What's Changed
- Show a built-in runner check on every stage the runner measures by @chelojimenez in #5488
- Document built-in runner checks for 4 eval stages by @mintlify[bot] in #5495
- feat(user-testing): tell a tester when a server didn't connect by @olartgabo in #4062
- Meter the signed-in caller on /api/web/* (MJ-012) by @olartgabo in #5451
- Make the compare-plans table read as one recommended column by @olartgabo in #5327
- Scale the runs table pass rate so it stops reading 1% by @olartgabo in #5311
- Close the two disclosed MJ-001 residuals by @olartgabo in #5447
- Stop offering plan changes the server refuses by @olartgabo in #5331
- Refuse hosted chat on a project the caller is not a member of (MJ-013) by @olartgabo in #5404
- Keep persisted conformance runs behind the pinned egress guard (MJ-001) by @chelojimenez in #5459
- Enforce tool approval on the server for gated operations (MJ-008) by @chelojimenez in #5462
- Let org admins revoke any organization API key, and expire keys by default (MJ-010) by @chelojimenez in #5461
- Upload avatars and logos through the server, and store widget HTML as text (MJ-004, MJ-006) by @chelojimenez in #5464
- Verify tool results and assistant turns in client-sent history (MJ-009) by @chelojimenez in #5466
- Read private chat artifacts through authorized, short-lived links (MJ-005, MJ-007) by @chelojimenez in #5465
- Add internal diagnostics for Electron proxy failures by @ignaciojimenezr in #5493
- Stop calling a partial balance or a transient hold "out of credits" by @olartgabo in #5445
- Map billing refusals to copy instead of toasting the Convex payload by @olartgabo in #5333
- Revoke AuthKit sessions on sign-out and verify bearers at the gateway (MJ-011) by @chelojimenez in #5463
- log: stop a failed console write from escaping into its caller by @ZeHuari in #5458
- updater: stop reporting a skipped install as an unhandled rejection by @ZeHuari in #5434
- deps: update next, wrangler, sharp, fflate, uuid and pin postcss by @chelojimenez in #5504
- deps(examples): refresh sample app lockfiles within existing ranges by @chelojimenez in #5503
- ci: pin actions/download-artifact to v4.3.0 by commit SHA by @chelojimenez in #5502
- Stop browser-injected stack overflows paging #mcpjam-alerts by @nachocossio in #5476
- diagnostics: record failed OAuth proxy endpoint in error reports by @ignaciojimenezr in #5512
- Trace Convex query failures with client correlation details by @ignaciojimenezr in #5511
- Let Dependabot updates land on their own, and land the production group by @chelojimenez in #5506
- Bump example apps to Vite 8, plugin-react 6, TypeScript 7 and dotenv 18 by @chelojimenez in #5507
- Bump open 11, marked 18, date-fns 4, concurrently 10, and TypeScript 7 in the check fixture by @chelojimenez in #5508
- Bump ESLint to 10 in the inspector and the SDK by @chelojimenez in #5509
- Bump Vite to 8 in the inspector and the MCP app UI build by @chelojimenez in #5510
- Split the tool-call arguments into their own scorer at Tool call by @chelojimenez in #5492
- Pass PR branch names to preview workflow steps through env by @chelojimenez in #5521
- Pause rubric checks in settings when the goal judge's policy is off by @chelojimenez in #5501
- fix(auth): cancel queries before auth loss and show loading during logout by @ignaciojimenezr in #5513
- Reopen the auth popup after the AS rejects the debugger's authorization code by @SebasKoria in #5439
- oauth: stop filing a server's missing resource metadata as our error by @ZeHuari in #5470
- Give each swarm goal card session one status by @nachocossio in #5483
- Changelog: swarm session chip redesign (2026-09-24) by @mintlify[bot] in #5533
- swarms: drop the actionable-findings list from the Findings tab by @ZeHuari in #5534
- Changelog: swarm Findings tab removes actionable-findings list by @mintlify[bot] in #5535
- fix(server): noindex the app shell and serve a real robots.txt by @nachocossio in #3336
- Harden connection handling (MJ-003) by @chelojimenez in #5523
- Docs: add 403 credential origin mismatch troubleshooting by @mintlify[bot] in #5542
- Keep public-client and DCR XAA servers connecting (MJ-003 follow-up) by @chelojimenez in #5543
- Harden web error handling (MJ-020, MJ-021) by @chelojimenez in #5528
- Harden telemetry compatibility (MJ-015) by @chelojimenez in #5529
- Update Soundcheck authentication dependencies by @chelojimenez in #5527
- Bump the development-dependencies group across 1 directory with 14 updates by @dependabot[bot] in #5517
- chore: add release changeset for inspector, CLI, and SDK by @ignaciojimenezr in #5545
- Retry suite starts after database conflicts by @ignaciojimenezr in #5538
- Grey out delete for a server group in use by @ignaciojimenezr in #5539
- Keep users signed in on reload (fix workos-has-session cookie value) by @ignaciojimenezr in #5547
- Upload client source maps to PostHog before Sentry deletes them by @nachocossio in #5530
- Backtest: rule out the tool scorers from half the frozen evidence by @chelojimenez in #5520
- chore(release): version packages by @chelojimenez in #5551
Full Changelog: v3.11.0...v3.12.0