What's Changed
- PR size check: 400-line budget, 1,500 hard limit unless mechanical by @prathmeshpatel in #6140
- Typecheck the inspector server in CI, as a per-file ratchet by @prathmeshpatel in #6142
- Git pre-commit and pre-push hooks: slop checks for every agent and person by @prathmeshpatel in #6170
- ci: timeout-minutes on the remaining PR-triggered jobs by @prathmeshpatel in #6147
- Claude Code hooks: check the session's repo; Stop counts only this turn's untracked files by @prathmeshpatel in #6168
- test: wait for the OAuth gate after the trigger click in ScenarioChatPage by @prathmeshpatel in #6159
- Slop rules for user-facing copy: dashes, filler, vague errors by @prathmeshpatel in #6149
- UI Copy Review: Haiku 5.5 classifies new copy, Sonnet 5.5 rewrites what it flags by @prathmeshpatel in #6150
- Add Meticulous visual testing for the Inspector client by @chelojimenez in #6152
- Harden enterprise telemetry privacy: backend-resolved policy, identity grant, relay enforcement by @chelojimenez in #6136
- Run Claude Code and Codex on the organization's own provider keys by @chelojimenez in #6135
- Show the out-of-credits dialog once; gray out runs that can only fail (PLB-175) by @ignaciojimenezr in #6126
- fix(auth): let enterprise SSO start without a guest session by @chelojimenez in #6185
- Document out-of-credits disabled buttons and dialog dismiss by @mintlify[bot] in #6186
- Move CODEOWNERS to /.github so the code-owner review rule enforces by @prathmeshpatel in #6182
- Scrub customer content from error reports and server logs by @chelojimenez in #6123
- Devin setup: skills, REVIEW.md, DeepWiki steering and a hook probe by @prathmeshpatel in #6156
- Credential-safe telemetry (1/7): credential-URL registry and its tests by @chelojimenez in #6160
- Credential-safe telemetry (2/7): scrub credential URLs at every PostHog exit by @chelojimenez in #6161
- Credential-safe telemetry (3/7): scrub credential URLs at every Sentry exit by @chelojimenez in #6162
- Show shared paid credits in the sidebar credits card by @Paoli99 in #5205
- ci: run required checks in the merge queue by @prathmeshpatel in #6237
- Credential-safe telemetry (4/7): scrub credentials in the PostHog relay and server logs by @chelojimenez in #6163
- Paper case editor 1/5: check field editors by @ignaciojimenezr in #6178
- Credential-safe telemetry (5/7): take callback codes and share tokens out of the address bar by @chelojimenez in #6164
- Credential-safe telemetry (6/7): prove telemetry egress end to end by @chelojimenez in #6165
- Credential-safe telemetry (7/7): leak monitor, vendor containment configs and docs by @chelojimenez in #6166
- ci: run Dependency Audit on stacked PRs by @ignaciojimenezr in #6245
- chore: clarify CODEOWNERS and add area reviewers by @prathmeshpatel in #6235
- ci: run the test jobs on Blacksmith runners by @chelojimenez in #6244
- ci: add Chromatic capture foundation by @prathmeshpatel in #6207
- test: capture hosted overview and tool results by @prathmeshpatel in #6229
- test: capture chat apps and evaluation failures by @prathmeshpatel in #6230
- test: capture Swarm overview personas and sessions by @prathmeshpatel in #6231
- test: capture MCP tool error results by @prathmeshpatel in #6232
- test: capture Swarm empty and creation states by @prathmeshpatel in #6233
- test: isolate staging login and refresh guard by @prathmeshpatel in #6234
- Open the daily Inspector version PR at 5 PM Pacific by @prathmeshpatel in #6187
- Org AI keys 1a: Shared AI refusal vocabulary by @chelojimenez in #6197
- Org AI keys 1b: Shared AI refusal copy by @chelojimenez in #6198
- Org AI keys 1c: SDK and CLI refusal handling by @chelojimenez in #6199
- Host templates (SDK): match real esm.sh behavior (Claude blocks, ChatGPT/Codex allow) (PLB-298) by @ignaciojimenezr in #6236
- test: raise visual suite timeouts and report the real staging sign-in error by @prathmeshpatel in #6273
- Org AI keys 1e: Show organization policy refusals in chat by @chelojimenez in #6167
- Org AI keys 1d: Browser refusal helpers by @chelojimenez in #6200
- Paper case editor 2/5: step fields and drag handles by @ignaciojimenezr in #6179
- ci: add adversarial PR reviews with Claude Sonnet by @prathmeshpatel in #6276
- deps: shell-quote 1.12.0 (4 critical Dependabot alerts) by @chelojimenez in #6277
- Paper case editor 3/5: check and action rows by @ignaciojimenezr in #6180
- deps: handlebars 4.7.10 (2 CRITICAL Dependabot alerts) by @olartgabo in #6116
- Org AI keys 9a: Read organization policy and eligibility by @chelojimenez in #6202
- Org AI keys 9b: Preserve typed route refusals by @chelojimenez in #6203
- Org AI keys 9c: Enforce policy on eval model selections by @chelojimenez in #6204
- run-inspector skill: give agents a working guest profile by @prathmeshpatel in #6269
- fix(ci): remove unsupported Claude review schema constraint by @prathmeshpatel in #6281
- Paper case editor 4/5: case spine and Add drawer by @ignaciojimenezr in #6181
- Give the suite judge model its own settings section by @ignaciojimenezr in #6271
- Update bundled Codex and Copilot templates from the 2026-10-12 probes by @ignaciojimenezr in #6275
- Document grading instructions as API/CLI-only setting by @mintlify[bot] in #6283
- Fix stale Copilot preset reference in host-templates docs by @mintlify[bot] in #6284
- WIP: checkpoint manual test Paper UI redesign by @ignaciojimenezr in #6105
- Update eval case workspace docs for Paper spine redesign by @mintlify[bot] in #6285
- Same-origin app iframe: client setting, opaque mount, caniuse row (PLB-296) by @ignaciojimenezr in #6132
- Document sameOriginAppIframe client setting by @mintlify[bot] in #6286
- Org AI keys 9d: Authorize runs carrying their own keys by @chelojimenez in #6205
- Org AI keys 9e: Policy-aware SDK leases and run reports by @chelojimenez in #6247
- Document orgPolicy refusal and AI_POLICY_REFUSED error by @mintlify[bot] in #6291
- Org AI keys 9f: Authorize local provider attempts and share judge overrides by @chelojimenez in #6169
- Bump the example-dependencies group across 6 directories with 7 updates by @dependabot[bot] in #6280
- deps: lift shell-quote, source-map-js, http-cache-semantics, sharp and MCP SDK out of advisory ranges by @olartgabo in #6100
- Org AI keys 10a: Read picker policy configuration by @chelojimenez in #6248
- Org AI keys 10b: Compose eligible model choices by @chelojimenez in #6249
- Org AI keys 10c: Apply policy to chat and environment pickers by @chelojimenez in #6250
- Document org AI key policy in model picker by @mintlify[bot] in #6294
- Org AI keys 10d: Apply policy to explicit judge choices by @chelojimenez in #6251
- Org AI keys 10e: Apply policy to eval target choices by @chelojimenez in #6252
- Org AI keys 10f: Preserve case-model connection identity by @chelojimenez in #6171
- Org AI keys 11a: Preserve structured launch problems by @chelojimenez in #6253
- Org AI keys 11b: Show actionable launch problems by @chelojimenez in #6254
- Org AI keys 11c: Check organization model choices before launch by @chelojimenez in #6255
- Update org/keys_required error code docs by @mintlify[bot] in #6299
- Org AI keys 11d: Check judge and harness launch prerequisites by @chelojimenez in #6256
- Org AI keys 11e: Show unavailable analysis as not analyzed by @chelojimenez in #6172
- Org AI keys 12: the switch (inspector) by @chelojimenez in #6173
- Org AI keys 13a: Read organization AI model configuration by @chelojimenez in #6257
- Org AI keys 13b: Display the organization default model by @chelojimenez in #6258
- Org AI keys 13c: Test and clear the organization default model by @chelojimenez in #6259
- Org AI keys 13d: Choose the organization default model by @chelojimenez in #6260
- Org AI keys 13e: Explain default model feature coverage by @chelojimenez in #6261
- fix(auth): recover stale project URLs after sign-in by @ignaciojimenezr in #6109
- Docs: org default AI model unconfigured states by @mintlify[bot] in #6307
- Org AI keys 13f: Align default model copy across SDK docs and billing by @chelojimenez in #6175
- Org AI keys 14: review fixes by @chelojimenez in #6266
- fix(swarms): send the canonical hosted model id to /stream by @ZeHuari in #6124
- fix(guest): stop guest token refresh at a 429 instead of retrying into it by @ZeHuari in #6309
- Adversarial review: budget the diff, and skip instead of failing by @chelojimenez in #6310
- Fix two timing flakes in client tests by @chelojimenez in #6270
- Stop the staging login check blocking the app's own on-load calls by @chelojimenez in #6274
- fix(sdk): sync Copilot default to GPT-5.6 Luna by @ignaciojimenezr in #6315
- Show pending organization deletions and allow cancellation by @chelojimenez in #6246
- fix(client): explain unavailable auth on HTTP custom domains by @ignaciojimenezr in #6314
- chore(release): version packages (3.16.0) by @chelojimenez in #6318
- e2e: run the smoke suite against the community backend, never production by @chelojimenez in #6190
- Publish the Docker Hub image on every Inspector release again by @nachocossio in #6298
- fix(test): drain staging proxy routes before context teardown by @prathmeshpatel in #6302
- ci(release): ping #prs with @channel when a version PR opens by @chelojimenez in #6319
Full Changelog: v3.15.0...v3.16.0