Skip to main content

​
Unreleased

  • Embed: migrate @mcp-b/char to an iframe-based custom-element host contract where <char-agent> fills its parent container and syncs host context/responsive layout automatically; React wrappers now live under @mcp-b/char-react.
  • UI: remove the Threads navigation entry and dashboard threads summary to streamline the SaaS UI.
  • Support: show end-user name/email details and focus the support view on each user’s latest conversation.
  • Integration: remove the Test tab, keep troubleshooting guidance under OAuth, and make WebMCP tools jump to the relevant tab.
  • UI: align status, info, and alert colors to semantic tokens for brand consistency across screens.
  • Embed/Auth (breaking, pre-1.0): unify embed authentication on publishable keys (publishableKey required, idToken optional), remove dev-mode and ticketAuth, and replace legacy clientId/organizationId connect inputs.
  • API/Auth (breaking, pre-1.0): replace legacy ticket exchange with POST /api/auth/pk-ticket (publishable key required, ID token optional) and enforce key-based org resolution with origin checks.
  • Docs: rewrite Mintlify quickstart, embedding, framework, identity-provider, security, and auth reference pages to document the publishable-key model and new runtime contract.
  • Docs: promote Vibe Coding to a top-level docs tab with client-first MCP setup patterns (Claude, Codex, Gemini, Cursor, VS Code, Windsurf), MCP styles, and skills/plugin quick links.
  • Docs: make Claude Code plugin install the primary MCP setup path; plugin install now explicitly auto-configures chrome-devtools, char-docs, webmcp-docs, and char-saas.
  • Docs/UI: reposition governance as integration-based (LangGuard or BYO provider), collapse governance navigation to integrations-first, and document trust boundaries (IdP + provider authoritative, UI hints non-authoritative).
  • Security: add approved-client registry cookie support for the MCP OAuth consent flow.
  • Worker/UI: move PDP governance configuration to org-level settings (/beta/governance/integrations) backed by D1 + oRPC, execute policy checks from org provider config, and bypass when no provider is configured or enabled.
  • MCP: add remote governance management tools (manage_governance_provider, test_governance_provider) so org governance config can be managed and validated from Char MCP clients.
  • Embed: add <char-agent-shell> in @mcp-b/char as the opinionated custom-element shell (iframe-owned PIP composer, desktop push panel, responsive fullscreen policy) while keeping <char-agent> as the low-level primitive.
  • Embed: refactor @mcp-b/char-react CharAgentShell into a thin wrapper over <char-agent-shell> so React and vanilla integrations share the same shell behavior.
  • Embed: harden <char-agent-shell> with fail-closed availability defaults (hide shell fully when iframe init is unavailable) while continuing to emit char-error for observability.
  • Embed: align collapsed PIP composer controls in runtime to shared UI primitives (Input and Button) for consistent styling and accessibility.
  • Embed (breaking, pre-1.0): remove legacy open host API/bridge compatibility in favor of displayMode, and add canonical policy helpers at @mcp-b/char/display-mode-policy.
  • Embed (breaking, pre-1.0): remove deprecated host->iframe char-styles and char-dark-mode message compatibility; host context is now unified on char-context (no change to CSS variables, connect(), or setHostContext()).
  • Security (embed): harden host-context ingestion by sanitizing host CSS variable values and enforcing always-on char-context schema validation with fail-closed rejection of invalid patches; defer message flood controls, link-domain restrictions, and stricter style-src as trusted-host follow-ups.
For updates, contact [email protected].