chore(main): release 1.21.0

[jmagar]

🤖 I have created a release beep boop

1.21.0 (2026-09-20)

Added

• access: allowlisted emails get access at first sign-in (#665) (685b698)
• agents: wire LLM execution and tasks (#670) (9d4c924)
• auth: allow Antigravity OAuth redirect URI by default (#698) (65ffb2a)
• codemode: discover prompts resources and skills (#699) (09eddd0)
• codemode: generalize capability catalog (#693) (f38d18d)
• codemode: scope OpenAPI OAuth by caller (#703) (e530772)
• console: add public Codex setup shell (#684) (aa0f3bd)
• console: align Labby with the Gateway Console mock (#630) (df0026d)
• discover: display bounded revision file counts (#655) (dc9c520)
• gateway: use rmcp Unix socket transport (#700) (6bf6d7b)
• setup: add first-class install-labby skill (#694) (e4e6de2)
• ux: seamless first-run, desktop application shell, and setup onboarding (#646) (25c50d3)

Fixed

• access: close the allowlist review findings from #665/#659 (#678) (e1b54a4)
• access: reconcile superseded v8 stores safely (#692) (f99c60b)
• agents: close the agents/tasks, depot and Code Mode review findings from #670/#671/#669 (#679) (fe7de3c)
• agents: harden LLM task execution and provider cleanup (#676) (5cc929d)
• ci: manage release incidents through GitHub REST (#707) (3631d86)
• codemode: canonicalize namespace filters safely (#688) (1ac8e62)
• codemode: harden saved snippet execution (#682) (79f10df)
• container: keep Docker workspace cache in sync (#674) (d2cc606)
• depot: preserve operator scope for destructive calls (#671) (e6310c3)
• gateway: close the gateway hardening review findings from #652 (#680) (412f743)
• gateway: harden negotiated capability handling (#701) (e29610b)
• gateway: raise the Code Mode timeout ceiling to match upstream requests (#669) (b3f4b91)
• gateway: reject uncorrelated HTTP JSON-RPC errors (#689) (b313a86)
• mcp: enforce transport lifecycle contracts and document oracle workflows (#650) (53305c3)
• setup: close the first-run, installer and desktop review findings from #646 (#681) (180ba9d)
• skill-library: honor depot.private_hosts for exact-source peers (#639) (e3d0830)
• skills: accept interoperable allowed-tools forms (#687) (8bcabdb)
• web: accept nullable Depot component media types (#690) (e145524)
• web: align Library hero scale with console (#695) (fe3dc65)
• web: gate the Library on a project-bound session (#668) (0c94087)
• web: keep hero stat values compact (#675) (5874909)
• web: make gateway state display consistent (#697) (0d7d504)
• web: prime Depot catalog before Library calls (#685) (a1019c3)

---

This PR was generated with Release Please. See documentation.