Exact assistant session totals and a hardened dashboard

Assistant session listings now report exact range-bounded activity totals with pagination that no longer distorts the numbers, and the dashboard ships three browser hardening headers a penetration test flagged as missing. Device-agent fleet configuration is also scoped to organization admins, matching who could already change it.

Features

• Exact assistant session totals #5265 - Activity totals are computed exactly for the selected range, independent of pagination, so the summary numbers stop shifting as pages load. (Author: @danielkov)
• Stronger browser isolation #5269 - Dashboard responses now carry cross-origin resource, opener, and cross-domain policy headers, closing three findings from a penetration test without breaking cross-origin asset loads. (Author: @walker-tx)
• Device-agent configuration is admin-only #5101 - Viewing fleet configuration now requires organization admin, matching the existing requirement on changing it, and the tab hides from non-admins while Setup stays available to everyone. (Author: @speakeasyforgebot)
• Platform admin: operator tooling #5266 - Visible to platform operators only. The organizations list keeps its search and filters in the URL so a view can be pasted to a colleague, a login URL contract opens the customer dashboard already scoped to a chosen organization (#5277), and organization rows report real trial state instead of a defaulted date that made every row look like a trial (#5276). (Author: @walker-tx)

Bug fixes

• AI-suggested exclusions save #5258 - Suggested exclusion patterns were validated with a different regex engine than the one the platform matches with, so valid suggestions failed as invalid. The form now validates with the matching engine, surfaces server-side errors, and retries a failed suggestion once with corrective feedback. (Author: @dennnis-ez)
• Demo visitors land on sample data #5250 - Entering the demo organization lands on its default project instead of an empty organization home. (Author: @alx-xo)
• Publish status no longer stuck on needs syncing #5260 - Organizations on the phased hooks rollout saw a permanent "needs syncing" after every hooks version bump they weren't eligible for yet. Freshness now runs the same eligibility check as publishing, so only changes that would actually apply count. Hook installations are also served an updated binary (#5148). (Author: @daviddanialy)