What's Changed
- sidebar: one hover card per item, one open at a time (PUR-110) by @moisonmaxime in #6815
- fix(oauth): name the server's certificate when TLS trust fails by @weimar-torres-herrera in #6832
- test(e2e): mock legalAcceptance:getStatus in the signed-in visual fixture by @nachocossio in #6851
- fix(server): relay MCP Apps resource reads in eval and swarm runs by @prathmeshpatel in #6803
- fix(browser): say why Chromium did not start instead of a bad project by @weimar-torres-herrera in #6833
- Only page on empty model replies MCPJam can own by @ignaciojimenezr in #6728
- Evaluate: go straight to creating a suite when none exists by @ZeHuari in #6822
- deps: clear the open Dependabot alerts (MCP SDK 1.32.1, storybook, electron, undici, zod, vite) by @olartgabo in #6862
- cli: keep dependency console output off stdout by @ZeHuari in #6854
- fix(telemetry): split frameless dependency errors out of one Sentry group by @nachocossio in #6849
- docs: redirect three paths that answer 404 by @ZeHuari in #6852
- evals: 404 a malformed id on the run-disclosure query, not 502 by @nachocossio in #6848
- fix(auth): answer an unreachable WorkOS with a 503 instead of paging by @nachocossio in #6858
- fix(skills): gate on a server skill loaded in an earlier request by @chelojimenez in #6857
- fix(chat): keep reasoning for org OpenAI Responses turns by @ignaciojimenezr in #6855
- conformance: report a 401 refusal as incomplete, not failed by @ZeHuari in #6856
- fix(sdk): forward MCPJam auth to goal-completion judges by @prathmeshpatel in #6846
- fix(client): agent-started eval runs use the Setup Run iteration count by @devin-ai-integration[bot] in #6818
- swarm: say why a target's setup failed, and log the real error by @devin-ai-integration[bot] in #6817
- feat(apps): add the shared WebMCP view relay foundation by @chelojimenez in #6845
- harness: don't count a widget that rejected its data as rendered by @chelojimenez in #6874
- logger: print run and session IDs on local console lines by @chelojimenez in #6875
- evals: accept public match option names on every case surface by @chelojimenez in #6876
- evals: grade a failed tool call's identical retry as one call by @chelojimenez in #6879
- feat(apps): use WebMCP view tools in Chat and Playground by @chelojimenez in #6870
- harness: generate the bake context without a built SDK by @chelojimenez in #6877
- feat(apps): add serialized view tools to browser sessions by @chelojimenez in #6871
- I1: resolve plain Playground turns through environments by @chelojimenez in #6882
- harness: drop the Codex config key 0.163.0 ignores by @chelojimenez in #6878
- feat(evals): enforce policy and record MCP App view tools by @chelojimenez in #6872
- Preserve available swarm turn evidence on timeout by @prathmeshpatel in #6841
- I2: resolve v1 chat turns through saved setups by @chelojimenez in #6883
- I3: compose plugin setups per comparison client by @chelojimenez in #6884
- Normalize hosted setup before execution (cleanup groundwork) by @chelojimenez in #6885
- I4: remove legacy hosted chat execution paths by @chelojimenez in #6888
- Attach sandboxes through guarded backend preparation by @chelojimenez in #6890
- Follow the backend's hosted-browser answer, and expire it (KES-720 Phase 3) by @chelojimenez in #6891
- Keep app-tool turns from raising a false chat conflict by @chelojimenez in #6894
- Gate native MCP execution with durable approval and evidence by @chelojimenez in #6896
- Skip the tool snapshot on a timed-out swarm turn by @chelojimenez in #6887
- feat(playground): list and run MCP App tools in the Tools panel by @chelojimenez in #6897
- fix(playground): share App tools in the zero-server panel by @chelojimenez in #6898
- Don't crash on a null hosted-browser availability answer by @chelojimenez in #6903
- Preserve native MCP HTTP requests and streamed results by @chelojimenez in #6899
- Run native Claude chats through the forwarding gate by @chelojimenez in #6902
- playground: say when a client's model needs sign-in by @ignaciojimenezr in #6873
- chore: add Inspector, CLI, and SDK release changeset by @ignaciojimenezr in #6906
- Restore scoped RPC logs for native Claude forwarding by @chelojimenez in #6907
- Add a service-token route for the hourly hosted-browser synthetic check (KES-720 Phase 5) by @chelojimenez in #6904
- Remove the hosted-browser env switches; the flag decides launch (KES-720) by @chelojimenez in #6895
- chore(release): version packages (3.18.0) by @chelojimenez in #6860
Full Changelog: v3.17.0...v3.18.0