Browser sign-in on the registered loopback port; tokens in the SecretStore profile.
Rides the Responses provider for conversion/streaming; refresh-on-expiry and on-401.
REST: signin (background + status poll), status, signout; oauth rows in providers list.
Canvas/chrome surface tokens (content brightest, chrome tinted; dark lifts canvas).
Sweep of off-scale font sizes in styles.css and Tailwind arbitrary values.
Light-mode contrast fixes for muted/faint/warn ink.
Deep links (artifact/board chips, Access) force-show transiently without touching the pref.
Topbar Artifacts chip drops its cowork-only gate (artifacts are universal now).
Copy contents is the primary copy; path/open/reveal live in the labeled menu.
Access footer: '+ Add a source · Manage →'; mute explainer moves to the toggle tooltip.
Auto-collapse is edge-triggered now: stable callback identity + the rail notifies
only on real open/close transitions, so a manual toggle is never fought.
First session after a server breaks (or breaks differently) gets the transcript notice;
unchanged-broken stays quiet (Connectors carries it). Personas declaring the server keep
the every-session notice. Dedupe persists across restarts; recovery re-arms it.
verify() replaces cached-yes ensure for explicit tests; dead connections tear down and reconnect.
Connected rows show 'tested ⟨when⟩' so the click has a visible result.
Storage reports remaining token lifetime (issued_at persisted) and blanks stale access
tokens so the SDK refreshes before the request; discovered AS metadata is persisted and
seeded so refresh targets the real token endpoint, not <origin>/token.
Fast-fail with a shell steer before any prompt; docstring names the closed catalog
and stops citing semgrep (pip/brew, deliberately unmanaged) as an example.
More fold gains a Files section listing workspace/scratch/granted roots.
Roots open in the artifact viewer (Files breadcrumb); folder click-through was already there.
Gated sessions run workspace+scratch dual-root; artifact listing scans scratch only.
Artifact chips resolve across workspace, scratch, and granted roots; request_directory registers for all sessions.
List groups General/Security with quiet disclosures for unshipped coworkers and the installer (native pickers for folder/zip); gallery is internal-build only.
Detail: markdown About with bundle screenshot carousel, one Connectors table (Status/Enable), tool calls collapsed under Advanced, management controls moved here.
Account menu drops Automations (sidebar nav has it) and the OpenWorker Cloud suffix.
Token savings + compaction move from Models to a new Settings - Context optimization tab.
Coworkers page loses its duplicate intro line.
Custom - MCP group after Connected; Add custom server modal at top; per-server detail subpage with Test.
Status never claims connected for stdio: Live / Ready + persisted tested-at / Not tested / Needs sign-in / Error.
Explicit connect reports stderr tails; a 401 on an anonymous http probe becomes needs-sign-in with a one-click OAuth switch.
Test button probes any enabled server row without opening a session.
Capture stdio stderr tail; record generic connect errors for /v1/mcp (status=error);
persistent session notice via mcp_error; tests for client, manager, and GUI mapping.
Devika Verma