Release v3.18.0

What's Changed

• sidebar: one hover card per item, one open at a time (PUR-110) by @moisonmaxime in #6815
• fix(oauth): name the server's certificate when TLS trust fails by @weimar-torres-herrera in #6832
• test(e2e): mock legalAcceptance:getStatus in the signed-in visual fixture by @nachocossio in #6851
• fix(server): relay MCP Apps resource reads in eval and swarm runs by @prathmeshpatel in #6803
• fix(browser): say why Chromium did not start instead of a bad project by @weimar-torres-herrera in #6833
• Only page on empty model replies MCPJam can own by @ignaciojimenezr in #6728
• Evaluate: go straight to creating a suite when none exists by @ZeHuari in #6822
• deps: clear the open Dependabot alerts (MCP SDK 1.32.1, storybook, electron, undici, zod, vite) by @olartgabo in #6862
• cli: keep dependency console output off stdout by @ZeHuari in #6854
• fix(telemetry): split frameless dependency errors out of one Sentry group by @nachocossio in #6849
• docs: redirect three paths that answer 404 by @ZeHuari in #6852
• evals: 404 a malformed id on the run-disclosure query, not 502 by @nachocossio in #6848
• fix(auth): answer an unreachable WorkOS with a 503 instead of paging by @nachocossio in #6858
• fix(skills): gate on a server skill loaded in an earlier request by @chelojimenez in #6857
• fix(chat): keep reasoning for org OpenAI Responses turns by @ignaciojimenezr in #6855
• conformance: report a 401 refusal as incomplete, not failed by @ZeHuari in #6856
• fix(sdk): forward MCPJam auth to goal-completion judges by @prathmeshpatel in #6846
• fix(client): agent-started eval runs use the Setup Run iteration count by @devin-ai-integration[bot] in #6818
• swarm: say why a target's setup failed, and log the real error by @devin-ai-integration[bot] in #6817
• feat(apps): add the shared WebMCP view relay foundation by @chelojimenez in #6845
• harness: don't count a widget that rejected its data as rendered by @chelojimenez in #6874
• logger: print run and session IDs on local console lines by @chelojimenez in #6875
• evals: accept public match option names on every case surface by @chelojimenez in #6876
• evals: grade a failed tool call's identical retry as one call by @chelojimenez in #6879
• feat(apps): use WebMCP view tools in Chat and Playground by @chelojimenez in #6870
• harness: generate the bake context without a built SDK by @chelojimenez in #6877
• feat(apps): add serialized view tools to browser sessions by @chelojimenez in #6871
• I1: resolve plain Playground turns through environments by @chelojimenez in #6882
• harness: drop the Codex config key 0.163.0 ignores by @chelojimenez in #6878
• feat(evals): enforce policy and record MCP App view tools by @chelojimenez in #6872
• Preserve available swarm turn evidence on timeout by @prathmeshpatel in #6841
• I2: resolve v1 chat turns through saved setups by @chelojimenez in #6883
• I3: compose plugin setups per comparison client by @chelojimenez in #6884
• Normalize hosted setup before execution (cleanup groundwork) by @chelojimenez in #6885
• I4: remove legacy hosted chat execution paths by @chelojimenez in #6888
• Attach sandboxes through guarded backend preparation by @chelojimenez in #6890
• Follow the backend's hosted-browser answer, and expire it (KES-720 Phase 3) by @chelojimenez in #6891
• Keep app-tool turns from raising a false chat conflict by @chelojimenez in #6894
• Gate native MCP execution with durable approval and evidence by @chelojimenez in #6896
• Skip the tool snapshot on a timed-out swarm turn by @chelojimenez in #6887
• feat(playground): list and run MCP App tools in the Tools panel by @chelojimenez in #6897
• fix(playground): share App tools in the zero-server panel by @chelojimenez in #6898
• Don't crash on a null hosted-browser availability answer by @chelojimenez in #6903
• Preserve native MCP HTTP requests and streamed results by @chelojimenez in #6899
• Run native Claude chats through the forwarding gate by @chelojimenez in #6902
• playground: say when a client's model needs sign-in by @ignaciojimenezr in #6873
• chore: add Inspector, CLI, and SDK release changeset by @ignaciojimenezr in #6906
• Restore scoped RPC logs for native Claude forwarding by @chelojimenez in #6907
• Add a service-token route for the hourly hosted-browser synthetic check (KES-720 Phase 5) by @chelojimenez in #6904
• Remove the hosted-browser env switches; the flag decides launch (KES-720) by @chelojimenez in #6895
• chore(release): version packages (3.18.0) by @chelojimenez in #6860

Full Changelog: v3.17.0...v3.18.0