dashboard@0.121.0

Minor Changes

• 6f0271b: Capture Pi (pi.dev) sessions, and enforce policy on them, alongside the agents
  Gram already observes. Pi has no hook configuration dialect to render into and
  no MCP client of its own: its only integration point is a TypeScript extension
  loaded into the Pi process. The observability package for Pi is therefore a
  generated extension that forwards Pi's lifecycle events to the hooks relay over
  NDJSON stdio, where the existing redaction, credential, and decision paths turn
  them into canonical hook events. Prompts, tool calls and their results, per-turn
  tokens and cost, and session start/end all land in the dashboard under the pi
  source, and a policy deny blocks the prompt or tool call inside Pi rather than
  being reported after the fact.

  MCP for Pi comes from third-party extensions that bridge servers in as ordinary
  Pi tools, which leaves tool names as the only signal that a call left the
  machine. The relay reads the config those extensions share (.pi/mcp.json,
  ~/.pi/agent/mcp.json), reports the servers a workspace can reach as an
  inventory snapshot at session start — with credentials redacted — and attributes
  tool calls to the matching server so Pi traffic is visible to Shadow MCP rather
  than appearing as unattributed local tools.

  The package is downloadable per platform from the plugins page, ships in the
  published marketplace repo for extraction into ~/.pi/agent/ or a repository's
  .pi/, and speakeasy-hooks install --provider=pi renders the same extension
  locally. Pi also joins the setup walkthrough and the shared agent-provider
  catalog, so it carries its own name and mark everywhere a captured session's
  source is shown.

• 8464d04: Add private_key_jwt authentication for remote OAuth token exchanges and refreshes. Remote session clients can select an attached organization JSON Web Key Set and configure whether signed client assertions use the issuer URL or token endpoint URL as their audience.

Patch Changes

• 6f6ab02: Replace the admin trial extension action with Change end date. Operators can shorten or extend a running trial to any future UTC calendar date, with an audit record of the previous and new end dates. New and restarted trials still default to fourteen days.
• 0fecf64: Assign access challenge roles before resolving requests.
• 29b0b09: Reduce noisy failures from canceled guardrail workbench evaluations and limit oversized session replays. The workbench now reports when a session contains more messages than the replay can evaluate.
• 57312da: Grant marketplace repo collaborators admin access so platforms that gate marketplace setup on repository admin — such as Cursor's "Serve Marketplace From Cursor" — can be enabled without editing the repo on GitHub.
• 57312da: Report adding marketplace collaborators as "Collaborators added" instead of "Plugins published to GitHub" on the plugins list and plugin detail pages.
• 8fafae0: Remote session issuers can be bound to a tunneled MCP server, so Gram routes persisted issuer metadata refreshes and back-channel OAuth calls through the tunnel when the authorization server is unreachable from the public internet. That covers the whole back channel: the code exchange, token refresh, revocation, dynamic client registration, the issuer's JWK Set, and the userinfo and introspection calls that name a session's owner. Every issuer endpoint routed through the tunnel must be reachable from the same local origin as TUNNEL_LOCAL_MCP_URL; the agent pins tunneled requests to that origin while preserving their paths and queries. Discover by URL still uses Gram's direct egress; private issuer endpoints, including the DCR endpoint, can be entered manually in issuer settings. Platform admins can manage the binding from the issuer settings page; tunnel bindings and tunneled dynamic client registration remain platform-admin-only. Adding an MCP Catalogue server whose provider is already set up as a bound issuer is refused rather than registered over direct egress. Replacing a client registration the identity provider no longer recognizes also rides the binding, so a private provider's clients recover on their own instead of failing every login until an administrator re-registers them by hand.
• e116bae: The dashboard gains a Shadow AI section listing the AI tools running on an organization's devices, split into coding harnesses, assistants, and open model runners, with each tool's logo and its access decision. A new AI scan targets page shows the detection library behind it — built-in targets grouped by kind and collapsed by default, an organization's own targets above them — and lets an admin add a target by pasting its JSON or by fetching it from a URL.
• 4918df0: The Watchdog page now shows when risk analysis last ran: "Analyzing now", "Last analyzed 4m ago", or "No recent analysis". The same status is available as risk.getAnalysisStatus in the management API and as the get_risk_analysis_status Platform MCP tool.