v5.0.0a1

What's Changed

• fix(ui): anchor notebook inline chat to the cursor line by @herikwebb in #191
• chore(security): upgrade dependencies to address known CVEs by @pjdoland in #197
• a11y: keyboard + screen-reader fixes across chat sidebar and popovers by @pjdoland in #205
• a11y(settings): convert tabs to ARIA tablist with arrow-key nav by @pjdoland in #206
• test(ui): scaffold Galata-based Playwright UI test suite by @pjdoland in #207
• feat(settings): promote Skills to a top-level tab + admin policy gate by @pjdoland in #224
• feat(settings): add Claude-mode MCP Servers tab + admin policy gate by @pjdoland in #225
• feat(settings): add Claude-mode Plugins management tab + admin policy gate by @pjdoland in #226
• fix(notebook-toolbar): make update button work outside Claude mode by @pjdoland in #238
• fix(launcher): show Claude Code tile whenever the CLI is available by @pjdoland in #239
• fix(notebook-toolbar): focus prompt textarea when popover opens by @pjdoland in #240
• feat(config): layer additional_skipped_workspace_directories on NBI config by @pjdoland in #241
• docs(contributing): document traitlet vs env var vs config-file guidance by @pjdoland in #242
• fix(claude): dedupe /clear in @-mention autocomplete by @pjdoland in #243
• fix(settings): show persisted Claude model after JupyterLab restart by @pjdoland in #244
• chore(deps): bump react-icons to ~5.6.0 by @pjdoland in #245
• feat(chat-sidebar): add "+ New Chat session" button to restart Claude by @pjdoland in #246
• fix(claude): stabilize is_connected() against the worker-spawn resurrection race by @pjdoland in #250
• feat(copilot): add newer GitHub Copilot chat models by @zerone0x in #255
• fix(notebook-tools): keep cell tools targeting the right notebook when the user switches tabs by @pjdoland in #253
• feat(skills): raise GitHub archive cap to 100 MB, make overridable by @pjdoland in #257
• fix(chat-sidebar): refresh @-mention picker when workspace files change by @pjdoland in #251
• feat(chat-sidebar): real progress feedback during long Claude tasks by @pjdoland in #254
• feat(terminal): drag-drop file attach with @-mention / raw modes by @pjdoland in #256
• Touch ups by @mbektas in #263
• fix(claude): mention zero-based indexing in cell-tool descriptions by @pjdoland in #265
• fix(chat-sidebar): close workspace file picker on Escape from search input by @pjdoland in #266
• feat(chat-sidebar): hover preview for image context thumbnails by @pjdoland in #267
• feat(launcher): add tiles for opencode, Pi, and GitHub Copilot CLI by @pjdoland in #268
• feat(copilot): dynamically discover available Copilot chat models by @pjdoland in #269
• fix(extension): marshal websocket writes to the IOLoop thread by @pjdoland in #270
• ux(chat-sidebar): clarify chat-input footer icons by @pjdoland in #271
• test(ui): expand Galata coverage with high-signal user-flow specs by @pjdoland in #272
• fix(claude): render tool-result check on the right of the label by @pjdoland in #277
• fix(chat): keep disabled send button state neutral by @GHX5T-SOL in #276
• fix plugin name on settings row by @mbektas in #280
• feat(mcp): JSON-paste path in Add MCP server dialog by @pjdoland in #285
• feat(claude-mcp): disable MCP servers per workspace by @pjdoland in #286
• docs: cover post-4.8.0 changes across README, admin guide, skills, CHANGELOG by @pjdoland in #287
• Add plugin marketplace picker by @puneetdixit200 in #284
• security: add runtime kill switch for the managed-skills reconciler by @pjdoland in #291
• feat(launcher): admin policy to hide coding-agent launcher tiles by @pjdoland in #288
• security: sandbox shell-tool working_directory to jupyter_root by @pjdoland in #290
• security: enforce 0o600 on the encrypted GitHub token file by @pjdoland in #293
• fix(extension): free WS message-callback handlers when requests finish by @pjdoland in #294
• security: detect GitHub Enterprise hosts for marketplace add by @pjdoland in #292
• security: filter anchor URI schemes against XSS allowlist by @pjdoland in #296
• security(mcp): validate user MCP config shape before persisting by @pjdoland in #299
• security: scrub process-env secrets from shell-tool output by @pjdoland in #295
• security(ws): authenticate and origin-check Copilot WebSocket upgrades by @pjdoland in #301
• feat(plugins): show marketplace details and add an Update button by @pjdoland in #303
• feat(onboarding): in-app first-run tour for the NBI sidebar by @pjdoland in #304
• feat(skills): accept comma-separated list of managed-skills manifests by @pjdoland in #321
• feat(skills): track upstream for user-imported GitHub skills by @pjdoland in #322
• a11y(chat-sidebar): promote header icon-divs to keyboard-reachable buttons by @pjdoland in #305
• a11y(popovers): keyboard-first workspace, tools, and slash popovers by @pjdoland in #306
• a11y(ask-user-question): radio for single-select, form-scoped ids by @pjdoland in #307
• a11y(claude-mcp): wire form labels to their inputs by @pjdoland in #308
• a11y(checkbox): keyboard activation + WAI-ARIA checkbox role by @pjdoland in #309
• fix(claude-sessions): unify session listing across NBI surfaces, drop history.jsonl gate by @pjdoland in #310
• a11y(chat): make 'open notebook' link reachable by keyboard by @pjdoland in #311
• a11y(skills-panel): real icons, focus reveal, drop nested-button wrapper by @pjdoland in #312
• a11y(send-button): warn color + aria-label swap while stopping by @pjdoland in #313
• a11y(inline-popover): use JupyterLab theme tokens for background by @pjdoland in #314
• a11y(uploading): animated ellipsis + role=status / aria-live by @pjdoland in #315
• a11y(drop-zone): theme-aware chip text for guaranteed contrast by @pjdoland in #316
• a11y(generating): pause rotating border under prefers-reduced-motion by @pjdoland in #317
• a11y(transcript): announce streaming chat replies via aria-live by @pjdoland in #318
• a11y(focus): Ctrl/Cmd+Shift+L global shortcut to focus the chat input by @pjdoland in #320
• security(claude): sandbox UI-bridge tool paths to jupyter_root by @pjdoland in #323
• fix(deps): drop fastmcp for the official mcp SDK; pin urllib3 for CVE fixes by @pjdoland in #324
• a11y(sidebar): visually-hidden 'Skip to message input' link by @pjdoland in #319
• use sparkles icon for coding agent section by @mbektas in #325
• feat(claude): attach workspace files as @-mention in Claude mode by @pjdoland in #327
• feat(icons): add brand icons for Codex and OpenCode launcher tiles by @CCDevelopForFun in #333
• fix(claude-sessions): unwrap NBI preamble when joined with user prompt by @pjdoland in #331
• Allow user choose dir from tile by @CCDevelopForFun in #332
• feat(refresh): reload open document tabs when their files change on disk by @pjdoland in #330
• fix(claude): steer system prompt away from over-eager notebook creation by @pjdoland in #336

New Contributors

• @GHX5T-SOL made their first contribution in #276
• @puneetdixit200 made their first contribution in #284

Full Changelog: v4.8.0...v5.0.0a1

cc. @pjdoland