Release v3.16.2

What's Changed

• Web search: show why it's off under an organization's own-key policy by @chelojimenez in #6455
• Web search: choose an organization search model by @chelojimenez in #6463
• fix(client): retry permitted profiles after policy transitions by @chelojimenez in #6484
• fix(telemetry): retain hosted model catalog failure signal by @chelojimenez in #6478
• build(telemetry): generate telemetry catalogs at every entry point instead of committing them by @chelojimenez in #6466
• fix(client): replace repeated swarm persona summaries with one warning by @prathmeshpatel in #6383
• docs: list every redacted URL parameter in the telemetry privacy guide by @olartgabo in #6382
• feat(inspector): link the Privacy Policy and Terms of Use from About by @olartgabo in #6448
• fix(oauth): give bearer tokens room past the 8 KiB header cap by @ZeHuari in #6311
• fix(e2e): defer local fixtures in deployed smoke by @chelojimenez in #6490
• fix(client): prompt guests to sign in before eval case generation by @prathmeshpatel in #6288
• server: keep the local UI's own origin when ALLOWED_ORIGINS is set by @ZeHuari in #5739
• fix(inspector): serve fonts from the bundle instead of Google Fonts by @olartgabo in #6447
• Turn the adversarial review into a phased review pipeline with autofix by @moisonmaxime in #6444
• fix(telemetry): mask all text in PostHog replay at the full level by @olartgabo in #6451
• fix(swarms): show recorded verdicts and unread findings coverage by @ozboms in #6424
• feat(sdk): read Codex and legacy plugin layouts under a compatible parser profile by @chelojimenez in #6456
• feat(client): run a plugin without the one server a member can't use yet by @chelojimenez in #6469
• feat(plugins): prepare every plugin stdio server, in the plugin root by @chelojimenez in #6471
• feat(sdk): adapt legacy Codex and Claude MCP configs under the compatible profile by @chelojimenez in #6459
• refactor(server): move turn notice writers and scenario harness refusals into their own modules by @chelojimenez in #6473
• feat(plugins): check a plugin server's launch after its placeholders resolve by @chelojimenez in #6481
• refactor(sdk): move MCP entry value normalizers out of mcp-config.ts by @chelojimenez in #6460
• feat(chat): run a Playground turn without a plugin's server that fails by @chelojimenez in #6474
• feat(sdk): read OpenAI per-server auth into a typed descriptor by @chelojimenez in #6461
• feat(client): say which plugin a Playground turn ran without a server of by @chelojimenez in #6475
• feat(client): sign in to a plugin's server from its card and Settings by @chelojimenez in #6479
• Plugin extensions: forms from model calls without elicitation, 5 MB model and settings Apps by @chelojimenez in #6502
• feat(sdk): read keyed .app.json, OpenAI display names and validated onboarding by @chelojimenez in #6462
• feat(client): offer Sign in on the chat's plugin notice by @chelojimenez in #6480
• fix(sdk): enforce URL, header and cwd rules, and stop rejecting plugins for metadata URLs by @chelojimenez in #6464
• feat(client): run plugins' local servers for a client run on this machine by @chelojimenez in #6483
• feat(sdk): record executable files, parser revision and an execution digest by @chelojimenez in #6465
• feat(server): read onboarding for a plugin that has no server by @chelojimenez in #6485
• refactor(client): move the Playground's onboarding send into its own module by @chelojimenez in #6486
• fix(sdk): find letter-only and percent-encoded keys in plugin URLs by @chelojimenez in #6505
• feat(plugins): keep a bundle's executable bits in the cache and the box by @chelojimenez in #6470
• feat(client): set up and run onboarding for a plugin with no server by @chelojimenez in #6487
• feat: trace each plugin onboarding attempt and record where a stalled one stopped by @chelojimenez in #6488
• feat(client): sign in first, then resume a plugin's onboarding by @chelojimenez in #6489
• fix(plugins): retain scope challenges through sign-in by @chelojimenez in #6500
• Let any project member get an empty project's first client by @nachocossio in #6304
• fix(evals): decouple SDK export from live capability checks by @ozboms in #6425
• fix(client): explain unavailable organization links by @prathmeshpatel in #6525
• chore(inspector): remove the Meticulous session recorder and CI workflow by @olartgabo in #6528
• fix(client): avoid inaccessible shared-settings plans CTA by @prathmeshpatel in #6287
• fix(client): lock frontier model pickers for authenticated guests by @prathmeshpatel in #6243
• Ask every PR for its task, spec and plan by @ozboms in #6427
• fix(sdk): refuse a ZIP link entry whose name ends in a slash by @chelojimenez in #6506
• chore(observability): audit PP-80 endpoint inventory by @ozboms in #6428
• fix(apps): stop chat widgets going blank after a turn by @ignaciojimenezr in #6530
• Stop the UI copy extractor reading TypeScript generics as JSX text by @nachocossio in #6522
• Stop the UI copy extractor reading JSX ternary branches as copy by @nachocossio in #6523
• fix(ci): run dogfood evals on a CLI with the 120s eval deadline by @weimar-torres-herrera in #6507
• docs: add YouTube, Instagram and TikTok to README links by @Paoli99 in #6534
• swarms: launch sponsored splits in one click and tighten the copy by @prathmeshpatel in #6131
• fix(client): recover from oversized guest assistant requests by @prathmeshpatel in #6378
• fix(chat): stop paging on retired and org-blocked model refusals by @ignaciojimenezr in #6498
• test: keep SDK and Vitest test runs out of production telemetry by @chelojimenez in #6509
• fix(telemetry): redact provider tokens in logs and model-bound errors by @chelojimenez in #6638
• fix(telemetry): log verified org, project and server IDs from request context only by @chelojimenez in #6642
• ci(slop): raise the PR size budget to 800 and count a moved line once by @chelojimenez in #6685
• docs(agents): tighten AGENTS.md and close the gaps agents hit by @prathmeshpatel in #6708
• fix(client): show update tray icon in collapsed sidebar by @prathmeshpatel in #6709
• fix(chat): keep org BYOK on the local route in the local app by @ignaciojimenezr in #6711
• test(chat-v2): fix flaky hung-server tool listing test by @ignaciojimenezr in #6720
• Share saved platform login and refresh with the SDK by @chelojimenez in #6713
• Require online identity before every official eval run by @chelojimenez in #6714
• Explain eval identity and prepare the SDK and CLI migration by @chelojimenez in #6715
• docs: self-host Geist and link the Privacy Policy and Terms of Use by @olartgabo in #6458
• Consolidate eval mapping and executor wrapping by @chelojimenez in #6722
• Prepay direct SDK eval iterations by @chelojimenez in #6723
• Complete suite, CLI and Vitest eval payments by @chelojimenez in #6725
• fix(inspector): link Terms and Privacy Policy in guest and checkout dialogs by @olartgabo in #6503
• fix(electron): restart once instead of crashing when the port is taken by @ignaciojimenezr in #6497
• Swarms: explain a call to a tool the server does not have by @ignaciojimenezr in #6727
• feat(inspector): show saved system prompt attribution (BB-360) by @prathmeshpatel in #6732
• fix(clients): exclude server selection from host binding identity by @chelojimenez in #6735
• fix(harness): preserve approval continuity through reloads by @chelojimenez in #6729
• feat(codex): pin runtime 0.163.0 and qualified GPT-6 models by @chelojimenez in #6740
• fix(traces): persist and attribute harness tool outcomes by @chelojimenez in #6731
• fix(harness): release turn lanes when saving fails by @chelojimenez in #6734
• feat(claude-code): default new clients to Haiku 5.5 by @chelojimenez in #6743
• fix(playground): require local setup before sending by @chelojimenez in #6739
• refactor(evals): extract shared resource selectors by @chelojimenez in #6733
• fix(flags): isolate server-evaluated flags by browser tab by @chelojimenez in #6737
• fix(clients): show actionable execution refusals by @chelojimenez in #6738
• fix(harness): preserve local approvals and MCP connections by @chelojimenez in #6730
• feat(codex): prepare attended Windows execution by @chelojimenez in #6741
• fix(evals): resolve client launches through environments by @chelojimenez in #6736
• feat(codex): prepare Intel Mac and unattended Apple silicon targets by @chelojimenez in #6742
• ci(local-harness): build the SDK before verifying a pack by @chelojimenez in #6745
• Let goals choose their judge model over the API and at swarm creation by @nachocossio in #6524
• Move the Playground's first clients onto ensureProjectClient by @nachocossio in #6312
• fix(evals): let GitHub checks run when a group server was deleted by @weimar-torres-herrera in #6526
• chore: add Inspector, CLI, and SDK release changeset by @ignaciojimenezr in #6783
• fix(evals): explain a model search with no match by @weimar-torres-herrera in #6641
• fix(oauth): redeem the debugger's auth code before it expires by @weimar-torres-herrera in #6400
• fix(local-harness): drop Codex update_plan conformance check by @ignaciojimenezr in #6785
• ci(local-harness): add a Codex Windows conformance leg by @ignaciojimenezr in #6786
• chore(release): version packages (3.16.2) by @chelojimenez in #6499

Full Changelog: v3.16.1...v3.16.2