v2.18.5

[2.18.5] - 2026-10-17

Core Features

• OpenRouter vision provider: Added image analysis, description, text extraction, object detection, and multimodal prompts through OpenRouter.
• MCP OAuth credential status: OAuth-protected MCP servers now track login/credential health (not_logged_in, ready, needs_relogin) separately from reachability, surfaced via the admin API, mcp status/mcp login, and the admin panel's MCP servers page. A config change (URL, client ID, scopes, redirect port) safely invalidates the old credential instead of silently reusing it, and switching a server off OAuth (or deleting it) cleans up its stored token. Admin API responses no longer return a configured client secret in plain text. The panel can now create and edit an OAuth 2.0 server directly — scopes, client ID/secret, redirect port — alongside the existing static-header option, with a clear warning before switching a server off OAuth since that permanently deletes its stored credential.
• Redesigned MCP admin panel: The MCP servers list is now a sortable, paginated table matching the styling used across the admin panel (API Keys, Users), with server details shown in a panel below the list on selection instead of inline. Global MCP defaults (tool calling on/off, loop budgets, per-setting defaults) moved out of the servers table into their own "Settings" tab under the MCP section, so the servers table now lists only actual configured servers.

Security

• MCP OAuth hardening: Closed several edge cases where a stale, mismatched, or previously-rejected OAuth credential could be trusted again too eagerly — including unresolved environment/secrets references, and an endpoint that accepts unauthenticated requests masking an actual credential failure.