Vercel Labs Release Notes

New Features

• Turbo JSONC workspaces: Workspaces that only have turbo.jsonc now use Turbo orchestration, the same as turbo.json. (#422)
• Unresolved hostname warning: After registering a route, portless asks the proxy to sync the hosts file and warns when the hostname still does not resolve. (#374)
• WebMCP documentation site: The docs moved to Geistdocs and expose their pages to agents through WebMCP. (#427)

Bug Fixes

• Hosts sync data loss: Manual hosts sync refuses to write when the hosts file cannot be read, verifies what it wrote, and removes stale managed entries when no routes remain. (#424)
• Local CA certificate: The generated CA no longer carries a duplicate Basic Constraints extension on OpenSSL 1.1.1 and LibreSSL, which macOS and OpenSSL 3 rejected and left *.localhost untrusted. (#443)
• Proxy crash on backend restart: The proxy no longer forwards client hop-by-hop headers, which left backend sockets open and crashed the proxy with ECONNRESET when a backend restarted. (#445)
• Wildcard fallback order: With --wildcard, an unregistered subdomain now routes to the most specific registered parent instead of the first one stored. (#446)
• Occupied app ports: Free app ports are checked on 127.0.0.1, ::1, 0.0.0.0 and ::, so portless no longer assigns a port another server already holds. (#447) …

Bug Fixes

• Fixed auth vault login to pick usable controls when hidden duplicates exist, and to bind credential entry to the selected field so replaced fields or redirected focus are rejected before submitting (#2014)
• Fixed chat mode to allow webmcp, skills, and other top-level browser commands, so the model uses page WebMCP tools instead of falling back to eval (#2015)
• Fixed Kernel profiles so KERNEL_PROFILE_NAME sessions send the profile as an object instead of failing with a 400, and added KERNEL_PROFILE_SAVE_CHANGES to opt into saving changes back (#2004)
• Fixed Chrome freezing after launch by draining its stderr for the browser's lifetime, so a full log pipe no longer blocks the browser (#2003)
• Fixed Browser Use by switching to Cloud V4, which creates, attaches to, and stops the same browser with bounded timeouts (#1879)
• Fixed Vercel Sandbox shared memory detection by measuring /dev/shm capacity and adding --disable-dev-shm-usage below 256 MiB, so Chrome no longer terminates renderers on the undersized mount (#1890)

Improvements

• Upgraded the eve integration from eve 0.47.3 to 0.57.0, so apps on eve 0.50 and later build again (#1945)

Documentation

• Updated the contact sheet example with the loading-flash demo output (#1871)

Contributors

• @Railly
• @benjamincanac
• @boatri
• @luxleader
• @petehunt
• @robertjamesprior
• @simonellefsen
• @zyz619963502zyz

New Features

• TanStack Start renderer: Added @json-render/tanstack-start for JSON-defined applications with file-based routes, reusable layouts, SSR loaders, head metadata, prerender paths, client navigation, and route fallbacks (#334)
• Experimental Jev composition: Added experimental_composeSpec and experimental_createEvaluator to compose validated specs from app-owned candidates, plus a Jev model option and iterative composition editing in the playground

Improvements

• Vue named slots: Vue registries now support catalog-declared named slots alongside the default children slot (#323)
• React streaming stability: Stabilized streamed React renders and added coverage for incomplete streamed props and nested prop identities (#325)
• Documentation and project status: Expanded renderer, Jev, and package documentation and added Labs status badges to the project README

Contributors

• @ctate
• @Railly

New Features

• Added conditional screenshots with screenshot --if-changed to skip unchanged captures and --threshold <0-1> to tolerate small pixel differences. Screenshot history is scoped to each tab and capture mode, and unchanged captures omit the image path to save tokens (#1813)
• Added automatic snapshot deltas with snapshot --delta, which returns a full baseline followed by an unchanged revision or compact structural changes. Use --full to refresh the baseline (#1811)
• Added persistent snapshot refs for surviving DOM elements across same-document changes. Replaced elements and navigated pages or iframes invalidate their refs without recycling identifiers (#1812)
• Added human-like pointer movement with session --input-mode, per-action --human for clicks and drags, and reproducible curved mouse move paths (#1810)
• Added recording presentation tools: --cursor renders an animated pointer and click ripple, while --contact-sheet saves a timestamped PNG summary of visual changes (#1807, #1808)
• Added stateful auth vault login with auth login --no-navigate, which fills an already prepared login page after verifying its origin against the credential URL (#1771)
• Added WebMCP catalog updates to normal browser responses. Concise, content-bounded summaries appear on initial discovery and catalog changes, while full schemas remain opt-in (#1842)

Improvements …

New Features

• Added higher-quality video recording: record start and record restart now capture the current active page at 30 fps by default, support --fps 1-60, use Page.startScreencast for smoother motion, and preserve wall-clock timing. WebM and MP4 output are documented, and doctor reports the ffmpeg recording dependencies (#1763, #1776, #1778)
• Added WebMCP availability output so navigation responses advertise when a page exposes allowed WebMCP tools, including availability metadata for CLI, JSON, and MCP clients (#1760)
• Added session setup inheritance for new tabs. Tabs opened with tab new or through page clicks now inherit the active session's headers, credentials, user agent, locale, timezone, geolocation, offline mode, routes, color scheme, and init scripts before their first navigation (#1777)

Bug Fixes

• Fixed recording startup validation so missing ffmpeg, extensionless output paths, and invalid recording options fail before browser or recording state changes. Failed replacements preserve the active take, and ffmpeg errors now include useful diagnostics (#1778)
• Fixed recording navigation state so URL navigation during recording clears stale element refs, frame scope, and page WebMCP state like normal navigation (#1776)

Contributors

• @jamesvclements
• @ctate
• @Railly

New Features

• Added experimental WebMCP support for discovering and invoking tools provided by the current page, including frame-aware tool selection, detached results, cancellation, bounded metadata and output handling, and an opt-in MCP tool profile. WebMCP is enabled by default for locally managed Chrome and can be disabled with --no-webmcp or AGENT_BROWSER_NO_WEBMCP.
• Added a WebMCP generation skill that helps agents expose existing page workflows as validated page tools while recording safety constraints, deterministic checks, and fallback behavior.

Improvements

• Updated the eve integration to 0.47.3 and raised its compatibility floor to 0.39.1.
• Updated brace-expansion dependency resolutions across the project lockfiles.

Bug Fixes

• Removed the obsolete Lightpanda session timeout argument so launches use the current supported server options.

Contributors

• @ctate
• @Railly
• @anupamme
• @arrufat

Security

• Hardened dashboard origin validation and reverse-proxy access with same-origin provenance enforcement that defends against DNS rebinding, form/header smuggling, and cross-origin requests. Reverse-proxied origins now require exact HTTPS allowlisting and generated token authentication, while tokenless IPv4 and IPv6 loopback access remains supported. Dashboard options are validated strictly, and CLI and MCP lifecycle behavior is aligned (#1738)

Bug Fixes

• Fixed root remote CDP WebSocket URLs with query strings to insert the required slash before the query while preserving the encoded query (#1735)

Contributors

• @ctate
• @Railly

Bug Fixes

• Fixed Windows ARM64 launcher selection to prefer a native ARM64 executable when present and fall back to the published x64 executable through Windows emulation when it is not (#1725)
• Fixed stream URL tracking to emit active main-frame URL updates for full-document, History API, and fragment navigation, while rebinding correctly after active-tab changes and ignoring child-frame or background-tab navigation (#1682)
• Fixed snapshot diff element references by resetting ref numbering for each diff, invalidating refs across URL navigations, and preserving the previous refs when a diff fails (#1719)

Improvements

• Updated Rust dependencies to rustls-webpki 0.103.13 and quinn-proto 0.11.17 (#1723, #1720)

Contributors

• @ctate
• @Railly
• @Angelmmiguel
• @anupamme
• @nexxusbruno-ship-it

New Features

• Added private proxy CA trust for locally launched Chromium on Linux. Use --ca-cert <path>, AGENT_BROWSER_CA_CERT, or caCert in config and MCP to import a PEM bundle or DER certificate into an isolated NSS trust store without disabling hostname, validity, or unrelated-authority verification. The effective CA persists across commands in a running session, equivalent certificate content reuses Chromium, and --no-ca-cert explicitly clears retained trust. Unsupported launch modes and conflicting CA options return actionable errors (#1669)

Improvements

• Added a bundled protected Vercel deployments skill that guides agents through short-lived Trusted Sources OIDC authentication, authorized automation bypasses, and explicit human handoffs for dashboard-only configuration (#1705)

Contributors

• @Railly
• @ctate
• @bilby91

New Features

• Agent-readable documentation: The documentation site now exposes clean Markdown pages and an llms.txt index so agents can discover and consume the docs directly. (#387)

Bug Fixes

• Framework flags through package scripts: Frameworks that ignore PORT now receive the assigned --port and --host flags when launched through supported package-manager scripts, while non-server and unsafe scripts are left untouched. (#366)
• Windows service lifetime: The Windows startup service now registers a UTF-16 Task Scheduler definition with no execution time limit and replaces existing tasks atomically. (#381)
• Ctrl+C process cleanup: Interrupt handling now waits for the command's process tree to exit and terminates remaining descendants after a short grace period. (#385)

Contributors

• @Railly
• @EfeDurmaz16
• @JohnPhamous

New Features

• Named slots for React: Components can declare named slots such as header and footer, while children remains the default slot. Slots are preserved through validation, streaming, nested conversion, code export, playground views, and Devtools navigation (#320). Built from the original contribution by @wotnak in #105
• Nested repeats: repeat.statePath now accepts item-relative paths such as { "$item": "employees" }, enabling nested data rendering across React, React Native, React Email, React PDF, Image, Ink, Solid, Svelte, and Vue (#319). Built from the original contribution by @tmchow in #256
• Harness chat example: Added a complete Next.js example using the AI SDK 7 harness adapter, agent delegation, sandbox transport, and json-render components (#302)

Bug Fixes

• Chained action params: Named onSuccess and onError actions now receive their configured params across core and all renderer bridges (#307)
• Consistent optional visibility: Element visible fields now remain optional across Zod 4 versions, while prompts explicitly require children arrays for every element (#299)
• Spec validation and autofix: Dangling child references are pruned, malformed visibility conditions are reported, and repeated items can be filtered safely (#300)

Improvements …

Changelog

• Add Select All control to skill picker (#1999)
• fix: fail scoped well-known installs instead of falling back to the root index (#1990)
• fix: refuse remove --all when specific skills are named (#1964)
• fix: don't delete a skill from the same repo pinned to a different ref (#1953)
• fix: bypass blob snapshots for explicit refs (#1934)
• Fix internal skill filtering for well-known sources (#1921)
• fix: exclude internal skills from --skill '*' wildcard (#1909)
• feat: add Posit Assistant agent support (#1885)
• fix: remove obsolete OpenClaw use warning (#1858)
• fix: secure private repository authentication (#1857)

Contributors

@GeorgijGrigoriev,@Osamaali313 @Patrick-Erichsen,@dylanpulver @fenfenxu,@hcjmartin @initred,@quuu @statik

New Features

• Added persistent session-to-tab binding for shared Chrome sessions. Named sessions connected through --cdp or --auto-connect now remember their CDP target across commands and daemon restarts, and CDP target ids can be used directly as tab references. Start each session with --pin-tab to make the binding strict, so a tab closed externally returns a stable tab_gone error instead of silently adopting a neighboring tab. JSON output includes data.targetId and an optional sanitized data.lastUrl; batch exposes the same recovery data under result (#1589)

Improvements

• Added a Remote Agent Browser provider guide covering Vercel authentication, disposable and stable sessions, custom VCR images, snapshots, and live-view URLs (#1648)

Bug Fixes

• Fixed parallel sessions sharing one Chrome hijacking each other's tabs. Event-discovered targets no longer steal a pinned session's active tab, re-attach restores the persisted target instead of selecting index 0, and preliminary plus existing-daemon --cdp and --auto-connect paths preserve explicit pin enable and disable. Agent skill guidance now requires a named --session before the first command (#1589) …