v0.31.1

Security

• Requests with a compressed body, such as Content-Encoding: br, now get 415 before any auth check. Before this, a client that could reach the port could feed bytes to Node's bundled Brotli decoder (CVE-2026-111497, "Node2Shell") without a token. The fix covers xum server, the Docker image and the desktop app's API server. (#7359)
• The CLI warns on Node releases without the Brotli fix. engines.node now requires ^22.23.4 || ^24.22.1 || >=26.12.1 (it was >=22), and the Docker build fails when its Node is affected. (#7359)
• Published packages ship an npm-shrinkwrap.json generated from bun.lock, with digests (#7234). xum server self-updates now install the versions that the release's shrinkwrap pins, and they refuse a release whose shrinkwrap lacks digests. Stable 0.31.0 is refused for that reason, so a server on this release cannot go back to 0.31.0 through self-update. (#7346)
• Still open: the desktop app's bundled Electron 44.5.1 runs Node 24.21.0. Its outbound fetches (MCP servers, provider base URLs, OAuth endpoints) still decode Brotli responses from remote servers. #7358 tracks the Electron bump until a stable Electron bundles Node 24.22.1 or newer.

Highlights

• Plugins with review before they run. Claude Code plugins and marketplace plugins install from Settings → Plugins. Their commands load as user skills, and their hooks never run (#7130, #7133, #7134). Codex-format plugin hooks run only after you trust them, and trust is kept per hook hash (#6150, #6155). A changed plugin skill or workflow script keeps its approved version until you review it (#6987).
• MCP Apps and Artifacts. MCP App views open in their own right-sidebar tabs, from the command palette, and from the New tab launcher (#6132, #6133, #6441). Each server needs consent for the domains its views reach (#6137). MCP Apps is now its own experiment, off by default. Users who had Artifacts on keep MCP Apps on after upgrading (#6769). HTML artifacts can open a workspace (#6225) and load CDN stylesheets and fonts (#7325).
• Right sidebar and chat list. The right sidebar has Codex-style tabs with a New tab launcher, and /side chats open in a tab (#5920, #5884). A collapsed sidebar shows an overview card (#6089). Ctrl+Shift+B toggles it, and its open or closed state is kept per workspace (#7128, #7106). The flat chat list adds Pinned and Recent sections and project avatars (#6978).
• Cost and prompt-cache visibility. The Costs tab shows prompt-cache health for each turn (#6236). Anthropic requests are checked for prompt-cache prefix breaks, and each break appears in the timeline (#6238, #6311). Pricing is corrected for 1-hour Anthropic cache writes and Sonnet 5.5 cache reads (#6235), and long-context requests are priced at the tier each request reaches (#6741, #7119).
• Providers and models. Google Vertex AI is a built-in provider (google-vertex) that accepts Google Cloud credentials or a Vertex express mode API key (#6825). Meta's Muse Wonder is available through the Meta Model API (#6286), and Gemini Cyber model metadata now covers Vertex AI (#7357). Catalogue GPT-5.6 models get back Extra High, Max and Pro modes (#7347). Fast mode follows the chat for every provider (#6830).
• Goals, tasks and chat messaging. A paused goal can be marked complete without resuming it (#6222). Default task limits rise to 32 parallel tasks and nesting depth 5, and a one-time migration moves configs that still hold the old defaults (#6390). The Exec agent can call ask_user_question without blocking its turn (#6209), and open questions stay docked above the chat input (#6887). A side chat and its main chat can exchange explicit messages (#6281), and chats that share a user-set @tag can message each other (#6407).
• Resource limits for local agents. Settings → Agents → Resource limits is off by default. When it is on, one CPU limit and one memory limit apply to all local agent commands. Xum enforces them with a Linux cgroup v2 that must be delegated to the user running Xum (#6894). A project can set its own limit inside the shared one (#7115).
• Faster loads and steadier long chats. Settings, Mermaid diagrams, the terminal view, right-sidebar panels, tool cards and the command palette now load on first use (#6057, #6037, #6028, #6081, #6800, #6998). Hashed web UI assets are served precompressed and immutable (#5953), and the first-run page paints before the app script loads (#6600). Long transcripts cap how many rows stay mounted (#6889). New worktree workspaces open without waiting for the origin fetch (#6661). Diffs of large files use bounded memory, and far-apart edits now produce hunks (#7020, #7024).
• Contrast and landmarks. Muted and secondary text, inline code, syntax colors and tinted action buttons meet WCAG AA contrast in the light and dark themes (#5973, #5987, #6455, #6545, #6768). The workspace page has one main landmark in every layout (#5967), and the arrow keys move between right-sidebar tabs (#7173).
• Removed features. The advisor model (#5976), layout presets (#7112), the Xum Gateway provider and its login (#7268), and the Memory Intuition and Memory Hot Set experiments (#7348, #7349) are removed. The Coder AI Gateway, OpenRouter, Bedrock and GitHub Copilot routes remain. Saved chats still show old advisor and Intuition tool calls (#5976, #7348).

Full changelog: v0.31.0...v0.31.1