2.5.0

What's Changed

• test(smoke): run the headless web smokes in Firefox via the pre-push gate by @cliffhall in #2133
• fix: render tool schemas with root-level anyOf/oneOf composition by @cliffhall in #2137
• chore(web): move App.tsx's module-level block into files by @cliffhall in #2149
• chore(web): extract App.tsx's leaf hooks by @cliffhall in #2150
• chore(web): collapse App.tsx's six session refs into useSessionRef by @cliffhall in #2152
• fix(scripts): make smoke:tui assert the TUI survives its first frame (#2147) by @cliffhall in #2158
• ci: run the coverage gate in a parallel job instead of serially after validate by @cliffhall in #2160
• chore(web): extract App.tsx's OAuth recovery cluster into useOAuthRecovery by @cliffhall in #2162
• chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs by @cliffhall in #2164
• chore(web): extract App.tsx's MCP Apps wiring into useMcpApps by @cliffhall in #2166
• chore(scripts): rename the local pre-push gate off ci, and guard it out of CI (#2146) by @cliffhall in #2167
• chore(web): extract App.tsx's connection lifecycle into useConnectionLifecycle by @cliffhall in #2169
• feat(web): use the Ace JSON editor everywhere, and restore the raw-JSON toggle by @cliffhall in #2170
• chore(web): extract App.tsx's server commands into useServerCommands by @cliffhall in #2173
• fix: say why a never-acknowledged subscriptions/listen ended, instead of retrying it eight times by @cliffhall in #2176
• fix(web): surface failed resource subscribe/unsubscribe by @cliffhall in #2179
• fix(web): refuse a raw-JSON tool argument the schema would retype by @cliffhall in #2175
• fix(scripts): give the render-smoke overlap test room for process startup by @cliffhall in #2178
• test(scripts): anchor the render-smoke overlap paint to the parent's clock by @cliffhall in #2181
• chore(web): collapse InspectorView's prop wall into domain bundles by @cliffhall in #2182
• fix: cancel a Streamable HTTP call by closing its stream (#2140) by @cliffhall in #2185
• feat(auth): revoke OAuth tokens at the authorization server on clear (RFC 7009) by @cliffhall in #2186
• fix(auth): accept RFC 8414 metadata served at the OIDC well-known path by @cliffhall in #2184
• fix(core): read state stores during render instead of re-syncing in an effect by @cliffhall in #2193
• chore(web): resolve the react-hooks findings App.tsx's decomposition unmasked (#2161) by @cliffhall in #2191
• fix(web): terminate the five void-discarded OAuth recovery promises by @cliffhall in #2190
• chore: lint core/react with eslint-plugin-react-hooks by @cliffhall in #2194
• chore: extract AGENTS.md recipes into agent skills by @cliffhall in #2189
• chore: consolidate duplicated runtime dependencies into the root package.json by @cliffhall in #2200
• chore: consolidate shared toolchain devDependencies into the root package.json by @cliffhall in #2199
• docs: tune skill eval cases and document how to write them by @cliffhall in #2203
• chore: bump version to 2.5.0 by @cliffhall in #2213
• chore: merge v2/main for the v2.5.0 milestone release by @cliffhall in #2215

Full Changelog: 2.4.0...2.5.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.5.0