v0.16.0

Highlights

Adds an opt-in allowlist cookie policy for high-trust agent deployments, and fixes a subdomain auth bug where parent-domain session cookies were injected host-only and never reached app subdomains. Existing setups are unchanged: omitting a policy preserves the current sync-all / blocklist behavior.

What's Changed

• fix(cdp): faithful host-only/__Host- cookie injection on the sink path by @mvanhorn in #96
• fix(cmux): inject cookies via a hidden background tab (no popup, no sidebar workspace) by @mvanhorn in #97
• fix(livecdp): preserve leading dot on domain cookies (subdomain scope) by @kaushikgopal in #100
• Clarify install skill supports Codex by @thepraggyverse in #102
• feat: add cookie allowlist policy by @lennartorlando in #98

New Contributors

• @kaushikgopal made their first contribution in #100
• @thepraggyverse made their first contribution in #102
• @lennartorlando made their first contribution in #98

Full Changelog: v0.15.0...v0.16.0