v1.125.0

This release adds several new features including Docker token minting, structured output mode, restricted safety mode, and harness session resumption, alongside multiple bug fixes for file editing, caching, attachment handling, and OAuth flows.

What's New

• Adds the ability to mint Docker tokens from the stored access token, enabling authentication without Docker Desktop running (feat(auth): mint Docker tokens from the stored access token)
• Adds a tool-based structured output mode as an opt-in alternative to native structured output (feat: add tool-based structured output mode)
• Adds a restricted safety mode for unattended and headless runs, allowing classifier-safe calls while denying unmatched destructive or unknown calls without prompting (feat(safety): add restricted mode for unattended runs)
• Adds the ability to resume external harness sessions on later turns instead of starting a new session each time (feat(runtime): resume external harness sessions)
• Includes session cost in session summaries (feat: include cost in session summaries)

Bug Fixes

• Fixes a path containment bug in VCS ignore logic where a repository root like /work/repo incorrectly matched sibling paths like /work/repo-sibling (fix(pkg/fsx/vcs.go))
• Fixes edit_file silently prepending content when oldText is empty; empty oldText is now refused (fix(acp): refuse edit_file edits with an empty oldText)
• Fixes a file backend cache bug where entries written by a sibling process remained invisible to Lookup indefinitely (fix(pkg/cache/cache.go))
• Fixes attachment content being able to close its own envelope delimiter, and labels the region as untrusted to prevent content injection (fix(attachment): stop attachment content from closing its own envelope)
• Fixes a self-closing envelope delimiter bypass in attachment handling (fix(attachment): defuse the self-closing envelope delimiter too)
• Fixes malformed tool call names (e.g. attribute-style syntax hallucinated by a model) being persisted to session, which caused non-retriable errors on replay (fix(runtime): sanitize malformed tool call names before persisting to session)
• Fixes standalone OAuth login discovery to correctly forward remote metadata, match names/URLs exactly, and use authoritative challenge metadata (fix(mcp): repair standalone OAuth login discovery)
• Fixes standalone OAuth login to honor CallbackPort and CallbackRedirectURL configuration, matching the behavior of the managed OAuth flow (fix(mcp): honor callback configuration in standalone OAuth login)
• Fixes the TUI not retaining the interrupt confirmation setting across restarts and page rebuilds (fix(tui): retain interrupt confirmation setting)

Technical Changes

• Refactors MCP protected resource metadata discovery into a shared helper to eliminate duplication between managed and unmanaged OAuth flows (refactor(mcp): share protected resource metadata discovery)
• Propagates OAuth scopes through dynamic registration in MCP (fix(mcp): propagate OAuth scopes through dynamic registration)
• Isolates pkg/runtime tests from the real user config directory to prevent local settings from affecting test outcomes (test(runtime): isolate pkg/runtime tests from the real user config)
• Refreshes the embedded models.dev catalog snapshot (chore: refresh embedded models.dev snapshot)

---

What's Changed

• docs: update CHANGELOG.md for v1.124.0 by @docker-read-write[bot] in #3964
• feat(auth): mint Docker tokens from the stored access token by @dgageot in #3935
• docs: auto-update for merged PRs (2026-08-13) by @aheritier in #3969
• feat: add tool-based structured output mode by @Sayt-0 in #3966
• docs: remove internal issue/PR references from plan tool page by @aheritier in #3972
• test(runtime): isolate user config in tests by @aheritier in #3981
• fix(runtime): sanitize malformed tool call names before persisting to session by @melmennaoui in #3974
• feat(safety): add restricted mode for unattended runs by @Sayt-0 in #3970
• docs: add missing built-in tools to concepts overview by @aheritier in #3973
• test(mcp): make OAuth browser launch injectable across platforms by @aheritier in #3979
• fix(mcp): propagate scopes through dynamic client registration by @aheritier in #3881
• refactor(mcp): share protected resource metadata discovery by @aheritier in #3955
• chore(deps): update reviewed Go dependencies by @aheritier in #3980
• fix(attachment): stop attachment content from closing its own envelope, and label the region untrusted by @dwin-gharibi in #3942
• fix(cache): adopt the on-disk state read during Store, not just its mtime by @dwin-gharibi in #3928
• fix(filesystem): refuse edit_file edits with an empty oldText by @dwin-gharibi in #3926
• fix(fsx): test repository containment on a path boundary, not a string prefix by @dwin-gharibi in #3923
• feat: include cost in session summaries by @rumpl in #3991
• docs: auto-update for merged PRs (2026-08-16) by @aheritier in #3990
• fix(mcp): repair standalone OAuth login discovery by @aheritier in #3959
• fix(tui): retain interrupt confirmation setting by @Sayt-0 in #3994
• fix(mcp): honor callback configuration in standalone OAuth login by @aheritier in #3987
• feat(runtime): resume external harness sessions by @rumpl in #3989
• chore: refresh embedded models.dev snapshot by @github-actions[bot] in #3992

Full Changelog: v1.124.0...v1.125.0