What’s new

Routine scheduling no longer runs on AWS EventBridge. Schedules are now read and armed entirely on Cloudflare, which removes a cross-cloud hop from every scheduled run and means nothing can re-arm a stale AWS schedule behind your back.

• Routine reads come from Cloudflare rather than DynamoDB
• EventBridge scheduling is decommissioned — no path remains for an old schedule to fire
• Agent wakes were already in-sandbox; this aligns Hono routines with them

A real machine you own can now be an agent. Declare it on an agent class and the machine becomes the thing that does the work, running your own Claude or Codex seat, with the result arriving back in the same conversation.

• The app repository and any declared repositories are checked out fresh before every run
• The conversation is the session, so follow-up instructions resume the same CLI session
• One job per computer and app at a time, with a typed error rather than a silent queue
• Inspect and operate connected machines with sf ops

The largest change in this period. An agent is a TypeScript class in your app under app/agents/**, compiled into your own Worker on deploy. It holds your app's bindings, so it reads your data in-process rather than through a platform API — and deploying it is what registers it.

• Tools are thin adapters over your own domain functions, so business rules bind every caller
• sf agents lint validates every class locally — routes, bindings, model ids, evals — before a remote build
• Traces stitch child agent runs inline in the parent diagram, and a delegating tree bills as one turn
• The chassis is vendored into the build, so no npm dependency is required

A Usage tab showing infrastructure usage and cost per app, so spend is attributable to the thing that caused it rather than arriving as one line at the end of the month.

The full store journey is now something an agent can walk you through: enrolling, creating the API keys, and submitting. Testing on a real device stays a single QR scan with no developer account needed.

• Expo preview works end to end — scan once, reopen after every deploy
• Click-by-click guides for Apple Developer Program and Google Play Console setup
• Tabs-first native scaffold so a new mobile app feels native rather than webby

Signup is now protected against automated abuse, which was arriving through address aliasing. Legitimate signups are unaffected.

Declare a sender in app/email.json and your Worker gets a binding plus an assigned From address. No API keys, no SMTP configuration — the binding is the whole integration.

• Each environment gets its own address automatically
• From is pinned to the assigned address, so a misconfigured sender fails loudly instead of silently spoofing
• Transactional only — receipts, codes, alerts

Declare a queue in app/queues.json and deploy provisions it along with a dead-letter twin. Produce from app code, consume with a handler or an agent, with retries and backoff you configure.

• At-least-once delivery with exponential backoff, then the DLQ
• Inspect and replay failures with sf queues dlq peek / redrive
• Each environment gets its own queue and backlog

A desktop app for building by conversation. Your teams and apps in a rail, a chat per app, and the project on disk — with no terminal required, though everything it does is still available from the CLI.

• Per-app design chats with your own Claude Code or Codex seat
• Switch provider and model per chat, and steer mid-run by typing while it works
• Live streaming of agent turns, with mermaid diagrams and rich blocks rendered in chat
• Team management, per-app usage, Finder / Terminal / Editor / Data / Logs shortcuts
• Auto-update for both the app and the bundled sf CLI

Ask for a mobile app and a real native companion is built alongside your web app. Scan the QR code once with Expo Go and reopen it after every deploy — no cables, no store account.

Opt a route in with one line and it is served from the edge without running your Worker at all. Every deploy invalidates the app's cache automatically, so a release can never leave stale HTML behind.

• Analytics and consent cookies no longer defeat caching — those requests are treated as anonymous
• Declare your own session cookies inert to cache logged-in traffic safely
• stale-while-revalidate serves instantly while refreshing behind it
• x-sf-cache and x-sf-version headers make the behaviour observable

Reads can be served by regional replicas, multiplying read throughput. The scaffold wires a per-request session so every visitor still reads their own writes.

• Query c.get('db') for ~95% of routes and read-your-writes is automatic
• Use withSession('first-primary') where cross-user freshness is mandatory

Design a voice, audition three takes, and keep the one you want as a team voice for voice-enabled chat.

Sonnet 5 becomes the default for new work, with Sonnet 4.6 and Opus 4.7 retired. GLM 5.2 and Kimi 2.7 Code join the registry, including a high-speed Kimi variant.

• GLM 5.2 with a 1M context window and 128K max output
• Run sf models for the current list — the catalog moves

A Workers KV namespace is now bound to every app as env.KV, with no setup. Use it for caching, sessions, feature flags and counters — and as the fastest mitigation you have during an incident, since a flag flips in seconds without a deploy.

Author a write as an operation route and every caller — an agent, an HTTP route, a scheduled job — goes through the same invariant. The build fails if an operation route skips caller verification, because an unauthenticated write path is one anyone can invoke.

• Verified conversation identity is carried into the operation token
• Operations can be granted to specific agents as tools

IP, country and ASN rules, a bot threshold, blocked paths and maintenance mode — enforced at the edge before your code runs, so filtered traffic costs you nothing.

A filter language for request logs with click-to-filter, so finding the failing request stops being a scroll. Available in the console and from sf logs.

• Filter by status, path, error state and time window
• Opt in per app to capture request and response bodies for 14 days

Secrets can be updated without a redeploy dance. Values remain write-only — listing returns names, never values.

A scheduled agent can deliver its result straight to Slack, email or chat with no orchestration to write.

A thread rooted on the bot's own message continues naturally — no need to mention it again on every reply. In channels with several bots, messages are attributed so each one knows what is meant for it.

Grant specific people read access to an app's conversations, so the person answering for an agent's behaviour can actually see what it did.

The website chat widget gained a full-screen mode with new-chat and history, plus container and inline mounting and a documented theming contract.

Deep-copy an existing app, optionally into another team — useful for spinning a variant off something that already works. A clone is a separate app from then on; for a staging copy of the same app, use an environment instead.

Connect remote MCP servers that authenticate with a custom header, and edit those header values from the connector modal.

The console leads with a launcher across all your teams and apps rather than a left rail, with a click-to-copy app-id chip in the workspace header.

One app can start work in another, governed by an explicit invocation policy that says who may call in. Templates became team-wide and apps can be grouped.

• Per-app policy: self, controller, or an allowlist of apps
• Cross-app work appears in the job tree like any other

A calendar-month cap alongside the existing daily one, so a slow leak is bounded and not just a single bad day.

See your database contents and the tasks currently running against an app, without leaving the console or reaching for the CLI.