What's Changed
- fix(oauth): label 2026-07-28 as the latest protocol revision by @olartgabo in #3773
- feat(plugins): Phase 7 client UI — skip surfacing, credential setup UX, mirrored contract fields, dotted names by @chelojimenez in #3839
- feat(oauth): toast what the provider actually returned on refresh failure by @ignaciojimenezr in #3843
- feat(plugins): in-VM shim bridging Streamable HTTP to a stdio plugin server by @chelojimenez in #3852
- feat(oauth): toast the backend-classified refresh failures too by @chelojimenez in #3862
- fix(sdk): report a refused connection as a refused connection by @chelojimenez in #3860
- fix(caniuse): make sticky table header actually stick by @nachocossio in #3770
- fix(nav): visual consistency pass on sidebar and guest Home by @nachocossio in #3772
- fix(oauth): require a client id before saving a pre-registered target by @ignaciojimenezr in #3858
- Document pre-registered Client ID validation in OAuth Debugger by @mintlify[bot] in #3868
- feat(sdk): record who has to act on an error, not just what went wrong by @chelojimenez in #3864
- Update jsonrpc/parse_error docs to match new catalog copy by @mintlify[bot] in #3870
- Surface the debug proxy's error reason in the OAuth debugger by @ignaciojimenezr in #3869
- Show toast for client updates by @ignaciojimenezr in #3861
- feat(plugins): hosted plugin stdio servers run in the caller's computer behind the shim by @chelojimenez in #3859
- fix(chat): stop rendering a gateway's HTML error page into the chat by @chelojimenez in #3866
- fix(oauth): stop redacting live tokens in the hosted request executor by @chelojimenez in #3865
- fix(chatboxes): visitor-facing runtime copy stops calling every link a swarm by @chelojimenez in #3878
- evals: contain the GitHub Checks availability read in a boundary by @ZeHuari in #3873
- perf(ci): shard the inspector test suite across 4 runners by @ignaciojimenezr in #3874
- fix(mcp): accept the resource indicator as a token audience by @chelojimenez in #3879
- fix(client-picker): logo rows and a primary dot on the right (PUR-15) by @nachocossio in #3848
- Make #mcpjam-alerts trustworthy: page on MCPJam's failures, and only those by @chelojimenez in #3875
- telemetry: stop filing bug reports for backend refusals by @ignaciojimenezr in #3881
- feat(mcpjam-agent): lead with action chips and task-oriented copy by @ZeHuari in #3849
- fix(toast): give error toasts a real TTL instead of staying open forever by @ZeHuari in #3888
- fix(hosts): stop a deleted client's permalink from hanging the app by @ignaciojimenezr in #3891
- fix(oauth): establish trace redaction safety foundation by @chelojimenez in #3882
- fix(hosts): keep a non-id /hosts/:hostId segment out of getHost and storage by @nachocossio in #3890
- fix(sdk): fail closed on required OAuth metadata by @chelojimenez in #3883
- feat(insights): one Insights workbench for Swarms and User Testing, plus the findings rail by @chelojimenez in #3889
Full Changelog: v2.35.0...v2.35.1