ag-ui-protocol/ag-ui release/2026-09-11

Release 2026-09-11

on GitHub

Packages Published

TypeScript (npm) - published at 14:02:39 UTC

@ag-ui/aws-strands@0.3.0

• TypeScript bridge now forwards RunAgentInput.context to the model, matching the Python bridge.
• Adds provider token usage on RUN_FINISHED/RUN_ERROR terminal events, accumulated per (provider, model).
• Adds templateToolsProvider/template_tools_provider to filter template agent tools per request.
• Exposes URL fetch policy through TypeScript adapter config; validates URL sources (scheme allowlist, address checks, size cap, redirects) before fetching.
• Adds per-thread agent config route; reports uncarried settings per field.
• Surfaces model citations on the assistant message under a citations metadata key, including chunk mode.
• Reports abnormal model stop reasons and guardrail interventions as RUN_ERROR in TypeScript.
• Recovers frontend tool results across restart in TypeScript; carries ToolMessage.error onto tool results.
• Preserves multi-block and non-text tool results, attachments, and reports media drops.
• Fixes media conversion defects including URL attachments with no declared type.
• Python bridge gains multi-agent orchestrator support and per-thread concurrent-run refusal (THREAD_BUSY).
• Adds interrupt support with persistence across restarts; presence, not truthiness, decides answered interrupts.
• Emits RAW for unmapped stream events; forwards unrecognised delta kinds (including Bedrock citations) to RAW fallback.
• Advertises events.RAW: true in the TypeScript capabilities matrix.
• Unifies terminal error codes/messages and emitted events across both bridges.
• Carries newer Strands SDK config fields to per-thread agents instead of dropping them silently.
• Requests extended thinking on the Anthropic demo provider when reasoning is enabled.
• Contains hostile HTTP responses; blocks zero-net and NAT64-embedded URL targets; closes auth fail-open paths.

Breaking changes

• CORS is now opt-in: createStrandsApp no longer installs CORS unconditionally or defaults corsOrigin to "*". Re-verify cross-origin config.
• Empty corsOrigin array now denies all origins instead of collapsing to wildcard; credentials withheld for wildcard and null origins.
• Auth guard now runs before body parsing; verify auth-protected routes.
• Terminal RUN_ERROR codes and message text changed to unify across bridges; clients matching on code/message must re-verify.
• Citations now ride message metadata rather than only RAW; RAW capability now reported as true.
• Resume payload shape, cancellation sentinels, and approval metadata keys aligned across bridges; re-verify tool-result handling on resume.
• Newer SDK config fields require an explicit disposition; a new SDK field can fail the TypeScript build until mapped.

Python (PyPI) - published at 14:02:40 UTC

ag_ui_strands@0.4.0

• Report provider token usage on RUN_FINISHED.usage and RUN_ERROR.usage, accumulated per (provider, model); labels OpenAIResponsesModel as openai.
• Surface model citations on the annotated assistant message under a top-level citations metadata key; carried through chunk mode.
• Add template_tools_provider/templateToolsProvider to StrandsAgentConfig to filter template agent tools per request.
• Add per-thread agent config route; forward plugins per-thread; report uncarried settings per field; carry newer-SDK constructor fields.
• Drive multi-agent orchestrators (Graph/Swarm) from the Python bridge; agent now accepts a callable invoked per run for isolation.
• Delegate frontend waits to native interrupts by default; report the pause; make retries idempotent.
• Surface RunAgentInput.context to the model as a separate leading user message.
• Refuse a second concurrent run per thread with RUN_ERROR { code: "THREAD_BUSY" } on the Python single-agent path.
• Emit RUN_ERROR CONTINUATION_TOOL_NAME_UNRESOLVED when a continuation tool result cannot be named; fail closed instead of empty prompt.
• Emit hook_error CustomEvent when a developer callback throws.
• Validate URL sources before server-side fetch: restrict schemes to http/https, refuse redirect downgrades, prevent DNS rebinding, apply byte/timeout ceilings across redirect hops.
• Harden HTTP endpoints: strict JSON content-type validation, auth hook, CORS opt-out; apply dojo CORS allowlist to mounted demos.
• Preserve attachments, multi-block and non-text tool results; report media drops.
• Fix text/tool-call wire ordering so text is closed before a tool call opens.
• Read parked tool batch across Strands 1.54 and 1.55+ checkpoint shapes.
• Unify terminal error codes, message text, resume contract, and events across Python and TypeScript bridges.
• Emit RAW events for unmapped stream events; forward inner agent events; sanitize RAW payloads.
• Report force stops as run errors with the actual reason; emit error message on force_stop with no content.
• Exclude template-bound management tools from forwarding.

Breaking changes

• CORS: an empty allow-list now denies all origins on the TypeScript side instead of defaulting to wildcard; choose an explicit policy.
• URL fetch now refuses schemes outside http/https at construction and enforces byte/timeout ceilings across redirect hops.
• Frontend waits now use native interrupts by default; absence of ToolBehavior(continue_after_frontend_call=False) no longer selects the legacy placeholder-and-halt path.
• Terminal RUN_ERROR codes and message text changed to a unified set; clients matching codes/messages literally must re-verify.
• Concurrent second run on one thread now rejected with RUN_ERROR { code: "THREAD_BUSY" } on the Python single-agent path.
• RUN_FINISHED/RUN_ERROR now carry usage and outcome; clients must tolerate these fields.
• Citations now ride assistant message metadata rather than only the RAW fallback.
• Content-type validation on HTTP endpoints is now strict JSON.