Key Changes
Docker file API migration
Docker file APIs now run entirely inside a running container. This changes compatibility for applications that relied on host-side file access: images need /bin/sh and GNU filesystem utilities, including realpath, and access uses the container's default user or explicit runAs. Use a compatible image and suitable file permissions. Editor updates accept source files up to 10 MiB; use execCommand for larger edits. Newly added path grants require resume or recreation before file APIs can use them.
Optional UnixLocal file protection
UnixLocalSandboxClient adds fileIOProtection: 'auto' | 'required' | 'off'. The default 'auto' selects Python-based file protection when available and otherwise retains Node filesystem behavior. Use 'required' to reject unavailable protection or 'off' to retain the Node backend. Inspect session.fileIOBackend to see the selection. This protection applies to file/editor operations and does not confine host shell commands.
Image-generation action selection
imageGenerationTool() now accepts action: 'generate' | 'edit' | 'auto' and forwards it through streaming and non-streaming Responses requests. Leaving action unspecified preserves provider defaults.
What's Changed
- feat: support the image generation tool action option by @seratch in #1861
- fix(core): avoid redundant final computer screenshots by @kyletser in #1827
- fix(core): recover deferred tools during response continuation by @seratch in #1856
- fix(sandbox): harden UnixLocal file I/O and route Docker file APIs through containers by @seratch in #1863
- fix(sandbox): preserve sandbox workdirs for shell command lists by @seratch in #1862
- fix(realtime): preserve agent_end response ownership by @pacocartones in #1858
Documentation & Other Changes
- chore: update versions by @github-actions[bot] in #1859
New Contributors
Full Changelog: v0.17.2...v0.18.0
