v1.138.0

This release introduces generated image output support with workspace-safe storage and portable session blobs, a new tool hook execution model with mandatory phases, and several other feature additions and fixes.

What's New

• Adds streaming support for model-generated media deltas, accumulating complete image bytes in runtime stream results
• Adds workspace media writes with collision-safe naming, MIME-corrected extensions, and no-overwrite publication for generated images
• Adds generated media materialization as workspace files with no-resend history placeholders stored in session JSON instead of raw base64
• Keeps all generated-media writes inside the owning workspace; external, traversal, and symlink-escaping paths are redirected to a sanitized basename
• Names generated media via private [media-file:] response markers with fallback to user-prompt filename, provider name, or generated-N
• Renders generated images through manifest-gated authorization, revalidating against the current manifest on every resolution
• Restores generated media from portable session blobs when resuming sessions
• Adds output_capabilities.image configuration support to resolve image output capability from models.dev metadata
• Guards image-output requests across Google surfaces (gateway, direct Gemini API, and Vertex), rejecting custom function tools and structured output before dispatch
• Adds tool hook phases with a fixed mandatory execution order: tool_input_transform runs first, followed by tool_guard; includes hook deduplication, config validation, and a shared events catalog with centralized contracts
• Adds provider_opts.service_tier field for OpenAI provider, forwarded unchanged to the underlying API for Fast mode support
• Marks lean TUI user prompts with OSC 133 semantic prompt boundaries in terminal scrollback, enabling navigation between turns in supported terminals (e.g., iTerm2); also restores session transcripts when the lean TUI starts with a resumed session

Bug Fixes

• Fixes Gemini session title generation by omitting thinkingConfig and reserving 128-token reasoning headroom with a separate 50-character visible title limit
• Fixes session title selection to keep image-output-capable models eligible as title candidates
• Fixes sanitization and bounding of generated-media metadata
• Classifies generated-media save failures into safe, reportable reasons

Technical Changes

• Reverts "fail fast on foreign-OS paths and explain path resolution" from the filesystem tool
• Moves CI image builds to Docker Build Cloud
• Reverts CI feedback-loop shortening changes (parallel jobs, warm Go cache, Build Cloud pipeline)
• Fixes CI image builds for fork pull requests that lack cloud credentials

---

What's Changed

• feat(#3996): stream model-generated media deltas by @aheritier in #4023
• docs: update CHANGELOG.md for v1.137.0 by @docker-read-write[bot] in #4212
• feat(openai): support provider_opts.service_tier for Fast mode by @dgageot in #4214
• docs: fix CLI completion, debug visibility, task dev parallelism, DCO clarification by @dgageot in #4215
• docs: auto-update for merged PRs (2026-09-10) by @aheritier in #4216
• chore: update docker-agent-action to v2.0.7 by @docker-agent in #4208
• feat(#3996): add workspace media writes and session provenance by @aheritier in #4024
• ci: move image builds to Docker Build Cloud by @aheritier in #4219
• feat(#3996): save generated media with no-resend placeholders by @aheritier in #4025
• feat(#3996): keep generated media workspace-only with portable session copies by @aheritier in #4026
• feat(#3996): name generated media with private markers and prompt fallback by @aheritier in #4027
• fix(#3996): leave reasoning headroom for Gemini session titles by @aheritier in #4028
• feat(#3996): render generated images from manifest-gated portable blobs by @aheritier in #4029
• ci: shorten the feedback loop (parallel jobs, warm Go cache, Build Cloud) by @aheritier in #4220
• docs(#3996): describe portable generated media and Gemini output limits by @aheritier in #4030
• feat(hooks): tool hook phases — mandatory guards, transforms, dedup and strict output by @dgageot in #4211
• Revert "ci: shorten the feedback loop (parallel jobs, warm Go cache, Build Cloud)" by @dgageot in #4223
• revert: remove foreign-OS path rejection from filesystem tool by @dgageot in #4222
• feat: mark lean TUI prompts in terminal scrollback by @rumpl in #4224

Full Changelog: v1.137.0...v1.138.0