dashboard@0.145.0

Minor Changes

• ac9c37b: The GitHub Actions setup offers a fourth choice of jobs, Pull requests. It writes the exact rule repo:<owner>/<repo>:pull_request, which admits pull request jobs that use no environment and refuses branch, tag and environment jobs. The generated workflow runs only on pull_request (opened, synchronize, reopened and ready for review) and skips pull requests from forks, which get no GitHub token. The setup warns that anyone who can push a branch can run such a job with the workflow as their branch has it, and that a pull_request_target workflow is admitted too, a fork's pull request included. Editing an agent whose rule admits pull requests opens on this choice. GitHub Actions is still offered only where the workload-platform-github-actions feature flag is on.
• ec05cce: Guide GitHub User Identity installations through organization-owned OAuth app setup, credential saving, sign-in, and connection testing. Preserve setup progress without storing credentials or connection results.
• d39fe87: Guide Slack User Identity installations through app configuration, credential saving, sign-in, and connection testing. Require fresh authorization after permission changes and keep credentials and connection results out of saved browser progress.
• 8e5727e: Before you delete an MCP server, turn it off, change its sign-in, remove its upstream authorization server, or change or remove one of its addresses, the confirmation now lists who holds an active connection and when each one last used it. Callers whose sign-in is shared with other servers are marked, and you type the server's name to confirm.

Patch Changes

• e4a0ec9: The Added to Project dialog no longer spills past its edges when a server has a long MCP URL. The URL now shortens to fit, and the guardrail notice and next steps stay inside the dialog.

• 2356df7: An agent's Activity tab now shows when someone grants it their connection or removes it, and says what each permission change touched. Attaching or detaching a connection also records agent:connection_attach or agent:connection_detach with the agent as subject, next to the existing remote_session:attach and remote_session:detach entries. A permission change row now reads, for example, "mcp:connect · Acme Ops" instead of only "Added direct policy grant to agent".

• a7fb791: An agent's Permissions tab now says in plain words which upstream credentials each mcp:auth grant covers, for example "Every upstream credential in the organization", "Content calendar · Service account", "Personal connections of the person the agent acts for" or "Ada Lovelace's Grain connection". It used to show "All resources" for every grant on all credentials, even when the grant was narrowed to one person's connection or to the agent's own user, and a raw id for a single credential. The mcp:auth heading also gets a description.

• 246c1d9: On the agent wizard's MCP sign-in step, a server row that uses another member's connection no longer shows a grey band inset from the row's edges. The band looked like a misplaced hover. The lock on the row's badge still marks the connection as someone else's.

• 5de619b: Device agent crash reports now keep crashes from the daemon and the menu bar app apart when they share a function name, and can carry the device's OS release.

• 032b80f: An agent's Permissions tab now says, on each MCP server under mcp:connect, whom the agent acts for there: "On behalf of" with the person's avatar and name, linked to their identity page, when the agent signs in with that person's own connection. Servers with a shared credential show nothing extra. It reads the agent's assigned connections, so it is right before the agent makes its first call.

• 5e62b3a: Device agents can report crashes, recovered panics and update rollbacks to the control plane, including agents on servers and CI that authenticate with an agent key. Only reports shaped like a device agent crash are accepted; they are scrubbed again on arrival, forwarded to monitoring as logs and a crash count, and not stored.

• 1f3f475: Agent identity pages no longer send one MCP server activity request per project. A new telemetry.getOrgMcpServerActivity endpoint returns recent activity for every readable project in one request and scans only the recent window. The agents roster also stops loading people-only data it never shows.

• ecd89cd: The card shown after an agent adds a catalog MCP server through Platform MCP now shows the real next step: Add credentials, Connect when only sign-in is left, or no button when nothing required is left. It no longer always says Finish setup. The MCP server readiness bar now treats Included in Plugin as optional and does not count it as a step left.

• c334170: speakeasy auth now signs in with a PKCE one-time code instead of receiving an API key on its local callback. The CLI sends a code challenge with the browser login, the dashboard returns only a short-lived code bound to that challenge, and the CLI redeems the code with a verifier that never leaves the process. A key for another organization can no longer be swapped in through the callback, and a process that reads the callback gets nothing usable. The callback URL also carries a single-use state token, so stray or forged callbacks are rejected without ending the real login. cliAuth.authorize accepts key_scope: producer for this flow; it requires org:admin, the same as creating a producer key in the dashboard, and the key is recorded in the audit log.

• 86cc25f: Chat attachments can no longer run script on the Speakeasy API or dashboard origin. assets.serveChatAttachment and assets.serveChatAttachmentSigned now send Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox and X-Content-Type-Options: nosniff with every attachment, and a Content-Disposition that displays raster images, audio, plain text, CSV, Markdown and JSON inline and downloads everything else, including HTML, SVG, XML and PDF. Fetching an attachment or embedding it as an image or audio source works as before. In chat, opening an HTML, SVG, XML or other active attachment now downloads it instead of opening it in a new tab, and replayed SVG images show the file icon instead of a preview.

• a323b85: Claude Cowork onboarding now has a dedicated step for allowing Speakeasy in Claude's network egress settings, placed before OTEL export, on both the Team/Enterprise and Pro/Max paths. It names the exact Claude settings (Capabilities → Code execution and file creation → Allow network egress → Additional allowed domains), lists every Speakeasy domain to copy, and notes that the hooks binary download also comes from those domains, so nothing else needs allowing. A separate final step covers verifying hook events in a new Cowork session.

• 735fbe3: Organization admins can turn device agent crash reports off for their fleet from the device agent configuration page.

• f013657: For organizations enforcing typed upstream credentials, direct MCP server consent now shows only the server's linked personal connections and previews tools with the selected credential. Changing credentials refreshes the preview, and approval cannot reuse a tool inventory captured with a different credential.

• c815d93: Members with agent:write on an agent can now list and open that agent's sessions read only, and the dashboard shows them its Sessions panel.

• 49bce6f: Sessions and summaries from agents that report tokens but no cost, such as OpenClaw and Codex, now show an unknown cost with the reason instead of $0.

• 6e241c3: The agent page now shows whom the agent acts for on each MCP server instead of "Authorized by", and tool calls made with an agent API key no longer record the key's issuer as the person the agent acted for.

• d2d08a3: The docked Project Assistant now stays at the bottom of the page on short or loading pages, instead of appearing near the top.

• 95bf80c: On organizations with upstream auth enforcement, the Enterprise Managed Authorization section of an MCP server's settings now offers the sign-in registrations behind the server's credentials, instead of saying no client is linked.

• 2c58e45: The message a session transcript is opened on (from a risk finding or a provenance citation) is now visibly highlighted in light mode.

• df33431: The Platform MCP card's setup link now names the open step. On the MCP server's settings page, a banner at the top of the Identity section says what is left: add an API key, set up the OAuth client your team signs in with, or sign in. For an API key, the Custom Headers list opens on its own. When the step is done, the banner says the server is ready to use. The banner and the sidebar readiness bar now use the same check.

• 6039087: Add a setting on provider clients that sends the connecting MCP client's name to the authorization server, so it can label each connection.

• e0da93f: Gateway instructions now open with one line naming the servers the caller can use, so agents that load tools on demand, such as Codex, know what the gateway reaches before they search. The line stays within 250 characters and ends with a count when servers do not fit. Gateways with their own instructions keep them as written, and the gateway settings page now says so.

• 2c9cfe8: When a gateway server gets a sign-in after a person approved it as needing none, calling that server now says what to do: reconnect the gateway in their AI app, or ask an administrator if reconnecting can't fix it. The session keeps working for the gateway's other servers, and token refresh is unchanged. In Code Mode, tools.connect now returns that message when reconnecting can't fix it, instead of a sign-in link. Gateway messages now say "Reconnect this gateway in your AI app" wherever that's the fix.

• c551914: In Tool Logs, the gateway name on a call that reached an agent gateway or the organization gateway now opens that gateway's page. It used to open the stored gateway page, which has nothing for these gateways and failed to load. An agent gateway opens the agent's Permissions tab and the organization gateway opens its own page, the same places the "dispatched through gateway" icon already opens. Tool usage traces now report the kind, project and agent of the gateway a call reached.

• b182e4b: The GitHub Actions setup's workflow now uses the device agent action's v0.1 tag, which moves to each 0.1.x release, instead of a pre-release commit, so a job picks up new releases of the action without its workflow being edited. The setup notes that a team that requires commit pins can pin a release commit instead. The workflow still sets no speakeasyd version, so the action installs the latest stable speakeasyd.

• b1002a8: An identity's Tool logs now include local tool calls by default, so agents that only run through hooks no longer show an empty panel. An agent's overview has a "Show local tools" switch that applies to its Tool calls card and its Tool logs together.

• 9a8baff: The Inspect tab now lists every tool an MCP server offers and shows which ones your access doesn't include under "Not available". Viewing the tab or syncing no longer records or removes tools based on one person's access. Sync is offered only to people who can edit the server, once its tools have been saved, and the connect prompt now explains that you sign in with your own account.

• b8439d9: The agent setup and edit flows no longer say a connected agent "needs a key". When the agent already has a key, the install step says when that key was last used and offers to issue another key for a new runtime.

• 282c878: Project pages keep what you are doing when the Project Assistant finishes connecting or when you start a new conversation with it. Open dialogs stay open and typed values stay in place, where they used to reset without warning. Text typed into the assistant box while it connects now moves into the composer instead of disappearing.

• ba2707f: Use live theme-aware catalog logos across dashboard surfaces while preserving custom server logos and legacy icon fallbacks.

• f43e71e: Update npm dependencies to address high-severity Dependabot security alerts. @speakeasy-api/functions and @gram-ai/functions now require @modelcontextprotocol/sdk 1.32.0 or later as a peer dependency.

• 1e11a63: Temporary outages no longer read as sign-in failures: affected routes answer with a retryable 503, and sign-in, connect and gateway pages say the problem should clear.

• 6a49697: Speed up the project home page by cutting the requests it makes.

  • telemetry.getProjectOverview takes a new include_usage flag. It returns the per-user and per-agent usage breakdowns in the same response. When the project has no agent usage, it returns mcp_usage instead: the number of external end users, the top end users by tool calls, the most used tools, and the tools with the highest failure rate. The dashboard no longer chains telemetry.query and telemetry.searchUsers calls after the overview.
  • telemetry.getProjectOverview no longer returns fields the dashboard never read: comparison, metrics_mode, and the summary's resolved_chats, failed_chats, active_users_count, top_users and llm_client_breakdown. The server no longer runs the queries behind them.
  • chat.list takes a new pinned_first flag. The home page's recent chats now load with one call instead of two.
  • The dashboard asks the server to create the project assistant at most once per page load, instead of once per component that needs it.

• 4ed5001: Speakeasy now asks for a review before sensitive access is granted and records it when it is. In the role editor, a save that adds a permission, or adds members or agents to a role that already grants a sensitive one, opens a review step that lists what is added and what the new holders gain, and waits for a confirmation when any of it exposes other members' activity or allows destructive changes. Manage Roles and Grant Access preview what a role adds to what the member already holds, counting a permission held on one project that the role gives everywhere, and wait for the same confirmation. The access_role:create, access_role:update and access_member:update_role audit rows carry sensitive_scopes_added in their metadata, naming the sensitive permissions the change gave that were not held before or were held only on some resources; a change that adds nothing sensitive writes no metadata.

• d616859: Saving an MCP server's User Identity no longer removes the sign-in client other servers on the same issuer use. A client for a new provider is added alongside the others, a provider that already has a client reuses it, and a server's callers only need that server's own clients. Turning off User Identity on a server now only removes that server's own clients. Replacing a client other servers use is an explicit choice that lists them, and they move to the new client together.

• effcbb3: With upstream auth enforced, two remote MCP servers that share one organization-wide sign-in no longer show each other's upstream. The agent wizard's connection check, the connection it assigns when you create or save an agent, its Connect and Reauthenticate links, and the server's Enterprise Managed Authorization section now read each server's own credentials. Without enforcement they still read the sign-in's registrations, which route the call.

• c4168eb: When adding a credential to an MCP server, the sign-in list shows only sign-ins for that server's authorization server, each with its name, logo and URL. A "Show all" link brings back the rest.

• 346ecdc: Tool logs name every gateway a call went through, including gateways in other projects, agent gateways and the organization gateway. The gateway icon on a tool call now opens that gateway's page, where you can see the MCP servers behind it.

• 73925f6: Search boxes on list pages no longer drop characters when you type quickly.

• d616859: Turning off User Identity on an MCP server now takes effect in every case, including when a gateway shares its issuer or no server has claimed its sign-in client. Settings now show the sign-in clients a server's callers actually need, so the page no longer reads No Identity while requests still ask callers to sign in, and saving reports an error rather than success when nothing was removed.

• 8ba97be: While the dashboard starts or a page loads, an animated Speakeasy logo now fills the page. Before, the page showed a spinner, "Loading…" text, or nothing. Cards, tables, tabs, sheets and dialogs now show placeholder shapes of their content while it loads, so the layout no longer jumps when data arrives. Buttons and small fields use one spinner style everywhere.

• 802711d: Setting up an agent that runs on a platform now uses the MCP authentication provider its servers share. The token endpoint and audience come from that provider, where the wizard used to preselect the organization's first shared provider whatever the servers used, and the servers then refused the token. When a server uses its own per-server provider, or the agent's servers are split across providers, the Credential step names each one with a link to its authentication settings and won't continue until they share one, so no agent is created with a token its servers refuse. GitHub Actions jobs are unaffected: the device agent gets their tokens from each server.