Changelog

What we
shipped.

We build in the open, on a near-weekly cadence. Every release in plain language — newest first.

Prefer the story? Read the monthly digest on the blog →

October 2026

v2.15.4 2026-10-12 SecurityFix

Private mode now also removes the knowledge a chat had saved

  • When you switch a chat to private mode, lynox now also deletes the long-term knowledge entries recorded from that chat. Before, only its memories were removed. In a private chat the assistant now refuses to save new memories, even when you ask.
  • A task that runs on its own now asks before common command line calls that send data to the web (such as uploads with curl or wget) or hand code straight to an interpreter (such as node -e or python -c).
  • A task that needs an answer and has nobody to ask now stops and leaves a note saying why. Before, it carried on without the answer.
  • Disconnecting Google in Settings now asks first. On a self-hosted instance that backs up to Google Drive, it also deletes the backups lynox uploaded through that connection, and then tells you how many files were deleted, or that some may be left.
  • Debug captures are now deleted after seven days. A backup that already holds one keeps it until that backup is deleted.
v2.15.0 2026-10-07 SecurityFix

Your keys no longer go somewhere new without your OK

  • When the agent puts a stored key or password into a web request, the key goes without asking only to the service you set it up for. For any other address you see the key's name and the address and decide; if you allow it, that holds for the rest of the chat. In a chat, if the agent wants to use a key in another tool, it asks every time. A task running on its own, with nobody to ask, cannot be steered by a mail or web page it has read into sending a key somewhere else.
  • A scheduled mail is no longer sent twice. A slow answer from the mail server used to count as a failure, and the same mail could go out again.
  • Switching a tool off in Settings now applies to chats that are already open, from their next message on. Before, an open chat kept the tools it started with.
  • Error messages no longer show stored keys and passwords, or keys in common formats, in plain text.
  • The check that stops a key from leaving in a web request or a mail now also recognises keys from Stripe, Slack and Shopify.
  • When you erase memories, the names of people and companies they created are erased with them, unless something else still refers to them. Before, the names stayed behind.

August 2026

v2.14.0 2026-08-18 NewFixSecurity

Your instance can be tuned to cost less, without you changing anything

  • We can now set which models run behind each level of your instance — quick answers, everyday work, hard thinking. That means your cost can be tuned from our side while your work stays exactly the same. If you have picked a strategy yourself in Settings, yours wins: our setting only fills a choice you have not made.
  • A workflow step is now billed against the model that actually ran it. Where a cheaper model was doing the work, the bill still named the expensive one — up to about ten times too much charged against your included budget, so you could hit a ceiling you had never really reached.
  • A name in an incoming mail can no longer smuggle in an extra recipient. A crafted display name could add an address that the confirmation dialog never showed you — so you would approve a mail to one person and it would reach two. Fixed on both mail paths; on the second one the smuggled address had become the only recipient.
  • Long text you paste into the chat is stored as a file instead of riding along in every following message. Before, a large paste was re-read on every turn afterwards, which quietly made the rest of that conversation more expensive.
  • A dropped connection no longer runs your request twice. The app used to assume a request had never started when the connection died mid-answer, and send it again — now it asks the server first.
  • Workflows have firmer spending limits: a step cap you can raise deliberately, a bound on how many steps run at once, and two gaps closed where a malformed limit switched the brake off entirely instead of falling back to a safe one.
  • Asking for the strongest model inside a background task now asks you first, and offers the middle level instead of simply refusing.
v2.13.0 2026-08-09 FixNew

Workflows stop spending money nobody asked them to

  • A workflow step that does not say which capability level it needs now runs on the fast one. Before, it silently inherited the premium level of your conversation — a mechanical step that pages through two thousand contacts was paying analysis prices for mechanical work. We measured before changing it: on exactly that shape, the fast level was flawless in every run.
  • A workflow step now names the tools it needs and gets exactly those. System-shell access is never handed out by default any more — that is why a customer saw approval dialogs for shell commands no step had any business running.
  • Once a document is saved, its full text stops riding along in the conversation. The agent keeps a short reference and reads the saved file when it needs the content — on one real thread, those bodies were a fifth of the entire cost.
  • The message box stays at the bottom of the chat, also while a workflow is running or a review is open — it used to ride out of view on phones and desktops alike.
v2.12.1 2026-08-08 FixSecurity

The status bar tells the truth about your providers

  • If you route different tiers to different providers, the bar at the bottom now names all of them. It used to name one — so a setup running Mistral, Fireworks and Anthropic side by side showed a single one of the three, and reported that one provider’s health as though it were the whole picture.
  • The pinned "still open" row above the message box is gone. It collected the suggestions you did not click and kept them until you dismissed them by hand — and because the wording changes from turn to turn, it could not tell an old suggestion from a rephrased new one, so it showed you the same thing twice. Suggestions now belong to the turn that offered them. A way to deliberately keep one is being designed.
  • A dependency with a published vulnerability was pinned to a fixed version.
v2.12.0 2026-08-07 NewSecurity

What the agent remembers — visible, correctable, deletable

  • The durable memory is now switched on for new managed instances. That obliges the other half, which ships with it: a fact you can drop when it is wrong, a subject you can erase completely, and a prompt that names what it is asking about instead of showing you an unanchored question.
  • A conversation says when facts are still waiting for your confirmation — by count, never by a word that implies more certainty than the number carries.
  • When the agent delegates work, you can see it happening: the sub-run is attributed to the sub-agent rather than folded into the main chat, and it reports what it cost and how long you waited. The input field stays usable throughout.
  • An uploaded document is now handled as content from outside — the same way a fetched web page already was. What the agent reads and what the agent is told to do stay separate.
  • The API keys you store can no longer be overwritten by the agent. It can see that a key is set — that is by design, so it knows what it may use — but on a bring-your-own-key setup an overwrite would have destroyed access nobody can restore for you.

July 2026

v2.11.0 2026-07-29 NewSecurity

Setup starts from your business — and confirmations you can trust

  • The first run now begins with your website. The agent reads it, then asks the three to five questions that reading made possible — each tied to something it actually found, not a generic questionnaire. Your answers become part of what it remembers instead of chat history that scrolls away.
  • When the agent asks you to confirm an action, everything it wrote into that question is now shown as plain text. Something it fetched from elsewhere can no longer format itself to look like part of what you are approving.
  • Reading a web page now takes the whole page. The previous approach tried to pick out the article and regularly handed back a code sample or the navigation instead — unnoticed, because a short wrong answer still looks like an answer.
  • Claude Opus 5 joins the models you can assign to a tier, and operators running their own instance can lock whole model families out of it.
  • If the agent stops to ask you something while the tab sits in the background, the tab title marks it and a notification arrives — a run no longer waits unnoticed.
v2.10.0 2026-07-22 NewFix

A stronger everyday model — and Claude Fable 5 for the deepest work

  • The Efficient and Balanced strategies now run Mistral Medium 3.5 as their everyday model. We measured the smaller main model answering hard tasks itself instead of delegating them — the upgrade closes exactly that gap.
  • The max-quality strategy hands its deepest reasoning to Claude Fable 5, the strongest model we route to today.
  • Image understanding now also works when Mistral powers the everyday and deep tiers, and the model picker handles providers where both tiers share one model.
  • Long answers survive dropped provider connections with an automatic retry, and a new opt-in diagnostic capture (off by default, encrypted, deleted with its chat) helps us debug tricky sessions with your consent.
v2.9.0 2026-07-21 New

Model strategies: pick how each part of a chat is powered, in one click

  • A model strategy maps each part of a conversation to a specific model in one step — chosen from cards in settings or a quick picker in the chat header — and always shows you which host is answering.
  • Fireworks joins as a provider option you can put behind a tier, active only once its key is in place.
  • Reopening a chat mid-task now shows a multi-step turn as one clean message instead of many, keeps your in-flight message from being dropped, and the opening briefing stays current.
  • Image understanding now works on the latest Mistral models, plus a batch of chat and artifact-card polish.
v2.8.0 2026-07-17 New

Durable Knowledge: a lasting memory tier lynox builds up over time

  • A second, archival memory tier keeps durable facts without pushing older ones out — turned on per instance by us, off by default.
  • When it is on, you see and correct what lynox remembers right in the chat — and anything it picks up from external content waits for your approval before it sticks.
  • Follow-up suggestions now arrive cleanly with no stray text, and they survive a page reload.
  • Hosted plans get a per-run cost ceiling and a live balance view, and the secret vault stops stashing duplicate keys.
v2.7.1 2026-07-15 Fix

Chat polish: an honest model picker, a cleaner footer, and timestamps back

  • The model picker now shows the actual model each tier runs — including when you point a tier at a different provider.
  • The message footer reads as one clean line and scrolls sideways on your phone instead of getting cut off, and your own messages show their time again.
  • The "what next" suggestions always render as buttons now, never as raw text.
v2.7 2026-07-14 NewSecurity

Choose your model per chat, and carry workflows between instances

  • Pick the model for a new chat right from the composer, and set which tier a conversation runs on. Your plan still sets the ceiling — every path stays within the models your plan includes.
  • Save a workflow on one instance and import it on another. On import, the secrets and hosts a workflow needs are re-approved on the new instance — nothing carries over trusted from the file, and an imported workflow stays inert until you review it.
  • One-click presets for local runtimes and gateways — Ollama, LM Studio, vLLM, LocalAI, Groq, Together AI and Fireworks each get their own tile with the URL filled in.
  • Security hardening under the hood: a stored API key stays bound to the endpoint it belongs to and is never sent to an unknown host, and in-chat workflow runs now count toward your usage the same way the rest of your work does.
v2.6.1 2026-07-12 SecurityFix

Custom API connections now need your explicit sign-off

  • When the agent connects an API that lynox has not vetted, saving it now asks you to confirm first — so data only ever flows to a custom endpoint after a real person approves it, never on its own. If nobody is there to confirm, on an unattended background run, the connection simply is not saved.
  • The optional diagnostic logs now tidy up after themselves — once switched on, they keep only a bounded amount of history instead of growing without limit.
v2.6 2026-07-12 NewFixSecurity

Memory that knows where it learned things — and forgets cleanly

  • Every memory now records where it came from — the channel it arrived on, whether it originated in untrusted content, and the model that embedded it. The agent derives a trust level from that, laying the groundwork for recall that weighs how a fact was learned. This ships switched off, with no change to today’s behaviour.
  • Deletion is more precise and more honest. A memory whose text happens to contain a wildcard character can no longer drag unrelated memories out with it, a deletion that fails to reach the recall store now surfaces instead of silently leaving "deleted" content recallable, and secrets are masked in the recall store just as they are in the plain notebook.
  • Cleaner conversation history. The internal steps that condense a long conversation no longer show up as visible messages in your thread, and a resumed summary can no longer be overwritten by an internal system message.
v2.5 2026-07-11 NewFixSecurity

Memory you can trust — and permanently delete

  • Permanently delete what the agent remembers. Deleting a memory now erases its text and embedding from every store behind a confirmation — a real, irreversible deletion, not a hidden entry that lingers in backups. It also reaches memories built from uploaded documents, which previously had no way to be removed.
  • More reliable recall on hosted instances. A memory that failed to reach the recall store — so it could never be recalled — or a deletion that failed to reach it — so it could never be erased — used to pass silently as success. Both now surface immediately, and deletions fail safely rather than half-finishing. A migrated instance also keeps the memories it recalls from.
  • Safer conversation summaries. When a long conversation is condensed, its summary can no longer present a tool result as a confirmed fact, and any secrets are masked before the summary is stored. The diagnostic export now includes a privacy-safe view of memory state, so recall issues can be investigated without guesswork.
v2.4 2026-07-09 NewFix

Cheaper, more reliable handling of long conversations

  • Long conversations cost less. The summary that condenses a long thread now runs on a cheaper model tier by default — roughly a four-fold cut in what each condensation costs. You can pin a different tier in settings if you prefer more detail.
  • Compaction you can rely on. The summary is now stored durably, so resuming a condensed thread rebuilds context from that summary plus every message since it — and the “prepare & compact” prompt is no longer skipped when a single large turn jumps straight past the threshold.
  • The agent checks that an integration actually exists before asking you for its credential, so you are no longer prompted for a key nothing is wired to use yet. The context-usage indicator is now coloured by how much of the cost budget a conversation has used.
v2.3 2026-07-08 FixNew

Hybrid mode reliable end to end, and a stronger honesty guarantee

  • The agent grounds its recommendations in verified data. Before proposing a strategy or plan it gathers and shows the real data it relies on, and an empty or failed tool result is reported plainly instead of being filled in with made-up figures.
  • Hybrid mode now works reliably across pipelines and workflows: each step routes to the right provider, model, and key instead of silently running on the wrong one, and workflow sub-agents resolve your stored secrets — an unresolved secret fails loudly rather than being sent as plain text.
  • Reliability fixes: a run waiting on a question no longer times out at the 30-minute mark while you take your time to answer; warm browser tabs reload onto the freshly deployed version after an update; and the chat footer reads more clearly.
v2.2 2026-07-07 NewFix

Choose the model your main chat runs on, plus cross-provider sub-agents

  • A new model picker in LLM settings lets you choose the band — fast, balanced, or deep — and the concrete model your main conversation runs on, within your plan’s ceiling.
  • Sub-agents can now run on a different provider than your main agent — an Anthropic main can delegate to a Mistral sub-agent and vice-versa, each on its own provider, model, and key.
  • Correctness pass: agent-opened escalation threads reopen instead of erroring, failed and cross-provider sub-agents surface a real error instead of quietly reporting success, and the context and compaction indicators got an honesty pass.
v2.1 2026-07-07 NewFix

Claude Sonnet 5 as an opt-in model, plus a correctness and data-safety wave across memory and upgrades

  • You can now pick Claude Sonnet 5 for the balanced tier — it adds a one-million-token context window. Your existing setup is unchanged until you choose it, in Settings → LLM.
  • A correctness and data-safety wave across the knowledge base: upgrades that never discard data when a database migration hits an error, memory edits that stay consistent everywhere, and a new, reversible way to merge two entries for the same person.
  • Under-the-hood reliability and billing accuracy improvements. Self-hosting behind a reverse proxy? Client-IP handling changed for stronger rate-limiting — set LYNOX_TRUST_PROXY=true so per-client limits keep working.
v2.0 2026-07-06 MilestoneNewSecurity

Foundation Rework: a unified automation core, media processing, and a broad reliability, billing, and security hardening

  • Workflows, triggers, and tasks now share one consolidated store with a clearer “when vs. what” model and reusable connections — a stronger base for automation. On upgrade everything migrates itself, with no action and no data loss.
  • New media tool: transcode, extract audio, and generate thumbnails from audio and video, safely and within strict limits.
  • More accurate billing across every metered path, clearer handling of interrupted runs, and message timestamps plus artifact-card fixes in the chat.
  • A wide security-hardening wave (vault, filesystem, network egress, injection guards) and, for managed hosting, a one-click EU right-of-withdrawal and more robust provisioning.

June 2026

v1.22 2026-06-30 New

Foundation groundwork, a configurable network policy, and GDPR data controls

  • The Foundation Rework groundwork ships dormant — a new consolidated data store behind an off-by-default flag, doing nothing yet. It is the base the 2.0 release builds on.
  • A configurable outbound network policy (allow-all, deny-all, or an allow-list) gates where the agent is allowed to reach.
  • GDPR: data erasure now wipes the new store as well, and the data export paginates so large datasets come out complete.
v1.21 2026-06-29 NewSecurity

Connect a mailbox from chat — the password never touches the agent

  • A new flow resolves a known provider’s mail servers and hands off to an in-chat consent step where you enter the app password.
  • The password goes straight from your browser to the vault — it never enters the agent context, the run history, or the prompt store.
v1.20 2026-06-29 New

Readable PDF and Word uploads, remembered across conversations

  • A PDF or Word file dropped into chat is text-extracted server-side and read by the agent, instead of rejected.
  • What it read persists into memory, so the document is recalled automatically in later turns and threads.
v1.19 2026-06-26 New

The navigation maps to the agent loop

  • Triggers get an editable home with pause, delete, and run-now; Workflows, Tasks, and settings each map to a primitive instead of a feature.
  • “Open in chat” on tasks, contacts, and API profiles — create or edit them by talking to the agent.
  • Cheaper watch change-detection — it hashes the page’s visible content on the fast tier instead of re-fetching raw HTML.
v1.18 2026-06-25 New

The inbox becomes chat-first, and contacts get a real identity

  • Replying to or composing a mail opens a chat with the message loaded as context — the standalone composer is gone.
  • Saved correspondents become real contacts keyed on email, and the task model splits into user-TODOs and agent-triggers.
v1.17 2026-06-24 New

Saved workflows become a scheduled, chat-editable surface

  • Schedule a saved workflow on a cron; a run that needs your input opens an unread chat thread with the full context.
  • Edit or fix a workflow by talking to the agent — no bespoke step-editor.
  • Headless runs gain explicit autonomy, full observability, and fail-closed capability contracts.
v1.16 2026-06-22 NewFix

Context-cost tooling, a thread debug-export, and cheaper long conversations

  • A thread debug-export bundles the messages and per-run cost, tokens, and cache composition (secrets scrubbed).
  • Long threads auto-summarize against a token budget to bound the cost of large-context conversations.
v1.15 2026-06-17 New

Provider-agnostic routing: each tier on its own provider and model

  • A Standard mode keeps one provider for every tier; an opt-in Hybrid mode lets you mix providers freely, tier by tier.
  • A per-tier editor with a model picker; managed tenants stay on the curated Anthropic + Mistral allow-list.
v1.14 2026-06-16 New

Mistral becomes a first-class provider; canonical environment names

  • The “EU-sovereign mode” toggle is retired — Anthropic and Mistral are freely switchable providers.
  • Managed-Pro can reach Opus for deep work while everyday chat stays on a cost-sane tier.
v1.13 2026-06-12 NewFix

Managed-Pro on Opus, background work on Mistral, plus cost and crash hardening

  • Managed-Pro deep work runs on Opus; background and bulk tasks route to the cheaper Mistral profile.
  • Free-text answers on tabbed questions, a calendar-month spend cap, and auto-capped oversized HTTP responses.
v1.12 2026-06-09 NewFix

Provenance: every recalled fact carries where it came from

  • An un-spoofable marker tags each fact’s origin — user-asserted, tool-verified, agent-inferred, or external-unverified — through recall and compaction.
  • Managed billing fix: saved and scheduled workflows now count against the budget and the credit gate, instead of running uncapped.
v1.11 2026-06-08 NewSecurity

EU AI Act transparency, hardened BYOK endpoints, and sanctions screening

  • A persistent notice that responses are AI-generated and may contain errors (EU AI Act Art. 50), in German and English.
  • Production sanctions name-screening is populated with non-Latin coverage, and BYOK custom-endpoint handling is hardened.
v1.10 2026-06-06 NewFix

Chat runs survive reloads, and long threads stop losing messages

  • A chat run is no longer tied to its browser connection — reload or disconnect and it keeps going headless, resumable when you return.
  • The prompt cache works again — a large cost drop on long conversations — and assistant messages no longer vanish after compaction.
v1.9 2026-06-04 NewFix

Nothing vanishes silently: durable turns, artifact history, one cost number

  • Artifacts gain a real version history (up to 10 snapshots), so an accidental overwrite is recoverable.
  • A user message is persisted at run start, so an abort or reload mid-stream can’t lose it; and cost shows one consistent number everywhere.
v1.8 2026-06-03 NewFix

Provider-agnostic model tiers, diagnostics, and inbox polish

  • Model tiers are now named by what they do — deep / balanced / fast — instead of one vendor’s brand names. Old names keep working.
  • New opt-in chat diagnostics panel with per-message metrics, plus JSON export for any conversation.
  • Inbox: encoded and non-UTF-8 mail renders correctly, and mail context moved below the message for a calmer read.
  • Clearer settings: an invalid provider config now shows the real reason, and managed instances always show the correct provider and data-residency.

May 2026

v1.7.5–1.7.9 2026-05-27 NewFixSecurity

Launch-hardening: honesty by default and a smoother first run

  • When web search isn’t configured, the agent says so instead of inventing results — no more fabricated sources.
  • Setup now validates your API key before saving it, so a typo is caught up front instead of on your first message.
  • Dozens of self-host rough edges smoothed: provider-aware setup hints, correct sender names on email, cleaner installer output.
v1.7.0 2026-05-22 New

Saved Workflows and a livelier chat stream

  • Save any multi-step task as a reusable workflow and re-run it from a dedicated library tab.
  • The chat now shows a live activity ticker, interleaved thinking, and a marker where long conversations were compacted.
v1.6.0 2026-05-19 NewSecurity

Passwordless email login and light mode

  • Magic-link login: sign in with a one-time emailed code, alongside passkey and password.
  • Light-mode theme for the whole web UI.
  • Connect any API yourself: managed customers can now add their own credentials without filing a support ticket.
v1.5.0 2026-05-16 New

Settings overhaul and smart API setup

  • Reorganized settings with per-tool toggles and server-side enforcement of what the agent may use.
  • API Setup v2: point lynox at a docs URL and it bootstraps the connection for you.
v1.4.0 2026-05-14 NewSecurity

Unified Inbox and a security audit pass

  • Unified Inbox: read and act on your mail straight inside lynox.
  • Thirteen critical and high-severity findings from a full codebase audit fixed before launch.

April 2026

v1.3.0 2026-04-21 Milestone

The April build-out: voice, automation, and multi-provider

  • A month of near-daily releases adding voice, scheduled automation, and support for multiple LLM providers.
v1.0.0 2026-04-15 Milestone

First public release of lynox

  • The business runtime engine goes public on npm and GitHub — self-host with one command.
Full technical release notes on GitHub →