Release v3.12.0

What's Changed

• Show a built-in runner check on every stage the runner measures by @chelojimenez in #5488
• Document built-in runner checks for 4 eval stages by @mintlify[bot] in #5495
• feat(user-testing): tell a tester when a server didn't connect by @olartgabo in #4062
• Meter the signed-in caller on /api/web/* (MJ-012) by @olartgabo in #5451
• Make the compare-plans table read as one recommended column by @olartgabo in #5327
• Scale the runs table pass rate so it stops reading 1% by @olartgabo in #5311
• Close the two disclosed MJ-001 residuals by @olartgabo in #5447
• Stop offering plan changes the server refuses by @olartgabo in #5331
• Refuse hosted chat on a project the caller is not a member of (MJ-013) by @olartgabo in #5404
• Keep persisted conformance runs behind the pinned egress guard (MJ-001) by @chelojimenez in #5459
• Enforce tool approval on the server for gated operations (MJ-008) by @chelojimenez in #5462
• Let org admins revoke any organization API key, and expire keys by default (MJ-010) by @chelojimenez in #5461
• Upload avatars and logos through the server, and store widget HTML as text (MJ-004, MJ-006) by @chelojimenez in #5464
• Verify tool results and assistant turns in client-sent history (MJ-009) by @chelojimenez in #5466
• Read private chat artifacts through authorized, short-lived links (MJ-005, MJ-007) by @chelojimenez in #5465
• Add internal diagnostics for Electron proxy failures by @ignaciojimenezr in #5493
• Stop calling a partial balance or a transient hold "out of credits" by @olartgabo in #5445
• Map billing refusals to copy instead of toasting the Convex payload by @olartgabo in #5333
• Revoke AuthKit sessions on sign-out and verify bearers at the gateway (MJ-011) by @chelojimenez in #5463
• log: stop a failed console write from escaping into its caller by @ZeHuari in #5458
• updater: stop reporting a skipped install as an unhandled rejection by @ZeHuari in #5434
• deps: update next, wrangler, sharp, fflate, uuid and pin postcss by @chelojimenez in #5504
• deps(examples): refresh sample app lockfiles within existing ranges by @chelojimenez in #5503
• ci: pin actions/download-artifact to v4.3.0 by commit SHA by @chelojimenez in #5502
• Stop browser-injected stack overflows paging #mcpjam-alerts by @nachocossio in #5476
• diagnostics: record failed OAuth proxy endpoint in error reports by @ignaciojimenezr in #5512
• Trace Convex query failures with client correlation details by @ignaciojimenezr in #5511
• Let Dependabot updates land on their own, and land the production group by @chelojimenez in #5506
• Bump example apps to Vite 8, plugin-react 6, TypeScript 7 and dotenv 18 by @chelojimenez in #5507
• Bump open 11, marked 18, date-fns 4, concurrently 10, and TypeScript 7 in the check fixture by @chelojimenez in #5508
• Bump ESLint to 10 in the inspector and the SDK by @chelojimenez in #5509
• Bump Vite to 8 in the inspector and the MCP app UI build by @chelojimenez in #5510
• Split the tool-call arguments into their own scorer at Tool call by @chelojimenez in #5492
• Pass PR branch names to preview workflow steps through env by @chelojimenez in #5521
• Pause rubric checks in settings when the goal judge's policy is off by @chelojimenez in #5501
• fix(auth): cancel queries before auth loss and show loading during logout by @ignaciojimenezr in #5513
• Reopen the auth popup after the AS rejects the debugger's authorization code by @SebasKoria in #5439
• oauth: stop filing a server's missing resource metadata as our error by @ZeHuari in #5470
• Give each swarm goal card session one status by @nachocossio in #5483
• Changelog: swarm session chip redesign (2026-09-24) by @mintlify[bot] in #5533
• swarms: drop the actionable-findings list from the Findings tab by @ZeHuari in #5534
• Changelog: swarm Findings tab removes actionable-findings list by @mintlify[bot] in #5535
• fix(server): noindex the app shell and serve a real robots.txt by @nachocossio in #3336
• Harden connection handling (MJ-003) by @chelojimenez in #5523
• Docs: add 403 credential origin mismatch troubleshooting by @mintlify[bot] in #5542
• Keep public-client and DCR XAA servers connecting (MJ-003 follow-up) by @chelojimenez in #5543
• Harden web error handling (MJ-020, MJ-021) by @chelojimenez in #5528
• Harden telemetry compatibility (MJ-015) by @chelojimenez in #5529
• Update Soundcheck authentication dependencies by @chelojimenez in #5527
• Bump the development-dependencies group across 1 directory with 14 updates by @dependabot[bot] in #5517
• chore: add release changeset for inspector, CLI, and SDK by @ignaciojimenezr in #5545
• Retry suite starts after database conflicts by @ignaciojimenezr in #5538
• Grey out delete for a server group in use by @ignaciojimenezr in #5539
• Keep users signed in on reload (fix workos-has-session cookie value) by @ignaciojimenezr in #5547
• Upload client source maps to PostHog before Sentry deletes them by @nachocossio in #5530
• Backtest: rule out the tool scorers from half the frozen evidence by @chelojimenez in #5520
• chore(release): version packages by @chelojimenez in #5551

Full Changelog: v3.11.0...v3.12.0