> ## Documentation Index > Fetch the complete documentation index at: https://docs.usechar.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > Release notes, updates, and version history for the Char embedded AI agent platform ## Unreleased * Embed: migrate `@mcp-b/char` to an iframe-based custom-element host contract where `` fills its parent container and syncs host context/responsive layout automatically; React wrappers now live under `@mcp-b/char-react`. * UI: remove the Threads navigation entry and dashboard threads summary to streamline the SaaS UI. * Support: show end-user name/email details and focus the support view on each user’s latest conversation. * Integration: remove the Test tab, keep troubleshooting guidance under OAuth, and make WebMCP tools jump to the relevant tab. * UI: align status, info, and alert colors to semantic tokens for brand consistency across screens. * Embed/Auth (breaking, pre-1.0): unify embed authentication on publishable keys (`publishableKey` required, `idToken` optional), remove `dev-mode` and `ticketAuth`, and replace legacy `clientId`/`organizationId` connect inputs. * API/Auth (breaking, pre-1.0): replace legacy ticket exchange with `POST /api/auth/pk-ticket` (publishable key required, ID token optional) and enforce key-based org resolution with origin checks. * Docs: rewrite Mintlify quickstart, embedding, framework, identity-provider, security, and auth reference pages to document the publishable-key model and new runtime contract. * Docs: promote Vibe Coding to a top-level docs tab with client-first MCP setup patterns (Claude, Codex, Gemini, Cursor, VS Code, Windsurf), MCP styles, and skills/plugin quick links. * Docs: make Claude Code plugin install the primary MCP setup path; plugin install now explicitly auto-configures `chrome-devtools`, `char-docs`, `webmcp-docs`, and `char-saas`. * Docs/UI: reposition governance as integration-based (`LangGuard` or BYO provider), collapse governance navigation to integrations-first, and document trust boundaries (`IdP + provider` authoritative, UI hints non-authoritative). * Security: add approved-client registry cookie support for the MCP OAuth consent flow. * Worker/UI: move PDP governance configuration to org-level settings (`/beta/governance/integrations`) backed by D1 + oRPC, execute policy checks from org provider config, and bypass when no provider is configured or enabled. * MCP: add remote governance management tools (`manage_governance_provider`, `test_governance_provider`) so org governance config can be managed and validated from Char MCP clients. * Embed: add `` in `@mcp-b/char` as the opinionated custom-element shell (iframe-owned PIP composer, desktop push panel, responsive fullscreen policy) while keeping `` as the low-level primitive. * Embed: refactor `@mcp-b/char-react` `CharAgentShell` into a thin wrapper over `` so React and vanilla integrations share the same shell behavior. * Embed: harden `` with fail-closed availability defaults (hide shell fully when iframe init is unavailable) while continuing to emit `char-error` for observability. * Embed: align collapsed PIP composer controls in runtime to shared UI primitives (`Input` and `Button`) for consistent styling and accessibility. * Embed (breaking, pre-1.0): remove legacy `open` host API/bridge compatibility in favor of `displayMode`, and add canonical policy helpers at `@mcp-b/char/display-mode-policy`. * Embed (breaking, pre-1.0): remove deprecated host->iframe `char-styles` and `char-dark-mode` message compatibility; host context is now unified on `char-context` (no change to CSS variables, `connect()`, or `setHostContext()`). * Security (embed): harden host-context ingestion by sanitizing host CSS variable values and enforcing always-on `char-context` schema validation with fail-closed rejection of invalid patches; defer message flood controls, link-domain restrictions, and stricter `style-src` as trusted-host follow-ups. For updates, contact [alex@mcp-b.ai](mailto:alex@mcp-b.ai).