# SDK changelog

Human-readable release history for @aml-jsx/sdk.
Canonical: https://agent-markup-language.com/docs/reference/changelog/sdk/
Documentation index: https://agent-markup-language.com/docs/
Complete documentation: https://agent-markup-language.com/docs/llms.txt

This page tracks `@aml-jsx/sdk`. Entries are newest first. See [GitHub Releases](https://github.com/we-are-singular/aml/releases) for tags and complete release artifacts.

<!-- changelog:entries -->

## SDK v0.8.0 — Explicit authoring boundaries and real Agent Skills

Released 2026-09-01.

SDK 0.8.0 is a breaking authoring release that separates prompt structure, file inclusion, filesystem materialization, and Agent capabilities into distinct AML primitives. It replaces the old inline-text `<Skill />` contract with staged Agent Skills, adds bounded live file inclusion and exact prompt blocks, and carries the same filesystem behavior across Workspaces and Sandboxes.

### Breaking changes

- **`<Skill />` now declares a package instead of prompt text.** `src` must point to a local Agent Skill package whose root `SKILL.md` supplies its canonical name and description; AML stages the complete package for one Agent session and never inlines its body. Migrate `<Skill src="./review.md" />` to `<Include src="./review.md" />`, and replace inline Skill children with ordinary AML text or `<Block />`. [Skill reference](https://agent-markup-language.com/docs/reference/primitives/skill/) · [Include reference](https://agent-markup-language.com/docs/reference/primitives/include/)
- **`<File />` now follows the nearest active filesystem.** A File inside a Sandbox writes the live guest instead of failing because it is not directly owned by a Workspace, while a File outside a Sandbox still uses the active Workspace. Its props now require exactly one of resolved children or a local `src`; code that depended on Sandbox rejection or constructed the old props shape must migrate. [File reference](https://agent-markup-language.com/docs/reference/primitives/file/) · [Sandbox and Workspace composition](https://agent-markup-language.com/docs/cookbook/sandboxes-and-workspaces/)
- **Custom provider contracts add Skill and filesystem responsibilities.** `SandboxRuntime` implementations must provide bounded `readFile`, `stat`, `writeFile`, and `createFileStaging` operations, and direct `AgentRequest` fixtures must include `skills`. Every `AgentSkill` carries its owned `.agents` home, package directory, and `SKILL.md` path. Agent providers may opt into staged native discovery with `skillDiscovery: "native"`; providers that do not opt in receive AML's metadata fallback. [Provider authoring](https://agent-markup-language.com/docs/reference/provider-authoring/) · [Agent provider selection](https://agent-markup-language.com/docs/providers/agents/)

### Highlights

- **Bounded live file inclusion with `<Include />`** Read an application-owned file with `src` or a file from the active Workspace or Sandbox with `path`. Valid UTF-8 content at or below `maxBytes` is inlined; oversized application and host-Workspace bytes are staged for the Agent without decoding, while an active Sandbox keeps its live file and renders a cwd-relative read instruction. [Include reference](https://agent-markup-language.com/docs/reference/primitives/include/)
- **Exact prompt separation and named sections with `<Block />`** A Block contributes exactly one blank line before and after its resolved children, including an empty Block's two newline characters. Its optional `tag` wraps content in a kebab-cased XML-style section for the model without creating another capability, instruction-priority, lifecycle, or control-flow scope. TypeScript remains the control language for conditions and mapping. [Block reference](https://agent-markup-language.com/docs/reference/primitives/block/)
- **Progressively discovered Agent Skills** Codex and OpenCode discover invocation-private staged packages through their native Skill mechanisms; other built-in providers receive the canonical metadata and staged `SKILL.md` path as fallback guidance. Source packages remain immutable and every staging root is released with its Agent session. [Skill reference](https://agent-markup-language.com/docs/reference/primitives/skill/) · [Codex Agent](https://agent-markup-language.com/docs/providers/agents/codex/) · [OpenCode Agent](https://agent-markup-language.com/docs/providers/agents/opencode/)
- **A documented composition and collection model** The guides now distinguish returning AML to compose naturally from awaiting component-local `evaluate(...)` to collect a nested result before later TypeScript runs. A production-shaped code-review example applies that model with materialized evidence, bounded Includes, real Skills, parallel typed reviewers, and final synthesis. [Component bodies descend; results ascend](https://agent-markup-language.com/docs/concepts/#component-bodies-descend-results-ascend) · [Code-review workflow](https://agent-markup-language.com/docs/cookbook/code-review-workflow/)

### Commits

- fix(sdk): keep block separators deterministic (303c5f3)
- fix(sdk): keep oversized includes agent-readable (9418950)
- fix(sdk): allow skills after follow-up descriptors (e5c29ba)
- feat(sdk): add named prompt blocks (60ce5e8)
- fix(sandbox-daytona): reject unsafe file destinations (45cc4fc)
- fix(agent-codex): use agent-owned skill home (951ec71)
- fix(sdk): stage oversized includes without decoding (e05acf4)
- refactor(sdk): simplify skill discovery capability (62c6548)
- feat(sdk): expose agent-owned skill home (ef90c65)
- refactor(sdk): make filesystem path ownership explicit (328fde8)
- fix(sandbox-modal): reject directory file destinations (72ca287)
- test(sdk): exercise authoring primitives in kitchen sink (9ee3891)
- feat(sdk): add filesystem authoring primitives (c7e4b6f)
- feat(sandbox): sync Docker Hub overview (02b39dc)
- feat(sandbox): automate release changelogs (3fb9674)
- fix(sandbox): restore browser signing flow (5619a72)
- fix(sandbox): await signing confirmation safely (cbb51ee)
- fix(sandbox): gate keyless image signing (41d9f8a)
- release(sandbox): v0.4.1 (3c821a0)
- release(sandbox): v0.4.0 (2653164)
- feat(sandbox): add per-agent image variants (1246c8c)
- release(sandbox): v0.3.4 (b5e046a)

## SDK v0.7.2 — A documented and verified public API

Released 2026-08-31.

This release requires a documented public contract and backs it with a gate: every declaration `@aml-jsx/sdk` exports, and every locally-owned type shape reachable from it, must carry an adjacent JSDoc block, enforced during the SDK's lint task and guarded by conformance tests.

### Highlights

- **Documented public API contract** Every symbol exported from `@aml-jsx/sdk`, together with every locally-owned type shape reachable from it through references and inheritance, now carries an adjacent JSDoc block that explains its purpose, defaults, and constraints. Coverage spans the package root, `testing`, `jsx-runtime`, and `jsx-dev-runtime` entrypoints across the Agent, Sandbox, Workspace, Tool, MCP, Script, Skill, FollowUp, Loop, Parallel, context, evaluation, observability, and testing surfaces. [Runtime reference](https://agent-markup-language.com/docs/reference/runtime) · [Testing reference](https://agent-markup-language.com/docs/reference/testing)
- **A documentation gate on the SDK lint task** A new `docs:check` audit is wired into the SDK's `lint` task. It builds the SDK, walks the resolved public type graph from the public entrypoints, and fails with a location-stamped list of any exported declaration or locally-owned nested shape missing JSDoc. The check follows recursion with cycle protection so a documented public property cannot conceal an undocumented nested type, and references owned by dependencies remain out of scope. Conformance tests guard the checker against both rejecting undocumented shapes and accepting correctly documented ones.

### Commits

- tools(sdk): enforce public api documentation (1917391)
- docs(sdk): document public api contracts (2562b57)
- release(sandbox): v0.3.3 (e964822)
- release(sandbox): v0.3.2 (ae6ca89)
- release(sandbox): v0.3.1 (1a762b1)

## SDK v0.7.1 — Preserved OpenCode native tools and ACP tool-call summaries

Released 2026-08-29.

This patch keeps caller-disabled native OpenCode tools intact while retaining AML's portable permission denials as the final authority, and extends run summaries with a content-free tally of ACP tool-call starts.

### Highlights

- **OpenCode preserves caller-disabled native tools** The OpenCode profile no longer overwrites the tool map with a blanket `*: true` that discarded disabled native tools. It now merges native tool choices from both the top-level `tools` config and the `agent.aml.tools` layer before applying AML's portable permission denials, which remain the final authority. [OpenCode Agent](https://agent-markup-language.com/docs/providers/agents/opencode/)
- **ACP tool-call summaries** `createTraceSummaryCollector()` now also counts ACP tool-call starts (`acp.session.update` with `tool_call`) from the trace stream, exposing each run's `acpToolCalls` as a content-free total and per-name breakdown alongside the existing span aggregates. [Observability](https://agent-markup-language.com/docs/observability)

### Commits

- fix(agent-opencode): #36 preserve disabled native tools (96eb4b6)
- feat(sdk): #34 summarize acp tool calls (32560de)
- release(sandbox): v0.3.0 (ca0b7a2)

## SDK v0.7.0 — Parallel branches, callable Tools, and per-Agent timeouts

Released 2026-08-29.

This release introduces an explicit concurrency boundary, makes defined Tools callable from application code, adds per-Agent execution timeouts and diagnostic names, and correlates application work and run summaries in the trace stream. It also keeps structured output reliable for nested Agents and hardens permission inheritance for Codex and OpenCode subagents.

### Highlights

- **Parallel branches with an explicit concurrency boundary** New `<Parallel />` evaluates independent text-producing branches concurrently, so branches may finish in any order but contribute successful text in authored order. It waits for every branch and its Sandbox/Workspace cleanup before resolving, and surfaces any rejection as one exported ParallelError whose failures keep the authored branch index and cause. Caller cancellation still propagates, and maxConcurrentAgents remains the single limit on provider calls. [Parallel reference](https://agent-markup-language.com/docs/reference/primitives/parallel) · [Explicit concurrency](https://agent-markup-language.com/docs/concepts/#explicit-concurrency)
- **Defined Tools are now callable from application code** The `defineTool()` result becomes both a model-grantable Tool and a directly callable function usable inside an active component without an enclosing `<Agent />` or `<Tool />`. Calls share the same execution path, schema-validating input and revalidating and snapshotting output while inheriting cancellation and tracing, and never grant the Tool to a model. Granted Tools must reference the exact callable returned by `defineTool()`. [Tool reference](https://agent-markup-language.com/docs/reference/primitives/tool) · [Tool or MCP](https://agent-markup-language.com/docs/cookbook/tool-or-mcp)
- **Application observability across the trace stream** Components can time custom phases with `withTraceSpan()`, and `createTraceSummaryCollector()` derives content-free per-run summaries keyed by an explicit `runId`, with `deleteRun()` to release them. Preserved ACP message boundaries and a bounded repair turn keep structured results reliable for nested Agents. Telemetry sink failures stay isolated on `onTraceError` and never change the workflow result. [Observability](https://agent-markup-language.com/docs/observability) · [Application observability cookbook](https://agent-markup-language.com/docs/cookbook/application-observability)
- **Per-Agent execution timeouts and diagnostic names** A `timeoutMs` prop bounds a provider session after it acquires a scheduler slot, aborting on the earliest of timeout or enclosing cancellation and surfacing a timeout reason with elapsed `timeoutMs` in the trace. A `name` prop adds optional, non-unique diagnostic metadata for relating traces and failures to workflows, never reaching the prompt or system instructions. [Agent reference](https://agent-markup-language.com/docs/reference/primitives/agent)
- **Delegated subagents inherit restricted permissions** Codex and OpenCode now deny restricted delegation so native child sessions cannot widen the portable AML permission set. OpenCode maps read-only filesystem, no shell, or no network into inherited edit, bash, and web deny rules; Codex keeps restricted subagents within the single AML-owned session. [OpenCode Agent](https://agent-markup-language.com/docs/providers/agents/opencode) · [Codex Agent](https://agent-markup-language.com/docs/providers/agents/codex)

### Commits

- feat(sdk): #30 add application observability (3f12335)
- feat(sdk): #29 make defined tools callable (c0a6a83)
- feat(sdk): #28 preserve acp message boundaries (cc67af7)
- test(sdk): cover parallel cleanup failures (0452df1)
- feat(sdk): #9 add explicit parallel boundary (a01a823)
- fix(sdk): verify acp session configuration (650ad0a)
- feat(sdk): #11 support nested structured output (0dadac0)
- fix(sdk): #22 repair missing structured output (c87e4f8)
- fix(agent-opencode): align acp launch with runtime requests (d1c9a0f)
- test(agent-codex): prove delegated sandbox inheritance (2d8bbaa)
- test(agent-opencode): prove delegated permission inheritance (d862248)
- fix(agent-codex): preserve restricted subagent delegation (d29dc5d)
- fix(agent-opencode): #20 inherit task permissions (e7494cd)
- fix(agent-codex): #20 prevent restricted subagent delegation (b188163)
- fix(agent-opencode): #20 prevent restricted task delegation (24e320b)
- fix(sdk): preserve cancellation during agent cleanup (bca0107)
- feat(sdk): #12 add per-agent execution timeouts (de044a9)
- feat(sdk): add agent diagnostic names (a20447b)
- release(sandbox): v0.2.0 (4f497bd)
- build(sandbox): update aml runtime (b0418e3)
- refactor(sandbox): align source and release lane (ca51b2e)

## SDK v0.6.0 — A portable Agent runtime image

Released 2026-08-18.

This release debuts AML's portable Agent runtime image, which packs the AML runtime and every built-in Agent provider into a published Docker image and becomes the basis for the SDK's sandbox smoke matrix. It also tightens standalone Copilot CLI launches so they never touch the operator's home directory.

### Highlights

- **New `aml-agent-sandbox` runtime image** AML now ships a ready-to-run Docker image, `wearesingular/aml-agent-sandbox`, with Docker Hub as the canonical stable registry for semantic versions and `latest` (each stable release includes provenance and an SBOM) and a mutable `dev` tag on GHCR. It is a Debian Bookworm/glibc runtime with Node.js 26, Python 3, Git, common shell/network/archive tools, and the codex, copilot, glm, opencode, and pi ACP executables pinned to the versions validated by the SDK's smoke matrix. It runs as the unprivileged `aml` user and ships its license and third-party notices. [Sandbox images](https://agent-markup-language.com/docs/sandbox-images/) · [Image changelog](https://agent-markup-language.com/docs/reference/changelog/sandbox/)
- **Run clean mounted workflows with the embedded AML runtime** The image embeds the `aml` CLI and `@aml-jsx/sdk`, and points `/node_modules` at the embedded dependency tree so standard ancestor resolution keeps bare imports visible even when a provider bind-mounts over `/workspace`. A clean mounted TypeScript, TSX, or JavaScript workflow can therefore run (for example `aml run /workspace/workflow.tsx`) with no local `package.json`, `node_modules`, or installation. [Sandbox images](https://agent-markup-language.com/docs/sandbox-images/)
- **Sandbox smoke matrix runs from the AML image** The SDK smoke matrix now exercises the Docker, Daytona, and Modal Sandboxes from the published AML Agent image (a `dev` tag on GHCR during development) instead of installing Agent executables per run, and supports pinning a specific image/tag. This keeps cross-provider compatibility checks aligned with the exact Agent versions the image ships. [Compatibility](https://agent-markup-language.com/docs/compatibility/)
- **Invocation-private Copilot CLI home** The Copilot profile now also sets `HOME` to AML's invocation-private state directory, alongside `COPILOT_HOME`. Because the standalone `copilot` CLI extracts its bundled runtime through `HOME` before it reads `COPILOT_HOME`, isolating both keeps its credentials, permissions, and session state away from the operator's home directory. [Copilot Agent](https://agent-markup-language.com/docs/providers/agents/copilot/)

### Commits

- refactor(agent-sandbox): simplify image release contract (77d0c87)
- test(workspace-local): allow slow ci child startup (0696711)
- refactor(agent-sandbox): simplify image checks (2435653)
- feat(agent-sandbox): embed aml runtime (c73a881)
- test(sdk): allow smoke matrix image pinning (71e81b4)
- fix(agent-sandbox): preserve buildx state during releases (571510b)
- test(sdk): use ghcr dev image for sandbox smoke (7516e36)
- release(agent-sandbox): make docker hub canonical (a682373)
- test(sdk): run sandbox matrix from aml image (5cfdc08)
- feat(agent-sandbox): add portable agent runtime image (01032c9)
- fix(agent-copilot): isolate standalone cli home (535f8d8)

## SDK v0.5.2 — Add GLM as a community agent provider

Released 2026-08-17.

GLM joins Codex, Copilot, OpenCode, and Pi as a fifth built-in agent provider. The new `glmAgent()` factory launches Z.ai GLM Coding Plan models through the registry-listed, community-maintained `glm-acp-agent` ACP adapter, with Z.AI Coding Plan authentication and invocation-private session state.

### Highlights

- **New `glmAgent()` factory function** Exported from `@aml-jsx/sdk`, `glmAgent()` creates a GLM agent provider with options for command, args, environment overlay, apiKey, model, baseUrl, maxTokens, and working directory. It launches the configured command (default `glm-acp-agent`), which calls the GLM Coding Plan endpoint directly and provides file, shell, web, and image tools. [GLM Agent reference](https://agent-markup-language.com/docs/providers/agents/glm/)
- **Z.AI Coding Plan authentication** Passing `apiKey` adds `Z_AI_API_KEY` and selects the adapter's `z-ai-api-key` authentication method; Coding Plan keys bill against plan quota rather than pay-as-you-go API credit. [GLM Agent reference](https://agent-markup-language.com/docs/providers/agents/glm/)
- **Invocation-private adapter state** The adapter's resumable sessions are kept inside AML's session directory via `ACP_GLM_SESSION_DIR`, so adapter state stays private to each evaluation alongside the rest of the run. [GLM Agent reference](https://agent-markup-language.com/docs/providers/agents/glm/)
- **Sandbox remains the permission boundary** Because `glm-acp-agent` exposes no portable permission surface beyond ACP protocol requests, the enclosing `<Sandbox />` stays the boundary for filesystem, shell, and network restrictions. The adapter is community-maintained, not the Z.ai ZCode harness (which has no ACP implementation), and AML does not install it implicitly. [GLM Agent reference](https://agent-markup-language.com/docs/providers/agents/glm/)

### Commits

- feat(agent-glm): add community glm acp provider (c50c865)

## SDK v0.5.1 — Run Scripts on the trusted host with a compacted console tree

Released 2026-08-13.

This release makes `<Script />` usable without a Sandbox by executing on the trusted host, adds a per-execution working directory, and keeps the interactive console trace focused on lifecycle boundaries by omitting repetitive ACP chunk updates. New kitchen-sink smoke coverage exercises the full public surface together.

### Highlights

- **Host execution for `<Script />`** `<Script />` no longer requires an enclosing `<Sandbox />`. When no Sandbox is active, it runs the authored command or interpreted source on the trusted host from the runtime working directory, reusing the same process-tree cleanup, abort signaling, timeout, and cancellation semantics as local Agents. Host output is bounded to 4 MiB per stream. Host runs are deliberately unconfined — they inherit the AML host identity and environment — so AML surfaces them as `environment="host"` and reserves them for trusted authored automation; model-generated or untrusted source should still select an enforcing Sandbox. [Script reference](https://agent-markup-language.com/docs/reference/primitives/script/)
- **Per-execution working directory** Both `<Script />` forms accept a `cwd` prop, a portable relative forward-slash path resolved against the runtime cwd on the host or the active Sandbox root inside a Sandbox. AML rejects absolute paths, backslashes, and parent traversal. TypeScript now models the literal-`command` and `shell`-source variants as two disjoint prop forms, so `args` is valid only with `command` and the shell form requires child source. [Script reference](https://agent-markup-language.com/docs/reference/primitives/script/)
- **Compacted ACP console traces** The console tracer omits the repetitive `agent_message_chunk`, `agent_thought_chunk`, and `tool_call_update` ACP point events so the interactive tree stays focused on lifecycle boundaries; these events remain in the trace stream for custom sinks. The initial `tool_call` stays visible and reports the optional programmatic `toolName`. [Observability](https://agent-markup-language.com/docs/observability)
- **Kitchen sink smoke coverage** The SDK smoke suite gained an end-to-end workflow exercising Agents, Sandboxes, Workspaces, MCP servers, Tools, Skills, Scripts, and structured output together, giving release automation a single pass over the public surface.

### Commits

- fix(sdk): suppress thought chunks in console traces (902906b)
- test(sdk): add kitchen sink smoke workflow (1bb3f3e)
- feat(sdk): compact acp console traces (b164f57)
- feat(sdk): add script working directory (cb49c16)
- feat(sdk): run script on the trusted host (348f27b)

## SDK v0.5.0 — Trace the Agent lifecycle and cancel on process signals

Released 2026-08-12.

This release makes Agent execution observable across its full lifecycle and gives application-owned Node processes a portable way to turn `SIGINT`/`SIGTERM` into a single cancellation signal. It also fixes the OpenCode profile so it no longer overrides OpenCode's native coding prompt, and lets the Copilot provider resolve during clean type-checking.

### Highlights

- **Process signal cancellation** A new `ProcessSignalCancellation` helper, exported from `@aml-jsx/sdk`, installs `SIGINT`/`SIGTERM` listeners and converts the first signal into one caller-owned `AbortSignal`. Constructing the helper explicitly opts the process in — importing the SDK does not. The first signal aborts active evaluations so AML can release Agent sessions, Sandbox leases, and Workspace scopes; a second signal exits immediately. Cleanup is bounded by the default 10-second deadline, and `exitCode` preserves status `130` (`SIGINT`) or `143` (`SIGTERM`) without an early `process.exit()`. Frameworks or supervisors that already own shutdown can pass their existing signal instead. [Runtime reference](https://agent-markup-language.com/docs/runtime/#process-signals)
- **Agent and ACP lifecycle tracing** Agent execution now emits a dedicated `agent.session` span enclosing setup, turns, and cleanup, alongside new `sandbox.process` and `acp.session.*` point events for process spawn/kill and ACP session creation, prompt submission, streaming updates, and completion. `agent.cleanup` reports teardown explicitly, and the console tracer renders these as a nested tree from the `agent` span down through turns. Metadata-only tracing stays content-free; enabling content capture passes each serialized ACP update object through unchanged. [Observability](https://agent-markup-language.com/docs/observability)
- **Preserved OpenCode native system prompt** Because OpenCode replaces its model-specific base coding prompt whenever a custom Agent has a non-empty `prompt`, the OpenCode profile no longer sets that field. Non-empty AML System content is instead prepended to the first user turn inside literal `<SYSTEM>` tags, while empty content adds no prelude — preserving OpenCode's native prompt while carrying the AML instructions across ACP. [OpenCode Agent](https://agent-markup-language.com/docs/providers/agents/opencode/)
- **Clean-checkout Copilot type resolution** The SDK's `tsconfig` now maps `@aml-jsx/agent-copilot` to its source, so consumers and CI can type-check against the Copilot provider without relying on stale build output. [Copilot provider reference](https://agent-markup-language.com/docs/providers/agents/copilot/)

### Commits

- fix(agent-opencode): preserve native system prompt (f977e1a)
- feat(sdk): trace agent and acp lifecycle (e956aad)
- feat(sdk): add process signal cancellation (11d2a4a)
- fix(sdk): resolve copilot source during type-checking (3cab6be)

## SDK v0.4.4 — Add GitHub Copilot as built-in agent provider

Released 2026-08-11.

This release adds GitHub Copilot to the AML SDK as a first-class agent provider alongside Codex, OpenCode, and Pi, enabling `copilot --acp` launches with AML permission bridging and structured output support.

### Highlights

- **New `copilotAgent()` factory function** Exported from `@aml-jsx/sdk`, the `copilotAgent()` factory creates a Copilot agent provider with options for command, args, environment overlay, model, reasoning effort, and working directory. The provider launches `copilot --acp` with invocation-private state (`COPILOT_HOME`), explicit authentication resolution (`COPILOT_GITHUB_TOKEN > GH_TOKEN > GITHUB_TOKEN`), and AML permission-to-deny-rule mapping (`--deny-tool=write|shell|url`). [Copilot provider reference](https://agent-markup-language.com/docs/providers/agents/copilot/) · [Agent providers overview](https://agent-markup-language.com/docs/providers/agents/)
- **Expanded `AcpAgentLaunchContext` interface** Two new optional fields added to the shared ACP agent launch context: `amlMcpServerName?: string` (name of the invocation-owned MCP server hosting AML JavaScript Tools) and `inheritsProcessEnvironment: boolean` (whether the launched process inherits the host's `process.env`). All ACP profiles now pass these to `createLaunch()`, enabling provider-specific behavior like Copilot's environment-aware auth token resolution. [Agent primitives reference](https://agent-markup-language.com/docs/reference/primitives/agent/)
- **Copilot permission mapping (filesystem, shell, network)** The Copilot profile translates AML permission grants into Copilot CLI deny flags and tool exclusions: `read-only` filesystem excludes edit/write tools and passes `--deny-tool=write`; `shell: false` excludes bash and passes `--deny-tool=shell`; `network: false` excludes web tools and passes `--deny-tool=url`. Deny rules take precedence over ACP approvals, narrowing the model-visible tool set. [Copilot provider reference](https://agent-markup-language.com/docs/providers/agents/copilot/)
- **Structured output instruction for Copilot** When AML provides an output schema and the MCP server is active, the Copilot profile injects a `structuredOutputInstruction` that names the `aml_submit_result` MCP tool with the correct server prefix, instructing Copilot to call it once with the final result. [Agent primitives reference](https://agent-markup-language.com/docs/reference/primitives/agent/)
- **Documentation and catalog updates** Added a full Copilot provider reference page and updated the cross-provider capability matrix to include GitHub Copilot as the fourth built-in agent provider alongside Codex, OpenCode, and Pi. [Agent providers overview](https://agent-markup-language.com/docs/providers/agents/) · [Copilot provider reference](https://agent-markup-language.com/docs/providers/agents/copilot/)

### Commits

- feat(sdk): add github copilot agent provider (cbbe572)

## SDK v0.4.3 — Recoverable structured output submissions

Released 2026-08-11.

Agents now receive actionable validation errors when submitting invalid structured output, allowing correction and retry within the same turn instead of terminal failure. The first valid submission wins; subsequent submissions are traced but ignored. This release also adds a new <code>agent.output</code> trace event for observability and an automated changelog authoring workflow.

### Highlights

- **Recoverable structured output submissions** The <code>aml_submit_result</code> tool now validates each submission against the output schema before accepting it. Invalid submissions return a tool error with the validation failure, allowing the agent to retry within the same turn. After the first valid submission is accepted, later submissions are silently ignored with a success response. Early submissions (before the final authored turn) are also retriable rather than terminal. [Structured output cookbook](https://agent-markup-language.com/docs/cookbook/structured-output) · [Agent primitives reference](https://agent-markup-language.com/docs/reference/primitives/agent)
- **Structured output schema validation** The bridge now calls the application-owned schema's validate method on each submission before accepting it. Validation failures are returned to the agent as tool errors containing the error message and cause. Validation is performed through <code>AgentStructuredOutputServices</code>, a shared registry that uses <code>Symbol.for</code> to work across multiple physical copies of the SDK in one JavaScript realm. [Runtime architecture](https://agent-markup-language.com/docs/runtime)
- **New <code>agent.output</code> trace event** A new <code>agent.output</code> trace event fires on every <code>aml_submit_result</code> call with a call number and status of 'accepted', 'ignored', or 'invalid'. This provides structured observability into the submission lifecycle: you can see how many attempts an agent made, which attempt was accepted, and whether earlier attempts were rejected by validation or arrived before the turn was ready. [Observability](https://agent-markup-language.com/docs/observability)
- **Automated changelog authoring workflow** The SDK and CLI release-it configurations now run a changelog generation script as part of the <code>after:bump</code> hook, which produces markdown changelog entries and stages them. The generated changelog is formatted and committed automatically. [SDK changelog](https://agent-markup-language.com/docs/reference/changelog/sdk) · [CLI changelog](https://agent-markup-language.com/docs/reference/changelog/cli)

### Commits

- fix(sdk): share structured output services (2b4fa27)
- fix(sdk): recover structured output submissions (261e748)
- fix(sdk): stream release hook traces (1ba1c80)
- fix(sdk): review generated changelog formatting (f494035)
- fix(sdk): trace changelog authoring (a21ad63)
- fix(sdk): preserve authored changelog markdown (dd58489)
- fix(sdk): format generated changelog entries (09be3c1)
- feat(sdk): add aml-authored changelog workflow (a8e9e60)

## SDK v0.4.2 — Independent package release lanes

Released 2026-08-10.

SDK and CLI publishing gained independent release lanes, allowing each package to advance on its own version and tag history without conflating their changes.

### Highlights

- **Package-specific releases.** Release tooling now distinguishes SDK tags from CLI tags and keeps their generated notes scoped to the package being published. [CLI reference](https://agent-markup-language.com/docs/cli/)

### Commits

- tools: isolate package release lanes (21bca45)

## SDK v0.4.1 — Unified workspace builds

Released 2026-07-31.

The repository consolidated its Turbo task graph so SDK builds and package checks run consistently from both package and root workflows.

### Highlights

- **Consistent build ownership.** Workspace tasks now share the same root orchestration instead of maintaining overlapping build paths. [Deployment](https://agent-markup-language.com/docs/production/deployment/)

### Commits

- build: unify turbo workspace tasks (4522d7a)

## SDK v0.4.0 — A sharper ACP execution boundary

Released 2026-07-31.

Agent execution was standardized around Agent Client Protocol sessions, with clearer process ownership, capability translation, cleanup, and failure handling across built-in providers.

### Highlights

- **Shared ACP lifecycle.** Agent providers now use one execution architecture for session startup, turns, Tools, MCP, structured output, and teardown. [Agent providers](https://agent-markup-language.com/docs/providers/agents/)
- **Closed process gaps.** Failure and cleanup behavior was tightened around the provider process boundary. [Runtime reference](https://agent-markup-language.com/docs/reference/runtime/)
- **More reliable Workspaces.** Local Sandbox resolution and cross-process lock startup gained focused fixes and regression coverage. [Workspace providers](https://agent-markup-language.com/docs/providers/workspaces/)

### Commits

- fix(sdk): close acp process boundary gaps (2f4d42d)
- refactor(sdk): sharpen acp process architecture (4f8185e)
- refactor(sdk): standardize agent execution on acp (6b2c758)
- test(workspace): allow cross-process lock startup (6b235ec)
- fix(workspace): resolve local sandbox in clean tests (9290668)

## SDK v0.3.1 — S3 Workspace type resolution

Released 2026-07-30.

This patch corrected how the SDK resolves the S3 Workspace implementation during clean typechecking.

### Highlights

- **Clean-checkout type safety.** Consumers and CI can resolve the S3-backed Workspace without relying on stale build output. [S3 Workspace](https://agent-markup-language.com/docs/providers/workspaces/s3/)

### Commits

- fix(sdk): resolve s3 workspace during typecheck (2d81fdd)

## SDK v0.3.0 — S3-compatible durable Workspaces

Released 2026-07-30.

AML added durable Workspace persistence backed by S3-compatible object storage, including revision data, ownership locks, and cleanup behavior.

### Highlights

- **Remote persistence.** Workflows can materialize and publish durable state through an S3-compatible provider. [S3 Workspace](https://agent-markup-language.com/docs/providers/workspaces/s3/)

### Commits

- feature(workspace): add s3-compatible persistence (29f6426)

## SDK v0.2.0 — Portable provider lifecycles

Released 2026-07-29.

Provider lifecycle contracts were standardized and the Sandbox catalog expanded with Modal, while Daytona configuration moved to the shared root boundary.

### Highlights

- **Modal Sandboxes.** AML can provision remote Modal execution environments through the built-in provider. [Modal Sandbox](https://agent-markup-language.com/docs/providers/sandboxes/modal/)
- **Consistent lifecycle contracts.** Providers now share clearer startup, acquisition, release, and failure expectations. [Provider authoring](https://agent-markup-language.com/docs/reference/provider-authoring/)
- **Simpler Daytona configuration.** Environment selection moved out of nested implementation details. [Daytona Sandbox](https://agent-markup-language.com/docs/providers/sandboxes/daytona/)

### Commits

- refactor(sandbox-daytona): move environment selection to root (2bf27cb)
- feature(sandbox-modal): add modal sandbox provider (d0fe6c8)
- refactor(sdk): standardize provider lifecycle contracts (6f2882a)

## SDK v0.1.3 — Pi and the portable Sandbox matrix

Released 2026-07-29.

The Agent catalog gained Pi support and AML established a portable Sandbox runtime exercised across every built-in Agent provider.

### Highlights

- **Pi Agent support.** Workflows can select Pi and its extensible MCP/tooling path. [Pi Agent](https://agent-markup-language.com/docs/providers/agents/pi/)
- **Cross-provider confidence.** The Sandbox smoke matrix now exercises Agent and Sandbox combinations through the same portable contracts. [Compatibility](https://agent-markup-language.com/docs/compatibility/)

### Commits

- feature(sandbox): run all agents across sandbox providers (a7353de)
- feature(sandbox): add portable runtime and smoke matrix (e3383ca)
- feature(sdk): add pi agent integration (47fadd2)

## SDK v0.1.2 — Reliable OpenCode process output

Released 2026-07-28.

OpenCode process streams are now piped through the provider boundary correctly, and SDK releases keep the root lockfile synchronized.

### Highlights

- **Visible OpenCode output.** Provider process stdout and stderr now follow the expected ACP execution path. [OpenCode Agent](https://agent-markup-language.com/docs/providers/agents/opencode/)
- **Reproducible publishing.** Release bumps update the shared package lock before the release commit is created.

### Commits

- fix(agent-opencode): pipe opencode process output (00cd62f)
- fix(sdk): keep release lockfile synchronized (6712a41)

## SDK v0.1.1 — The first public AML SDK

Released 2026-07-28.

The first public package established AML's asynchronous JSX runtime and its core Agent, Tool, MCP, Sandbox, Workspace, Skill, FollowUp, Loop, context, evaluation, and observability boundaries.

### Highlights

- **Composable Agent workflows.** JSX became an executable dependency tree with bounded Agent concurrency and structured component evaluation. [Concepts](https://agent-markup-language.com/docs/concepts/)
- **Scoped capabilities.** Tools, MCP servers, Skills, and same-session FollowUps gained explicit ownership inside an Agent. [Primitives](https://agent-markup-language.com/docs/reference/primitives/)
- **Execution and durability.** Docker Sandboxes and local Workspaces established separate command and persistence boundaries. [Provider contracts](https://agent-markup-language.com/docs/reference/providers/)
- **Built-in coding Agents.** The initial package included Codex and OpenCode provider adapters. [Agent providers](https://agent-markup-language.com/docs/providers/agents/)

### Commits

- release(sdk): prepare unified public package (7efe97d)
- refactor(agent-opencode): separate option capture (d87da81)
- fix(runtime): isolate evaluation event subscribers (3999a92)
- feature(runtime): add evaluation lifecycle events (917894a)
- feature(context): add immutable dependency scope (71e64db)
- feature(observability): add evaluation traces (936ad3b)
- feature(agent-codex): add Codex provider adapter (36a66d6)
- feature(loop): add transactional Agent state (4f1e876)
- feature(follow-up): add same-session Agent turns (6dc0cf9)
- feature(runtime): bound Agent concurrency (91649bb)
- feature(evaluate): add structured component data (4323f1d)
- feature(mcp): add scoped server capabilities (069be42)
- feature(workspace-local): add durable local provider (4902aa4)
- feature(sandbox-docker): attach Workspace materializations (5c78719)
- feature(sdk): add durable Workspace boundary (6559c4c)
- feature(sandbox-docker): add Docker confinement provider (f0bea60)
- feature(sandbox): add provider-neutral execution scope (8ff8840)
- feature(skill): add local and inline instructions (6edc831)
- feature(tool): add scoped JavaScript capabilities (f0c96e6)
- feature(agent-opencode): add OpenCode provider adapter (5be0e73)
- feature(sdk): establish AML evaluation and Agent boundaries (1e5bbfd)