Vercel Labs Release Notes

Changelog

• fix: discover skills nested under two categories (#1866)
• fix(update): normalize GitHub shorthand for project deletion checks (#1865)
• fix: preserve locked GitHub host during updates (#1837)
• Surface skills added upstream to well-known sources during update (#1824)
• Make skills update work for well-known installs (incl. skills.sh packs) (#1821)
• Preselect all skills when installing a skills.sh pack (#1820)
• Add MiniMax Code agent support (#1814)
• fix(remove): keep the lock entry while another agent still uses the skill (#1786)
• fix(find): show all registry results in non-interactive search (#1748)
• fix: store local path sources in lockfile using portable source (#1743)

Contributors

@AndreaCovelli,@IsmaelMartinez @SenseiMarv,@Ygilany @byapparov,@hetaoBackend @mlekhi,@quuu

New Features

• Added input priority and per-client delivery settings to the stream server: each WebSocket connection now splits into a reader task and a writer loop, so clicks and keystrokes dispatch to the browser without queueing behind a frame write. Adds a per-client {"type":"config","maxFps":N} cap (1 to 120, 0 uncapped) and opt-in ack pacing via {"type":"config","pacing":"ack"} with {"type":"ack","seq":N}, which keeps one frame in flight so a stalled client never drains a backlog. Both settings can also be declared on the connection URL (?pacing=ack&maxFps=10), the only way to cover the opening frame. Every frame now carries a monotonic seq (#1594)
• Added configurable stream encoding: frames were hardcoded to jpeg quality 80 at the session viewport, so frame rate was the only bandwidth lever. AGENT_BROWSER_STREAM_QUALITY, AGENT_BROWSER_STREAM_MAX_WIDTH and AGENT_BROWSER_STREAM_MAX_HEIGHT are read once per daemon and cut bytes without dropping frames: on a busy page at 1280x720, quality 20 takes a frame from 54 KB to 25 KB, and quality 20 at 640x360 takes it to 9 KB, frame rate unchanged in both. Width and height default to the session viewport, so a larger viewport is never downscaled unless both are set (#1626)

Behavior Changes …

Bug Fixes

• Multi-segment custom TLDs: --tld and PORTLESS_TLD now accept dotted DNS names such as dev.example.com, so local URLs can mirror production structure. validateTld checks per-label DNS rules and the 253-character total limit, overlapping TLDs resolve by longest match, and cert cache filenames stay under the filesystem name limit for long hostnames. (#365)
• WebSocket over HTTP/2: Proxy now advertises RFC 8441 extended CONNECT and bridges :protocol websocket streams to an HTTP/1.1 upgrade against the backend, fixing dev server HMR for browsers that negotiate h2 over ALPN. Plain-HTTP upgrades on the TLS port are proxied instead of dropped, and a backend that rejects the handshake or answers with a bad Sec-WebSocket-Accept now gets a 502 instead of a silently destroyed socket. (#363)

Contributors

• @Railly
• @KingPsychopath
• @erichurkman
• @sanjevirau

Behavior Changes

• The daemon now ships a default idle timeout of 1 hour: after an hour with no commands or dashboard input it saves configured restore state, closes the browser, and exits, so integrations that die without calling close no longer leak the daemon and its Chrome tree indefinitely. Sessions without --restore or another restore key discard transient browser state and open tabs when they shut down. Set AGENT_BROWSER_IDLE_TIMEOUT_MS=0 to restore the old always-persist behavior, or any other value to tune it. Dashboard mouse, keyboard, and touch input reset the timer. The default never closes headed browsers, including Safari and iOS WebDriver sessions, or user-attached browsers that may be in direct human use. Provider-owned cloud browsers remain eligible for cleanup, and an explicitly configured timeout applies to all browsers, as before (#1605)

Bug Fixes

• Fixed tab recovery and selection to avoid daemon hangs on Memory Saver-discarded tabs by selecting a live renderer on CDP connect, reviving tabs on switch or after close, treating dialog-blocked tabs as live, preserving refs on rejected operations, and surfacing recovery state across CLI, JSON, and MCP output (#1543)
• Fixed a11y selector errors to report invalid CSS selectors cleanly instead of exposing raw browser evaluation stack traces in text and JSON output (#1604)

Contributors

• @ctate
• @Railly
• @joelhooks
• @jadenfix

Bug Fixes

• Fixed find role to match implicit ARIA roles and browser-computed accessible names through the accessibility tree, so semantic elements like <h2> (heading) and <ul> (list) resolve, with case-insensitive substring name matching that mirrors Playwright's getByRole (#1552)
• Fixed element-not-found errors to preserve the locator detail (selector, role, name, or index) instead of flattening every miss into one generic message, and aligned the advertised find actions with the set the dispatcher actually accepts (#1553)

Contributors

• @Railly
• @cooleryu

Changelog

• test: make warning sanitization coverage Windows-safe (#1755)
• fix: honor GH_HOST for GitHub Enterprise shorthand (#1752)
• Add Grok Build agent support (#1708)
• feat: add Kimchi agent support (#1707)
• fix(update): support full-depth skill updates (#1705)
• fix: apply claude-code symlink exemption to blob install path (#1608)
• fix: clean up upstream-deleted skills whose lock key differs from folder name (#1570)
• feat: show skill origin in list output (#1450)
• fix: remove missing skills from lock files during update/uninstall (#1357)
• fix: warn instead of silently skipping malformed SKILL.md files (#1058) (#1059)
• fix(cli): exit 1 on unknown command and honour subcommand --help (#1040)

Contributors

@ADM-NKH,@IsmaelMartinez @Ygilany,@akunzai @fabio-barboza,@jaryalarshita @paymog,@quuu @yearth

New Features

• Eve extension - Added @agent-browser/eve, an Eve extension that mounts the agent-browser tool set with namespaced browser tools, sandbox bootstrap helpers, docs, examples, CI, and release packaging (#1547)

Security

• Hardened domain allowlists by blocking WebRTC bypasses, applying network containment across launch modes, workers, popups, restored state, and reused daemon sessions, rejecting unsafe startup arguments, and adding Chrome regression coverage (#1546)

Bug Fixes

• Fixed completed-page waits so load and DOMContentLoaded waits resolve immediately when the current document is already ready, with structured Eve wait timeout handling and focused coverage (#1554)

Contributors

• @ctate
• @dnukumamras

Bug Fixes

• Tailscale funnel routing: Proxy now routes requests addressed to a route's Tailscale funnel or serve hostname, so --funnel and --tailscale apps reached at <device>.ts.net no longer return a 404, including when several apps share one hostname on different ports. (#352)
• IPv6-only dev servers return 502: Proxy now dials upstreams over both loopback families, fixing 502s when a dev server binds ::1 only, such as Vite on Node 17+. (#353)
• Worktree prefix in multi-app mode: Bare portless in a monorepo worktree now applies the branch prefix in multi-app mode as it already did for single apps, so hostnames no longer collide across worktrees. (#355)

Contributors

• @Railly
• @ahfoysal

New Features

• WebGPU launch preset - Added --webgpu across the CLI, config, environment, and MCP surfaces, with hardware backends on macOS and Windows, software Vulkan on Linux, automatic Xvfb for displayless headed sessions, and a doctor --webgpu render and screenshot probe (#1529)

Improvements

• Added periodic restore-state autosaves while the browser remains open, preserving recent state after a browser window is closed by hand and capturing background page changes while honoring the restore save policy. The interval is configurable with AGENT_BROWSER_AUTOSAVE_INTERVAL_MS (#1509)

Contributors

• @ctate

Changelog

• test: allow LFS clone test time on Windows (#1628)
• test: restore CI and cover LFS-less clones (#1627)
• Update modules + simplegit fix (#1626)
• feat: add install telemetry metadata (#1625)
• fix(update): preserve non-GitHub lock source URLs (#1614)
• fix(git): block ext transport (#1611)
• fix(installer): preserve copy modes and Claude symlinks (#1598)
• docs(find-skills): remove non-existent npx skills check command (#1594)
• fix: never spawn skill updates through a shell (#1592)
• fix(detect-agent): ignore Cursor integrated terminal false positives (#1549)
• Add ZCode agent support (#1527)
• fix(update): preserve failure exit code (#1522)
• chore: upgrade @clack/prompts to v1.2.0 (#971)

Contributors

@DodoCode0,@Soykervinn @chenlinxi890-spec,@crskzn @quuu,@syf2211 @walkerdustin,@yearth