Release v2.13.0

What's Changed

• Remove 11 fully rolled-out PostHog feature flags by @chelojimenez in #2634
• fix(test): scope run-detail KPI query, unblock Run Tests by @Vu-John in #2655
• PR-I1: Persistent "Use MCPJam as your test IdP" card + docs page by @Vu-John in #2564
• PR-I3: XAA server endpoints — AS discovery + health check by @Vu-John in #2565
• PR-I7: ID-JAG claim lint panel with spec citations by @Vu-John in #2566
• PR-I2: useXaaResourceApps hook + resource-app types by @Vu-John in #2658
• PR-I4: XAA resource-app registration wizard, steps 1-2 by @Vu-John in #2568
• PR-I5: Registration wizard step 3 + registered-resource list by @Vu-John in #2571
• PR-I6: XAA flow runner — Run all, registration-backed runs, deep link by @Vu-John in #2572
• PR-I8: XAA negative-test scorecard by @Vu-John in #2575
• fix(xaa): make resource/AS discovery a fallback, not a mandatory first step by @Vu-John in #2576
• feat(xaa): group debugger steps into spec phases (ID-JAG draft steps 1–4 + bootstrap) by @Vu-John in #2587
• feat(xaa): client secret for manual debugger runs (confidential-client jwt-bearer) by @Vu-John in #2594
• fix(xaa): resolve test-IdP issuer from server discovery, not browser origin by @Vu-John in #2651
• feat(xaa): streamline test-IdP card and add clear-configuration by @Vu-John in #2654
• refunds by @ignaciojimenezr in #2615
• cta team plan by @ignaciojimenezr in #2629
• fix(mcp): accept all platform AuthKit issuers, not just AUTHKIT_DOMAIN by @chelojimenez in #2669
• [XAA] Clarify test-IdP card + fix scorecard badge + onboarding by @Vu-John in #2668
• fix(test): scope billing upsell assertions after #2629 Team CTA by @chelojimenez in #2672
• Synthetic monitors MVP: widget probes, render checks, scheduled runs, Monitoring tab by @chelojimenez in #2636
• Add Claude Code host template from live probe by @ignaciojimenezr in #2653
• feat(mcp): guest + anonymous access to the platform MCP server by @chelojimenez in #2675
• Fix/eval compare host attachment servers by @ignaciojimenezr in #2674
• Add @mcpjam/chat-ui (Tier A read-only transcript renderer) by @chelojimenez in #2678
• inspector: adopt @mcpjam/chat-ui ReadOnlyTranscript in ShareUsageThreadDetail by @chelojimenez in #2680
• feat(computer): awake-time usage meter in the Computer tab by @chelojimenez in #2650
• chat-ui/inspector: single-source thread-helpers via subpath export by @chelojimenez in #2681
• fix(hosted): allow the Computer tab in hosted mode by @chelojimenez in #2682
• fix(docker): copy chat-ui workspace into the staging build by @chelojimenez in #2686
• chat-ui/inspector: single-source trace/replay adaptation via /trace subpath by @chelojimenez in #2685
• Clarify XAA subject, carry email into ID-JAG, detail negative-test failures by @Vu-John in #2687
• [XAA Debugger UX] PR-I1: clearer scorecard, setup copy, and flow orientation by @Vu-John in #2688
• [XAA Debugger] Make the stepper agree with the scorecard on negative tests by @Vu-John in #2690
• [XAA Debugger] Consistent step status + reset for negative-test probe by @Vu-John in #2693
• feat(client): add AgentCore and VS Code host templates by @olartgabo in #2676
• Tier B Phase 0: WidgetHost boundary contract for the widget runtime by @chelojimenez in #2694
• fix(evals): authenticate guest eval runs with the guest bearer by @chelojimenez in #2683
• Render widget probes in all environments (bake Chromium into the hosted image) by @chelojimenez in #2696
• feat(hosts): Computer + Built-in tools islands on the host graph canvas by @chelojimenez in #2698
• Tier B Phase 1a: useWidgetHost hook + services/surface/debug inversion by @chelojimenez in #2697
• Tier B Phase 1a follow-up: useWidgetHost guard test + persistentSurfaceHost note by @chelojimenez in #2701
• Resolve platform MCP worker URL by environment; auto-run worker in dev by @chelojimenez in #2703
• Tier B Phase 1b: invert renderer environment/sandbox reads behind useWidgetHost by @chelojimenez in #2702
• Refresh WidgetHost boundary comments after Phase 1b by @chelojimenez in #2705
• Tier B Phase 2 (Slice 1): @mcpjam/sdk/widget-runtime subpath (tool-visibility + logging-transport) by @chelojimenez in #2706
• feat(hosts): Tools + Computer as dedicated host focus tabs by @chelojimenez in #2708
• Tier B Phase 2 (Slice 2): iframe-sandbox-policy → @mcpjam/sdk/widget-runtime by @chelojimenez in #2711
• Set up local Playwright Chromium automatically by @ignaciojimenezr in #2707
• fix(servers): use create-if-missing for implicit server creates by @chelojimenez in #2673
• Tier B Phase 2 (Slice 3): host-app-bridge → @mcpjam/sdk/widget-runtime by @chelojimenez in #2713
• fix oauth debugger by @ignaciojimenezr in #2715
• fix(platform-mcp): widget render, empty-state, and local-dev auth by @chelojimenez in #2714
• Tier B Phase 3a: invert MCP Apps modal off inspector app-state by @chelojimenez in #2716
• feat(sdk): HostConfig harness field — foundation for a real Claude Code runtime by @chelojimenez in #2704
• Tier B Phase 3b: invert remaining widget-cluster app-state + extend guard by @chelojimenez in #2719
• fix(hosted): speed up guest cold load — drop project-loading gate + server-render guest bootstrap by @chelojimenez in #2718
• Tier B Phase 3c: scaffold @mcpjam/widget-react + prove the package boundary by @chelojimenez in #2720
• chore(changeset): release HostConfig harness field by @chelojimenez in #2717
• Tier B Phase 3d-i-a: relocate data/chrome/debug WidgetHost contract slices to the package by @chelojimenez in #2721
• Tier B Phase 3d-i-b: complete WidgetHost contract fold-in (inspector becomes a shim) by @chelojimenez in #2722
• Tier B Phase 3d-ii-a: relocate detection/parsing utils to @mcpjam/widget-react by @chelojimenez in #2723
• Tier B Phase 3d-ii-b: relocate app-tools registry + tool-input streaming by @chelojimenez in #2725
• cli: add mcpjam mcp — run MCPJam as a stdio MCP server by @chelojimenez in #2639
• fix(test): repoint cross-matrix-isolation guard at the relocated useToolInputStreaming impl by @chelojimenez in #2726
• fix(docker): copy widget-react workspace into inspector image build by @chelojimenez in #2729
• Tier B Phase 3d-ii (values): relocate extractMethod + stableStringifyJson to @mcpjam/sdk/widget-runtime by @chelojimenez in #2728
• fix(sdk): make stableStringifyJson key sort locale-independent by @chelojimenez in #2730
• Tier B Phase 3d-ii-c: relocate the interactive widget renderer into @mcpjam/widget-react by @chelojimenez in #2734
• Tier B Phase 3d-iii: harden @mcpjam/widget-react public surface (drop internal SDK types) by @chelojimenez in #2736
• Host compatibility report: design + L0 prototype by @chelojimenez in #2555
• Gate Claude Code host template behind PostHog flag by @chelojimenez in #2739
• Host nav: collapse the stacked double navbar into a single row by @chelojimenez in #2742
• feat(apps): headless widget render — mcpjam apps render by @chelojimenez in #2732
• Host Compare: offer static host profiles as opt-in columns by @chelojimenez in #2744
• Preserve structuredContent for MCP App widgets on the shared chat path by @chelojimenez in #2746
• Tier B: publish-enable @mcpjam/widget-react by @chelojimenez in #2738
• CLI: deliver update notice to any agent, not just TTYs by @chelojimenez in #2747
• Render Check by @ignaciojimenezr in #2748

New Contributors

• @olartgabo made their first contribution in #2676

Full Changelog: v2.12.0...v2.13.0