docker-agent

This release adds config flavors, Mermaid state diagram direction support, and Anthropic adaptive-thinking validation, along with several bug fixes for security, token refresh, and session handling.

Breaking Changes

• Moves the file-backed SQLite session store to session/sqlitestore (refactor(session)!:)

What's New

• Adds config flavors — named YAML patches declared in an agent config and applied at load time via the --flavor flag
• Adds support for Mermaid state diagram directions
• Adds fast-fail validation when thinking_display: display is set on Anthropic adaptive-thinking models (Claude Opus/Sonnet 4.6+), surfacing the error at startup rather than at inference time
• Makes standalone SSE usage in MCP tools configurable (defaults to false)

Bug Fixes

• Fixes path injection risk in CreateSession by validating WorkingDir against permitted roots before use
• Fixes incorrect integer conversion in DMR provider by adding bounds check when narrowing int64 context size to int32
• Fixes token refresh when Docker Desktop returns an expired JWT, and prevents the refresh nudge from starving the token polling budget
• Fixes Anthropic thinking_display validation to also apply against fallback models
• Fixes decoding of remote MCP prompts instead of type-asserting
• Fixes session store recovery to not overwrite an existing backup
• Hardens error paths in the OAuth flow

Technical Changes

• Splits model discovery into an OpenAI-free dmrmodels package
• Drops full go-git dependency from gitignore matching
• Decouples pkg/runtime and pkg/agent from the MCP toolset package
• Makes the JS command evaluator pluggable to drop the goja dependency
• Removes unreachable helpers left behind by earlier refactors (including Printer.PrintError, NewSourceLoader, ToolsetMetadata, workingdir.Default, and ExtractCoords)
• Freezes config schema v13 and opens v14 as the new latest
• Replaces context.Background() with t.Context() in tests

What's Changed

• docs: update CHANGELOG.md for v1.113.0 by @docker-read-write[bot] in https://github.com/docker/docker-agent/pull/3763
• fix(codeql): go/path-injection in pkg/server/session_manager.go:542 by @ronan-thibaut-glitch in https://github.com/docker/docker-agent/pull/3758
• fix(codeql): go/incorrect-integer-conversion in pkg/model/provider/dmr/configure.go:158 by @ronan-thibaut-glitch in https://github.com/docker/docker-agent/pull/3756
• feat: support Mermaid state diagram directions by @rumpl in https://github.com/docker/docker-agent/pull/3764
• docs: update API and TUI documentation for recent feature additions by @aheritier in https://github.com/docker/docker-agent/pull/3765
• chore: remove unreachable helpers by @Sayt-0 in https://github.com/docker/docker-agent/pull/3769
• feat: config flavors — named YAML patches enabled at run time via --flavor by @dgageot in https://github.com/docker/docker-agent/pull/3768
• Make standalone SSE usage in mcp tools configurable by @krissetto in https://github.com/docker/docker-agent/pull/3770
• refactor: cut heavy transitive deps (goja, expr, openai-go, go-git, sqlite) from the code-built embedder surface by @dgageot in https://github.com/docker/docker-agent/pull/3771
• feat(anthropic): fail fast when thinking_display: display is set on adaptive-thinking models by @dgageot in https://github.com/docker/docker-agent/pull/3772
• fix(desktop): force token refresh when Docker Desktop returns an expired JWT by @dgageot in https://github.com/docker/docker-agent/pull/3773
• chore: freeze config v13 and start v14 as latest by @dgageot in https://github.com/docker/docker-agent/pull/3774

Full Changelog: https://github.com/docker/docker-agent/compare/v1.113.0...v1.114.0