0.4.0

Features

• Redesign the sign-in, forbidden and auth-error screens (#185)
• Redesign the Default model block and model picker (#188, #195)
• Refine the QuickApp editor layout (#168)
• Add Edit JSON for the QuickApp configuration, with Monaco loaded on demand (Issue #204) (#308)
• Pre-fill new QuickApps from the application type schema defaults — model, temperature, conversation starters, Add attachments, Web fetch; stored values still win (Issue #290) (#310)
• Move Code interpreter into the Settings column and align Advanced Settings with Figma; Add attachments and Fetch web resources default to on for new apps (Issue #224) (#304)
• Remove the Built-in file tools setting — the editor no longer writes features.dial_files, the backend default applies; use Edit JSON to restrict tools (Issue #332) (#335)
• Remove the editor's own 30-second auto-save — saves now happen only on host TRIGGER_SAVE / TRIGGER_AUTO_SAVE (#330)
• Cut the editor startup bundle from 5876 kB to 884 kB by loading ag-grid and Monaco on demand (#326)
• Translate the "Scroll to top" button in the catalog pickers (#324)
• Adopt the Design shadow scale and the kit FormSection — popup titles and section cards look slightly different (#301)
• [Host] Adopt the typed editor connector (@epam/ai-dial-visualizer-connector) for the editor lifecycle, with stricter inbound validation — see Deployment Changes (Issue epam/ai-dial-chat#9539) (#292)

Fixes

• Show unavailable (deleted or unshared) toolsets, agents and skills as a red validation error, and only once the catalog has loaded (Issue epam/ai-dial-chat#9635) (#319)
• Show the details popup and Tools tab for toolsets defined inline in the application's JSON (e.g. REST API toolsets) instead of "This toolset is no longer available" (Issue #320) (#338)
• Load the client config once per session user, keep the primary locale when saving translations, and keep the Instructions editor light when the theme fails to load (#263)
• Refresh the save baseline after a save, translate error messages, and fix encoded-id summary lookup (#273)
• Fix toolsets QA findings — empty-row description, Tools tab search highlighting (Issue #211) (#283)
• Label temperature bands Cold / Neutral / Hot (Issue #209) (#275)
• Fix model picker layout issues (Issue #221) (#270)
• Keep long names and paths inside the add-on details card, and Close at the end of the footer on small screens (Issue #265) (#271, #269)
• Keep the catalog Filter dropdown inside the viewport and widen the conversation starters popup on mobile (Issue #268) (#274, #276)
• Pad the QuickApp 2.0 form inside the frame like the editor app (#328)
• Make the file manager Add button neutral gray (#334)
• Keep Monaco hidden until its first paint is styled, and restore its styles under CSP (Issue #204) (#333, #331)
• Pin pdfjs-dist to 5.4.149 to address GHSA-hq66-cqwq-w95j (#288)
• Resolve npm audit vulnerabilities (#302)

CI

• Add a daily SCA scan via epam/ai-dial-ci 4.13.2 (#318)

Other

• Switch @epam/ai-dial-* chat libraries to the stable non-dev release 1.3.0 (an overrides entry raises @epam/ai-dial-react-pdf-highlighter to 0.3.2 until ai-dial-chat bumps the pin), @epam/ai-dial-ui-kit to 0.16.1 and @epam/ai-dial-react-file-manager to 0.4.1; @epam/ai-dial-chat-visualizer-connector is replaced by @epam/ai-dial-visualizer-connector (#336, #340, #323, #292)
• Migrate to Tailwind CSS 4 — a host theme that only sets --shadow-sm / --shadow-md keeps its colour on the larger layer (Issue #277) (#289)

Deployment Changes

Host integration changes

Important

The editor now accepts postMessage commands only from its embedding parent window (event.source === window.parent) at an allowed origin, and ignores messages with malformed known fields. Hosts embedding the editor in an iframe need no configuration change; messages from any other window are now discarded, even with allowedOrigin set to *. Existing save payloads and multiple-origin/wildcard allowedOrigin values are preserved. See the host-integration spec.

• The handshake is now also sent as {applicationName}/readyToInteract through AppsEditorClient; the uppercase READY / READY_TO_INTERACT Admin messages are unchanged (#292)
• Hosts must send TRIGGER_SAVE themselves — the editor no longer saves on its own every 30 seconds (#330)

Behavioral changes

Note

After redeploying this image, new QuickApps open with defaults from the application type schema, and no timer-driven saves occur.

• New-app defaults — Add attachments, Fetch web resources and Process files default to on, and the model, temperature and conversation starters come from the type schema when present (#304, #305, #310)
• features.dial_files — no longer written for new apps; an absent key means all file tools per the backend default, so deploy ai-dial-quickapps-backend PR #710 first (#335)
• Auth/handshake timing — the client config is requested after the auth status is known, so the handshake waits for one GET /api/v1/auth/me (#263)

0.4.0-rc.1

Fixes

• (toolsets) show details for toolsets defined inline in JSON (Issue #320) (#338)

Other

• (deps) bump chat libs to the stable 1.3.0 (#340)

0.4.0-rc.0

Features

• Add Edit JSON for the QuickApp configuration, with Monaco loaded on demand (Issue #204) (#308)
• Pre-fill new QuickApps from the application type schema defaults — model, temperature, conversation starters, Add attachments, Web fetch; stored values still win (Issue #290) (#310)
• Move Code interpreter into the Settings column and align Advanced Settings with Figma; Add attachments and Fetch web resources default to on for new apps (Issue #224) (#304)
• Remove the Built-in file tools setting — the editor no longer writes features.dial_files, the backend default applies; use Edit JSON to restrict tools (Issue #332) (#335)
• Remove the editor's own 30-second auto-save — saves now happen only on host TRIGGER_SAVE / TRIGGER_AUTO_SAVE (#330)
• Cut the editor startup bundle from 5876 kB to 884 kB by loading ag-grid and Monaco on demand (#326)
• Translate the "Scroll to top" button in the catalog pickers (#324)
• Adopt the Design shadow scale and the kit FormSection — popup titles and section cards look slightly different (#301)
• [Host] Adopt the typed editor connector (@epam/ai-dial-visualizer-connector) for the editor lifecycle, with stricter inbound validation — see Deployment Changes (Issue epam/ai-dial-chat#9539) (#292)

Fixes

• Show unavailable (deleted or unshared) toolsets, agents and skills as a red validation error, and only once the catalog has loaded (Issue epam/ai-dial-chat#9635) (#319)
• Load the client config once per session user, keep the primary locale when saving translations, and keep the Instructions editor light when the theme fails to load (#263)
• Refresh the save baseline after a save, translate error messages, and fix encoded-id summary lookup (#273)
• Fix toolsets QA findings — empty-row description, Tools tab search highlighting (Issue #211) (#283)
• Label temperature bands Cold / Neutral / Hot (Issue #209) (#275)
• Fix model picker layout issues (Issue #221) (#270)
• Keep long names and paths inside the add-on details card, and Close at the end of the footer on small screens (Issue #265) (#271, #269)
• Keep the catalog Filter dropdown inside the viewport and widen the conversation starters popup on mobile (Issue #268) (#274, #276)
• Pad the QuickApp 2.0 form inside the frame like the editor app (#328)
• Make the file manager Add button neutral gray (#334)
• Keep Monaco hidden until its first paint is styled, and restore its styles under CSP (Issue #204) (#333, #331)
• Pin pdfjs-dist to 5.4.149 to address GHSA-hq66-cqwq-w95j (#288)
• Resolve npm audit vulnerabilities (#302)

CI

• Add a daily SCA scan via epam/ai-dial-ci 4.13.2 (#318)

Other

• Switch @epam/ai-dial-* chat libraries to the non-dev release 1.3.0-rc.0, @epam/ai-dial-ui-kit to 0.16.1 and @epam/ai-dial-react-file-manager to 0.4.1; @epam/ai-dial-chat-visualizer-connector is replaced by @epam/ai-dial-visualizer-connector (#336, #323, #292)
• Migrate to Tailwind CSS 4 — a host theme that only sets --shadow-sm / --shadow-md keeps its colour on the larger layer (Issue #277) (#289)

Deployment Changes

Host integration changes

Important

The editor now accepts postMessage commands only from its embedding parent window (event.source === window.parent) at an allowed origin, and ignores messages with malformed known fields. Hosts embedding the editor in an iframe need no configuration change; messages from any other window are now discarded, even with allowedOrigin set to *. Existing save payloads and multiple-origin/wildcard allowedOrigin values are preserved. See the host-integration spec.

• The handshake is now also sent as {applicationName}/readyToInteract through AppsEditorClient; the uppercase READY / READY_TO_INTERACT Admin messages are unchanged (#292)
• Hosts must send TRIGGER_SAVE themselves — the editor no longer saves on its own every 30 seconds (#330)

Behavioral changes

Note

After redeploying this image, new QuickApps open with defaults from the application type schema, and no timer-driven saves occur.

• New-app defaults — Add attachments, Fetch web resources and Process files default to on, and the model, temperature and conversation starters come from the type schema when present (#304, #305, #310)
• features.dial_files — no longer written for new apps; an absent key means all file tools per the backend default, so deploy ai-dial-quickapps-backend PR #710 first (#335)
• Auth/handshake timing — the client config is requested after the auth status is known, so the handshake waits for one GET /api/v1/auth/me (#263)

0.3.2

Features

• Add Edit JSON for the QuickApp configuration, with Monaco loaded on demand (Issue #204) (#308)
• Pre-fill new QuickApps from the application type schema defaults — model, temperature, conversation starters, Add attachments, Web fetch; stored values still win (Issue #290) (#310)
• Move Code interpreter into the Settings column and align Advanced Settings with Figma; Add attachments and Fetch web resources default to on for new apps (Issue #224) (#304)
• Remove the Built-in file tools setting — the editor no longer writes features.dial_files, the backend default applies; use Edit JSON to restrict tools (Issue #332) (#335)
• Remove the editor's own 30-second auto-save — saves now happen only on host TRIGGER_SAVE / TRIGGER_AUTO_SAVE (#330)
• Cut the editor startup bundle from 5876 kB to 884 kB by loading ag-grid and Monaco on demand (#326)
• Translate the "Scroll to top" button in the catalog pickers (#324)
• Adopt the Design shadow scale and the kit FormSection — popup titles and section cards look slightly different (#301)
• [Host] Adopt the typed editor connector (@epam/ai-dial-visualizer-connector) for the editor lifecycle, with stricter inbound validation — see Deployment Changes (Issue epam/ai-dial-chat#9539) (#292)

Fixes

• Show unavailable (deleted or unshared) toolsets, agents and skills as a red validation error, and only once the catalog has loaded (Issue epam/ai-dial-chat#9635) (#319)
• Load the client config once per session user, keep the primary locale when saving translations, and keep the Instructions editor light when the theme fails to load (#263)
• Refresh the save baseline after a save, translate error messages, and fix encoded-id summary lookup (#273)
• Fix toolsets QA findings — empty-row description, Tools tab search highlighting (Issue #211) (#283)
• Label temperature bands Cold / Neutral / Hot (Issue #209) (#275)
• Fix model picker layout issues (Issue #221) (#270)
• Keep long names and paths inside the add-on details card, and Close at the end of the footer on small screens (Issue #265) (#271, #269)
• Keep the catalog Filter dropdown inside the viewport and widen the conversation starters popup on mobile (Issue #268) (#274, #276)
• Pad the QuickApp 2.0 form inside the frame like the editor app (#328)
• Make the file manager Add button neutral gray (#334)
• Keep Monaco hidden until its first paint is styled, and restore its styles under CSP (Issue #204) (#333, #331)
• Pin pdfjs-dist to 5.4.149 to address GHSA-hq66-cqwq-w95j (#288)
• Resolve npm audit vulnerabilities (#302)

CI

• Add a daily SCA scan via epam/ai-dial-ci 4.13.2 (#318)

Other

• Switch @epam/ai-dial-* chat libraries to the non-dev release 1.3.0-rc.0, @epam/ai-dial-ui-kit to 0.16.1 and @epam/ai-dial-react-file-manager to 0.4.1; @epam/ai-dial-chat-visualizer-connector is replaced by @epam/ai-dial-visualizer-connector (#336, #323, #292)
• Migrate to Tailwind CSS 4 — a host theme that only sets --shadow-sm / --shadow-md keeps its colour on the larger layer (Issue #277) (#289)

Deployment Changes

Host integration changes

Important

The editor now accepts postMessage commands only from its embedding parent window (event.source === window.parent) at an allowed origin, and ignores messages with malformed known fields. Hosts embedding the editor in an iframe need no configuration change; messages from any other window are now discarded, even with allowedOrigin set to *. Existing save payloads and multiple-origin/wildcard allowedOrigin values are preserved. See the host-integration spec.

• The handshake is now also sent as {applicationName}/readyToInteract through AppsEditorClient; the uppercase READY / READY_TO_INTERACT Admin messages are unchanged (#292)
• Hosts must send TRIGGER_SAVE themselves — the editor no longer saves on its own every 30 seconds (#330)

Behavioral changes

Note

After redeploying this image, new QuickApps open with defaults from the application type schema, and no timer-driven saves occur.

• New-app defaults — Add attachments, Fetch web resources and Process files default to on, and the model, temperature and conversation starters come from the type schema when present (#304, #305, #310)
• features.dial_files — no longer written for new apps; an absent key means all file tools per the backend default, so deploy ai-dial-quickapps-backend PR #710 first (#335)
• Auth/handshake timing — the client config is requested after the auth status is known, so the handshake waits for one GET /api/v1/auth/me (#263)

0.3.1

Fixes

• (infra) bump node base images to 24.22.2 (CVE-2026-111497)- #9637 #

0.3.0

BREAKING CHANGES

• Replace the standalone Next.js server with a static Vite/React SPA served by chat-api — the Docker image, all runtime env vars, the auth provider variables and the OAuth redirect URI path (/api/auth/callback/<provider> → /api/v1/auth/callback/<provider>) change; see Deployment Changes and CHANGELOG.md (#149, #155, #158)
• [Host] Read applicationName from the entry-URL query parameter instead of CUSTOM_CLIENT_VARIABLES — upgrade ai-dial-chat (with pass-application-name-to-quickapps) first (#232)

Features

• Use chat skills instead of prompts in the editor (Issue #136) (#139)
• Support application credentials: open the host's credential forms from the agent details popup — needs a host advertising applicationCredentials=true (#140, #244)
• Split Agents & Toolsets into separate Toolsets and Agents rows (Issue #189, #211, #150, #210, #212) (#216)
• Redesign the Skills add-on, reuse the catalog modal for the skills picker and preview skill package files by type (CSV/xlsx, PDF, docx/pptx, images, Markdown, code) (Issue #210) (#213, #223, #247)
• Move conversation starters into Add-ons with a setup modal, removable on hover (Issue #207) (#200, #214, #234)
• Add a Knowledge base add-on row with a restyled file picker — a selected folder is added as a folder, current files are pre-checked, upload progress shows in the kit TransferQueue (Issue #208) (#222, #227, #249, #253, #257)
• Show catalog-style add-on details (header, Connect tab, toolset credentials) for skills, toolsets and agents (#227, #233, #235)
• Replace the agent Connection dialog with a Settings tab in the agent details popup — Connect via (MCP / Chat Completion) saves immediately (#244)
• Add a search field and tool count to the Tools tab of toolset details (#237)
• Add a Settings row with an Advanced Settings popup holding temperature, process files, attachments and feature toggles (Issue #209) (#194, #197, #199, #217, #224, #225, #255)
• Default the orchestrator temperature of new apps to 0.5 (#220)
• Require non-blank Instructions to save (Issue #203) (#219)
• Redesign the Quick App editor layout, Default model block and model picker (#168, #177, #183, #184, #188, #195)
• Redesign the sign-in, forbidden and auth-error screens (#185)
• [Host] Accept several origins in allowedOrigin (#198)
• [Host] Tell the host when the form is invalid — the new VALIDITY_STATE message, and SAVE_ERROR for a manual save blocked by validation (Issue #238) (#254)

Fixes

• Treat shared apps exactly like own apps — read-only now comes only from the host's isReadonly prop (Issue #208) (#256)
• Save toolset and agent ids single-encoded (Issue #178) (#192)
• Persist the Quick App display version from TRIGGER_SAVE (Issue #164) (#190)
• Show the right name for an MCP-only application added as an agent instead of unknown (#141)
• Fit the editor to mobile screens — keep the scroll position when toggling a switch, wrap the Instructions toolbar, open the add-on, model and Knowledge base popups full-screen (Issue #252, #258, #259, #260)
• Patch zlib in the runtime image to address CVE-2026-85091 (#217)

Other

• Run on the ghcr.io/epam/ai-dial-chat-bff runtime image, defaulting to the development tag — pin a tag for reproducible builds (#160, #162)
• Bump @epam/ai-dial-* chat libraries to 1.2.0, @epam/ai-dial-ui-kit to ^0.15.4 and @epam/ai-dial-react-file-manager to ^0.3.5; add @epam/ai-dial-attachment-canvas, @epam/ai-dial-quotations and pdfjs-dist for skill file previews (#223, #227, #233, #241, #247)
• Align Tailwind color tokens with ui-kit 2.0 (#182)

Deployment Changes

New environment variables

Variable	Required	Default	Description
CORS_ORIGIN	Yes	—	Origin(s) allowed to call the API cross-origin; usually the same as AUTH_CALLBACK_BASE_URL
AUTH_SESSION_SECRET	Yes	—	64 hex characters; AUTH_SESSION_PREV_SECRET allows zero-downtime rotation
AUTH_CALLBACK_BASE_URL	Yes	—	This app's own origin
AUTH_POST_LOGOUT_REDIRECT_URI	Yes	—	Set to the same value as CORS_ORIGIN and AUTH_CALLBACK_BASE_URL (per CHANGELOG.md)
AUTH_SESSION_COOKIE_NAME	No	__Host-quickapps.sess	Session cookie name
AUTH_TRANSACTION_COOKIE_NAME	No	__Host-quickapps.tx	OAuth handshake cookie name
AUTH_LEGACY_COOKIE_NAMES	No	—	Old next-auth cookie names to expire; avoids HTTP ERROR 431 after upgrade
CSP_MODE	No	report-only	Set to enforce once there are no violation reports
ALLOWED_CONNECT_ORIGINS	No	none	Extra fetch/XHR origins permitted by CSP
OVERLAY_ENABLED	No	unset	Only when the session cookie needs SameSite=None
API_PREFIX	No	api	Prefix for API and health-check routes
OTEL_SDK_DISABLED	No	true	Set to false plus the OTEL_* variables to enable OpenTelemetry

Renamed / deprecated environment variables

Caution

The old names are no longer read.

Old variable	New variable or location	Notes
NEXTAUTH_SECRET	AUTH_SESSION_SECRET
NEXTAUTH_URL	AUTH_CALLBACK_BASE_URL	CORS_ORIGIN is set separately
THEMES_URL	THEMES_CONFIG_URL	Now the base URL; /config.json is appended
ALLOWED_FRAME_ANCESTORS	ALLOWED_IFRAME_ORIGINS
QUICK_APPS_DEFAULT_MODEL	DEFAULT_DEPLOYMENT
AUTH_<PROVIDER>_ISSUER / _CLIENT_SECRET	AUTH_<PROVIDER>_HOST / _SECRET	Keycloak, Auth0, Azure AD secret; see CHANGELOG.md
CODE_INTERPRETER_ENABLED, WEB_FETCH_ENABLED, ADD_ATTACHMENT_ENABLED	CUSTOM_CLIENT_VARIABLES keys codeInterpreterEnabled, webFetchEnabled, addAttachmentEnabled	Boolean true, not "true"
ALLOWED_ORIGIN, DIAL_ADMIN_URL, DIAL_CHAT_URL	CUSTOM_CLIENT_VARIABLES keys allowedOrigin, dialAdminHost, dialChatHost
QUICK_APPS_APPLICATION_NAME	applicationName entry-URL query parameter	No env fallback

Settings keys (CUSTOM_CLIENT_VARIABLES)

Key	Change	Description
allowedOrigin	New location, accepts several values	One origin, a comma-separated list or a JSON array; unset or * accepts any origin (unsafe outside local dev)
dialAdminHost, dialChatHost	New location	Host origins for the visualizer connector
codeInterpreterEnabled, webFetchEnabled, addAttachmentEnabled	New location	Boolean (must be true, not "true"); offer the Code interpreter, Web fetch and Add attachment settings, off when unset
applicationName	Removed	Passed by the host as the entry-URL query parameter

Host integration changes

Important

Upgrade ai-dial-chat first: it must send applicationName in the QuickApps entry URL, otherwise readyToSave is never sent and Save/Preview stay disabled; the admin host does not send it yet. The editor also posts VALIDITY_STATE ({ isValid }) and a SAVE_ERROR for a manual save blocked by validation — older hosts ignore them and wait for the save timeout. Application credentials need a host advertising applicationCredentials=true and handling REQUEST_APPLICATION_CREDENTIALS; older hosts just hide the action. Update every identity provider's redirect URI to /api/v1/auth/callback/<provider>.

Behavioral changes

Note

New apps default the orchestrator temperature to 0.5 (saved values are unchanged), and shared apps are no longer forced read-only.

• Image — now chat-api plus this app's static build, amd64-only, default port 5000 (#149, #179)
• Health check — HEALTHCHECK calls /<API_PREFIX>/health (#149)

0.3.0-rc.2

Fixes

• Keep the editor's scroll position when toggling a switch, such as Attachments, on mobile — the tap no longer jumps the page (Issue #260)
• Wrap the Instructions formatting toolbar within the field on mobile instead of overflowing its edge (Issue #258)
• Open the Add skill, Add toolset, Add agent and Change model modals full-screen below the md breakpoint (768px) (Issue #259)
• Fit the Knowledge base add files popup to mobile screens — full-screen with reduced insets so the file list keeps most of the height (Issue #252)

0.3.0-rc.1

Features

• Replace the agent Connection dialog with a Settings tab in the agent details popup — Connect via (MCP / Chat Completion) saves immediately, MCP is shown when no transport is saved; Application credentials now close the popup before the host's forms open (#244)
• Add a selected Knowledge base folder as a folder instead of expanding it into its files; a saved folder is pre-checked when the popup is reopened (Issue #208) (#257)

Fixes

• Add files of a selected Knowledge base folder, and keep the dialog open with an error banner when listing fails (#249)
• Pre-check current files in the Knowledge base popup, including names with spaces or special characters and files in lazily loaded folders (Issue #208) (#253)
• Treat shared apps exactly like own apps — read-only now comes only from the host's isReadonly prop (Issue #208) (#256)
• Require the maximum attachments amount while attachments are enabled; Save is blocked and a new loaded app without a valid max gets the default 1 (#255)
• [Host] Tell the host when the form is invalid — a blocked manual save posts SAVE_ERROR, and the new VALIDITY_STATE message lets the host disable Save/Preview (Issue #238) (#254)
• Preview skill package files by type (CSV/xlsx tables, PDF, docx/pptx, images, Markdown, code) instead of as raw text (#247)

Other

• Add @epam/ai-dial-attachment-canvas and @epam/ai-dial-quotations 1.2.0-rc.0 and pdfjs-dist for skill file previews; the preview code is lazy-loaded (#247)

Deployment Changes

Settings keys (CUSTOM_CLIENT_VARIABLES)

Key	Change	Description
codeInterpreterEnabled, webFetchEnabled, addAttachmentEnabled	Documented	Boolean (must be true, not "true"); offer the Code interpreter, Web fetch and Add attachment settings, off when unset. Replace the removed *_ENABLED env vars from 0.3.0-rc.0

Host integration changes

Important

The editor now posts a new VALIDITY_STATE message ({ isValid }) and a SAVE_ERROR for a manual save blocked by validation. Upgrade ai-dial-chat to a version that handles them to disable Save/Preview on an invalid form; older hosts ignore the new message and wait for the save timeout.

Behavioral changes

Note

Shared apps are no longer forced read-only; the editor honors only the host's isReadonly.

• Application credentials — the action now closes the agent details popup, then sends REQUEST_APPLICATION_CREDENTIALS; the host protocol is unchanged (#244)

0.3.0-rc.0

BREAKING CHANGES

• Replace the standalone Next.js server with a static Vite/React SPA served by chat-api — the Docker image, all runtime env vars, the auth provider variables and the OAuth redirect URI path (/api/auth/callback/<provider> → /api/v1/auth/callback/<provider>) change; see Deployment Changes and CHANGELOG.md (#149, #155, #158)
• [Host] Read applicationName from the entry-URL query parameter instead of CUSTOM_CLIENT_VARIABLES — upgrade ai-dial-chat (with pass-application-name-to-quickapps) first (#232)

Features

• Use chat skills instead of prompts in the editor (Issue #136) (#139)
• Support application credentials: open the host's credential forms from agent chips and Advanced Settings — needs a host advertising applicationCredentials=true (#140)
• Split Agents & Toolsets into separate Toolsets and Agents rows (Issue #189, #211, #150, #210, #212) (#216)
• Redesign the Skills add-on and reuse the catalog modal for the skills picker (Issue #210) (#213, #223)
• Move conversation starters into Add-ons with a setup modal, removable on hover (Issue #207) (#200, #214)
• Add a Knowledge base add-on row and restyle the file picker; show upload progress in the kit TransferQueue (#222, #227)
• Show catalog-style add-on details (header, Connect tab, toolset credentials) for skills, toolsets and agents (#227, #233)
• Add a search field and tool count to the Tools tab of toolset details (#237)
• Add a Settings row with an Advanced Settings popup holding temperature, process files, attachments and feature toggles (Issue #209) (#194, #197, #199, #217, #224, #225)
• Default the orchestrator temperature of new apps to 0.5 (#220)
• Require non-blank Instructions to save (Issue #203) (#219)
• Redesign the Quick App editor layout, Default model block and model picker (#168, #177, #183, #184, #188, #195)
• Redesign the sign-in, forbidden and auth-error screens (#185)
• [Host] Accept several origins in allowedOrigin (#198)

Fixes

• Save toolset and agent ids single-encoded (Issue #178) (#192)
• Persist the Quick App display version from TRIGGER_SAVE (Issue #164) (#190)
• Show the right name for an MCP-only application added as an agent instead of unknown (#141)
• Hide the add-on trash button once the details popup is closed with the mouse (#235)
• Label the conversation-starters modal footer action Cancel (#234)
• Patch zlib in the runtime image to address CVE-2026-85091 (#217)

Other

• Run on the ghcr.io/epam/ai-dial-chat-bff runtime image, defaulting to the development tag — pin a tag for reproducible builds (#160, #162)
• Bump @epam/ai-dial-* chat libraries to 1.2.0-rc.0, @epam/ai-dial-ui-kit to ^0.15.0 and @epam/ai-dial-react-file-manager to ^0.3.0 (#223, #227, #233, #241)
• Align Tailwind color tokens with ui-kit 2.0 (#182)

Deployment Changes

New environment variables

Variable	Required	Default	Description
CORS_ORIGIN	Yes	—	Origin(s) allowed to call the API cross-origin; usually the same as AUTH_CALLBACK_BASE_URL
AUTH_SESSION_SECRET	Yes	—	64 hex characters; AUTH_SESSION_PREV_SECRET allows zero-downtime rotation
AUTH_CALLBACK_BASE_URL	Yes	—	This app's own origin
AUTH_POST_LOGOUT_REDIRECT_URI	Yes	—	Set to the same value as CORS_ORIGIN and AUTH_CALLBACK_BASE_URL (per CHANGELOG.md)
AUTH_SESSION_COOKIE_NAME	No	__Host-quickapps.sess	Session cookie name
AUTH_TRANSACTION_COOKIE_NAME	No	__Host-quickapps.tx	OAuth handshake cookie name
AUTH_LEGACY_COOKIE_NAMES	No	—	Old next-auth cookie names to expire; avoids HTTP ERROR 431 after upgrade
CSP_MODE	No	report-only	Set to enforce once there are no violation reports
ALLOWED_CONNECT_ORIGINS	No	none	Extra fetch/XHR origins permitted by CSP
OVERLAY_ENABLED	No	unset	Only when the session cookie needs SameSite=None
API_PREFIX	No	api	Prefix for API and health-check routes
OTEL_SDK_DISABLED	No	true	Set to false plus the OTEL_* variables to enable OpenTelemetry

Renamed / deprecated environment variables

Caution

The old names are no longer read.

Old variable	New variable or location	Notes
NEXTAUTH_SECRET	AUTH_SESSION_SECRET
NEXTAUTH_URL	AUTH_CALLBACK_BASE_URL	CORS_ORIGIN is set separately
THEMES_URL	THEMES_CONFIG_URL	Now the base URL; /config.json is appended
ALLOWED_FRAME_ANCESTORS	ALLOWED_IFRAME_ORIGINS
QUICK_APPS_DEFAULT_MODEL	DEFAULT_DEPLOYMENT
AUTH_<PROVIDER>_ISSUER / _CLIENT_SECRET	AUTH_<PROVIDER>_HOST / _SECRET	Keycloak, Auth0, Azure AD secret; see CHANGELOG.md
CODE_INTERPRETER_ENABLED, WEB_FETCH_ENABLED, ADD_ATTACHMENT_ENABLED	CUSTOM_CLIENT_VARIABLES keys	See CHANGELOG.md
ALLOWED_ORIGIN, DIAL_ADMIN_URL, DIAL_CHAT_URL	CUSTOM_CLIENT_VARIABLES keys allowedOrigin, dialAdminHost, dialChatHost
QUICK_APPS_APPLICATION_NAME	applicationName entry-URL query parameter	No env fallback

Settings keys (CUSTOM_CLIENT_VARIABLES)

Key	Change	Description
allowedOrigin	New location, accepts several values	One origin, a comma-separated list or a JSON array; unset or * accepts any origin (unsafe outside local dev)
dialAdminHost, dialChatHost	New location	Host origins for the visualizer connector
applicationName	Removed	Passed by the host as the entry-URL query parameter

Host integration changes

Important

Upgrade ai-dial-chat first: it must send applicationName in the QuickApps entry URL, otherwise readyToSave is never sent and Save/Preview stay disabled. The admin host does not send it yet. Application credentials additionally need a host advertising applicationCredentials=true and handling REQUEST_APPLICATION_CREDENTIALS; older hosts just hide the action. Update every identity provider's redirect URI to /api/v1/auth/callback/<provider>.

Behavioral changes

Note

New apps default the orchestrator temperature to 0.5; saved values are unchanged.

• Image — now chat-api plus this app's static build, amd64-only, default port 5000 (#149, #179)
• Health check — HEALTHCHECK calls /<API_PREFIX>/health (#149)

0.2.0

Fixes

• Add logic for removed toolsets\agents
• Fix display of json-added toolsets
• [QuickApps] Can't download file from Context files modal in editor, Issue #134 (#137)