Release v3.16.0

What's Changed

• PR size check: 400-line budget, 1,500 hard limit unless mechanical by @prathmeshpatel in #6140
• Typecheck the inspector server in CI, as a per-file ratchet by @prathmeshpatel in #6142
• Git pre-commit and pre-push hooks: slop checks for every agent and person by @prathmeshpatel in #6170
• ci: timeout-minutes on the remaining PR-triggered jobs by @prathmeshpatel in #6147
• Claude Code hooks: check the session's repo; Stop counts only this turn's untracked files by @prathmeshpatel in #6168
• test: wait for the OAuth gate after the trigger click in ScenarioChatPage by @prathmeshpatel in #6159
• Slop rules for user-facing copy: dashes, filler, vague errors by @prathmeshpatel in #6149
• UI Copy Review: Haiku 5.5 classifies new copy, Sonnet 5.5 rewrites what it flags by @prathmeshpatel in #6150
• Add Meticulous visual testing for the Inspector client by @chelojimenez in #6152
• Harden enterprise telemetry privacy: backend-resolved policy, identity grant, relay enforcement by @chelojimenez in #6136
• Run Claude Code and Codex on the organization's own provider keys by @chelojimenez in #6135
• Show the out-of-credits dialog once; gray out runs that can only fail (PLB-175) by @ignaciojimenezr in #6126
• fix(auth): let enterprise SSO start without a guest session by @chelojimenez in #6185
• Document out-of-credits disabled buttons and dialog dismiss by @mintlify[bot] in #6186
• Move CODEOWNERS to /.github so the code-owner review rule enforces by @prathmeshpatel in #6182
• Scrub customer content from error reports and server logs by @chelojimenez in #6123
• Devin setup: skills, REVIEW.md, DeepWiki steering and a hook probe by @prathmeshpatel in #6156
• Credential-safe telemetry (1/7): credential-URL registry and its tests by @chelojimenez in #6160
• Credential-safe telemetry (2/7): scrub credential URLs at every PostHog exit by @chelojimenez in #6161
• Credential-safe telemetry (3/7): scrub credential URLs at every Sentry exit by @chelojimenez in #6162
• Show shared paid credits in the sidebar credits card by @Paoli99 in #5205
• ci: run required checks in the merge queue by @prathmeshpatel in #6237
• Credential-safe telemetry (4/7): scrub credentials in the PostHog relay and server logs by @chelojimenez in #6163
• Paper case editor 1/5: check field editors by @ignaciojimenezr in #6178
• Credential-safe telemetry (5/7): take callback codes and share tokens out of the address bar by @chelojimenez in #6164
• Credential-safe telemetry (6/7): prove telemetry egress end to end by @chelojimenez in #6165
• Credential-safe telemetry (7/7): leak monitor, vendor containment configs and docs by @chelojimenez in #6166
• ci: run Dependency Audit on stacked PRs by @ignaciojimenezr in #6245
• chore: clarify CODEOWNERS and add area reviewers by @prathmeshpatel in #6235
• ci: run the test jobs on Blacksmith runners by @chelojimenez in #6244
• ci: add Chromatic capture foundation by @prathmeshpatel in #6207
• test: capture hosted overview and tool results by @prathmeshpatel in #6229
• test: capture chat apps and evaluation failures by @prathmeshpatel in #6230
• test: capture Swarm overview personas and sessions by @prathmeshpatel in #6231
• test: capture MCP tool error results by @prathmeshpatel in #6232
• test: capture Swarm empty and creation states by @prathmeshpatel in #6233
• test: isolate staging login and refresh guard by @prathmeshpatel in #6234
• Open the daily Inspector version PR at 5 PM Pacific by @prathmeshpatel in #6187
• Org AI keys 1a: Shared AI refusal vocabulary by @chelojimenez in #6197
• Org AI keys 1b: Shared AI refusal copy by @chelojimenez in #6198
• Org AI keys 1c: SDK and CLI refusal handling by @chelojimenez in #6199
• Host templates (SDK): match real esm.sh behavior (Claude blocks, ChatGPT/Codex allow) (PLB-298) by @ignaciojimenezr in #6236
• test: raise visual suite timeouts and report the real staging sign-in error by @prathmeshpatel in #6273
• Org AI keys 1e: Show organization policy refusals in chat by @chelojimenez in #6167
• Org AI keys 1d: Browser refusal helpers by @chelojimenez in #6200
• Paper case editor 2/5: step fields and drag handles by @ignaciojimenezr in #6179
• ci: add adversarial PR reviews with Claude Sonnet by @prathmeshpatel in #6276
• deps: shell-quote 1.12.0 (4 critical Dependabot alerts) by @chelojimenez in #6277
• Paper case editor 3/5: check and action rows by @ignaciojimenezr in #6180
• deps: handlebars 4.7.10 (2 CRITICAL Dependabot alerts) by @olartgabo in #6116
• Org AI keys 9a: Read organization policy and eligibility by @chelojimenez in #6202
• Org AI keys 9b: Preserve typed route refusals by @chelojimenez in #6203
• Org AI keys 9c: Enforce policy on eval model selections by @chelojimenez in #6204
• run-inspector skill: give agents a working guest profile by @prathmeshpatel in #6269
• fix(ci): remove unsupported Claude review schema constraint by @prathmeshpatel in #6281
• Paper case editor 4/5: case spine and Add drawer by @ignaciojimenezr in #6181
• Give the suite judge model its own settings section by @ignaciojimenezr in #6271
• Update bundled Codex and Copilot templates from the 2026-10-12 probes by @ignaciojimenezr in #6275
• Document grading instructions as API/CLI-only setting by @mintlify[bot] in #6283
• Fix stale Copilot preset reference in host-templates docs by @mintlify[bot] in #6284
• WIP: checkpoint manual test Paper UI redesign by @ignaciojimenezr in #6105
• Update eval case workspace docs for Paper spine redesign by @mintlify[bot] in #6285
• Same-origin app iframe: client setting, opaque mount, caniuse row (PLB-296) by @ignaciojimenezr in #6132
• Document sameOriginAppIframe client setting by @mintlify[bot] in #6286
• Org AI keys 9d: Authorize runs carrying their own keys by @chelojimenez in #6205
• Org AI keys 9e: Policy-aware SDK leases and run reports by @chelojimenez in #6247
• Document orgPolicy refusal and AI_POLICY_REFUSED error by @mintlify[bot] in #6291
• Org AI keys 9f: Authorize local provider attempts and share judge overrides by @chelojimenez in #6169
• Bump the example-dependencies group across 6 directories with 7 updates by @dependabot[bot] in #6280
• deps: lift shell-quote, source-map-js, http-cache-semantics, sharp and MCP SDK out of advisory ranges by @olartgabo in #6100
• Org AI keys 10a: Read picker policy configuration by @chelojimenez in #6248
• Org AI keys 10b: Compose eligible model choices by @chelojimenez in #6249
• Org AI keys 10c: Apply policy to chat and environment pickers by @chelojimenez in #6250
• Document org AI key policy in model picker by @mintlify[bot] in #6294
• Org AI keys 10d: Apply policy to explicit judge choices by @chelojimenez in #6251
• Org AI keys 10e: Apply policy to eval target choices by @chelojimenez in #6252
• Org AI keys 10f: Preserve case-model connection identity by @chelojimenez in #6171
• Org AI keys 11a: Preserve structured launch problems by @chelojimenez in #6253
• Org AI keys 11b: Show actionable launch problems by @chelojimenez in #6254
• Org AI keys 11c: Check organization model choices before launch by @chelojimenez in #6255
• Update org/keys_required error code docs by @mintlify[bot] in #6299
• Org AI keys 11d: Check judge and harness launch prerequisites by @chelojimenez in #6256
• Org AI keys 11e: Show unavailable analysis as not analyzed by @chelojimenez in #6172
• Org AI keys 12: the switch (inspector) by @chelojimenez in #6173
• Org AI keys 13a: Read organization AI model configuration by @chelojimenez in #6257
• Org AI keys 13b: Display the organization default model by @chelojimenez in #6258
• Org AI keys 13c: Test and clear the organization default model by @chelojimenez in #6259
• Org AI keys 13d: Choose the organization default model by @chelojimenez in #6260
• Org AI keys 13e: Explain default model feature coverage by @chelojimenez in #6261
• fix(auth): recover stale project URLs after sign-in by @ignaciojimenezr in #6109
• Docs: org default AI model unconfigured states by @mintlify[bot] in #6307
• Org AI keys 13f: Align default model copy across SDK docs and billing by @chelojimenez in #6175
• Org AI keys 14: review fixes by @chelojimenez in #6266
• fix(swarms): send the canonical hosted model id to /stream by @ZeHuari in #6124
• fix(guest): stop guest token refresh at a 429 instead of retrying into it by @ZeHuari in #6309
• Adversarial review: budget the diff, and skip instead of failing by @chelojimenez in #6310
• Fix two timing flakes in client tests by @chelojimenez in #6270
• Stop the staging login check blocking the app's own on-load calls by @chelojimenez in #6274
• fix(sdk): sync Copilot default to GPT-5.6 Luna by @ignaciojimenezr in #6315
• Show pending organization deletions and allow cancellation by @chelojimenez in #6246
• fix(client): explain unavailable auth on HTTP custom domains by @ignaciojimenezr in #6314
• chore(release): version packages (3.16.0) by @chelojimenez in #6318
• e2e: run the smoke suite against the community backend, never production by @chelojimenez in #6190
• Publish the Docker Hub image on every Inspector release again by @nachocossio in #6298
• fix(test): drain staging proxy routes before context teardown by @prathmeshpatel in #6302
• ci(release): ping #prs with @channel when a version PR opens by @chelojimenez in #6319

Full Changelog: v3.15.0...v3.16.0