Changelog

This page follows the tags and release times on GitHub Releases. For image deployments, pin the corresponding IMAGE_TAG; before upgrading, complete backups as described in Upgrades and Backups. The complete commit range, verification records, and original notes for each version remain authoritative on the corresponding GitHub Release.

v2.4 Series

v2.4.7 and post-release main updates - 2026-09-15

The v2.4.7 release added ephemeral private chat, optional WebAuthn passkeys, complete conversation export/archive tooling, request-proof hardening, Gemini and strict Responses compatibility fixes, batched document retrieval, and administrator model refresh. The release also raises source builds to Go 1.26 and creates the passkeys table automatically at startup; pin Docker images to 2.4.7 only after the application, runner, and sidecar images are available for both linux/amd64 and linux/arm64. See the full release notes.

The main branch after the tag also contains these documented features:

• Email-domain enrollment and access restrictions: platform administrators map an exact email domain to a workspace from the separate /admin/domains page. New eligible registrations are enrolled transactionally; optional personal-space locks prevent ordinary bound users from switching, creating, joining, or directly addressing personal resources. Per-user overrides can restore personal access. Platform administrators retain a personal space. See Domain enrollment and workspace access.
• Workspace administration: /admin/workspaces can create a workspace with an existing active user as owner/administrator. The workspace detail view can transfer ownership only to a current member; the previous owner becomes a regular member for this platform-admin operation.
• Conversation and project operations: users can archive conversations in bulk and manage project conversations from the project action menu; clearing personal conversations preserves workspace isolation.
• Image editing: generated images support masked editing with preserved mask state across message updates, and generation/editing states received reliability and accessibility polish.

The domain feature adds registration_domains and domain_users to both database dialects. These tables are included in backup ordering, use ON DELETE RESTRICT for workspace references and ON DELETE CASCADE for user/rule bindings, and are covered in the database reference. Existing users are not retroactively enrolled; changing an email does not remove an existing binding.

v2.4.6 - 2026-09-01

• Reworked long-context compaction into incremental, observable summaries. Retired target-percent and merge-budget settings are migrated away, complete tool evidence remains available to compaction, and compare-and-swap persistence protects concurrent manual, inline, asynchronous, and multi-instance runs.
• Prioritised the active conversation document during retrieval and added an end-to-end online-RAG timeout that fails open to the main chat when routing, retrieval, embedding, or full-document summarisation cannot finish in time.
• Made branch workflows and generation state more reliable: paged and cached branch trees, isolated branch-local files, serialised switch/delete reconciliation, stable tail pinning during layout changes, and cleanup for stopped, rejected, deleted, and partially completed generations.
• Split title and file/tool-route task model policies from the general task model policy, with the conversation model as a conservative fallback when a dedicated model is unavailable.
• Hardened OpenAI Responses replay across mixed compatible gateways. Strict schema failures now receive one safe retry with prefixed item IDs and unsupported replay metadata removed, while encrypted reasoning and tool semantics remain intact.
• No new mandatory environment variable is required. Migrations run at startup; version-pinned Docker deployments should use IMAGE_TAG=2.4.6 after all matching application and sandbox images are available.
• The fixed internal task prompts and system-prompt assembly rules are documented in Internal prompt catalog.

v2.4.5 - 2026-08-31

• Added user-managed MCP services, workspace capability and member-permission controls, and policy-aware model, tool, and resource catalogs.
• Improved OpenAI Responses history replay, browser conversation titles, MCP network safety, discovery state, and authorization checks.
• No new mandatory environment variable is required; database migrations run automatically. See the full v2.4.5 release notes for the complete migration and security details.

v2.4.3 - 2026-08-31

• Channel setup now lets administrators add models one at a time or fetch and bulk-select models from the upstream endpoint. Custom OpenAI-compatible roots such as /v2 and /v3 are accepted.
• Tool-mode preferences are conversation-scoped: the administrator controls the default for new conversations, while users can override the mode only inside an individual conversation.
• Concurrent sends on one branch are serialized and rejected or interrupted sends are reconciled. While an answer is streaming, one follow-up can be queued with its attachments and options, withdrawn back to the composer, and sent automatically when the current answer ends.
• Added a read-only sandbox file drawer for listing folders, opening files, and previewing supported artifacts. Conversation ownership, safe relative paths, and browser preview isolation are enforced by the API.
• Internal model calls now carry the selected model's extra_params; title and tool-route calls have more room to produce valid output. Image generation is marked unavailable until an enabled image model is configured.
• Backup imports are validated and restored atomically, and the chat sidebar, landing cards, empty menus, and active-reply state received reliability and visual refinements.
• Database migrations run automatically. For pinned Docker deployments, use IMAGE_TAG=2.4.3 after all matching application, sandbox runner, and sidecar images are published. No new mandatory environment variable is required.

v2.4.2 - 2026-08-30

• Password registration and OAuth/OIDC automatic provisioning are now independent, allowing provider-only signup without exposing the direct registration form.
• Accounts can remain signed in on multiple devices while refresh-token replay protection and security-state checks remain enforced; the login page also adds browser-managed password memory.
• Disabled models and channels can no longer be saved or used for model policy, task calls, tool routing, or new conversation execution.
• Administrators can choose the default Auto, On, or Off tool mode used when neither the account nor the current turn has an explicit choice.
• Fast mode has independent search, web-read, image, Python, total-call, and elapsed-time budgets. Provider-hosted tools remain available, and a local system tool is hidden only when its Fast limit is 0.
• Web reading leaves time for its Reader fallback, and direct image generation discards an irrelevant stale base_image_index instead of entering a failed duplicate-call path.
• Reader fallback supports both Jina's escaped target format and raw target URLs required by services such as https://markdown.new.
• Domain and HTTPS deployments must configure exact browser origins in ALLOWED_ORIGINS; same-origin IP/HTTP testing may leave it unset. No database migration or new mandatory variable is required.

v2.4.1 - 2026-08-29

• Image attachments remain available to conversation tools even when the selected chat model cannot accept native visual input.
• Image generation and editing handle previous generations, selected bases, reference images, multiple outputs, and invalid operations more reliably.
• Internal tasks and Auto tool routing inherit the current conversation model when no dedicated policy model is configured.
• The administrator setup walkthrough adds optional task and tool-routing model steps and fixes its Next, Finish, and skip behavior.
• Sandboxed HTML previews render generated Tailwind utilities and rewrite Google Fonts resources to reachable HTTPS mirrors.
• The project READMEs prominently link the official documentation and live demo. This release requires no database migration or new environment variable.

v2.4.0 - 2026-08-29

v2.4.0 expands personal deployment from a setup that "requires maintaining a set of external infrastructure" into a ready-to-run single-instance edition, while continuing to preserve and remain compatible with the original PostgreSQL, Redis, and Qdrant full deployment. This version also consolidates improvements to administrator initialization, tool execution reliability, authentication session security, RAG protection, and the chat experience.

Personal deployment and embedded vectors

• Added deploy/docker-compose.personal.yml and .env.personal.example. The Personal edition uses SQLite to store business data and vector data and replaces Redis with in-process caching and queues, so a separate deployment of PostgreSQL, Redis, or Qdrant is no longer required.
• Added VECTOR_BACKEND=sqlite to the vector backend. The Personal edition performs exact cosine-similarity retrieval over embedded vectors, which suits single-machine, low-maintenance personal use; SQLite vector data is included in the logical backup workflow.
• The Python sandbox no longer starts with the main service by default in the Personal edition. When code execution is needed, enable it selectively through the sandbox profile in Compose; when no local sandbox is configured, the admin side shows an explicit configuration prompt.
• The service orchestration, environment variables, and data paths of the original full deployment remain unchanged. The Personal edition targets single-instance operation only; it does not support horizontal scaling, and the SQLite database should not be placed on network file systems such as NFS.

Administrator bootstrap, channels, and model configuration

• First-time entry into the admin console now opens a page-by-page configuration walkthrough instead of a static checklist. The walkthrough can be skipped, reopened later, and jump to the corresponding configuration page and re-check its status.
• The walkthrough distinguishes the Personal and Full editions: required items cover channels, chat models, and the default model; embedding models, search, the sandbox, and SMTP are presented as enhancements to enable on demand.
• The channel models page supports discovering models from the provider's models endpoint and bulk-importing the models a channel supports. The import process clearly reports duplicate models, unsupported models, partial success, empty results, and request failures, so you won't mistakenly believe the configuration has taken effect.
• The admin overview adds activity for the last 24 hours, configuration health status, and a global offline indicator; workspace knowledge base information can be expanded to help troubleshoot resource and configuration associations.

Tool execution and model call reliability

• aivory_web_search now supports up to 5 queries per call and web_fetch up to 4 URLs; the system controls concurrency, deduplicates, and keeps a stable ordering, returning usable partial results even when some requests fail.
• Added call-count, time, and progress budgets for tool calls in a single turn, with detection of repeated calls or no-progress loops. When a limit is reached, the turn ends with a final answer that makes no further tool calls instead of continuing to retry indefinitely.
• This protection covers the OpenAI Chat, OpenAI Responses, Anthropic, Gemini, prompt tool flow, and Deep Research call paths; added explicit tool_budget_exceeded and tool_no_progress error states for easier diagnosis.
• Tool orchestration and context compression logic were split apart, with regression coverage added to reduce the risk of anomalies when many tools, long conversations, and streaming responses interleave.

Image generation and editing

• The image flow now clearly distinguishes "generating a new image" from "editing based on an attachment". When a turn has multiple attachments, users can designate the base image for editing, and the remaining images are still kept as references.
• Historical attachments are no longer accidentally carried into new editing requests; when the base image cannot be determined uniquely, execution is safely refused instead of picking an image at random.
• Provider parameters, sizes, generation counts, fallbacks, quotas, and usage records remain consistent, and historical references to attachments from deleted conversations are handled safely.

Authentication and session security

• The slider captcha was replaced with a server-signed pass token, adding expiry and replay protection so client-side state cannot be forged or reused directly.
• OAuth identity providers such as GitHub now retry with a fresh connection when token exchange times out; timeouts were also extended and a fixed allowlist of public error messages improves the sign-in failure experience under network fluctuations.
• Sign-in enables exclusive refresh sessions: after the same account signs in on a new device, refresh sessions on older devices become invalid. When a refresh token replay is detected, the entire session family is revoked to prevent a leaked token from continuously exchanging new access tokens.
• The browser serializes refresh requests across multiple tabs with Web Locks; CSRF validation was added to the refresh, session query, and sign-out endpoints.

RAG, documents, and hosted tool security

• Deletion is now blocked while an embedding model or channel is still referenced by global settings or knowledge bases; vector identity information likewise cannot be modified while references exist, preventing old document vectors from becoming unsearchable.
• Conflict scenarios now show actionable localized recovery instructions instead of raw database foreign-key errors. When document parsers or MinerU are unavailable, the document workflow also shows understandable failure reasons.
• No model implicitly attaches provider-hosted tools anymore. Hosted tools must be configured explicitly, preventing OpenAI channels or other models from having default tool permissions without the administrator knowing.

Chat, formula, and UI experience

• Clicking a rendered inline or block formula copies the complete LaTeX source text, with localized success or failure feedback; this change relates to #25 and was completed by #26.
• Completed thinking-time display and timer behavior after restore, and fixed line-break rendering of bold Markdown headings; the mobile avatar menu now matches the desktop feature set, and image attachments are correctly size-constrained within message bubbles.
• New conversations restore the configured default tool selections. Past conversations support a share entry point; the visual hierarchy of renaming, fonts, drawer layers, the sidebar, and the files page was unified to remove unnecessary border lines.
• The desktop chat top bar was tightened from 56px to 48px, reducing obstruction of conversation content; settings page heading fonts align with the main conversation title, and drawer citation text uses the same font rules.

Permissions, admin console, and sandbox recovery

• Session deletion controls were added to user group and workspace member permissions, with conversation deletion and message-turn deletion validated separately to avoid out-of-scope deletion based on broad permissions alone.
• Usage records and administrator search now support nicknames, making user-behavior investigation more direct.
• Sandbox archive recovery was improved for runtime environments on read-only root file systems; artifact link recognition was improved to make code-execution files more reliably accessible.

Images and platform support

• The application, sandbox runner, and sidecar images are published for both linux/amd64 and linux/arm64, tagged with the same semantic version as the application. Compose automatically selects the correct image per host architecture.
• 32-bit ARM is not supported. ARM64 and AMD64 deployments should use the v2.4.0 tag or the corresponding later versions; don't pin different components to inconsistent versions.

Upgrade notes

• Database migrations run automatically; no manual SQL is required. When SQLite vectors are in use, a vector_points table is created and handled together with routine database backups.
• Existing full deployments do not need to re-architect for the Personal edition, and the Personal and Full edition Compose configurations must not be started in a mix. Before upgrading, confirm your actual deployment mode and follow the backup steps in Upgrades and Backups.
• The exclusive session policy may sign the same account out on other devices; this is expected security behavior. After upgrading, re-check explicit configuration of Hosted tools and any embedding models/channels still referenced by knowledge bases—migrate the references first, then modify their vector identity.
• This release does not require any new mandatory environment variables. Full deployments and personal deployments can continue using the existing versioned image strategy.

v2.3 Series

v2.3.1 - 2026-08-22

• The Python sandbox now stages PDF, DOCX, PPTX, XLSX, and other files uploaded in each turn as raw bytes, so models can edit them while preserving the original formatting.
• Added the fetch_image built-in tool: it downloads public images into the sandbox through a backend SSRF-safe client, while the Python runner itself stays network-isolated.
• Fixed reasoning_content replay and streaming display between tool rounds in OpenAI Chat.
• web_fetch can now fall back through a Jina Reader-compatible extraction service when a direct connection is unreachable, while keeping the SSRF boundary.
• Improved how text models handle images, pasted attachments, image editing context, and multi-image layouts.

v2.3.0 - 2026-08-19

• Introduced the full workspace authorization model: administrator, member, and guest roles, plus workspace-level policies for resources, models, tools, files, and generation behavior.
• Replaced the old permanent workspace tokens with revocable, expirable, usage-limited invitation records, and added audit events.
• Skills and prompts support workspace resource library scopes; personal and workspace resources are isolated in storage, directories, and execution boundaries.
• Added enterprise OAuth/OIDC sign-in entry points and password policies, with backend validation of the configuration to keep administrators from locking themselves out.
• Addressed stability issues including Gemini metadata-only thought signatures, asynchronous popup geometry changes, and image publishing concurrency.

v2.2 Series

v2.2.13 - 2026-08-16

• Image generation supports a one-shot fallback channel and correctly records the actual serving channel and failed usage.
• Added a prompt optimization switch for direct drawing, and improved uploaded image compression, lightbox previews, downloading, and cross-turn image editing.
• Restored and reorganized the automatic, on, and off tool-use modes; MCP tools now default to explicit model-level selection.
• Added SearXNG search engine selection and request body privacy controls, and improved long-conversation compression plus sidebar and input box details.

v2.2.12 - 2026-08-14

• Knowledge bases gained an optional reranking service while preserving the original retrieval, citation, and failure fallback paths.
• Administrators gained a global content resources page showing ownership, status, and usage information for knowledge bases, projects, and generated images.
• Adjusted the main navigation, long-conversation title display, and input box focus feedback, and established a stable source boundary for the image library.

v2.2.11 - 2026-08-14

• Each model can configure an MCP service default selection policy, including "all available services" and an explicit custom list.
• Sharing a private knowledge base now requires the complete account email, preventing account enumeration and incorrect matching.
• The first message of a new conversation now enters the conversation page immediately, even on slow networks.

v2.2.10 - 2026-08-14

• Completed the long-conversation context compression lifecycle: automatic compression, /compact manual compression, and edit/delete/branch/concurrent and multi-instance scenarios stay consistent.
• Compression only changes the history context sent to the model; it never deletes the original messages visible to users.
• Reduced the cost of re-rendering Markdown blocks after a long streaming reply completes.

v2.2.9 - 2026-08-14

• Established layered permission controls across user groups, workspaces, knowledge bases, tools, and active conversations.
• Workspace member creation permissions, knowledge base read/write sharing, @ quick attachment of knowledge bases, and the tool selection flow were improved in sync.

v2.2.8 - 2026-08-14

• Expanded conversation document routing, complete document summarization, and retrieval strategies, and strengthened MCP, private workspaces, and feedback flows.
• Improved provider streaming output, document ingestion, sandbox recovery, and model history replay stability.

v2.2.7 - 2026-08-04

• Focused on the security and reliability of authentication, authorization, OAuth/OIDC, billing, file access, and concurrent administrator operations.
• Made version-pinned Docker deployments deterministic across the application and sandbox images.

Earlier Versions

v2.2.2 - 2026-07-21

• Added a visual formula editor and unified the storage format of formulas across editing, sharing, branching, import, and clipboard scenarios.
• Added fast/advanced model modes and refined tool routing, table reading, search, voice input, the mobile admin console, and conversation stability.

v2.2.1 - 2026-07-14

• Multi-device conversations, the sidebar, and session state now sync silently via SSE; older tabs update to the new version automatically at safe moments.
• Adjusted the default tool policy, billing and usage observability, RAG uploads, and the administrator action experience.

v2.2.0 - 2026-07-12

• The product was officially renamed Aivory; old Aurelia backups remain importable.
• Added file management for users and administrators, storage quotas, asynchronous user deletion, Word export of replies, identity linking, and RAG/upload and sandbox persistence.

v2.1.1 - 2026-07-02

• Introduced multi-user workspaces, invitation to join, shared conversations, member management, and an administrator workspace view.
• Improved native PDF parsing, RAG routing, citation display, and workspace-related security boundaries.

v2.1.0 - 2026-07-01

• Added drawing mode, multi-model validation, conversation trees and an overview, skill binding, mobile/PWA, plus RAG and context compression performance improvements.

v2.0.1 - 2026-06-23

• End-to-end security and reliability hardening of the code execution sandbox: preview CSP, exception recovery, idle recycling, child process cleanup, resource limits, and archive cleanup.

v2.0.0 - 2026-06-22

• Hardened the concurrency, estimation, injection, and deletion consistency of long-context compression.
• Added Mermaid diagram zoom, drag, fit-to-window, full-screen viewing, and PNG/SVG export.

Full Release Catalog

Each of the following versions has an official GitHub Release; for the complete changes, commit range, and upgrade notes of each patch version, open the corresponding link for the original release notes.

Version	Release date	Version	Release date
v2.2.6	2026-07-30	v2.2.5	2026-07-29
v2.2.3	2026-07-24	v2.0.1	2026-06-23
v2.0.0	2026-06-22	v2.1.0	2026-07-01

v2.2.4 has no corresponding Git tag or GitHub Release, so it is not included in the official release catalog.