v0.32.1

Security

• The desktop app now bundles Electron 44.10.0, whose Node 24.22.1 has the Brotli decoder fix for CVE-2026-111497 ("Node2Shell"). v0.32.0 refused Brotli responses on the old Node 24.21.0 as a stopgap (#7374). On the fixed Node that guard turns itself off. The bump also closes the Vertex AI sign-in path, which the guard did not cover. (#7684, #7358)
• xum run and xum workflow now install the same guard when they run on a Node without the fix (#7383).
• Remote MCP servers that redirect to another origin no longer connect, so Xum stops sending your MCP headers to a host you did not configure (@modelcontextprotocol/client 2.3.0, #7386). MCP OAuth scope discovery also follows only same-origin redirects (#7402).
• web_fetch refuses every network request while it parses a page's HTML (#7395).
• sharp 0.35.5 closes 3 high Dependabot alerts. Xum uses it to resize attached images and to decode MCP icons (#7389).
• Still open: the Nix package runs nixpkgs' electron_44, not the npm Electron. In this release's flake.lock that is 44.3.0 with Node 24.20.0, so on Nix the v0.32.0 guard stays on, and the Vertex AI sign-in path stays open, until nixpkgs ships 44.10.0.

Other changes

• Agent interface view (experiment). A new sub-experiment of Artifacts shows the agent's status.html page in the main pane instead of the chat, with the composer still visible (#7455). The Status page agent sub-experiment keeps that page current in the background, on a model you pick in Settings > Agents > Status Page (#7522). Agents get a nudge to publish and update the page (#7486), and a status bar on top of the view shows what the agent is doing and whether your last message arrived (#7661).
• Chat and composer. Open ask_user_question forms chain into one answer (#7388). Composer activity rows fold into the live line (#7660), and the workspace chat composer is one compact line (#7476). Skill references stay on /compact follow-ups and on /new and /fork start messages (#7532).
• Sidebar. The Pinned, Recent and Projects sections of the flat sidebar collapse (#7418). When the Artifacts tab already shows, Ctrl+Shift+K first moves focus into it, and only a press from inside the tab hides the sidebar (#7599).
• Plugins. Plugins install when their root plugin.json has no $schema (#7406), plugin skills load from snake_case folders (#7399), and long Add plugin errors wrap (#7641). Remote plugin snapshots are dropped when project trust changes outside the app (#7640), and remote plugin listings load faster (#7603).
• Phones and tablets. Fixes for the iPhone Duo PWA keyboard, taps and safe areas (#7520, #7431), iPad taps and rotation height (#7473), phone menus near the safe areas (#7460), and iOS text autosizing in artifact frames (#7480).
• Prompt cache and context. The MCP server list moves into the volatile system tail (#7653), frozen system sections stay on an assistant-last retry (#7654), post-compaction attachments go before the newest request (#7652), and the context estimate no longer overcounts at turn start (#7662).
• Reliability. The git status poll takes no index lock, so a concurrent commit cannot fail (#7633). A reported sub-agent reawakens for a parent message sent while it is still streaming (#7618). An artifact send that the session accepted is sent even if its turn cannot start (#7642). SSH askpass prompts cannot get an empty answer (#7512).
• Under the hood. effect 4.0.4 and undici 7.30.1 (#7625), plus refactors and new tests across the agent loop.

Full changelog: v0.32.0...v0.32.1