Local model management and workspace-owned apps

Models stored on the device can now be managed from TAP. The app also links compatible workspace identities automatically at sign-in, while account switching logs out before crossing into an unlinked identity.

Apps and specialist tools

Code and Browser become owned sources in the Apps system rather than special-case bundles. Workspace assignments and pins synchronize fully, missing assigned apps recover, and unused verified package files are reclaimed. The miniapp SDK gains Git, repository snapshot, and VFS read capabilities, with source-attested gestures required before opening a file picker.

Chat, settings, and billing

Voice signaling now uses typed media messages. Specialist permission requests keep their order, expired attachment URLs refresh before model selection, and thread entry, message search, profile cards, and resource sheets handle focus more carefully. Settings adds keyboard-operable MCP authentication choices and correctly associated validation messages. Billing now handles paymentless seat changes, preserves coupons across plan changes, blocks conflicting cancellation schedules, and suppresses warnings for permanent discounts.