v1.37.0

1.37.0 (2026-10-07)

Features

• add expandable result surfaces (986e495)
• add gallery image preview controls (9ed80b0)
• add generic MCP app display modes (50b340f)
• add oauth auth tags to photon metadata (6caf6ec)
• add Photon browser sessions (e93bc7a)
• add Photon stylesheet asset resolver (1681e5e)
• add property-based tool exposure (44dad27)
• add secure generated standalone web shell (d4ab3a6)
• adopt MCP SDK v2 for Beam (1e4932f)
• allow custom Cloudflare Worker names (6ea021d)
• auth: load Photon OAuth theme assets (a624b8c)
• cf: serve generated standalone web shell (09df1f7)
• complete Photon OAuth and MCP SDK worker flow (041ed93)
• consolidate MCP capability and agent-native enhancements (9ff7bb2)
• embed canonical rich form runtime (83af0fd)
• expand native result viewer surfaces (32c1909)
• expose browser timezone to Photon UIs (4169b15)
• expose Cloudflare MCP App resources (c70e663)
• expose MCP tool safety metadata (f072105)
• generate Cloudflare MCP OAuth runtime (fcd4756)
• integrate inbound MCP OAuth runtime (28e7981)
• negotiate latest MCP protocol in Beam (bd3f224)
• optionally derive application manifest screens (0fb8658)
• polish Photon OAuth consent UI (d18cb46)
• server: serve secure standalone web shell (dcd1948)
• support Cloudflare Access OAuth login adapter (e872a58)
• unify multi-target execution and MCP task mapping (ec19496)
• unify Photon browser rendering runtime (75c1d56)

Bug Fixes

• accept direct MCP App tool result notifications (e1a336e)
• align Cloudflare discovery and release checks (1ac7319)
• align Cloudflare MCP negotiation and async results (59cfc36)
• allow anonymous calls to public MCP tools (1aff04f)
• allow MCP app discovery without bearer auth (a34800d)
• apply CSP resource allowlists to scripts and styles (412ed4e)
• apply Photon theme bridge in Cloudflare UI assets (a971d70)
• auth: keep OAuth consent strict-CSP native (963100e)
• auth: share OAuth consent presentation (a8eaa09)
• auto-size MCP App bridge (4ecdb69)
• cf: embed canonical form runtime in MCP Apps (edc2fd5)
• cf: preserve OAuth injection with generated web (c3a557a)
• complete Beam MCP 2026 response handling (ffc3be0)
• constrain OAuth permission list (df61114)
• emit explicit MCP safety classifications (37aef2f)
• expose OAuth users with Photon user role (8342f07)
• fail closed on Cloudflare OAuth auth metadata (d627b21)
• harden Cloudflare route deployment (083211f)
• improve Beam UI startup and asset rendering (dded994)
• include MCP App resource metadata on Cloudflare (05dcfb3)
• inject MCP App bridge into Cloudflare UI assets (043d6bd)
• keep Codex flags out of Wrangler deploys (8d8ab32)
• make browser renderers CSP self-contained (5fca805)
• make Cloudflare promotion use the right auth path (3e9d24a)
• make Cloudflare version discovery resilient (39fd2fa)
• make Cloudflare version promotion robust (ca3129f)
• prefer MCP Apps postMessage transport (9db56e7)
• preserve access metadata on generator tools (cafe3c5)
• preserve and route embedded MCP apps (b906da8)
• preserve MCP render metadata in Cloudflare deploys (205b3cb)
• preserve Photon theme tokens across MCP hosts (d4ed119)
• promote Cloudflare versions after deploy (6727b43)
• recover blank custom UI iframes (9288a4e)
• render embedded MCP Apps reliably in Beam (f1b8ecd)
• reuse Photon resource bridge for Cloudflare (ffe2feb)
• route Cloudflare OAuth login through shared state (9ec9c02)
• send initial MCP App size (99d88f4)
• show Photon identity on OAuth consent (5cea3a0)
• tolerate bunx output during worker promotion (7a7d991)
• use real Node for release daemon checks (e765b68)
• validate Beam elicitation forms (90cbe84)
• verify Cloudflare version promotion (1701150)