docker-agent 1.46.0

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

This release adds OAuth credential configuration for MCP servers, evaluation testing improvements, and numerous stability fixes.
What's New

Adds support for explicit OAuth credentials configuration for remote MCP servers that don't support Dynamic Client Registration
Adds --repeat flag to eval command for running evaluations multiple times
Adds support for xhigh effort level in Anthropic adaptive thinking (Claude Opus 4.7+)
Adds task_budget configuration field for Claude Opus 4.7 to cap total tokens across multi-step tasks
Adds markdown rendering support in user_prompt dialog messages

Improvements

Improves image attachment handling by inlining as base64 data URLs for cross-provider compatibility
Improves robots.txt caching to store parsed data per host instead of boolean results
Improves session database version detection with clear upgrade messages for newer databases

Bug Fixes

Fixes --attach flag being silently ignored when used without a message argument
Fixes data race in AddMessageUsageRecord by adding mutex lock
Fixes data race in rule-based router by protecting lastSelectedID with mutex
Fixes panic in extractSystemBlocks when system message is empty with CacheControl
Fixes empty messages slice handling in SendUserMessage path
Fixes symlink-based path traversal vulnerability in ACP filesystem toolset
Fixes OAuth callback CSRF vulnerability by rejecting when expected state is not set
Fixes MCP tryRestart to use context-aware select instead of time.Sleep
Fixes assistant text being discarded when tool calls are present in Responses API conversion
Fixes MCP OAuth token refresh by remembering the discovered auth server

Technical Changes

Updates mutex handling for MCP Toolset.Instructions() method
Updates Go dependencies including Anthropic SDK and various UI libraries


What's Changed

docs: update CHANGELOG.md for v1.45.0 by @docker-read-write[bot] in docs: update CHANGELOG.md for v1.45.0 docker/docker-agent#2427
fix: reject OAuth callback when expected state has not been set (CSRF) by @dgageot in fix: reject OAuth callback when expected state has not been set (CSRF) docker/docker-agent#2434
fix: prevent symlink-based path traversal in ACP filesystem toolset by @dgageot in fix: prevent symlink-based path traversal in ACP filesystem toolset docker/docker-agent#2433
fix: guard against empty messages slice in SendUserMessage path by @dgageot in fix: guard against empty messages slice in SendUserMessage path docker/docker-agent#2432
fix: prevent panic in extractSystemBlocks on empty system message wit… by @dgageot in fix: prevent panic in extractSystemBlocks on empty system message wit… docker/docker-agent#2431
fix: hold mutex for instructions read in MCP Toolset.Instructions() by @dgageot in fix: hold mutex for instructions read in MCP Toolset.Instructions() docker/docker-agent#2430
fix: add mutex to protect lastSelectedID in rule-based router by @dgageot in fix: add mutex to protect lastSelectedID in rule-based router docker/docker-agent#2429
fix: add mutex lock to AddMessageUsageRecord to prevent data race by @dgageot in fix: add mutex lock to AddMessageUsageRecord to prevent data race docker/docker-agent#2428
Add --repeat flag to eval command for running evaluations multiple times by @dgageot in Add --repeat flag to eval command for running evaluations multiple times docker/docker-agent#2440
fix: replace time.Sleep with context-aware select in MCP tryRestart by @dgageot in fix: replace time.Sleep with context-aware select in MCP tryRestart docker/docker-agent#2436
fix: preserve assistant text when tool calls present in Responses API conversion by @dgageot in fix: preserve assistant text when tool calls present in Responses API conversion docker/docker-agent#2438
fix: detect newer session database and show clear upgrade message by @dgageot in fix: detect newer session database and show clear upgrade message docker/docker-agent#2441
Support explicit OAuth credentials for remote MCP servers by @dgageot in Support explicit OAuth credentials for remote MCP servers docker/docker-agent#2394
fix: cache parsed robots.txt per host instead of boolean result by @dgageot in fix: cache parsed robots.txt per host instead of boolean result docker/docker-agent#2437
bump direct Go dependencies by @dgageot in bump direct Go dependencies docker/docker-agent#2444
Render markdown in user_prompt dialog messages by @dgageot in Render markdown in user_prompt dialog messages docker/docker-agent#2446
Add a pokemon example by @dgageot in Add a pokemon example docker/docker-agent#2445
Add an advanced coder example by @dgageot in Add an advanced coder example docker/docker-agent#2447
fix(mcp): reuse discovered auth server for token refresh by @pandego in fix(mcp): reuse discovered auth server for token refresh docker/docker-agent#2448
Fix --attach flag by @rumpl in Fix --attach flag docker/docker-agent#2449
Support xhigh effort for Anthropic adaptive thinking (Opus 4.7+) by @dgageot in Support xhigh effort for Anthropic adaptive thinking (Opus 4.7+) docker/docker-agent#2450
feat(anthropic): add task_budget for Claude Opus 4.7 by @dgageot in feat(anthropic): add task_budget for Claude Opus 4.7 docker/docker-agent#2453
chore: update cagent-action to v1.4.1 by @derekmisler in chore: update cagent-action to v1.4.1 docker/docker-agent#2454

Full Changelog: docker/docker-agent@v1.45.0...v1.46.0

View the full release notes at https://github.com/docker/docker-agent/releases/tag/v1.46.0.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.