chore(main): release 1.6.0

[github-actions]

🤖 I have created a release beep boop

1.6.0 (2026-06-25)

Features

• add bonk ai code reviews (189dc48)
• add bonk ai code reviews (e16961b)
• cloudflare oauth connect with usage limits and BYOK inference (6fc180c)
• faster blueprint for minimal templates (1321e43)
• reduce limits (9f810e7)
• reduce limits (8299ba5)
• reduce side of blueprint infer for minimal templates (3eb0039)
• static analysis for browser rendered preview projects (22be3f8)
• static analysis for browser rendered preview projects (320fc84)
• think-based agent + code space (16670af)

Bug Fixes

• add missing lock changes (b567804)
• agents: prevent RCE via bootstrap command whitelist bypass (ae792a2)
• agents: prevent RCE via bootstrap command whitelist bypass (5dca3ab)
• ai gateway config issue (01de759)
• allow editing package.json in scratch templates (ee69533)
• bonk model name (57d83c0)
• bug where preview url did not use tunnel url (61291d0)
• bug where preview url did not use tunnel url when getting instance state (d2abffe)
• ci: use canonical gemini-3-pro-preview slug (9d22900)
• ci: use canonical gemini-3-pro-preview slug (63e78b1)
• ci: use gemini in bonk ai-pr-review workflow and fix vuln (17f56d6)
• ci: use gemini in bonk ai-pr-review workflow and fix vuln (277dbad)
• fixed github bot's commit mistakes (a729366)
• improve browser rendering checking logic (fa397bb)
• manual template selection (e440372)
• more visibility for containers and workers (a632039)
• opencode version issue (7842ab9)
• pass manually selected template and skip ai flow (ad7ae4e)
• prevent platform API key leak via user-supplied AI gateway baseUrl (854676e)
• prevent platform API key leak via user-supplied AI gateway baseUrl (d8a2526)
• preview: add CORS headers to space preview responses (d4ab976)
• preview: token+cookie auth for space previews and Safari banner (402ab7c)
• preview: token+cookie auth for space previews and Safari banner (cf88d69)
• race condition between instance start and static analysis (befdde7)
• remove opencode ref (e358598)
• resolve require("buffer") deploy error 10021 in Workers bundle (f14b40c)
• security: block prompt-injection data exfiltration via chat (f6c475f)
• security: block prompt-injection data exfiltration via chat (b6ab895)
• security: harden bootstrap command validation against postinstall RCE (31bfc6f)
• space: strip Service-Worker-Allowed from preview responses (918e974)
• space: strip Service-Worker-Allowed from preview responses (22f1900)
• ui and logging imp for cf oauth (fd8f281)
• ui and logging imp for cf oauth (86ebbdb)
• unintended change leading to bad behaviour (7a586cc)
• wrangle rupdate (9666d98)

---

This PR was generated with Release Please. See documentation.

[OMTAP]

done