Developer Platform Updates & Release Notes

The latest release of the Agents SDK ↗︎ adds four new ways to build with @cloudflare/think: on-demand Agent Skills, chat messengers (starting with Telegram), declarative scheduled tasks, and durable reasoning steps inside Workflows. This release also significantly hardens durable chat recovery, so turns reliably ride through deploys, evictions, and stalled model streams in production.

Agent Skills (experimental)

Give an agent a catalog of on-demand instructions, resources, and scripts. A skill source adds a catalog to the system prompt, and the model activates a skill only when a task matches — so a large library of capabilities does not bloat every prompt.

import { Think, skills } from "@cloudflare/think";
import bundledSkills from "agents:skills";

export class SkillsAgent extends Think {
	getSkills() {
		return [
			bundledSkills,
			skills.r2(this.env.SKILLS_BUCKET, { prefix: "skills/" }),
		];
	}
}

import { Think, skills } from "@cloudflare/think";
import bundledSkills from "agents:skills";

export class SkillsAgent extends Think<Env> {
	getSkills() {
		return [
			bundledSkills,
			skills.r2(this.env.SKILLS_BUCKET, { prefix: "skills/" }),
		];
	}
}
``` …

Sandboxes can expose a service running inside the container on a public preview URL through the sandbox.tunnels namespace. The SDK uses cloudflared inside the sandbox so you can share a running service without configuring exposePort() or a custom domain.

By default, sandbox.tunnels.get(port) creates a quick tunnel ↗︎ on a zero-config *.trycloudflare.com URL — no Cloudflare account, DNS record, or custom domain required. This is perfect for quick development and for .workers.dev deployments.

import { getSandbox } from "@cloudflare/sandbox";

const sandbox = getSandbox(env.Sandbox, "my-sandbox");
await sandbox.startProcess("python -m http.server 8080");

const tunnel = await sandbox.tunnels.get(8080);
console.log(tunnel.url); // → https://random-words-here.trycloudflare.com

import { getSandbox } from "@cloudflare/sandbox";

const sandbox = getSandbox(env.Sandbox, "my-sandbox");
await sandbox.startProcess("python -m http.server 8080");

const tunnel = await sandbox.tunnels.get(8080);
console.log(tunnel.url); // → https://random-words-here.trycloudflare.com

Named tunnels

…

You can now point wrangler d1 migrations apply at a nested migrations layout — such as the one produced by Drizzle ↗︎ (migrations/0001_init/migration.sql) — using the new migrations_pattern D1 binding config:

{
	"d1_databases": [
		{
			"binding": "DB",
			"database_name": "my-database",
			"database_id": "<UUID>",
			"migrations_dir": "migrations",
			"migrations_pattern": "migrations/*/migration.sql",
		},
	],
}

migrations_pattern is a glob (relative to your Wrangler config file) used to discover migration files. It defaults to ${migrations_dir}/*.sql, so existing projects keep working unchanged. Each migration's name is recorded in the migrations table as a path relative to migrations_dir.

To learn more, visit D1's migrations documentation.

Cloudflare Realtime SFU is a WebRTC Selective Forwarding Unit that runs on Cloudflare's global network, so you can route live audio, video, and data between WebRTC clients around the world without managing SFU infrastructure or regions.

When you use the WebSocket adapter to stream WebRTC media to a WebSocket endpoint, the adapter now auto-reconnects and buffers audio and video after brief endpoint disconnects or restarts.

Streaming WebRTC media to WebSocket endpoints

Many teams also use Realtime SFU as the media layer for backend applications, such as transcription, recording, note-taking, and agentic media-processing services. These systems often need to consume live WebRTC audio or video from the SFU in backend infrastructure, including Durable Objects, Workers, Containers, or external services, without running a WebRTC client themselves. …

You can now point wrangler d1 migrations apply at a nested migrations layout — such as the one produced by Drizzle ↗︎ (migrations/0001_init/migration.sql) — using the new migrations_pattern D1 binding config:

{
	"d1_databases": [
		{
			"binding": "DB",
			"database_name": "my-database",
			"database_id": "<UUID>",
			"migrations_dir": "migrations",
			"migrations_pattern": "migrations/*/migration.sql",
		},
	],
}

migrations_pattern is a glob (relative to your Wrangler config file) used to discover migration files. It defaults to ${migrations_dir}/*.sql, so existing projects keep working unchanged. Each migration's name is recorded in the migrations table as a path relative to migrations_dir.

To learn more, visit D1's migrations documentation.

R2 Data Catalog is a managed Apache Iceberg ↗︎ data catalog built directly into R2 buckets, queryable by any Iceberg-compatible engine such as Spark, Snowflake, and DuckDB. R2 Data Catalog now has published pricing for catalog operations and table compaction, in addition to standard R2 storage and operations.

Billing is not yet enabled. We will provide at least 30 days notice before we start charging for R2 Data Catalog usage.

Pricing is based on two dimensions:

• Catalog operations: $9.00 / million operations for metadata requests such as creating tables, reading table metadata, and updating table properties.
• Compaction: $0.005 / GB processed and $2.00 / million objects processed. These charges only apply when automatic compaction is turned on for a table.

Both dimensions include a monthly free tier: 1 million catalog operations, 10 GB of compaction data processed, and 1 million compaction objects processed.

For full pricing details and billing examples, refer to R2 Data Catalog pricing.

R2 Data Catalog is a managed Apache Iceberg ↗︎ data catalog built directly into your R2 bucket. It exposes a standard Iceberg REST catalog interface so you can connect query engines like Spark, Snowflake, DuckDB, and R2 SQL to your data in R2.

R2 Data Catalog now has a dedicated section in the Cloudflare dashboard, replacing the previous settings panel embedded in R2 bucket configuration. The new experience includes:

R2 Data Catalog dashboard overview

• Catalog overview — View all your catalogs in one place with catalog request counts, bucket sizes, and table maintenance status at a glance.
• Guided setup wizard — Create a catalog in three steps: choose or create an R2 bucket, configure table maintenance (compaction and snapshot expiration), and review. The wizard creates the bucket and generates a service credential automatically. …

Cloudflare Pipelines is a streaming data platform that ingests events, transforms them with SQL, and writes to R2 as JSON, Parquet, or Apache Iceberg ↗︎ tables. Pipelines now has published pricing based on two usage dimensions: the volume of data processed by SQL transforms and the volume of data delivered to sinks. Ingress into a Pipeline stream is free.

Billing is not yet enabled. We will provide at least 30 days notice before we start charging for Pipelines usage.

Pipelines pricing model is designed to charge per GB based on what you use:

• Streams (ingress): Free, regardless of volume.
• SQL transforms: $0.04 / GB for stateless transforms (filter, reshape, unnest, cast, compute).
• Sinks: $0.03 / GB for JSON, $0.06 / GB for Parquet or Iceberg output.

Workers Free plans include 1 GB / month for each dimension. Workers Paid plans include 50 GB / month.

For full pricing details and billing examples, refer to Pipelines pricing.

R2 SQL is a serverless, distributed query engine that runs SQL against Apache Iceberg ↗︎ tables stored in R2 Data Catalog. R2 SQL now has published pricing based on a single dimension: the volume of compressed data scanned to execute your queries. At $2.50 / TB ($0.0025 / GB), R2 SQL is priced at half the cost of AWS Athena and less than half of Google BigQuery on-demand.

Billing is not yet enabled. We will provide at least 30 days notice before we start charging for R2 SQL usage.

Data scanned is measured on compressed bytes read from R2 object storage. This matches what you see in your R2 bucket — if a Parquet file is 100 MB on disk, scanning that file bills for 100 MB. Each query has a minimum billing increment of 10 MB.

All plans include 10 GB of data scanned per month. Standard R2 storage and operations and R2 Data Catalog charges apply separately.

For full pricing details and billing examples, refer to R2 SQL pricing.

You can now call Browser Run Quick Actions directly from a Cloudflare Worker using the quickAction() method on the browser binding. This simplifies how Workers interact with Browser Run by removing the need for API tokens or external HTTP requests. Your Worker communicates with Browser Run directly over Cloudflare's network, resulting in simpler code and lower latency.

With the quickAction() method you can:

• Capture screenshots from URLs or HTML
• Generate PDFs with custom styling, headers, and footers
• Extract HTML content from fully rendered pages
• Convert pages to Markdown
• Extract structured JSON using AI
• Scrape elements with CSS selectors
• Get all links from a page …

Wrangler supports using wrangler containers ssh as an OpenSSH ProxyCommand for Containers. This lets your local SSH client connect to a running Container through Wrangler.

ssh -o ProxyCommand="wrangler containers ssh %h" cloudchamber@<INSTANCE_ID>

When standard input and output are piped, Wrangler forwards data to the SSH server in the Container. You can also pass --stdio to force this mode.

For more information, refer to the SSH documentation.

You can now send emails with display names on recipient addresses in addition to the existing from support. Pass an object with email and an optional name field for to, cc, bcc, replyTo, or from:

src/index.jsjs

export default {
	async fetch(request, env) {
		const response = await env.EMAIL.send({
			from: { email: "support@example.com", name: "Support Team" },
			to: { email: "jane@example.com", name: "Jane Doe" },
			cc: [
				"manager@company.com",
				{ email: "team@company.com", name: "Engineering Team" },
			],
			subject: "Welcome!",
			html: "<h1>Thanks for joining!</h1>",
			text: "Thanks for joining!",
		});

		return Response.json({ messageId: response.messageId });
	},
};

src/index.tsts

export default {
	async fetch(request, env): Promise<Response> {
		const response = await env.EMAIL.send({
			from: { email: "support@example.com", name: "Support Team" },
			to: { email: "jane@example.com", name: "Jane Doe" },
			cc: [
				"manager@company.com",
				{ email: "team@company.com", name: "Engineering Team" },
			],
			subject: "Welcome!",
			html: "<h1>Thanks for joining!</h1>",
			text: "Thanks for joining!",
		});

		return Response.json({ messageId: response.messageId });
	},
} satisfies ExportedHandler<Env>;

Plain strings remain fully supported for backward compatibility, and you can mix strings and named objects in the same array. …

You can now record specific participant audio tracks in RealtimeKit with track recording. Track recording creates separate WebM files for each participant instead of a single composite recording, which is useful for post-processing, transcription, and regulated or content-sensitive workflows.

To record specific participants, pass user_ids when starting a track recording:

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/<account_id>/realtime/kit/<app_id>/recordings/track \
  --header 'Authorization: Bearer <api_token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "meeting_id": "97440c6a-140b-40a9-9499-b23fd7a3868a",
  "user_ids": ["user-123", "user-456"]
}'

To pass user_ids for selective track recording, use the following minimum SDK versions:

• Web Core: @cloudflare/realtimekit version 1.4.0 or later
• Web UI Kit: @cloudflare/realtimekit-ui, @cloudflare/realtimekit-react-ui, or @cloudflare/realtimekit-angular-ui version 1.1.2 or later
• Android Core or iOS Core: version 2.0.0 or later
• Android UI Kit or iOS UI Kit: version 1.1.0 or later …

Custom flow configuration panel

Flows are automated rules that pair conditions (such as file extension, URL path, or query parameter) with parameters. Set up a flow to automatically apply image optimization to matching requests on your zone without writing code or changing URLs.

There are two modes for transformation flows:

• Provider flows — Migrate from another image optimization service. Your existing URLs continue to work while Cloudflare rewrites provider-specific parameters to their Cloudflare equivalents. Currently, Cloudflare supports provider flows for Fastly Image Optimizer.
• Custom flows — Define your own conditions and actions for use cases like automatic format conversion, responsive sizing with width=auto, or directory-based optimization.

To get started, go to Images > Transformations > Automation in the Cloudflare dashboard ↗︎. …

Flagship is now in public beta. Evaluate feature flags directly from Cloudflare Workers with no outbound HTTP calls, using globally distributed flag configuration backed by Workers KV and Durable Objects. Flagship supports typed flag values, targeting rules, percentage rollouts, audit history, and OpenFeature-compatible SDKs.

Evaluate a flag from a Worker in a few lines of code:

src/index.jsjs

export default {
	async fetch(request, env) {
		const showNewCheckout = await env.FLAGS.getBooleanValue(
			"new-checkout",
			false,
		);

		return new Response(showNewCheckout ? "New checkout" : "Standard checkout");
	},
};

src/index.tsts

export default {
	async fetch(request: Request, env: Env): Promise<Response> {
		const showNewCheckout = await env.FLAGS.getBooleanValue("new-checkout", false);

		return new Response(
			showNewCheckout ? "New checkout" : "Standard checkout",
		);
	},
} satisfies ExportedHandler<Env>;

Start creating flags from the Cloudflare dashboard today. Refer to the Flagship documentation to get started.

AI Gateway now uses the AI REST API on api.cloudflare.com. You can call any model — whether from OpenAI, Anthropic, Google, or hosted on Workers AI — through one unified API, using the same endpoints and authentication regardless of provider. Four endpoints are available:

• POST /ai/run — universal endpoint for all models and modalities
• POST /ai/v1/chat/completions — OpenAI SDK compatible
• POST /ai/v1/responses — OpenAI Responses API compatible
• POST /ai/v1/messages — Anthropic SDK compatible

curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "model": "openai/gpt-5.5",
    "messages": [{"role": "user", "content": "What is Cloudflare?"}]
  }'

All AI Gateway features — logging, caching, rate limiting, and guardrails — are applied automatically. Third-party models are billed through Unified Billing, so you do not need to manage separate provider API keys.

Third-party model requests are routed through your account's default gateway, which is created automatically on first use. To route requests through a specific gateway, add the cf-aig-gateway-id header. …

You can now use VPC Network bindings with network_id: "cf1:network" to reach your full private network from Workers, including:

• Cloudflare Mesh nodes and client devices
• Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh
• Destinations connected through Cloudflare WAN on-ramps — GRE, IPsec, and CNI

This means a single VPC Network binding can route Worker requests to private services regardless of how those services are connected to Cloudflare: through a Cloudflare Tunnel from a cloud VPC, a Mesh node on a private subnet, or a Cloudflare WAN on-ramp from your data center or branch site.

{
	"vpc_networks": [
		{
			"binding": "PRIVATE_NETWORK",
			"network_id": "cf1:network",
			"remote": true,
		},
	],
}

[[vpc_networks]]
binding = "PRIVATE_NETWORK"
network_id = "cf1:network"
remote = true

At runtime, the URL you pass to fetch() determines the destination:

// Reach a service behind a Cloudflare WAN IPsec on-ramp
const response = await env.PRIVATE_NETWORK.fetch("http://10.50.0.100:8080/api");

Note …

You can now receive event notifications for Artifacts repository changes and consume them from a Worker to build commit-driven automation.

This allows you to:

• Run custom workflows when a repository is created or imported
• Kick off a build and deploy a change when an agent pushes to a repo
• Trigger a review agent on every push

Available events include:

• Account-level events (artifacts source) — repo.created, repo.deleted, repo.forked, repo.imported
• Repository-level events (artifacts.repo source) — pushed, cloned, fetched

To learn more, refer to Artifacts documentation.

You can now manage Artifacts namespaces, repos, and repo-scoped tokens directly from Wrangler CLI.

Available commands:

• wrangler artifacts namespaces list — List Artifacts namespaces in your account.
• wrangler artifacts namespaces get — Get metadata for a namespace.
• wrangler artifacts repos create — Create a repo in a namespace.
• wrangler artifacts repos list — List repos in a namespace.
• wrangler artifacts repos get — Get metadata for a repo.
• wrangler artifacts repos delete — Delete a repo.
• wrangler artifacts repos issue-token — Issue a repo-scoped token for Git access.

To get started, refer to the Wrangler Artifacts commands documentation.

You can now share local dev sessions through Cloudflare Tunnel and get a public URL when using either Wrangler or the Cloudflare Vite plugin. This is useful when you need to share a preview, test a webhook, or access your app from another device.

Vite local dev tunnel demo

This lets you either:

• start a temporary Quick Tunnel with a random *.trycloudflare.com hostname, or
• use an existing named tunnel for a stable hostname and to restrict access with Cloudflare Access.

To start a tunnel, press t in Wrangler or t + Enter in Vite while your dev server is running. For details on setting up a named tunnel, refer to Share a local dev server.