Release v3.16.1

What's Changed

• AGENTS.md: start the app with dev:worktree from a worktree by @chelojimenez in #6328
• Preserve chat model selections through server dispatch by @chelojimenez in #6322
• fix(chat): preserve saved selections at the picker boundary by @chelojimenez in #6323
• fix(chat): carry picker and compare selections through requests by @chelojimenez in #6324
• fix(evals): stop reporting ENV_* environment refusals as query errors by @prathmeshpatel in #6327
• Swarms: show refused XAA sign-ins as sign-in failures by @ignaciojimenezr in #6329
• fix(chat): complete hosted selection and harness policy copy by @chelojimenez in #6325
• Add jwt, auth, authorization and otp to SECRET_PARAM_KEYS by @olartgabo in #6272
• Chunk and serialize browser artifact writes by @nachocossio in #6374
• test(server): use a simulated clock for plugin latency by @ignaciojimenezr in #6399
• fix(client): require server selection for swarms by @ignaciojimenezr in #6375
• chore(playground): remove dead PlaygroundHostPicker and MultiHostPicker by @nachocossio in #6380
• fix(chat): re-read the own-key AI policy at most every 15 s per turn by @ZeHuari in #6376
• fix(test): cover pending organization deletions in visual fixtures by @chelojimenez in #6330
• Hosts editor: type the stored legacy selection and never write settings on it by @nachocossio in #6118
• sdk: preserve record-only selection markers by @chelojimenez in #6364
• chat: forward inherited selection labels and origins by @chelojimenez in #6365
• ai: stamp request attribution and agent selection by @chelojimenez in #6366
• usage: consume bounded organization summary pages by @chelojimenez in #6367
• usage: record actual local organization provider attempts by @chelojimenez in #6368
• harness: carry hosted choices through SDK and Inspector leases by @chelojimenez in #6369
• Reconstruct telemetry at a shared vendor boundary by @chelojimenez in #6332
• Document modelSelection and reasoning effort for SDK leases by @mintlify[bot] in #6406
• fix: forward applied reasoning effort to harness leases by @chelojimenez in #6397
• fix: refresh organization usage while the report stays open by @chelojimenez in #6398
• Generate finite telemetry file and event inventories by @chelojimenez in #6333
• Emit bounded server logs and canary health probes by @chelojimenez in #6334
• Publish hosted egress addresses for IP allowlists by @chelojimenez in #6405
• Serialize server diagnostics once before vendor delivery by @chelojimenez in #6335
• Serialize desktop diagnostics at the final transport by @chelojimenez in #6337
• usage: page each BYOK source through its own index by @chelojimenez in #6407
• Restrict server analytics while preserving trusted flag identity by @chelojimenez in #6338
• Restrict SDK telemetry once at final network delivery by @chelojimenez in #6340
• Prepare explicit recorder content fixtures by @chelojimenez in #6370
• Extract shared replay test fixtures by @chelojimenez in #6372
• Declare conservative strict telemetry policies by @chelojimenez in #6331
• Enforce strict PostHog schemas at the relay boundary by @chelojimenez in #6341
• Decode complete telemetry vendor evidence by @chelojimenez in #6379
• Keep capture policies and replay conservative across transitions by @chelojimenez in #6342
• Catalog exact browser assets for final diagnostics by @chelojimenez in #6344
• Serialize browser Sentry after capture and live policy checks by @chelojimenez in #6345
• Wire browser diagnostics through the final serializer by @chelojimenez in #6346
• Use bounded chat error diagnostics by @chelojimenez in #6347
• Fix Sentry Replay privacy level docs by @mintlify[bot] in #6411
• Remove unused browser request tracking by @chelojimenez in #6354
• fix(telemetry): preserve SDK diagnostic facts and protocol metadata by @chelojimenez in #6387
• fix(telemetry): derive owned catalogs and retain structured logs by @chelojimenez in #6388
• fix(telemetry): bind native diagnostics to builds and opt-outs by @chelojimenez in #6389
• fix(telemetry): retain relay facts with independent privacy controls by @chelojimenez in #6390
• Document MCPJAM_TELEMETRY_DISABLED for desktop app by @mintlify[bot] in #6412
• fix(telemetry): separate content and replay grants by @chelojimenez in #6391
• fix(telemetry): enforce live policy at final Sentry transport by @chelojimenez in #6392
• Fix telemetry privacy level description for navigation by @mintlify[bot] in #6413
• docs: address Okta SAML/SCIM review requirements by @chelojimenez in #6408
• fix(telemetry): prove identity and unload policy enforcement by @chelojimenez in #6393
• fix(telemetry): remove superseded server Sentry scrubbers by @chelojimenez in #6394
• fix(telemetry): remove native CSP reporting bypass by @chelojimenez in #6395
• fix(telemetry): preserve source-map IDs through publication by @chelojimenez in #6396
• Point the Docker docs at the published Docker Hub image by @nachocossio in #6362
• fix(docker): run compose from the published image by @nachocossio in #6371
• deps: remove sprintf-js from the root lockfile (Dependabot #925) by @olartgabo in #6403
• deps: drop braces and sprintf-js from two example lockfiles by @olartgabo in #6401
• feat(plugins): follow @openai/mcp-extensions 0.2.0 by @chelojimenez in #6414
• feat(plugins): OpenAI extended forms over MRTR by @chelojimenez in #6415
• feat(plugins): ui/message send:false opens an editable draft by @chelojimenez in #6418
• feat(plugins): resolve mention search through openai/mentions by @chelojimenez in #6416
• feat(plugins): follow OpenAI's display-mode rules by @chelojimenez in #6417
• feat(sdk): report a ChatGPT desktop build as Codex's App hostInfo by @chelojimenez in #6420
• feat(plugins): remove an App's model context as one server operation by @chelojimenez in #6419
• Show clear generation failures with request IDs by @ignaciojimenezr in #6385
• fix(telemetry): map browser Sentry environment from deployment by @chelojimenez in #6422
• fix(telemetry): stabilize Sentry grouping and upload server maps by @chelojimenez in #6421
• Docs: plugin entrypoints, settings type retirement, and MRTR SDK methods by @mintlify[bot] in #6438
• Changelog: ui/message draft, settings titles, entrypoints by @mintlify[bot] in #6439
• fix(browser): keep local Browser sessions off the hosted token mint by @weimar-torres-herrera in #6377
• chore(deps): bump the ai-sdk group across 1 directory with 11 updates by @dependabot[bot] in #6436
• ci: approve Dependabot PRs but stop adding them to the merge queue by @chelojimenez in #6446
• fix(oauth): unify Auto escalation cleanup; superseded is not failure by @weimar-torres-herrera in #6119
• fix(chat): remove empty text from Anthropic and Bedrock requests by @ignaciojimenezr in #6410
• fix(sdk): name the MCP server in refused and 404 connect errors by @ZeHuari in #6430
• feat(client): track pending case launches outside setup drawers by @ignaciojimenezr in #6431
• fix(client): show case runs immediately without blocking the page by @ignaciojimenezr in #6432
• Document case run startup behavior in Evaluate by @mintlify[bot] in #6454
• fix(docs): stop automatic publication and revert #6454 by @prathmeshpatel in #6457
• fix(auth): recover guest access after startup timeouts by @ignaciojimenezr in #6384
• fix: retry slow server check queue calls instead of failing connects by @ignaciojimenezr in #6467
• chore: add Inspector, CLI, and SDK release changeset by @ignaciojimenezr in #6472
• chore(release): version packages (3.16.1) by @chelojimenez in #6402

Full Changelog: v3.16.0...v3.16.1