@mastra/core 1.9.0-alpha.0 → 1.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -1,5 +1,367 @@
1
1
  # @mastra/core
2
2
 
3
+ ## 1.9.0
4
+
5
+ ### Minor Changes
6
+
7
+ - Added `onStepFinish` and `onError` callbacks to `NetworkOptions`, allowing per-LLM-step progress monitoring and custom error handling during network execution. Closes #13362. ([#13370](https://github.com/mastra-ai/mastra/pull/13370))
8
+
9
+ **Before:** No way to observe per-step progress or handle errors during network execution.
10
+
11
+ ```typescript
12
+ const stream = await agent.network('Research AI trends', {
13
+ memory: { thread: 'my-thread', resource: 'my-resource' },
14
+ });
15
+ ```
16
+
17
+ **After:** `onStepFinish` and `onError` are now available in `NetworkOptions`.
18
+
19
+ ```typescript
20
+ const stream = await agent.network('Research AI trends', {
21
+ onStepFinish: event => {
22
+ console.log('Step completed:', event.finishReason, event.usage);
23
+ },
24
+ onError: ({ error }) => {
25
+ console.error('Network error:', error);
26
+ },
27
+ memory: { thread: 'my-thread', resource: 'my-resource' },
28
+ });
29
+ ```
30
+
31
+ - Add workflow execution path tracking and optimize execution logs ([#11755](https://github.com/mastra-ai/mastra/pull/11755))
32
+
33
+ Workflow results now include a `stepExecutionPath` array showing the IDs of each step that executed during a workflow run. You can use this to understand exactly which path your workflow took.
34
+
35
+ ```ts
36
+ // Before: no execution path in results
37
+ const result = await workflow.execute({ triggerData });
38
+ // result.stepExecutionPath → undefined
39
+
40
+ // After: stepExecutionPath is available in workflow results
41
+ const result = await workflow.execute({ triggerData });
42
+ console.log(result.stepExecutionPath);
43
+ // → ['step1', 'step2', 'step4'] — the actual steps that ran
44
+ ```
45
+
46
+ `stepExecutionPath` is available in:
47
+ - **Workflow results** (`WorkflowResult.stepExecutionPath`) — see which steps ran after execution completes
48
+ - **Execution context** (`ExecutionContext.stepExecutionPath`) — access the path mid-execution inside your steps
49
+ - **Resume and restart operations** — execution path persists across suspend/resume and restart cycles
50
+
51
+ Workflow execution logs are now more compact and easier to read. Step outputs are no longer duplicated as the next step's input, reducing the size of execution results while maintaining full visibility.
52
+
53
+ **Key improvements:**
54
+ - Track which steps executed in your workflows with `stepExecutionPath`
55
+ - Smaller, more readable execution logs with automatic duplicate payload removal
56
+ - Execution path preserved when resuming or restarting workflows
57
+
58
+ This is particularly beneficial for AI agents and LLM-based workflows where reducing context size improves performance and cost efficiency.
59
+
60
+ Related: `#8951`
61
+
62
+ - Added authentication interfaces and Enterprise Edition RBAC support. ([#13163](https://github.com/mastra-ai/mastra/pull/13163))
63
+
64
+ **New `@mastra/core/auth` export** with pluggable interfaces for building auth providers:
65
+ - `IUserProvider` — user lookup and management
66
+ - `ISessionProvider` — session creation, validation, and cookie handling
67
+ - `ISSOProvider` — SSO login and callback flows
68
+ - `ICredentialsProvider` — username/password authentication
69
+
70
+ **Default implementations** included out of the box:
71
+ - Cookie-based session provider with configurable TTL and secure defaults
72
+ - In-memory session provider for development and testing
73
+
74
+ **Enterprise Edition (`@mastra/core/auth/ee`)** adds RBAC, ACL, and license validation:
75
+
76
+ ```ts
77
+ import { buildCapabilities } from '@mastra/core/auth/ee';
78
+
79
+ const capabilities = buildCapabilities({
80
+ rbac: myRBACProvider,
81
+ acl: myACLProvider,
82
+ });
83
+ ```
84
+
85
+ Built-in role definitions (owner, admin, editor, viewer) and a static RBAC provider are included for quick setup. Enterprise features require a valid license key via the `MASTRA_EE_LICENSE` environment variable.
86
+
87
+ - Workspace sandbox tool results (`execute_command`, `kill_process`, `get_process_output`) sent to the model now strip ANSI color codes via `toModelOutput`, while streamed output to the user keeps colors. This reduces token usage and improves model readability. ([#13440](https://github.com/mastra-ai/mastra/pull/13440))
88
+
89
+ Workspace `execute_command` tool now extracts trailing `| tail -N` pipes from commands so output streams live to the user, while the final result sent to the model is still truncated to the last N lines.
90
+
91
+ Workspace tools that return potentially large output now enforce a token-based output limit (~3k tokens by default) using tiktoken for accurate counting. The limit is configurable per-tool via `maxOutputTokens` in `WorkspaceToolConfig`. Each tool uses a truncation strategy suited to its output:
92
+ - `read_file`, `grep`, `list_files` — truncate from the end (keep imports, first matches, top-level tree)
93
+ - `execute_command`, `get_process_output`, `kill_process` — head+tail sandwich (keep early output + final status)
94
+
95
+ ```ts
96
+ const workspace = new Workspace({
97
+ tools: {
98
+ mastra_workspace_execute_command: {
99
+ maxOutputTokens: 5000, // override default 3k
100
+ },
101
+ },
102
+ });
103
+ ```
104
+
105
+ - Workspace tools (list_files, grep) now automatically respect .gitignore, filtering out directories like node_modules and dist from results. Explicitly targeting an ignored path still works. Also lowered the default tree depth from 3 to 2 to reduce token usage. ([#13724](https://github.com/mastra-ai/mastra/pull/13724))
106
+
107
+ - Added `maxSteps` and `stopWhen` support to `HarnessSubagent`. ([#13653](https://github.com/mastra-ai/mastra/pull/13653))
108
+
109
+ You can now define `maxSteps` and `stopWhen` on a harness subagent so spawned subagents can use custom loop limits instead of relying only on the default `maxSteps: 50` fallback.
110
+
111
+ ```ts
112
+ const harness = new Harness({
113
+ id: 'dev-harness',
114
+ modes: [{ id: 'build', default: true, agent: buildAgent }],
115
+ subagents: [
116
+ {
117
+ id: 'explore',
118
+ name: 'Explore',
119
+ description: 'Inspect the codebase',
120
+ instructions: 'Investigate and summarize findings.',
121
+ defaultModelId: 'openai/gpt-4o',
122
+ maxSteps: 7,
123
+ stopWhen: ({ steps }) => steps.length >= 3,
124
+ },
125
+ ],
126
+ });
127
+ ```
128
+
129
+ - Added OpenAI WebSocket transport for streaming responses with auto-close and manual transport access ([#13531](https://github.com/mastra-ai/mastra/pull/13531))
130
+
131
+ - Added `name` property to `WorkspaceToolConfig` for remapping workspace tool names. Tools can now be exposed under custom names to the LLM while keeping the original constant as the config key. ([#13687](https://github.com/mastra-ai/mastra/pull/13687))
132
+
133
+ ```typescript
134
+ const workspace = new Workspace({
135
+ filesystem: new LocalFilesystem({ basePath: './project' }),
136
+ tools: {
137
+ mastra_workspace_read_file: { name: 'view' },
138
+ mastra_workspace_grep: { name: 'search_content' },
139
+ mastra_workspace_edit_file: { name: 'string_replace_lsp' },
140
+ },
141
+ });
142
+ ```
143
+
144
+ Also removed hardcoded tool-name cross-references from edit-file and ast-edit tool descriptions, since tools can be renamed or disabled.
145
+
146
+ - Adds requestContext passthrough to Harness runtime APIs. ([#13650](https://github.com/mastra-ai/mastra/pull/13650))
147
+
148
+ **Added**
149
+ You can now pass `requestContext` to Harness runtime methods so tools and subagents receive request-scoped values.
150
+
151
+ - Added `binaryOverrides`, `searchPaths`, and `packageRunner` options to `LSPConfig` to support flexible language server binary resolution. ([#13677](https://github.com/mastra-ai/mastra/pull/13677))
152
+
153
+ Previously, workspace LSP diagnostics only worked when language server binaries were installed in the project's `node_modules/.bin/`. There was no way to use globally installed binaries or point to a custom install.
154
+
155
+ **New `LSPConfig` fields:**
156
+ - `binaryOverrides`: Override the binary command for a specific server, bypassing the default lookup. Useful when the binary is installed in a non-standard location.
157
+ - `searchPaths`: Additional directories to search when resolving Node.js modules (e.g. `typescript/lib/tsserver.js`). Each entry should be a directory whose `node_modules` contains the required packages.
158
+ - `packageRunner`: Package runner to use as a last-resort fallback when no binary is found (e.g. `'npx --yes'`, `'pnpm dlx'`, `'bunx'`). Off by default — package runners can hang in monorepos with workspace links.
159
+
160
+ Binary resolution order per server: explicit `binaryOverrides` override → project `node_modules/.bin/` → `process.cwd()` `node_modules/.bin/` → `searchPaths` `node_modules/.bin/` → global PATH → `packageRunner` fallback.
161
+
162
+ ```ts
163
+ const workspace = new Workspace({
164
+ lsp: {
165
+ // Point to a globally installed binary
166
+ binaryOverrides: {
167
+ typescript: '/usr/local/bin/typescript-language-server --stdio',
168
+ },
169
+ // Resolve typescript/lib/tsserver.js from a tool's own node_modules
170
+ searchPaths: ['/path/to/my-tool'],
171
+ // Use a package runner as last resort (off by default)
172
+ packageRunner: 'npx --yes',
173
+ },
174
+ });
175
+ ```
176
+
177
+ Also exported `buildServerDefs(config?)` for building config-aware server definitions, and `LSPConfig` / `LSPServerDef` types from `@mastra/core/workspace`.
178
+
179
+ - Added a unified observability type system with interfaces for structured logging, metrics (counters, gauges, histograms), scores, and feedback alongside the existing tracing infrastructure. ([#13058](https://github.com/mastra-ai/mastra/pull/13058))
180
+
181
+ **Why?** Previously, only tracing flowed through execution contexts. Logging was ad-hoc and metrics did not exist. This change establishes the type system and context plumbing so that when concrete implementations land, logging and metrics will flow through execute callbacks automatically — no migration needed.
182
+
183
+ **What changed:**
184
+ - New `ObservabilityContext` interface combining tracing, logging, and metrics contexts
185
+ - New type definitions for `LoggerContext`, `MetricsContext`, `ScoreInput`, `FeedbackInput`, and `ObservabilityEventBus`
186
+ - `createObservabilityContext()` factory and `resolveObservabilityContext()` resolver with no-op defaults for graceful degradation
187
+ - Future logging and metrics signals will propagate automatically through execution contexts — no migration needed
188
+ - Added `loggerVNext` and `metrics` getters to the `Mastra` class
189
+
190
+ - Added `setServer()` public method to the Mastra class, enabling post-construction configuration of server settings. This allows platform tooling to inject server defaults (e.g. auth) into user-created Mastra instances at deploy time. ([#13729](https://github.com/mastra-ai/mastra/pull/13729))
191
+
192
+ ```typescript
193
+ const mastra = new Mastra({ agents: { myAgent } });
194
+
195
+ // Platform tooling can inject server config after construction
196
+ mastra.setServer({ ...mastra.getServer(), auth: new MastraAuthWorkos() });
197
+ ```
198
+
199
+ - **Added** local symlink mounts in `LocalSandbox` so sandboxed commands can access locally-mounted filesystem paths. ([#13474](https://github.com/mastra-ai/mastra/pull/13474))
200
+ **Improved** mounted paths so commands resolve consistently in local sandboxes.
201
+ **Improved** workspace instructions so developers can quickly find mounted data paths.
202
+
203
+ **Why:** Local sandboxes can now run commands against locally-mounted data without manual path workarounds.
204
+
205
+ **Usage example:**
206
+
207
+ ```typescript
208
+ const workspace = new Workspace({
209
+ mounts: {
210
+ '/data': new LocalFilesystem({ basePath: '/path/to/data' }),
211
+ },
212
+ sandbox: new LocalSandbox({ workingDirectory: './workspace' }),
213
+ });
214
+
215
+ await workspace.init();
216
+ // Sandboxed commands can access the mount path via symlink
217
+ await workspace.sandbox.executeCommand('ls data');
218
+ ```
219
+
220
+ - Abort signal and background process callbacks ([#13597](https://github.com/mastra-ai/mastra/pull/13597))
221
+ - Sandbox commands and spawned processes can now be cancelled via `abortSignal` in command options
222
+ - Background processes spawned via `execute_command` now support `onStdout`, `onStderr`, and `onExit` callbacks for streaming output and exit notifications
223
+ - New `backgroundProcesses` config in workspace tool options for wiring up background process callbacks
224
+
225
+ ### Patch Changes
226
+
227
+ - Added `supportsConcurrentUpdates()` method to `WorkflowsStorage` base class and abstract `updateWorkflowResults`/`updateWorkflowState` methods for atomic workflow state updates. The evented workflow engine now checks `supportsConcurrentUpdates()` and throws a clear error if the storage backend does not support concurrent updates. ([#12575](https://github.com/mastra-ai/mastra/pull/12575))
228
+
229
+ - Update provider registry and model documentation with latest models and providers ([`edee4b3`](https://github.com/mastra-ai/mastra/commit/edee4b37dff0af515fc7cc0e8d71ee39e6a762f0))
230
+
231
+ - Fixed sandbox command execution crashing the parent process on some Node.js versions by explicitly setting stdio to pipe for detached child processes. ([#13697](https://github.com/mastra-ai/mastra/pull/13697))
232
+
233
+ - Fixed an issue where generating a response in an empty thread (system-only messages) would throw an error. Providers that support system-only prompts like Anthropic and OpenAI now work as expected. A warning is logged for providers that require at least one user message (e.g. Gemini). Fixes #13045. ([#13164](https://github.com/mastra-ai/mastra/pull/13164))
234
+
235
+ - Sanitize invalid tool names in agent history so Bedrock retries continue instead of failing request validation. ([#13633](https://github.com/mastra-ai/mastra/pull/13633))
236
+
237
+ - Fixed path matching for auto-indexing and skills discovery. ([#13511](https://github.com/mastra-ai/mastra/pull/13511))
238
+ Single file paths, directory globs, and `SKILL.md` file globs now resolve consistently.
239
+ Trailing slashes are now handled correctly.
240
+
241
+ - `Harness.cloneThread()` now resolves dynamic memory factories before cloning, fixing "cloneThread is not a function" errors when memory is provided as a factory function. `HarnessConfig.memory` type widened to `DynamicArgument<MastraMemory>`. ([#13569](https://github.com/mastra-ai/mastra/pull/13569))
242
+
243
+ - Fixed workspace tools being callable by their old default names (e.g. mastra_workspace_edit_file) when renamed via tools config. The tool's internal id is now updated to match the remapped name, preventing fallback resolution from bypassing the rename. ([#13694](https://github.com/mastra-ai/mastra/pull/13694))
244
+
245
+ - Reduced default max output tokens from 3000 to 2000 for all workspace tools. List files tool uses a 1000 token limit. Suppressed "No errors or warnings" LSP diagnostic message when there are no issues. ([#13730](https://github.com/mastra-ai/mastra/pull/13730))
246
+
247
+ - Add first-class custom provider support for MastraCode model selection and routing. ([#13682](https://github.com/mastra-ai/mastra/pull/13682))
248
+ - Add `/custom-providers` command to create, edit, and delete custom OpenAI-compatible providers and manage model IDs under each provider.
249
+ - Persist custom providers and model IDs in `settings.json` with schema parsing/validation updates.
250
+ - Extend Harness model catalog listing with `customModelCatalogProvider` so custom models appear in existing selectors (`/models`, `/subagents`).
251
+ - Route configured custom provider model IDs through `ModelRouterLanguageModel` using provider-specific URL and optional API key settings.
252
+
253
+ - **`sendMessage` now accepts `files` instead of `images`**, supporting any file type with optional `filename`. ([#13574](https://github.com/mastra-ai/mastra/pull/13574))
254
+
255
+ **Breaking change:** Rename `images` to `files` when calling `harness.sendMessage()`:
256
+
257
+ ```ts
258
+ // Before
259
+ await harness.sendMessage({
260
+ content: 'Analyze this',
261
+ images: [{ data: base64Data, mimeType: 'image/png' }],
262
+ });
263
+
264
+ // After
265
+ await harness.sendMessage({
266
+ content: 'Analyze this',
267
+ files: [{ data: base64Data, mediaType: 'image/png', filename: 'screenshot.png' }],
268
+ });
269
+ ```
270
+
271
+ - `files` accepts `{ data, mediaType, filename? }` — filenames are now preserved through storage and message history
272
+ - Text-based files (`text/*`, `application/json`) are automatically decoded to readable text content instead of being sent as binary, which models could not process
273
+ - `HarnessMessageContent` now includes a `file` type, so file parts round-trip correctly through message history
274
+
275
+ - Fixed Agent Network routing failures for users running Claude models through AWS Bedrock by removing trailing whitespace from the routing assistant message. ([#13624](https://github.com/mastra-ai/mastra/pull/13624))
276
+
277
+ - Fixed thread title generation when user messages include file parts (for example, images). ([#13671](https://github.com/mastra-ai/mastra/pull/13671))
278
+ Titles now generate reliably instead of becoming empty.
279
+
280
+ - Fixed parallel workflow tool calls so each call runs independently. ([#13478](https://github.com/mastra-ai/mastra/pull/13478))
281
+
282
+ When an agent starts multiple tool calls to the same workflow at the same time, each call now runs with its own workflow run context. This prevents duplicated results across parallel calls and ensures each call returns output for its own input. Also ensures workflow tool suspension and manual resumption correctly preserves the run context.
283
+
284
+ - Fixed sub-agent instructions being overridden when the parent agent uses an OpenAI model. Previously, OpenAI models would fill in the optional `instructions` parameter when calling a sub-agent tool, completely replacing the sub-agent's own instructions. Now, any LLM-provided instructions are appended to the sub-agent's configured instructions instead of replacing them. ([#13578](https://github.com/mastra-ai/mastra/pull/13578))
285
+
286
+ - Tool lifecycle hooks (`onInputStart`, `onInputDelta`, `onInputAvailable`, `onOutput`) now fire correctly during agent execution for tools created via `createTool()`. Previously these hooks were silently ignored. Affected: `createTool`, `Tool`, `CoreToolBuilder.build`, `CoreTool`. ([#13708](https://github.com/mastra-ai/mastra/pull/13708))
287
+
288
+ - Fixed an issue where sub-agent messages inside a workflow tool would corrupt the parent agent's memory context. When an agent calls a workflow as a tool and the workflow runs sub-agents with their own memory threads, the parent's thread identity on the shared request context is now correctly saved before the workflow executes and restored afterward, preventing messages from being written to the wrong thread. ([#13637](https://github.com/mastra-ai/mastra/pull/13637))
289
+
290
+ - Fix workspace tool output truncation to handle tokenizer special tokens ([#13725](https://github.com/mastra-ai/mastra/pull/13725))
291
+
292
+ - Added a warning when a `LocalFilesystem` mount uses `contained: false`, alerting users to path resolution issues in mount-based workspaces. Use `contained: true` (default) or `allowedPaths` to allow specific host paths. ([#13474](https://github.com/mastra-ai/mastra/pull/13474))
293
+
294
+ - Fixed harness handling for observational memory failures so streams stop immediately when OM reports a failed run or buffering cycle. ([#13563](https://github.com/mastra-ai/mastra/pull/13563))
295
+
296
+ The harness now emits the existing OM failure event (`om_observation_failed`, `om_reflection_failed`, or `om_buffering_failed`), emits a top-level error with OM context, and aborts the active stream. This prevents normal assistant output from continuing after an OM model failure.
297
+
298
+ - Fixed subagents being unable to access files outside the project root. Subagents now inherit both user-approved sandbox paths and skill paths (e.g. `~/.claude/skills`) from the parent agent. ([#13700](https://github.com/mastra-ai/mastra/pull/13700))
299
+
300
+ - Fixed agent-as-tools schema generation so Gemini accepts tool definitions for suspend/resume flows. ([#13715](https://github.com/mastra-ai/mastra/pull/13715))
301
+ This prevents schema validation failures when `resumeData` is present.
302
+
303
+ - Fixed tool approval resume failing when Agent is used without an explicit Mastra instance. The Harness now creates an internal Mastra instance with storage and registers it on mode agents, ensuring workflow snapshots persist and load correctly. Also fixed requestContext serialization using toJSON() to prevent circular reference errors during snapshot persistence. ([#13519](https://github.com/mastra-ai/mastra/pull/13519))
304
+
305
+ - Fixed spawn error handling in LocalSandbox by switching to execa. Previously, spawning a process with an invalid working directory or missing command could crash with an unhandled Node.js exception. Now returns descriptive error messages instead. Also fixed timeout handling to properly kill the entire process group for compound commands. ([#13734](https://github.com/mastra-ai/mastra/pull/13734))
306
+
307
+ - HTTP request logging can now be configured in detail via `apiReqLogs` in the server config. The new `HttpLoggingConfig` type is exported from `@mastra/core/server`. ([#11907](https://github.com/mastra-ai/mastra/pull/11907))
308
+
309
+ ```ts
310
+ import type { HttpLoggingConfig } from '@mastra/core/server';
311
+
312
+ const loggingConfig: HttpLoggingConfig = {
313
+ enabled: true,
314
+ level: 'info',
315
+ excludePaths: ['/health', '/metrics'],
316
+ includeHeaders: true,
317
+ includeQueryParams: true,
318
+ redactHeaders: ['authorization', 'cookie'],
319
+ };
320
+ ```
321
+
322
+ - Remove internal `processes` field from sandbox provider options ([#13597](https://github.com/mastra-ai/mastra/pull/13597))
323
+
324
+ The `processes` field is no longer exposed in constructor options for E2B, Daytona, and Blaxel sandbox providers. This field is managed internally and was not intended to be user-configurable.
325
+
326
+ - Fixed abort signal propagation in agent networks. When using `abortSignal` with `agent.network()`, the signal now correctly prevents tool execution when abort fires during routing, and no longer saves partial results to memory when sub-agents, tools, or workflows are aborted. ([#13491](https://github.com/mastra-ai/mastra/pull/13491))
327
+
328
+ - Fixed Memory.recall() to include pagination metadata (total, page, perPage, hasMore) in its response, ensuring consistent pagination regardless of whether agentId is provided. Fixes #13277 ([#13278](https://github.com/mastra-ai/mastra/pull/13278))
329
+
330
+ - Fixed harness getTokenUsage() returning zeros when using AI SDK v5/v6. The token usage extraction now correctly reads both inputTokens/outputTokens (v5/v6) and promptTokens/completionTokens (v4) field names from the usage object. ([#13622](https://github.com/mastra-ai/mastra/pull/13622))
331
+
332
+ - Model pack selection is now more consistent and reliable in mastracode. ([#13512](https://github.com/mastra-ai/mastra/pull/13512))
333
+ - `/models` is now the single command for choosing and managing model packs.
334
+ - Model picker ranking now learns from your recent selections and keeps those preferences across sessions.
335
+ - Pack choice now restores correctly per thread when switching between threads.
336
+ - Custom packs now support full create, rename, targeted edit, and delete workflows.
337
+ - The built-in **Varied** option has been retired; users who had it selected are automatically migrated to a saved custom pack named `varied`.
338
+
339
+ - Added support for reading resource IDs from `Harness`. ([#13690](https://github.com/mastra-ai/mastra/pull/13690))
340
+
341
+ You can now get the default resource ID and list known resource IDs from stored threads.
342
+
343
+ ```ts
344
+ const defaultId = harness.getDefaultResourceId();
345
+ const knownIds = await harness.getKnownResourceIds();
346
+ ```
347
+
348
+ - chore(harness): Update harness sub-agent instructions type to be dynamic ([#13706](https://github.com/mastra-ai/mastra/pull/13706))
349
+
350
+ - Added `MastraMessagePart` to the public type exports of `@mastra/core/agent`, allowing it to be imported directly in downstream packages. ([#13297](https://github.com/mastra-ai/mastra/pull/13297))
351
+
352
+ - Added `deleteThread({ threadId })` method to the Harness class for deleting threads and their messages from storage. Releases the thread lock and clears the active thread when deleting the current thread. Emits a `thread_deleted` event. ([#13625](https://github.com/mastra-ai/mastra/pull/13625))
353
+
354
+ - Fixed tilde (~) paths not expanding to the home directory in LocalFilesystem and LocalSandbox. Paths like `~/my-project` were silently treated as relative paths, creating a literal `~/` directory instead of resolving to `$HOME`. This affects `basePath`, `allowedPaths`, `setAllowedPaths()`, all file operations in LocalFilesystem, and `workingDirectory` in LocalSandbox. ([#13739](https://github.com/mastra-ai/mastra/pull/13739))
355
+
356
+ - Switched Mastra Code to workspace tools and enabled LSP by default ([#13437](https://github.com/mastra-ai/mastra/pull/13437))
357
+ - Switched from built-in tool implementations to workspace tools for file operations, search, edit, write, and command execution
358
+ - Enabled LSP (language server) by default with automatic package runner detection and bundled binary resolution
359
+ - Added real-time stdout/stderr streaming in the TUI for workspace command execution
360
+ - Added TUI rendering for process management tools (view output, kill processes)
361
+ - Fixed edit diff preview in the TUI to work with workspace tool arg names (`old_string`/`new_string`)
362
+
363
+ - Fixed tilde paths (`~/foo`) in contained `LocalFilesystem` silently writing to the wrong location. Previously, `~/foo` would expand and then nest under basePath (e.g. `basePath/home/user/foo`). Tilde paths are now treated as real absolute paths, and throw `PermissionError` when the expanded path is outside `basePath` and `allowedPaths`. ([#13741](https://github.com/mastra-ai/mastra/pull/13741))
364
+
3
365
  ## 1.9.0-alpha.0
4
366
 
5
367
  ### Minor Changes
@@ -3,7 +3,7 @@ name: mastra-core
3
3
  description: Documentation for @mastra/core. Use when working with @mastra/core APIs, configuration, or implementation.
4
4
  metadata:
5
5
  package: "@mastra/core"
6
- version: "1.9.0-alpha.0"
6
+ version: "1.9.0"
7
7
  ---
8
8
 
9
9
  ## When to use
@@ -1,5 +1,5 @@
1
1
  {
2
- "version": "1.9.0-alpha.0",
2
+ "version": "1.9.0",
3
3
  "package": "@mastra/core",
4
4
  "exports": {
5
5
  "Agent": {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mastra/core",
3
- "version": "1.9.0-alpha.0",
3
+ "version": "1.9.0",
4
4
  "license": "Apache-2.0",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -275,12 +275,12 @@
275
275
  "vscode-jsonrpc": "^8.2.0",
276
276
  "vscode-languageserver-protocol": "^3.17.0",
277
277
  "zod": "^3.25.76",
278
- "@internal/ai-sdk-v5": "0.0.10",
279
- "@internal/ai-sdk-v4": "0.0.10",
280
- "@internal/ai-v6": "0.0.10",
281
- "@internal/lint": "0.0.63",
282
- "@internal/types-builder": "0.0.38",
283
- "@internal/external-types": "0.0.13"
278
+ "@internal/ai-sdk-v4": "0.0.11",
279
+ "@internal/ai-sdk-v5": "0.0.11",
280
+ "@internal/ai-v6": "0.0.11",
281
+ "@internal/external-types": "0.0.14",
282
+ "@internal/lint": "0.0.64",
283
+ "@internal/types-builder": "0.0.39"
284
284
  },
285
285
  "engines": {
286
286
  "node": ">=22.13.0"