport".

Fix: Upgrade agents from ^0.0.109 to ^0.4.0. As identified in cloudflare/agents#1239, this was caused by a security issue (CVE-2026-25536 / GHSA-345p-7cg4-v4c7) in @modelcontextprotocol/sdk < 1.26.0 — reusing server/transport instances can leak cross-client data. agents@0.4.0+ includes @modelcontextprotocol/sdk@1.26.0 which creates fresh Server/transport instances per connection, fixing both the crash and the security vulnerability.

Previous approach: We initially patched agents@0.0.109 with server.close() before server.connect(), but Sunil Pai (@threepointone) from Cloudflare pointed out that this re-enables the vulnerable pattern the SDK was designed to prevent. The correct fix is the version upgrade.

Changes

File	Change
cloudflare/vite.config.ts	fs/node:fs alias → node:fs; external @cloudflare/playwright/fs → node:fs
cloudflare/example/wrangler.toml	compatibility_date → 2025-09-23
cloudflare/package.json	Pin @cloudflare/playwright to 1.1.2, upgrade agents to ^0.4.0, add patch-package
cloudflare/patches/@cloudflare+playwright+1.1.2.patch	mkdtemp → mkdir + random suffix

Testing

Deployed and verified on two separate Cloudflare accounts (free and paid Workers plans). All MCP tools (browser_navigate, browser_snapshot, browser_take_screenshot, browser_close) work correctly after these fixes. Tested with both agents@0.4.0 (no patches) confirming the Durable Object hibernation issue is fully resolved.