Release v3.3.6

What's Changed

• fix(ci): hash the bundled Node download from stdin, not by filename by @chelojimenez in #4634
• feat(local-harness): trust the runtime pack release key by @chelojimenez in #4635
• fix(ci): stop GNU tar reading the Windows out root as a remote host by @chelojimenez in #4641
• chore(local-harness): commit the 3.3.6 pack digest table by @chelojimenez in #4642
• fix: stamp MCPJam deployment date by @ignaciojimenezr in #4540
• fix(sdk): forward hasPerRequestStream so modern cancellation aborts t… by @ignaciojimenezr in #4474
• Mirror the 2026-09-02 host re-probe by @ignaciojimenezr in #4640
• BB-133: A/B guest credit-limit modal (benefit-led copy + CTAs) by @SebasKoria in #4365
• fix(error-card): let developers select and copy error text by @nachocossio in #4615
• Align Client Compare fields with Can I Use by @ignaciojimenezr in #4644
• evals: settings you draft and save, and a contract that says what each grader measures by @chelojimenez in #4629
• Agent browser on this machine: the local engine, and a lease that means it by @chelojimenez in #4628
• evals: Enter in the accuracy field reports one edit, not two by @chelojimenez in #4652
• Show when a client profile was last checked by @ignaciojimenezr in #4650
• Track each saved client setting by @ignaciojimenezr in #4654
• Agent browser: what the last round's fixes broke by @chelojimenez in #4653
• Save clients updated to latest by @ignaciojimenezr in #4655
• sandbox proxy: mount MCP App views by document.write so they run at a real URL by @chelojimenez in #4661
• Document sandbox origin for referrer-restricted APIs by @mintlify[bot] in #4662
• mcp apps: show the view's origin in the Sandbox Stack panel by @chelojimenez in #4665
• B3b W4 re-land: retire the browser's re-derivation of a graded verdict by @chelojimenez in #4664
• fix: carry the two "Tool list changed" knobs to the connection, hosted and local by @ignaciojimenezr in #4645
• mcp apps: host-origin pinning, ui.domain surfacing, and per-server view origins by @chelojimenez in #4671
• Trace destinations: organization settings, REST, SDK and CLI by @chelojimenez in #4656
• Local inspector reaches OAuth servers on your own network by @chelojimenez in #4669
• Agent browser: the desktop app gets the browser it already is by @chelojimenez in #4660
• Close four trace-destination review findings that landed after #4656 merged by @chelojimenez in #4674

Full Changelog: v3.3.5...v3.3.6