Skip to content
Agent Fleet

v0.35.0

On AWS, workspace web traffic can now leave through an optional egress gateway that records it and can enforce the allowlist. Tenant admins can distribute OAuth MCP servers, memory gets its own MCP endpoint, and Toolchains keeps JDK and Node.js patches current.

New

Section titled “New”
  • AWS: an egress gateway for workspaces (preview): with EgressRoute=gateway on 00-network, workspace HTTP and HTTPS traffic leaves through a gateway with its own Elastic IP, the Admin panel’s Egress allowlist applies to ECS workspaces, and each connection is recorded with the workspace it is matched to (other traffic is dropped). pause.sh and standup.sh stop and restore it; read the Upgrade notes first. (#2717, #2728, #2729, #2742, #2759, #2665)
  • Raw egress events are kept for 30 days (AF_EGRESS_EVENT_RETENTION_DAYS, 0 keeps them), and can be archived to S3, Google Cloud Storage or a local directory before they are purged. The archive has not yet been run on a real AWS account. (#2675, #2699, #2720, #2732, #2734)
  • Distribute OAuth MCP servers to a tenant, optionally with a client registered in advance at the server. Each member signs in from Settings; no credential is distributed. (#2479)
  • Agent Fleet memory has its own MCP endpoint, /mcp/memory, whose tokens and claude.ai connectors reach only the memory tools. Memory tools called from outside can pick the project by repository URL. (#2764, #2765, #2766)
  • Merge a GitHub pull request from its work item, when GitHub says it can be merged, after a confirmation. (#2632)
  • Report back on Bitbucket pull requests when the Bitbucket connection holds the pullrequest:write scope. (#2709)
  • Uninstall JDK and Node.js versions you no longer need from Settings › Toolchains › Installed versions. (#2648)

Improved

Section titled “Improved”
  • Toolchains shows the exact JDK and Node.js patch in use, offers the newest patch, and names the version Install will fetch. JAVA_HOME picks the newer patch when the image and your home have the same major, and superseded Node.js patches Agent Fleet installed are removed at the next workspace start. (#2624, #2625, #2646, #2647)
  • MCP tokens moved to Settings › Outside access › MCP tokens & apps, which warns that a token given to a session reaches all your sessions within its scope; the sessions’ tab is now MCP servers (used by sessions). This deployment’s own /mcp can no longer be registered there. (#2680, #2696, #2677)
  • Managed sessions get $AF_WORK_DIR and $AF_SESSION_NAME, as Terminal sessions already did (opencode needs version 2 on Agent Fleet’s shared server). (#2431, #2710, #2715)
  • opencode 2 Terminal sessions on Agent Fleet’s shared server can branch from a past message, and opencode’s to-do list shows as the session’s ToDo. (#2493)
  • The memory browser pages back through all changes and forgotten memories, and a search with several words shows the memories that hold all of them, or marks partial matches when none do. (#2486)
  • Moving a session to copilot or Antigravity shows their remaining quota in the move dialog. (#2492)
  • Claude login expiry is shown in the repository launch dialog too, and a first prompt that could not be sent because the login expired says so with a Re-authenticate button. (#2494)
  • ECS: 30-ingress can set the idle timers, the GitHub sign-in extras and LAN image or LLM engines that the guide lists as configurable. (#2596)
  • Docker: the workspace listener (AF_CP_INTERNAL_URL) is supported, for hosts whose public front end does not accept connections from the Docker bridges. (#2776)

Fixed

Section titled “Fixed”
  • A peer message to a stopped claude session could be lost on resume while reported as delivered. A send to a claude that is still starting is now held until it can take input. (#2741)
  • Stop on a Terminal session could fail to interrupt opencode, cursor and copilot. Each now gets its own stop key. (#2491)
  • Every claude session ran two af MCP servers after an upgrade from an old version. (#2678)
  • Error messages, including the MCP connection test’s, were in Japanese whatever the display language. (#2483, #2721)
  • ECS-EC2: Stop (force) could leave the slot’s network interface attached. It is now released first. (#2524)
  • The Admin panel’s member detail stalled while the size of a home was measured. (#2425)
  • Egress observations were lost when the report to the Control Plane failed. (#2603)
  • The development OIDC IdP refused sign-in callbacks on a port only the owner had opened, although the preview hint said they worked. (#2500)
  • Kubernetes: AWS tools in a workspace looked up the node’s instance metadata, and the home-nearly-full notice was missing. Those lookups are now disabled by default; set AF_WS_WORKLOAD_AWS=1 if a workspace relies on the node’s AWS role. (#2498)
  • Smaller fixes: MCP sign-in (a stale pending marker, a doubled failure message, an unexplained refusal of an untrusted client host, comma-separated scopes), “Suggest memories now” could end silently, a memory import above the Control Plane’s limit, the inbox composer attached only one session, a skipped toolchain upgrade read as a failed install, and some inconsistent labels. (#2586, #2689, #2695, #2690, #2584, #2487, #2489, #2499, #2502, #2484, #2505)

Upgrade notes

Section titled “Upgrade notes”
  • Memory tools called through /mcp: memory_save and memory_forget now need scope, and scope: project needs project or repository. A client that relied on the default is refused with a message naming what to pass. (#2765)
  • AWS (ECS): the network stack is updated by hand, around update.sh. Workspaces move to subnets of their own and the S3 endpoint gets a policy, so follow “Upgrading from v0.34.x” in deploy/aws/ecs/README.md: back up, deploy 00-network with S3EndpointEnabled=false through a change set (it adds six resources and removes S3Endpoint), run update.sh, stop and start every running workspace, then deploy 00-network with S3EndpointEnabled=true. The network stack now needs --capabilities CAPABILITY_IAM. (#2716, #2763)
  • Do not deploy the new 00-network with its defaults. S3EndpointEnabled defaults to true, and the endpoint then refuses (AccessDenied) the S3 requests of every workspace that has not been restarted yet. update.sh lists the workspaces still in the old subnets. (#2763)
  • AWS: the S3 endpoint’s new policy applies to everything in the private subnets, not just workspaces. The Control Plane, the ecs-ec2 slot hosts and the engines get AccessDenied (there is no NAT fallback) for any same-region S3 request through the endpoint that the policy does not allow. The allowed buckets are the ECR layer bucket, the AL2023 repositories, the SSM Agent update and ECS agent download buckets, the 60-engines models bucket and the optional egress archive bucket that 10-data creates (a bucket of your own is refused). If the Control Plane uses other buckets, the template has no parameter to add one: set S3EndpointEnabled=false (S3 then goes through the NAT and pays its data processing), or keep the endpoint and maintain a customized S3Endpoint policy in deploy/aws/ecs/cfn/00-network.yaml. (#2716)
  • AWS: Fargate workspace starts now pay NAT data processing for the image pull, because workspace subnets have no S3 endpoint. ecs-ec2 slots still pull through the endpoint. (#2716)
  • AWS: rolling 00-network back to v0.34.x’s template drops the GatewayEipAllocationId and GatewayEipAddress parameters, so the next switch to EgressRoute=gateway must pass both again (README “Upgrading from v0.34.x”, Rollback). (#2728)
  • AWS: to empty a parameter of a live stack, use deploy/aws/ecs/clear-params.sh, not aws cloudformation deploy --parameter-overrides Key=, which did not clear it in a rehearsal. See the README. (#2763)
  • AWS: the deploying principal needs more permissions for the new optional pieces: Elastic IP association, launch templates, Auto Scaling groups, an instance role and a Secrets Manager secret for the egress gateway, ssm:SendCommand and ssm:GetCommandInvocation for pause.sh and standup.sh to check it, and S3 bucket creation for the egress archive. See “Minimal IAM” in deploy/aws/ecs/README.md.
  • AWS: the egress gateway is opt-in and a preview. 00-network’s EgressRoute stays nat-gateway unless you set gateway, which records every workspace connection and can enforce an allowlist. The gateway, its relay, the workspace subnets, pause/standup and this upgrade path were verified on a test deployment only, not yet in production. It gives workspaces a second egress address to allow-list, drops non-HTTP egress such as SSH git, and relays intercepted port 443 inside the gateway (an accepted exception to its design). (#2717, #2759)
  • AWS: the egress event archive is off by default. 10-data has two new optional parameters, EgressArchive and EgressArchiveRetentionDays; nothing changes until you deploy it with EgressArchive=create and run update.sh. (#2732)

Agent CLI pins: Claude Code 2.1.310, Codex 0.164.0, Antigravity 1.4.7, OpenCode 2.1.4 and Muse Code 1.4.13-R6996.1; rtk 1.1.0.