[dependabot]

Bumps the airlock-npm group with 14 updates:

Package	From	To
playwright-core	1.62.1	1.63.0
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
@types/node	24.13.3	24.13.6
@truefoundry/trueforge-sdk	0.1.3	0.2.0
@truefoundry/trueforge-ui	0.2.4	0.3.1
next	16.3.3	16.3.6
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.5	19.3.0
@eslint/eslintrc	3.3.6	3.3.7
eslint	9.39.5	10.11.0
eslint-config-next	16.3.3	16.3.6

Updates playwright-core from 1.62.1 to 1.63.0

Release notes

Sourced from playwright-core's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Updates @types/node from 24.13.3 to 24.13.6

Commits

• See full diff in compare view

Updates @truefoundry/trueforge-sdk from 0.1.3 to 0.2.0

Release notes

Sourced from @​truefoundry/trueforge-sdk's releases.

@​truefoundry/trueforge-sdk@​0.2.0

Minor Changes

• 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

Patch Changes

• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 2dcb3a0: Add created_by_me to list sessions and list schedules so callers can restrict results to resources they created (excluding managed-agent visibility).
• a000b47: List sessions accepts metadata[key]=value query params (OpenAPI deepObject) for exact metadata containment filtering. Bare JSON-string metadata query params are rejected. Metadata keys are limited to 32 characters and cannot include [] or whitespace so they do not collide with the bracket query form.
• 9501536: [truefoundry] Make MCPServerManifest a type-discriminated oneOf of RemoteMCPServerManifest and TrueFoundryMCPServerManifest.
• 0ec8dc6: Omit session total_cost_in_usd when cost is unavailable (instead of defaulting to 0), matching turn metrics.
• dc2151f: Paginate GET /api/v1/agents with limit / page_token and a pagination envelope; optional agent_name filters by case-insensitive substring. Agents library uses rows-per-page and prev/next against the token-paginated API. Schedule create and the schedules listing agent filter use a searchable agent combobox backed by the same filtered list API.
• 134dcb9: Python SDK is_event_delta / merge_event_delta (PyPI version locksteps with this package on Version Packages).
• 52987a7: Add internal.agents.getCodeSnippets API under the new SDK internal namespace.
• 38ce068: Add tenant-unique optional session external_id, Sessions.getOrCreateByExternalId, and an idempotent POST /internal/sessions/get-or-create-by-external-id endpoint and SDK method.
• b654052: Add caller-owned session metadata (Record<string, string> with size limits) on create, update, and read. Persist as a new session.metadata jsonb column; leave session custom unchanged.
• 11865b4: Add optional session source. Persist as nullable JSONB with a list filter index; expose on session responses and list via source_type / source_id. Schedule dispatch sets source on create; public create/update do not accept it.
• 4c1260e: [truefoundry] Wire TrueFoundry MCP authorize, status, and delete through ServiceFoundry; stub list auth_status; gate oauth2 invoke mid-turn with authRequired; paginate MCP server lists. UI treats SFY consent code/error on the FE landing like local DCR success/failure.
• 44f9cbe: [truefoundry] TrueFoundry mode: env-backed Daytona | truefoundry sandbox via TRUEFOUNDRY_SANDBOX_* (static SETTINGS JSON). Settings OpenAPI stays Daytona-only (SandboxProviderManifest); truefoundry is store-internal (StoredSandboxProviderManifest).
• f175245: [truefoundry] Add TrueFoundry-managed MCP list/get (SFY registry, gateway proxy URL, create/update 424).

@​truefoundry/trueforge-sdk@​0.2.0-rc.9

Patch Changes

• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.

@​truefoundry/trueforge-sdk@​0.2.0-rc.8

Patch Changes

• 648273b: Regenerate SDK from updated OpenAPI spec.
• 134dcb9: Python SDK is_event_delta / merge_event_delta (PyPI version locksteps with this package on Version Packages).

@​truefoundry/trueforge-sdk@​0.2.0-rc.7

Patch Changes

• 648273b: Regenerate SDK from updated OpenAPI spec.

... (truncated)

Changelog

Sourced from @​truefoundry/trueforge-sdk's changelog.

[0.2.0] - 2026-09-18

0.2.1-rc.0

Patch Changes

• 829ac6e: Regenerate SDK from updated OpenAPI spec.

[0.2.0-rc.9] - 2026-09-17

0.2.0

Minor Changes

• 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

Patch Changes

• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 648273b: Regenerate SDK from updated OpenAPI spec.
• 2dcb3a0: Add created_by_me to list sessions and list schedules so callers can restrict results to resources they created (excluding managed-agent visibility).
• a000b47: List sessions accepts metadata[key]=value query params (OpenAPI deepObject) for exact metadata containment filtering. Bare JSON-string metadata query params are rejected. Metadata keys are limited to 32 characters and cannot include [] or whitespace so they do not collide with the bracket query form.
• 9501536: [truefoundry] Make MCPServerManifest a type-discriminated oneOf of RemoteMCPServerManifest and TrueFoundryMCPServerManifest.
• 0ec8dc6: Omit session total_cost_in_usd when cost is unavailable (instead of defaulting to 0), matching turn metrics.
• dc2151f: Paginate GET /api/v1/agents with limit / page_token and a pagination envelope; optional agent_name filters by case-insensitive substring. Agents library uses rows-per-page and prev/next against the token-paginated API. Schedule create and the schedules listing agent filter use a searchable agent combobox backed by the same filtered list API.
• 134dcb9: Python SDK is_event_delta / merge_event_delta (PyPI version locksteps with this package on Version Packages).
• 52987a7: Add internal.agents.getCodeSnippets API under the new SDK internal namespace.
• 38ce068: Add tenant-unique optional session external_id, Sessions.getOrCreateByExternalId, and an idempotent POST /internal/sessions/get-or-create-by-external-id endpoint and SDK method.
• b654052: Add caller-owned session metadata (Record<string, string> with size limits) on create, update, and read. Persist as a new session.metadata jsonb column; leave session custom unchanged.
• 11865b4: Add optional session source. Persist as nullable JSONB with a list filter index; expose on session responses and list via source_type / source_id. Schedule dispatch sets source on create; public create/update do not accept it.
• 4c1260e: [truefoundry] Wire TrueFoundry MCP authorize, status, and delete through ServiceFoundry; stub list auth_status; gate oauth2 invoke mid-turn with authRequired; paginate MCP server lists. UI treats SFY consent code/error on the FE landing like local DCR success/failure.
• 44f9cbe: [truefoundry] TrueFoundry mode: env-backed Daytona | truefoundry sandbox via TRUEFOUNDRY_SANDBOX_* (static SETTINGS JSON). Settings OpenAPI stays Daytona-only (SandboxProviderManifest); truefoundry is store-internal (StoredSandboxProviderManifest).
• f175245: [truefoundry] Add TrueFoundry-managed MCP list/get (SFY registry, gateway proxy URL, create/update 424).

[0.2.0-rc.8] - 2026-09-15

0.2.0-rc.9

Patch Changes

... (truncated)

Commits

• 8b1d98e Version Packages (#801)
• 5ae0781 Rewrite changelog to tag truefoundry specific items
• 208ecba Version Packages (rc) (#783)
• 551b6a8 feat: configure MCP tool approval in Build Agent (#770)
• bd67d56 feat: Add a event schema with paused/running status (#785)
• e4c4b56 feat: introduce built-in web search capabilities in TrueFoundry (#761)
• 4a91f47 feat: Allow renaming sessions (#780)
• 584e815 AGE-2217: Expose tenant CREATE via list-permissions (#750)
• 7fc322f Version Packages (rc) (#738)
• 9846d6d feat: add Python samples to agent Use in Code (#736)
• Additional commits viewable in compare view

Updates @truefoundry/trueforge-ui from 0.2.4 to 0.3.1

Release notes

Sourced from @​truefoundry/trueforge-ui's releases.

@​truefoundry/trueforge-ui@​0.3.1

Patch Changes

• 56b3a59: Keep newly saved builders editable until the user leaves the build-agent page, then start fresh when they return.
• a122ba1: Show successful MCP authentication in chat, automatically continue after every required server connects, and indicate while the turn is starting. Confirm OAuth against the chat MCP connector read (getMcpConnector) so non-admins are not blocked by settings-only catalog GETs, and ignore authorize callbacks after the prompt unmounts.
• acad1a1: Add chat-history rename for servers that implement renameSession, including TrueForge harness title updates.
• a08c75a: Show absolute session activity timestamps on hover, label deferred MCP tools in the session timeline, and fix Safari collapsing contentSized modal bodies (flex-auto).

@​truefoundry/trueforge-ui@​0.3.0

Minor Changes

• 51127c4: Gate config.webSearch on host capabilities: New Chat auto-enables with no toggle; New Agent / edit show a Runtime Config switch (default on when absent).

• d269b01: Add a live advanced agent configuration drawer with shared model, runtime, MCP tool, skill, and Save Agent editors.

• e74e953: Keep agent configuration visible on the left in full-width builder layouts, add a responsive instructions and initial-messages drawer with explicit save, make mobile config overlays closable, save the current instruction draft, align builder chrome, and preserve open widgets across chat runtime changes.

• a189482: Add routed agent detail pages with lazy Overview, Sessions, and Use In Code tabs backed by the optional AgentSessionsServer port and built-in TrueForge adapter.

• 8491843: Add a slot-driven agent Metrics tab with aggregate cards, time-range filtering, and Harness-backed line charts.

• e3973a5: Open agent model settings inline and support typed custom model parameters.

• a189482: Add the agent library Sessions tab and an all-user Sessions sidebar page (including drafts) with agent and time filters, shareable query params, and the same two-pane timeline. Library agent details keep the active tab in ?tab= so opening an agent lands on Overview.

• 555bef0: Add a composer approval-nav banner (overridable ApprovalNavBanner slot) that counts pending tool approvals, pauses the composer, and jumps/expands/flashes the focused approval — including nested subagent tools.

• 3539da2: Add brand.mode (icon-title | icon-only | logo) so hosts pick chrome look first; name always labels the mark, and resolveBrandChrome maps mode to layout chrome.

• 16feb29: Add customActionRenderers so hosts can pause the composer on client-side tools with their own UI and resume via onSubmit(content).

• 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

• bc11131: MCP selectors (composer + agent config) infinite-scroll through listMcp pages via DraftCatalogProvider.

• 0297727: Add context-management compaction triggers with model-aware defaults and migrate persisted legacy token thresholds.

• 860e322: Split New Chat vs New Agent: simple chat keeps the Connectors/Skills picker; New Agent keeps Agent Config + Save Agent. Session metadata is_create_agent drives resume from the sessions browser.

• 12b02ff: Open Runtime Config in a right-side drawer and label scheduled sessions consistently.

• 0cc59f8: Wire schedule test runs and show last five run status chips on the schedules table. Bump @truefoundry/assistant-ui-runtime to 0.1.25.

• 0cc59f8: Add global Schedules page at /schedules with listing, popover-based filters, and create/edit drawer wired to the schedule API. New schedules save as paused, open a Test Schedule review with MCP connect status, and support Activate Anyway. List schedules uses server token pagination and multi-agent filters. Agents shows a Schedules count column (warning when any are paused) loaded via a batched list for on-screen agents. Add Table primitives with client-side and token pagination plus portal DropdownMenu so row actions are not clipped by overflow. Export a reusable popover select with single- and multi-select modes.

• 788636d: Sidebar layout is a permanent icon+label nav rail (no expand/collapse). Recent chats are hidden from the sidebar and mobile drawer; the drawer shows nav actions only.

• 04d2ee6: Add a sidebarText semantic token for sidebar nav labels, refresh trueforge sidebar colors, set trueforge base radius to 0.375rem (6px), and set sidebar / thread-list control corners to 0.75rem (12px).

  Expose design-system Button (Button.Primary / .Secondary / .Ghost / .Destructive). ButtonVariant is now primary | secondary | ghost | destructive (default renamed to primary; outline removed — use secondary). Button sizes are large (default) and small (icon for icon-only).

• 7e25f68: Open Save Agent in a right-side drawer with only the agent name while preserving configuration from Agent Config.

• 8f1a2dc: [truefoundry] Add a TrueFoundry-managed model registry. When TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL is set, models are listed from the TrueFoundry ServiceFoundry server and turns are routed through the tenant's default AI Gateway with the caller's token. Mutually exclusive with OIDC. Supports internal mutual TLS to the ServiceFoundry server via TRUEFOUNDRY_MTLS_ENABLED/TRUEFOUNDRY_MTLS_CERTS_DIR.

• f8b5eeb: Add optional resource permissions and gate agent, schedule, and session mutations.

Patch Changes

• 51127c4: Open Save Agent drawer on Clone with {name}-clone prefilled; stay on Agents list after save.
• d29717b: Clarify MCP API key entry: Bearer placeholders, auto-prefix Authorization values, and a header-name hint on the form.
• a273ed8: Preload Monaco when the UI shell mounts so tool request/response editors open faster.
• 347a7e7: Refresh composer and composer-trigger styling: 0.75rem composer corners with a light-theme primary-token gradient hairline (faded top → solid bottom) and a neutral hairline in dark, an icon-only tools trigger in place of the "Tools" caption and count badge, the shared agent-2 glyph on the agents-library trigger, and squared-off chrome-action geometry on the save-agent trigger. Also fixes agent-2.svg to use currentColor so it is legible in dark mode.
• 2a0ae4c: Show connector catalog logos in the composer Tools picker, matching the Connectors settings page.
• 2a0ae4c: Align AttachmentCard with assistant-ui's default square thumbnail, filename tooltip, and overlay remove control.
• 762ecc0: [truefoundry] TrueFoundry skills catalog: proxy GET /skills and /skills/versions from ServiceFoundry; settings skill writes return 424. SkillManifest is a type-discriminated oneOf of GitSkill | TrueFoundryRegistrySkill (type: truefoundry; name is FQN, display_name is short). AvailableSkill exposes optional metadata (display_name, repository_name, version). AgentSpec skill refs allow opaque FQN names, optional preload (registry), and max 50. UI draft skill mounts map catalog id to AgentSpec name.
• a189482: Load agent Use In Code snippets through client.internal.agents.getCodeSnippets instead of a raw client.fetch.
• 26a9b80: Add an agent-scoped Schedules tab and route library schedule actions into it.
• 1b8a3f7: Add documentation links to the code snippets view and shell actions.
• 584e815: Gate Save Agent (create) on tenant CREATE from list-permissions, keep Update Agent on agent MANAGE, unwrap { type, permissions }, and bump @truefoundry/assistant-ui-runtime to 0.1.39.

... (truncated)

Changelog

Sourced from @​truefoundry/trueforge-ui's changelog.

0.3.1

Patch Changes

• 56b3a59: Keep newly saved builders editable until the user leaves the build-agent page, then start fresh when they return.
• a122ba1: Show successful MCP authentication in chat, automatically continue after every required server connects, and indicate while the turn is starting. Confirm OAuth against the chat MCP connector read (getMcpConnector) so non-admins are not blocked by settings-only catalog GETs, and ignore authorize callbacks after the prompt unmounts.
• acad1a1: Add chat-history rename for servers that implement renameSession, including TrueForge harness title updates.
• a08c75a: Show absolute session activity timestamps on hover, label deferred MCP tools in the session timeline, and fix Safari collapsing contentSized modal bodies (flex-auto).

0.3.0

Minor Changes

• 51127c4: Gate config.webSearch on host capabilities: New Chat auto-enables with no toggle; New Agent / edit show a Runtime Config switch (default on when absent).

• d269b01: Add a live advanced agent configuration drawer with shared model, runtime, MCP tool, skill, and Save Agent editors.

• e74e953: Keep agent configuration visible on the left in full-width builder layouts, add a responsive instructions and initial-messages drawer with explicit save, make mobile config overlays closable, save the current instruction draft, align builder chrome, and preserve open widgets across chat runtime changes.

• a189482: Add routed agent detail pages with lazy Overview, Sessions, and Use In Code tabs backed by the optional AgentSessionsServer port and built-in TrueForge adapter.

• 8491843: Add a slot-driven agent Metrics tab with aggregate cards, time-range filtering, and Harness-backed line charts.

• e3973a5: Open agent model settings inline and support typed custom model parameters.

• a189482: Add the agent library Sessions tab and an all-user Sessions sidebar page (including drafts) with agent and time filters, shareable query params, and the same two-pane timeline. Library agent details keep the active tab in ?tab= so opening an agent lands on Overview.

• 555bef0: Add a composer approval-nav banner (overridable ApprovalNavBanner slot) that counts pending tool approvals, pauses the composer, and jumps/expands/flashes the focused approval — including nested subagent tools.

• 3539da2: Add brand.mode (icon-title | icon-only | logo) so hosts pick chrome look first; name always labels the mark, and resolveBrandChrome maps mode to layout chrome.

• 16feb29: Add customActionRenderers so hosts can pause the composer on client-side tools with their own UI and resume via onSubmit(content).

• 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

• bc11131: MCP selectors (composer + agent config) infinite-scroll through listMcp pages via DraftCatalogProvider.

• 0297727: Add context-management compaction triggers with model-aware defaults and migrate persisted legacy token thresholds.

• 860e322: Split New Chat vs New Agent: simple chat keeps the Connectors/Skills picker; New Agent keeps Agent Config + Save Agent. Session metadata is_create_agent drives resume from the sessions browser.

• 12b02ff: Open Runtime Config in a right-side drawer and label scheduled sessions consistently.

• 0cc59f8: Wire schedule test runs and show last five run status chips on the schedules table. Bump @truefoundry/assistant-ui-runtime to 0.1.25.

• 0cc59f8: Add global Schedules page at /schedules with listing, popover-based filters, and create/edit drawer wired to the schedule API. New schedules save as paused, open a Test Schedule review with MCP connect status, and support Activate Anyway. List schedules uses server token pagination and multi-agent filters. Agents shows a Schedules count column (warning when any are paused) loaded via a batched list for on-screen agents. Add Table primitives with client-side and token pagination plus portal DropdownMenu so row actions are not clipped by overflow. Export a reusable popover select with single- and multi-select modes.

• 788636d: Sidebar layout is a permanent icon+label nav rail (no expand/collapse). Recent chats are hidden from the sidebar and mobile drawer; the drawer shows nav actions only.

• 04d2ee6: Add a sidebarText semantic token for sidebar nav labels, refresh trueforge sidebar colors, set trueforge base radius to 0.375rem (6px), and set sidebar / thread-list control corners to 0.75rem (12px).

  Expose design-system Button (Button.Primary / .Secondary / .Ghost / .Destructive). ButtonVariant is now primary | secondary | ghost | destructive (default renamed to primary; outline removed — use secondary). Button sizes are large (default) and small (icon for icon-only).

• 7e25f68: Open Save Agent in a right-side drawer with only the agent name while preserving configuration from Agent Config.

• 8f1a2dc: [truefoundry] Add a TrueFoundry-managed model registry. When TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL is set, models are listed from the TrueFoundry ServiceFoundry server and turns are routed through the tenant's default AI Gateway with the caller's token. Mutually exclusive with OIDC. Supports internal mutual TLS to the ServiceFoundry server via TRUEFOUNDRY_MTLS_ENABLED/TRUEFOUNDRY_MTLS_CERTS_DIR.

• f8b5eeb: Add optional resource permissions and gate agent, schedule, and session mutations.

Patch Changes

• 51127c4: Open Save Agent drawer on Clone with {name}-clone prefilled; stay on Agents list after save.
• d29717b: Clarify MCP API key entry: Bearer placeholders, auto-prefix Authorization values, and a header-name hint on the form.
• a273ed8: Preload Monaco when the UI shell mounts so tool request/response editors open faster.
• 347a7e7: Refresh composer and composer-trigger styling: 0.75rem composer corners with a light-theme primary-token gradient hairline (faded top → solid bottom) and a neutral hairline in dark, an icon-only tools trigger in place of the "Tools" caption and count badge, the shared agent-2 glyph on the agents-library trigger, and squared-off chrome-action geometry on the save-agent trigger. Also fixes agent-2.svg to use currentColor so it is legible in dark mode.
• 2a0ae4c: Show connector catalog logos in the composer Tools picker, matching the Connectors settings page.
• 2a0ae4c: Align AttachmentCard with assistant-ui's default square thumbnail, filename tooltip, and overlay remove control.
• 762ecc0: [truefoundry] TrueFoundry skills catalog: proxy GET /skills and /skills/versions from ServiceFoundry; settings skill writes return 424. SkillManifest is a type-discriminated oneOf of GitSkill | TrueFoundryRegistrySkill (type: truefoundry; name is FQN, display_name is short). AvailableSkill exposes optional metadata (display_name, repository_name, version). AgentSpec skill refs allow opaque FQN names, optional preload (registry), and max 50. UI draft skill mounts map catalog id to AgentSpec name.
• a189482: Load agent Use In Code snippets through client.internal.agents.getCodeSnippets instead of a raw client.fetch.
• 26a9b80: Add an agent-scoped Schedules tab and route library schedule actions into it.

... (truncated)

Commits

• de68a16 Version Packages (#823)
• 079bd41 Revert "Persist shell navigation in sessionStorage when withRouter is off. (#...
• c37b822 Persist shell navigation in sessionStorage when withRouter is off. (#813)
• a08c75a Show timestamp in Sessions, Deferred tool name visibility fix, safari form re...
• 56b3a59 bugfix: reset build agent selected agent when revisited the page (#828)
• a122ba1 Chore: enhance MCP authentication flow with automatic resume and connection s...
• acad1a1 feat: allow session rename (#790)
• 8b1d98e Version Packages (#801)
• d29717b Auto prepend Bearer during MCP connection with API Key and add hints
• 51127c4 Enable agent Clone via Save drawer for create-capable viewers (#794)
• Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.6

Release notes

Sourced from next's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• a758ffc v16.3.6
• 868fad3 [active-lts] Harden next/og SVG serialization
• 8c81cbb [lts-active] test: remove unsupported deployment ID builder cases (#98821)
• ca2c75e v16.3.5
• 14fb290 [backport] Fix use cache prerender signal retention (#98448)
• 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
• 4b56cee [16.3.x] Backport docs fixes (#98317)
• 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
• 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
• 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.