v2.4.1

What's Changed

Aivory 2.4.1 makes image attachments useful with text-only chat models, aligns internal model policies with the model selected for each conversation, and fixes Tailwind and Google Fonts rendering in HTML previews. It also hardens image editing, improves the administrator onboarding flow, expands regression coverage, and adds direct links to the documentation and live demo.

Images with Text-only Models and Tools

• Allows images to be uploaded from both the composer and conversation-files panel regardless of the selected chat model's native vision capability.
• Keeps image attachments on the persisted conversation turn, including image-only turns, instead of filtering them out or rejecting the request before streaming begins.
• Continues to exclude image blocks from provider requests when the selected model is not vision-capable, while showing a localized warning that the image remains available to conversation tools.
• Preserves original image bytes for python_execute, MCP tools, restored conversations, and later model changes. Images still require a conversation scope and retain server-side signature and MIME classification.
• Treats a current image attachment as a deterministic file-tool signal in Auto mode so an enabled file-capable tool can inspect it without relying on the route classifier to infer the need from the prompt.

Image Generation and Editing Reliability

• Ignores a stale base_image_index when the model correctly selects previous_generation as the edit base. The index only applies to current_attachment and no longer causes a valid continuation edit to fail validation.
• Clarifies the image tool schema so models omit attachment indexes for previous-generation edits.
• Adds provider-mocked coverage for new generation, requested aspect ratios and resolution tiers, multiple outputs, PNG and JPEG edits, selected bases with reference images, prior-generation continuation, and editing an image generated earlier in the same turn.
• Adds negative-path coverage confirming invalid operations stop before the provider call and do not create artifacts, while valid operations persist artifacts and image usage counts.

Internal Model Policy

• Uses the current conversation model for titles, query routing, summaries, memory extraction, and other internal tasks when no dedicated task model is configured. The global default model remains the final fallback for task calls that have no usable conversation model.
• Uses the current conversation model to classify ambiguous Auto tool requests when no dedicated tool-routing model is configured. Explicit task and tool-routing model selections continue to take precedence.
• Makes context compaction consistently discover the current conversation model when the caller does not pass an explicit fallback.
• Adds explicit Use current conversation model choices and updated guidance across model policy and context-memory settings.
• Treats an unset task model as a valid inherited configuration in the administrator overview, while still reporting invalid configured model IDs.
• Prevents administrators from selecting model-based prompt moderation until an enabled chat model is configured as the moderation model.

Administrator Onboarding

• Adds optional task-model and tool-routing-model steps to the server-backed setup guide, with direct targets on the Model policy page and completion checks for valid enabled chat models.
• Keeps these two model optimizations optional, so they never block required first-run setup.
• Fixes navigation so Next continues through all remaining steps, Finish appears only at the end, and completion remains disabled until required setup is ready.
• Shows Skip for now only for an unseen guide and simplifies the Back, Next, and Finish action hierarchy.
• Updates all affected administrator copy in English, Simplified Chinese, Traditional Chinese, Japanese, and French.

HTML Preview Rendering

• Detects generated Tailwind utility classes and injects the bundled @tailwindcss/browser runtime into the sandboxed preview document, so utility-based HTML renders with its intended layout and styling.
• Avoids injecting Tailwind into ordinary custom-class documents and avoids adding a second runtime when the preview already includes Tailwind or is rebuilt.
• Supports complete HTML documents and bare fragments while preserving mixed-content upgrades, safe external-link behavior, iframe sandboxing, and no-referrer requests.
• Rewrites Google Fonts stylesheet and font-file hosts to reachable HTTPS mirrors while preserving resource paths.
• Adds focused frontend tests for runtime detection, document-head insertion, duplicate prevention, custom CSS isolation, empty previews, and Google Fonts rewriting.

Documentation

• Adds prominent links to the official documentation and live demo in the English and Simplified Chinese project READMEs.
• Points both deployment quick-start guides to the official deployment and configuration documentation.
• Updates the Chinese Auto tools documentation to describe current-conversation-model routing when no dedicated route model is set.

Upgrade Notes

• No database migration or new environment variable is required for this release.
• If task_model_id or tool_route_model_id is empty, internal calls now use the model selected for the current conversation. Configure dedicated low-latency, non-reasoning models if inheriting a reasoning model adds unwanted latency or cost.
• Text-only providers still never receive image bytes as native visual input. To inspect such images, enable an appropriate sandbox or MCP tool, or select a vision-capable chat model.
• HTML previews that use Tailwind utilities now load a runtime bundled with the application rather than relying on a public Tailwind CDN.

Validation

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• go test ./... from server/
• go build ./... from server/
• python3 -m unittest discover -s tests/sandbox-service -p 'test_*.py'
• Locale JSON validation with jq empty
• git diff --check

Release Scope

• Documentation and demo links: 763e954.
• Previous-generation image edit fix: 946d0ac.
• Durable images for text-only models and tools: 14a104e.
• Model policy, moderation guard, and onboarding refinements: 555a636 and a707465.
• Image operation regression coverage: dd35d2c.
• Tailwind and Google Fonts support in HTML previews: 9d8dfe6, ebd1de8, and 2999e85.

Full Changelog: v2.4.0...v2.4.1

v2.4.0

What's Changed

Aivory 2.4.0 introduces a lightweight personal deployment backed by SQLite, a guided administration experience, safer and more predictable tool execution, and stronger authentication and model-configuration protections. It also expands operational visibility, improves image generation and editing decisions, adds complete LaTeX copying, and refines the chat experience across desktop and mobile.

Personal Deployment and Embedded Vectors

• Adds deploy/docker-compose.personal.yml and .env.personal.example for a single-instance deployment that runs Aivory without external PostgreSQL, Redis, or Qdrant services.
• Stores application data and vector embeddings in SQLite, with in-process cache and queue implementations. A new exact cosine-similarity backend supports VECTOR_BACKEND=sqlite, alongside qdrant, disabled, and automatic selection.
• Includes SQLite vector data in logical backups and removes it with the corresponding documents, knowledge bases, and conversations.
• Keeps the sandbox optional through the Compose sandbox profile. Existing full-stack deployments continue to use PostgreSQL, Redis, and Qdrant unchanged.

Guided Administration and Model Setup

• Replaces the static first-run checklist with a server-backed walkthrough that can navigate administrators between configuration pages, retry status checks, skip recommended steps, and be reopened later.
• Detects personal and full deployments and distinguishes required channel, chat-model, and default-model setup from recommended embedding, search, sandbox, and SMTP configuration.
• Can discover and import compatible provider models when a channel is created, while skipping duplicates or unsupported entries and reporting complete, partial, empty, and failed outcomes.
• Expands the administrator overview with 24-hour activity metrics, configuration health, and a global offline indicator.
• Adds expandable workspace knowledge-base details covering documents, indexing, embedding configuration, status, and storage usage.

Tool Execution and LLM Reliability

• Adds batched web operations: aivory_web_search accepts up to five queries and web_fetch accepts up to four URLs, with bounded concurrency, deduplication, stable ordering, and partial-success results.
• Introduces per-turn tool and time budgets plus repeated-call and no-progress detection. When a limit is reached, Aivory stops calling tools and asks the model for one final tool-free response instead of allowing an endless loop.
• Applies the safeguards consistently across OpenAI Chat, OpenAI Responses, Anthropic, Gemini, prompt-tool flows, and Deep Research, with explicit tool_budget_exceeded and tool_no_progress handling.
• Reduces repeated context-compaction attempts and separates compaction and turn orchestration into focused modules with expanded regression coverage.

Image Generation and Editing

• Plans image requests explicitly as generation or editing operations and identifies whether the edit base is a previously generated image or a selected current attachment.
• Supports choosing a specific base from multiple attachments while keeping the remaining images as references.
• Prevents new-generation requests from accidentally carrying prior or current images into an edit request.
• Fails closed and asks for clarification when the intended edit base is ambiguous, while preserving provider parameters, dimensions, image counts, fallbacks, quotas, and usage reporting.
• Handles deleted conversation attachments without breaking history restoration or image-capability checks.

Authentication and Session Security

• Reworks the slider captcha around server-signed pass tokens with stronger verification, replay prevention, and expiration enforcement.
• Retries transient OAuth token-exchange timeouts once on a fresh connection, extends the exchange timeout, and restricts public OAuth errors to a fixed allowlist so provider responses and tokens are not exposed.
• Enforces exclusive refresh sessions at login. Refresh-token reuse revokes the complete session family, while browser tabs serialize refreshes with Web Locks to avoid false replay detection.
• Adds refresh-cookie CSRF validation to refresh, session, and logout endpoints.

RAG and Document Safety

• Prevents deletion of embedding models or channels that are referenced by global settings or knowledge bases, and blocks changes to vector-identity fields while those references exist.
• Returns localized conflict responses with recovery guidance instead of surfacing database foreign-key errors, including for historical dangling-model configurations.
• Surfaces parser and MinerU availability failures in document workflows so administrators can configure the missing service and retry indexing.
• Requires hosted tools to be configured explicitly; new models and channel imports no longer receive implicit OpenAI hosted-tool defaults.

Chat, Formula, and Sharing Experience

• Copies the complete LaTeX source from rendered inline and block formulas and provides localized success or failure feedback without disrupting citation interactions.
• Tracks and displays thinking duration, hides unavailable timing data in restored tool traces, and fixes reasoning Markdown line breaks around bold titles without changing ATX headings or creating unintended lists.
• Adds the same user avatar menu to mobile home and conversation headers, contains image attachments within message bubbles, and restores the configured default tool selection in new chats.
• Refines shared conversations, conversation renaming, font preferences, sidebar hierarchy, and general visual alignment.
• Reduces the desktop chat title bar from 56 px to 48 px and blends scrolled messages into it with the same subtle fade treatment used between sidebar controls and conversation history.
• Aligns the Personalization page's Response style and Tools headings with the typography used by other settings tabs.
• Unifies sub-conversation, HTML preview, and conversation-file drawers with matching title typography, borderless chat edges, and open/close motion. HTML output now begins directly below its title without a framed preview card or persistent sandbox caption.

Permissions, Administration, and Sandbox Recovery

• Adds conversation-deletion permissions to user groups and workspace members, enforces separate checks for deleting conversations and message rounds, and hides unavailable deletion actions in the client.
• Shows nicknames in usage records and lets administrators search usage by nickname, email address, or user ID.
• Recovers missing sandbox sessions from archives, supports restoration under a read-only root filesystem, and improves artifact-link recognition in Markdown and inline threads.

Deployment and Platform Support

• Publishes sandbox runner and sidecar images for both linux/amd64 and linux/arm64 under the same semantic-version tag, matching the existing multi-architecture application image.
• Lets Compose select the correct supported architecture automatically. 32-bit ARM remains unsupported.

Upgrade Notes

• Database migrations run automatically; no manual SQL is required. The new vector_points table stores embeddings when the SQLite vector backend is active.
• Existing full-stack installations remain on PostgreSQL, Redis, and Qdrant and do not need to migrate to the personal profile. The personal and full-stack Compose configurations are separate deployment paths and must not be combined.
• The personal profile is designed for one application instance. Do not horizontally scale it or place its SQLite database on NFS or another network filesystem.
• Logging in replaces existing refresh sessions, so users may need to sign in again on other devices after the upgrade.
• Review hosted-tool settings after upgrading because hosted tools now require explicit administrator configuration.
• Embedding models and channels referenced by knowledge bases or global settings can no longer be removed or have their vector identity changed until those references are updated.
• New settings use safe defaults and introduce no required environment variables. ARM64 installations can use the same v2.4.0 image tags as AMD64 installations.

Validation

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• go test ./... from server/
• go build ./... from server/
• python3 -m unittest discover -s tests/sandbox-service -p 'test_*.py'
• Locale JSON validation with jq empty
• git diff --check

Related Issues and Pull Requests

• Resolves #25 through #26: rendered inline and block formulas now copy their complete LaTeX source with localized success and failure feedback.

Release Scope

• Personal SQLite deployment and vector backend: 59e9131 (feat(deploy): add personal SQLite profile).
• Guided administration and model setup: ad98495, 5d53476, beb76a2, 42deb89, and 87caa70.
• Tool batching, loop protection, and LLM orchestration: 7c7322c, 44234cd, bc4a239, and 6ba9fa2.
• Image generation and editing routing: 740999b (fix image generation and editing routing).
• Authentication and session security: b5fd8f5, d881cb0, and 63892b4.
• RAG, document parsing, and explicit hosted tools: 1847588, b7e184d, and 5fb859c.
• Chat and interface improvements: 4178937, c6aa7ad, 438d557, 5a9fcb7, 659bee6, and 4c0536f.
• Conversation permissions, administrative visibility, and sandbox recovery: cecfcb3, af37c01, 5787054, 49ccf37, and febd235.
• Multi-architecture sandbox images: 415fd77 (build(docker): publish sandbox images for arm64).

Full Changelog: v2.3.1...v2.4.0

v2.3.1

What's Changed

Aivory 2.3.1 improves how the Python sandbox handles the files a conversation uses. Every conversation upload is now staged in its original form — so the model can edit an existing PDF, DOCX, PPTX, or XLSX without reconstructing it — and it adds a fetch_image tool that downloads public images into the sandbox through the backend's SSRF-safe client. This release also restores OpenAI chat reasoning across tool rounds, hardens web_fetch against unreachable origins with a reader-service fallback, and refines image handling on text-only models and across turns.

Sandbox Conversation Files

• Stages every conversation upload into /workspace/uploads/ in its original bytes, removing the earlier format allowlist. The model can now read and write the actual Office/PDF files the user attached instead of a regenerated approximation.
• Preserves document layout and formatting for targeted edits, guiding the model to prefer Python libraries such as python-docx, python-pptx, and pypdf over reconstructing content.
• Keeps uploads bounded by the existing conversation-upload size limit and resets the staging namespace between calls so stale or removed files do not linger.
• Advertises uploads in the sandbox guidance for every supported language (English, Simplified Chinese, Traditional Chinese, Japanese, French).

Public Image Downloads (fetch_image)

• Re-enables image downloads into the conversation sandbox with a fetch_image tool. The Python runner stays network-isolated; all outbound access goes through the backend's SSRF-safe client.
• Validates the URL scheme, host, and port, rejects private/loopback/metadata targets, enforces a byte cap, and verifies the bytes are a supported image before staging.
• Stages verified images under /workspace/downloads/, persists the sandbox session across turns, and rebuilds the session if the container is reclaimed.
• Adds signal and data coverage for image boundaries in the sandbox, including session-gone rebuilds and workspace policy denial.
• Adds per-turn and Deep Research limits for fetch_image and a per-invocation download timeout, all env-tunable and documented in docs/config-reference.md.
• Blocks fetch_image in fast turns alongside python_execute and subjects it to the AllowSandbox workspace policy.
• Adds the "Download image" entry to the selectable built-in-tool catalog.

OpenAI Chat Reasoning Across Tool Rounds

• Replays reasoning_content on request when replaying prior OpenAI chat turns, so reasoning blocks produced in earlier rounds are forwarded correctly.
• Streams OpenAI chat reasoning deltas into the same tool-loop events as non-reasoning content, restoring reasoning display continuity in longer tool-enabled conversations.
• Adds regression coverage for reasoning replay across a multi-turn tool loop.

Web Fetch Resilience

• When the origin is directly unreachable (filtered or black-holed route), retries the read through a Jina Reader-compatible text-extraction endpoint instead of hanging until the tool budget is exhausted.
• Runs the direct attempt on a short sub-timeout so a black-hole cannot consume the whole tool budget, and keeps the reader hop SSRF-safe — private, loopback, and metadata targets are never handed off.
• Relaxes the web_fetch timeouts (15s→30s tool, 25s→40s client) and adds regression coverage for the fallback path.

Chat, Images, and Error Handling

• On text-only models, warns that images will be ignored and strips image attachments from the request instead of blocking the send; the model switch itself warns when conversation history contains images.
• Converts phone formats vision providers cannot reliably decode (HEIC/HEIF, TIFF, BMP, AVIF, ICO) even when small, while keeping compatible formats byte-for-byte through 3 MiB.
• Supports paste-to-attach anywhere in the composer from clipboardData.files, deduped against the editor's own paste handler.
• Preserves image edit context across turns and skips restore for optimistic new-chat temp ids so new conversations no longer 404 with a spurious restore error.
• Sanitizes failed tool output and user-visible errors so internal paths, URLs, and secrets are never streamed or persisted.
• Wraps multiple image attachments to prevent overflow, and tightens admin users row alignment.

Upgrade Notes

• Database schema is unchanged in this release; no manual SQL is required.
• No configuration changes are required. New optional env vars (AIVORY_TOOLS_WEB_FETCH_JINA_FALLBACK, AIVORY_TOOLS_WEB_FETCH_JINA_BASE, AIVORY_TOOLS_WEB_FETCH_DIRECT_TIMEOUT, AIVORY_LLM_PER_TURN_TOOL_LIMITS_FETCH_IMAGE, AIVORY_LLM_DEEP_RESEARCH_TOOL_LIMITS_FETCH_IMAGE, AIVORY_LLM_TOOL_TIMEOUTS_FETCH_IMAGE) default to safe values and are documented in docs/config-reference.md.
• fetch_image requires the Python sandbox to be configured and to be enabled by the active workspace policy.

Validation

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• go test ./... from server/
• go build ./... from server/
• Locale JSON validation with jq empty
• git diff --check

Release Scope

• Sandbox conversation files and fetch_image tool: cafe633 (fix(images): preserve edit context across turns) and d1f9098 (feat(sandbox): stage all conversation uploads).
• OpenAI chat reasoning replay: 7b135c3 (fix(openai): replay chat reasoning content).
• Web fetch reader fallback: dcd74bc (fix(tools): fall back to a reader service when web_fetch can't reach the origin).
• Text-only model images and paste-to-attach: e525bc3 (fix(chat): ignore images on text-only models and support paste-to-attach).
• Image attachment wrapping: b1d9b14 (fix(ui): wrap multiple image attachments).
• Admin users row alignment: 39c9cf3 (fix(ui): tighten admin users row alignment).

Full Changelog: v2.3.0...v2.3.1

v2.3.0

What's Changed

Aivory 2.3.0 introduces a complete workspace authorization model for teams, governed member invitations, workspace-scoped skills and prompts, and administrator-controlled enterprise OAuth/OIDC entry policies. This release also hardens authorization across conversations, projects, knowledge bases, files, tools, and generation flows; improves modal behavior during asynchronous updates; fixes Gemini thought-signature compatibility; and strengthens release-image publishing.

Workspace Roles and Authorization

• Adds three explicit workspace roles: administrator, member, and guest. The workspace creator remains the canonical owner and is represented as an administrator with owner-only authority where required.
• Gives workspace administrators management access across workspace conversations, projects, knowledge bases, members, invitations, policies, and audit history.
• Keeps member access bounded to shared workspace resources and resources they created, while allowing administrators to inspect private workspace content for governance.
• Makes guests read-only across workspace content. Creation, mutation, generation, feedback, branching, retry, rename, sharing, and deletion controls are hidden when unavailable and are independently rejected by the API.
• Removes archive behavior from workspace conversations for every role, preventing workspace threads from disappearing into a personal archived-chat view.
• Shows the creator alongside the private marker when an administrator views another member's private workspace conversation.
• Adds per-member permissions for creating projects, creating private conversations, creating skills and prompts, creating knowledge bases, adding knowledge-base files, and deleting knowledge-base content.
• Applies authorization at the API and storage layers instead of relying on frontend visibility. PostgreSQL and SQLite use equivalent authorization paths.
• Rechecks authority inside sensitive transactions so stale administrator requests cannot complete after a role downgrade or removal.
• Revokes generation work when a membership or workspace policy change removes the authority required to continue it.

Workspace Capability Policies

• Adds workspace-level model allowlists and makes the configured model set selectable from workspace management.
• Adds workspace restrictions for built-in and hosted tools, MCP services, sandbox execution, image generation, knowledge bases, and file uploads.
• Adds an optional monthly member-credit ceiling scoped to workspace activity.
• Enforces capability policy when catalogs are listed and again when a request is executed, preventing clients from bypassing a hidden or disabled option with a direct API call.
• Keeps owner-only and administrator-only operations distinct, including administrator promotion, ownership transfer, and high-privilege invitation creation.
• Clears stale role-update loading state in the management UI and provides explicit loading, success, failure, and empty states for workspace administration requests.

Governed Workspace Invitations

• Replaces the legacy permanent workspace token flow with managed invitation records.
• Supports invitation role, optional exact-email binding, expiration, maximum-use limits, revocation, and usage tracking.
• Restricts administrator invitations to the workspace owner and defaults unrestricted invitations to the read-only guest role.
• Performs invitation authorization, validity checks, use-count updates, membership creation, and audit writes transactionally.
• Returns an existing member's actual stored role when they follow another invitation, avoiding temporary permission escalation in the client.
• Invalidates administrator invitations created by the former owner when workspace ownership is transferred.
• Prevents old permanent tokens, stale requests, concurrent consumption, removed invite creators, and ownership changes from bypassing current invitation governance.
• Adds a compact single-row invitation editor with styled role and expiry selectors, responsive wrapping, and no horizontal overflow.
• Adds workspace audit events for invitation lifecycle, member and role changes, policy updates, and ownership transfer.

Workspace Resource Library

• Renames the Skills page to Resource Library and adds a dedicated workspace scope for skills and prompt templates.
• Separates personal resources from workspace resources at storage, API, catalog, and conversation-execution boundaries.
• Allows workspace administrators and authorized members to create and manage workspace skills and prompts; guests remain read-only.
• Makes workspace resources available to conversations in that workspace without leaking them into personal or unrelated workspace catalogs.
• Adds the create-skills-and-prompts member permission to workspace role management.
• Aligns empty states across Files, Resource Library, Knowledge Bases, and Projects, including consistent typography and positioning in split file views.
• Fixes sidebar collapse and navigation shortcuts on macOS, including the workspace-aware new-chat shortcut behavior.
• Orders workspace library schema migrations before workspace indexes are created, preventing startup failures caused by a missing workspace_id column during upgrade.

Enterprise OAuth and OIDC Login Policy

• Adds administrator-controlled password-login availability without limiting configured OAuth/OIDC providers.
• Adds three unauthenticated entry modes: the regular login page, a provider picker, or immediate redirect to a selected provider.
• Falls back safely to the provider picker or login page when an automatic-redirect provider is unavailable, preventing redirect loops and inaccessible login screens.
• Adds required, optional, and disabled initial-password policies for accounts created through OAuth/OIDC.
• Separates public password registration from OAuth/OIDC automatic account provisioning, allowing existing third-party identities to log in while new automatic provisioning is disabled.
• Enforces disabled password authentication and password-management endpoints on the backend rather than only hiding frontend controls.
• Restricts identity linking and unlinking when the effective enterprise policy would make those operations unsafe.
• Validates policy changes against enabled, usable providers and the current administrator's linked identity to prevent an administrator from locking the installation out of every login method.
• Exposes the effective public policy without secrets, refreshes it across login and authenticated flows, and includes the new settings in administrator configuration backup and restore.
• Adds localized policy controls and error states in English, French, Japanese, Simplified Chinese, and Traditional Chinese.

Conversation and Content Safety

• Aligns workspace conversation controls with effective role and member permissions across the sidebar, composer, message actions, inline threads, project views, and conversation pages.
• Prevents read-only users from creating conversations or invoking edit, retry, regenerate, branch, feedback, rename, favorite, share, or delete actions.
• Preserves personal-space behavior outside a workspace; the new workspace restrictions are applied only when a workspace is active.
• Fixes the Knowledge Base detail page initialization order that could produce Cannot access 'n' before initialization and render a blank page.
• Fixes workspace member and audit authorization queries under PostgreSQL.

Gemini Thought-Signature Compatibility

• Filters Gemini parts that contain provider metadata or a thought signature but no text, inline data, function call, or function response payload.
• Prevents invalid requests where Gemini receives an uninitialized data oneof, which previously caused 400 responses in longer tool-enabled conversations.
• Preserves thought signatures on parts that also contain a valid payload, maintaining provider reasoning continuity where supported.
• Adds regression coverage for metadata-only parts and valid signed content.

Dialog and Loading Experience

• Keeps dialogs centered while their width or height changes, avoiding the transient jump to the upper-left corner seen during tab changes.
• Animates geometry changes caused by tabs, validation messages, skeleton replacement, and asynchronously loaded content.
• Continues an in-progress resize transition from the currently painted dimensions so rapid updates do not snap back to an earlier size.
• Adds a restrained content transition when asynchronous data replaces a placeholder without changing the dialog's outer dimensions.
• Constrains dialog bodies to the viewport, preserves fixed header and footer regions, and avoids accidental horizontal scrolling.
• Honors reduced-motion preferences for resize and content transitions.
• Refines workspace invitation and settings dialogs for denser controls and more stable loading behavior.

CI and Documentation

• Serializes application image publishing per Git ref and cancels stale in-progress builds so an older main build cannot overwrite a newer latest image.
• Passes the repository token explicitly to Docker metadata generation to improve release workflow reliability.
• Keeps semantic image tags for the application, sandbox runtime, and sandbox sidecar when v2.3.0 is published.
• Updates project acknowledgements to Qdrant, Radix UI, and Linux Do.

Upgrade Notes

• Database schema changes are applied automatically at startup. Back up the database before upgrading and allow one application instance to finish migration before scaling the new version out.
• This release adds workspace role, permission, policy, invitation, audit, and resource-library schema. No manual SQL is required.
• Existing workspace owners remain administrators with owner authority. Existing legacy workspace role values are normalized by the new authorization layer.
• Existing personal conversations...

v2.2.13

What's Changed

Aivory 2.2.13 improves image generation reliability, image attachment handling, tool selection, Gemini function calling, and long-chat compaction behavior. It also adds a request-body privacy control for provider diagnostics, makes MCP tools opt-in at the model level, tightens the main sidebar, and refines the shared composer focus treatment.

Image Generation Reliability

• Adds a one-time fallback channel for both direct image-model conversations and the image_generate built-in tool.
• Tries the configured primary channel first and moves to the fallback only when the first generation attempt fails.
• Attributes successful usage to the channel that actually served the image, including a fallback marker for operational review.
• Records failed primary and fallback attempts as zero-cost error usage entries so administrators can diagnose provider failures without charging users for unsuccessful work.
• Reuses one quota reservation across both attempts and prevents duplicate billing, artifact persistence, and success records when fallback is used.
• Keeps fallback behavior scoped to image generation; normal chat and unrelated tools retain their existing routing behavior.

Image Prompts, Uploads, and Downloads

• Adds a prompt-optimization switch below the composer when a direct image-generation model is selected.
• Enables prompt optimization by default and lets users turn it off to send their original prompt directly to the image model.
• Preserves the choice across normal send, edit-and-resend, and regenerate flows.
• Leaves images of 3 MiB or less byte-for-byte unchanged before upload.
• Compresses larger browser-decodable images automatically toward a provider-safe size below 3 MiB, without asking the user to resize the file manually.
• Tries high-quality encoding at the original dimensions first and reduces dimensions only when quality adjustment alone cannot meet the upload budget.
• Prefers transparency-preserving WebP or PNG output for non-JPEG sources and uses JPEG as a compatibility fallback.
• Uses orientation-aware browser decoding and limits temporary canvas size to avoid excessive memory use on large mobile photos.
• Opens generated images and image attachments in the existing lightbox and provides an explicit download action for the original served file.
• Avoids treating the rendered chat preview as the downloadable image, preserving the available generation resolution.

Tool Selection Experience

• Restores the three existing tool-use modes: Automatic, On, and Off.
• Places Tool use in the composer's add menu and opens a focused second-level mode panel instead of exposing a disconnected tool-selection submenu.
• Adds the tool-selection action to the mode-panel title area, keeping mode choice and tool choice in one workflow.
• Applies Automatic and On only to the tools the user selected; Off continues to disable tool declarations for the turn.
• Shows the current selection summary and selected count without exposing implementation categories in the user-facing list.
• Corrects selected-state checkmark alignment and gives long tool catalogs a bounded, independently scrollable results region.
• Preserves loading, retry, empty, search, unavailable, select-all, and clear states in the tool dialog.

SearXNG Engine Selection

• Adds an administrator-only engine selection field to the Web search settings when SearXNG is selected.
• Accepts SearXNG engine names or shortcuts separated by commas or spaces, so custom engines do not need to be added to Aivory's frontend catalog.
• Sends the selected list as SearXNG's engines query parameter, making a search use only the configured engines.
• Treats an empty list as "use the SearXNG instance defaults", preserving existing installations and custom SearXNG engine configuration.
• Normalizes names to lowercase, removes duplicates, limits the list length, and rejects invalid characters before saving.
• Applies changes on the next search without restarting Aivory and leaves Serper and Brave behavior unchanged.

Gemini Function-Calling Compatibility

• Normalizes every tool parameter schema sent to Gemini, covering built-in, hosted, and administrator-managed tools through the same provider path.
• Removes unsupported JSON Schema metadata such as $schema and translates broader schema constructs into Gemini's accepted function-declaration subset.
• Resolves local $ref definitions, simplifies external or recursive references, and preserves useful constraints in descriptions when Gemini cannot represent them directly.
• Handles objects, arrays, tuples, enums, constants, nullable values, unions, required fields, property ordering, numeric bounds, string bounds, and examples defensively.
• Filters required and ordering entries that no longer have a matching property after normalization.
• Enforces depth and node limits so an unexpectedly complex external schema cannot consume unbounded processing time.
• Leaves the original schema unchanged for providers that support the broader JSON Schema vocabulary.
• Prevents the Gemini 400 responses caused by unsupported $schema and additionalProperties fields in ordinary and MCP tool declarations.

MCP Defaults and Navigation

• Changes model-level MCP defaults to opt-in: an omitted, null, or empty configuration now selects no MCP services.
• Requires administrators to explicitly select each MCP service that a model should enable by default.
• Retains explicitly stored service IDs when a service is temporarily disabled, unavailable, unsynchronized, or no longer present in the live catalog.
• Continues to apply global tool availability and user-group permissions as hard runtime limits over model defaults and user selections.
• Keeps user selections authoritative for the conversation while preserving the existing Automatic, On, and Off behavior.
• Reduces spacing, row height, padding, and corner radius in the six primary sidebar actions so they align more closely with the conversation list.
• Softens the divider between navigation and conversations and adds a shallow top fade only after the conversation list begins scrolling.
• Preserves mobile tap targets, collapsed-sidebar behavior, active states, tooltips, and reduced-motion preferences.

Context Compaction

• Keeps automatic context compaction silent in the user interface; progress and outcome notifications are now reserved for an explicit /compact command.
• Skips automatic compaction when there is no eligible old conversation prefix beyond the current summary frontier.
• Applies the same user-message boundary and active-stream protection when deciding whether an automatic pass can make progress.
• Detects requests that would remain above the token trigger even after the deepest safe conversation cut, such as requests dominated by system instructions, tool declarations, attached context, or a very large recent turn.
• Stops repeatedly scheduling token-triggered no-op summaries for those irreducible requests while retaining the independent round-retention cadence as the conversation grows.
• Preserves inline compaction for genuine large backlogs and substantial token spikes when summarizing old turns can materially reduce the request.
• Prevents already fully compacted conversations from launching another summary task on every subsequent message.

Logging, Usage, and Interface Refinements

• Adds an administrator setting under Logging to disable persistence of complete upstream request bodies.
• Retains request method, URL, sanitized headers, status, timing, and provider error details when full request-body storage is disabled.
• Redacts multipart image bytes and large Base64 payloads from provider diagnostics to avoid storing oversized binary content in logs.
• Fixes the administrator Usage table with stable column widths, single-line truncation, and tooltips for values that do not fit.
• Replaces the detached composer light bar with a fine accent outline, a shallow reflected shadow, and a one-pixel focused lift.
• Uses the same focus behavior on the home and conversation composers and provides a distinct drag-over state.
• Disables composer movement under reduced-motion preferences while retaining a clear keyboard-focus response.
• Adds or updates interface text for English, French, Japanese, Simplified Chinese, and Traditional Chinese.

Upgrade Notes

• No manual database migration is required for this release.
• Existing model rows whose MCP policy is omitted or null now resolve to no default MCP services. Administrators should open each model and explicitly select the services that should start enabled.
• User-selected tools, administrator-wide availability, group permissions, and saved MCP connection settings are not changed by the default-off policy.
• Configure an image fallback channel only when a second provider or endpoint is available for the same image model behavior. A failed primary attempt and the fallback result remain separately visible in usage diagnostics.
• Prompt optimization affects direct image-model turns only. Turning it off bypasses the prompt-rewrite task and sends the user's prompt as entered.
• SearXNG engine selection is optional. For example, entering bing, wikipedia limits SearXNG searches to those two engines; clearing the field restores the instance's enabled defaults.
• The request-body logging switch affects newly captured provider diagnostics; existing stored records are not modified.
• Automatic compaction continues to run when configured and useful, but it no longer emits user-facing progress notifications. Use /compact when an explicit, visible compaction pass is needed.
• For Docker deployments, set IMAGE_TAG=2.2.13 and leave SANDBOX_IMAGE_TAG unset after the matching application and sandbox image workflows complete.

Validation

• Focused Go tests cover Gemini schema normalization, image fallback and per-attempt usage attribution, request-body priva...

v2.2.12

What's Changed

Aivory 2.2.12 adds optional knowledge-base reranking, a platform-wide content-resource workspace for administrators, and durable provenance boundaries for generated-image galleries. It also reorganizes the main navigation, makes long conversation titles readable without widening the sidebar, and gives the shared chat composer a restrained focus response on both the home and conversation pages.

Knowledge-Base Reranking

• Adds optional reranking for retrieval results through an independently configured OpenAI-compatible reranking service.
• Lets administrators configure the reranking Base URL, API key, and model under Document settings without creating or reusing a normal chat-model channel.
• Keeps reranking disabled by default. Existing installations preserve their current retrieval behavior until an administrator deliberately enables it.
• Runs reranking only when a conversation has one or more attached knowledge bases. Ordinary conversations, direct chat attachments, sandbox files, and conversations without an attached knowledge base remain unchanged.
• Applies the existing minimum relevance threshold before reranking, then sends at most 24 eligible candidates to the reranking service.
• Preserves fixed Top-K handling, multi-knowledge-base result interleaving, adjacent-fragment expansion, citations, and the existing multi-turn knowledge retrieval flow.
• Uses a five-second reranking timeout so an unavailable service cannot indefinitely delay an answer.
• Falls back to the original reciprocal-rank-fusion order when the service times out, returns a non-success response, omits required result fields, produces invalid indexes, or otherwise cannot be used.
• Validates the enabled configuration atomically before saving. The administrator interface requires an absolute HTTP(S) Base URL ending in /v1, a model, and an API key.
• Sends the API key as a Bearer token and keeps it masked when settings are read back through administrator APIs.
• Adds focused unit coverage for successful reordering, truncated candidate sets, malformed responses, invalid indexes, HTTP failures, timeouts, and fallback ordering.

Administrator Content Resources

• Adds a new /admin/resources page for reviewing knowledge bases, projects, and generated images across the entire installation.
• Places the new page in the administrator navigation as a standalone operational surface instead of nesting it under an individual user's profile.
• Lets administrators filter knowledge bases by resource name and by the creator's username or email.
• Shows knowledge-base ownership, workspace context, description, embedding model and availability, vector dimension, document totals, processing states, failures, storage size, chunk count, sharing totals, shared members, uploaders, and timestamps.
• Reuses the existing document metadata and status model so administrators can inspect ready, processing, and failed documents without introducing a second ingestion system.
• Lets administrators filter projects by project name and by the creator's username or email.
• Shows project instructions, visual settings, ownership, workspace context, the dedicated knowledge base, index health, documents, activity totals, and paginated source conversations.
• Lets administrators filter generated images by the owner's username or email and by the persisted image-model attribution.
• Shows image previews, generation prompts when available, model information, owner, workspace, filename, media type, file size, artifact ID, message ID, conversation ID, generation time, and a link to the source conversation.
• Provides explicit initial loading, background refresh, filter loading, error, retry, empty, filtered-empty, detail loading, detail failure, and pagination feedback throughout the page.
• Keeps list requests and detail requests protected against stale out-of-order responses when filters, pages, tabs, or selected resources change quickly.
• Removes the redundant per-user Library action from administrator user menus while retaining the new global resource inventory.
• Registers all new resource APIs behind administrator authorization and exposes them as read-only inspection endpoints.

Generated-Image Provenance

• Adds a durable source value to stored artifacts so the application can distinguish Python execution output from local image generation and hosted model image generation.
• Records python_execute, image_generate, and image_generation at artifact creation time instead of inferring provenance later from a whole assistant message.
• Restricts the user's My Gallery view to artifacts created by real image-generation paths.
• Applies the same source boundary to administrator per-user galleries, the new global image inventory, image totals, model options, and image detail lookups.
• Excludes charts, plots, screenshots, and other image files created by python_execute even when they share an assistant message with a generated image.
• Keeps gallery discovery based on persistent artifacts and billing usage rather than removable request logs, so deleting usage logs does not remove correctly attributed gallery images.
• Leaves excluded artifacts intact in storage and in their source conversations; the change affects gallery and inventory visibility only.

Navigation and Interaction

• Reorganizes the main sidebar around concise Files, Knowledge, and Library destinations.
• Adds the Knowledge destination to workspace sidebars for users who have knowledge-base permission.
• Removes the duplicate Knowledge entry from the avatar menu.
• Renames the former Skills & prompts navigation label to the shorter Library label while retaining the existing skills and prompt functionality.
• Makes truncated conversation titles pan horizontally after pointer hover or keyboard focus so the complete title can be read without changing sidebar width.
• Measures only actually overflowing titles and adjusts the animation duration to the hidden text distance.
• Preserves the normal ellipsis and exposes a native full-title hint when reduced-motion preferences are enabled.
• Adds a subtle one-pixel focused lift and localized reflected light beneath the shared composer on both the home page and conversation page.
• Keeps the composer treatment restrained to the active state and avoids a full perimeter glow.
• Preserves mobile sizing, keyboard focus visibility, dark-theme contrast, and reduced-motion behavior.

Localization

• Adds complete administrator resource-management and reranking copy for English, French, Japanese, Simplified Chinese, and Traditional Chinese.
• Updates navigation labels consistently across all five supported languages.

Upgrade Notes

• Database migrations run automatically for SQLite and PostgreSQL; no manual SQL migration is required.
• The migration adds artifacts.source as a non-null text field with an empty default for existing records.
• Historical artifacts do not contain reliable per-artifact provenance. Records whose source remains empty are therefore hidden from user and administrator galleries after upgrading, but they are not deleted and remain available from their original conversations.
• New artifacts are attributed at creation time, so local image generation, hosted image generation, and Python execution are separated reliably going forward.
• Reranking settings are seeded automatically and remain disabled by default. Existing knowledge bases, embeddings, chunks, citations, document status, and conversation selections require no migration or reindexing.
• When reranking is enabled, the retrieval query and up to 24 eligible knowledge-base fragments are sent to the independently configured external reranking service. Administrators should choose a service whose privacy and retention terms match their deployment requirements.
• Reranking failures are non-fatal and preserve the original retrieval order; disabling the setting immediately returns the installation to its previous retrieval path.
• Image model attribution in the administrator inventory is derived from the persistent image usage associated with the source assistant message. The normal one-model generation flow is exact; a rare message that invokes multiple distinct image-generation backends can share one displayed model attribution across its images.
• Existing /admin/users/:id/library deep links remain available for compatibility, but the visible administrator workflow now uses /admin/resources.
• For Docker deployments, set IMAGE_TAG=2.2.12 and leave SANDBOX_IMAGE_TAG unset after the matching application and sandbox image workflows complete.

Validation

• go test -count=1 ./... and go build ./... passed.
• All 71 frontend test files and all 425 frontend tests passed.
• TypeScript type checking, ESLint, and the production frontend build passed.
• Focused Go tests passed for reranking behavior, administrator resource stores, image-source filtering, schema migration, settings validation, permissions, and image workflow attribution.
• Desktop and mobile browser checks passed for the home page and conversation page in light and dark themes, including focused and unfocused composer states.
• All 75 locale JSON files parsed successfully, and the new keys have parity across the five supported interface languages.
• git diff --check passed.

Release Scope

• Knowledge-base reranking, administrator content resources, generated-image provenance, sidebar and title improvements, and composer focus treatment: 712086e (feat(admin): add content resources and knowledge reranking).

Full Changelog: v2.2.11...v2.2.12

v2.2.11

What's Changed

Aivory 2.2.11 adds per-model MCP tool defaults, closes an account-discovery gap in personal knowledge-base sharing, and makes the first message of a new conversation enter the chat view immediately even when the network is slow. Administrators can now decide which MCP services a model selects by default without weakening global or user-group restrictions, knowledge-base owners can share only by entering a complete account email address, and users receive immediate visual confirmation after sending from the home page.

Model-Level MCP Tool Defaults

• Adds an MCP default-selection section to the administrator model editor alongside the existing built-in tool defaults.
• Supports a live "all available services" policy that automatically includes newly added eligible MCP services without requiring every model to be edited again.
• Supports an explicit custom policy, including an empty selection when a model should start with no MCP services selected.
• Preserves the distinction between an omitted or null policy, an explicit empty array, and a specific list of MCP service IDs across administrator APIs, configuration backups, SQLite, and PostgreSQL.
• Keeps saved IDs for services that are disabled, temporarily unavailable, unsynchronized, or deleted, allowing administrators to review and remove stale configuration instead of losing it silently.
• Shows MCP names, icons, descriptions, loading placeholders, retry actions, empty states, disabled states, unsynchronized states, stale-snapshot states, and deleted-service placeholders in the model editor.
• Exposes select-all and clear actions for custom defaults while retaining unavailable saved selections until an administrator deliberately removes them.
• Applies model defaults only when the user has not made an explicit tool selection for the conversation. A user's selected tools remain authoritative for that turn.
• Continues enforcing administrator-wide tool availability and user-group permissions as hard runtime limits, regardless of a model's saved defaults.
• Declares tools only from currently enabled MCP services with a usable discovery snapshot. A previous synchronization error can continue using the last successful snapshot.
• Re-resolves MCP defaults when the system switches to a TTFT fallback model, so the fallback model uses its own configuration rather than inheriting the original model's defaults.
• Keeps MCP service IDs and connection details out of the public model catalog while returning the configuration through authenticated administrator endpoints.
• Adds localized administrator copy for English, Simplified Chinese, Traditional Chinese, Japanese, and French.

Private Knowledge-Base Sharing

• Requires a complete email address before searching for a user to share a personal knowledge base with.
• Returns no candidates for an empty query, display name, partial local part, partial address, wildcard, or email substring, preventing the sharing dialog from becoming a general account directory.
• Matches one active account by normalized, case-insensitive exact email and excludes the knowledge-base owner.
• Limits the candidate endpoint to at most one result because account emails are unique.
• Changes share creation and role updates to resolve the target from the complete email on the server instead of accepting an opaque user ID.
• Rejects attempts to bypass the discovery boundary by submitting user_id directly to the share mutation endpoint.
• Keeps existing shares in a separate visible list so owners can still review, change roles, and remove access without searching again.
• Adds clear input guidance, incomplete-address feedback, loading feedback, no-match feedback, retry behavior, and an already-shared state in all supported interface languages.
• Preserves the existing read and upload-capable roles, ownership rules, revocation behavior, user-group restrictions, and workspace/project sharing boundaries.

Immediate New-Conversation Navigation

• Creates a local temporary conversation and enters its /chat/<id> route synchronously when the user sends the first message from the home page.
• Starts the real conversation request only after the target route is visible, so a slow create request no longer leaves the home page looking unresponsive.
• Replaces the temporary conversation ID in place when the server returns the real ID, without interrupting the visible turn or stream.
• Uses the same optimistic transition for ordinary first messages and messages with attachments.
• Reuses an attachment-owned server conversation that was prepared earlier, preserving file ownership and ingestion state instead of creating a duplicate conversation.
• Waits for an in-progress attachment draft only in background send work; the wait no longer blocks route navigation.
• Avoids requesting conversation details or inline threads for client-only temporary IDs, eliminating expected 404 requests during the optimistic interval.
• Keeps the user's message and an explicit assistant error state visible if server-side conversation creation fails.
• Retains duplicate-send protection and avoids redirecting the user back to the conversation if they navigate elsewhere before the real ID arrives.
• Loads the home and thread views through one shared lazy route module so the first-send transition does not flash the content-panel loading fallback.

Upgrade Notes

• Database migrations run automatically for SQLite and PostgreSQL; no manual SQL migration is required.
• The migration adds nullable models.mcp_server_ids storage. Existing models receive NULL, which means all currently eligible MCP services are selected by default and preserves the behavior before this release.
• Administrators can save [] to make a model default to no MCP services, or save a list of service IDs for a custom default selection.
• Direct API integrations that call PUT /api/kbs/{id}/shares must now send email instead of user_id. The email must be complete and resolve to an active account.
• The share-candidate endpoint now returns a result only for an exact email lookup and returns at most one candidate.
• Existing knowledge-base shares, roles, files, embeddings, and conversation selections require no migration or reindexing.
• The optimistic new-conversation flow does not change stored conversation or message formats and requires no historical data migration.
• For Docker deployments, set IMAGE_TAG=2.2.11 and leave SANDBOX_IMAGE_TAG unset after the matching application and sandbox image workflows complete.

Validation

• TypeScript type checking, ESLint, and the production frontend build passed.
• Focused frontend tests passed for exact-email discovery, model MCP default-selection semantics, optimistic first-send ordering, attachment conversation reuse, and temporary-route request suppression.
• Focused Go tests passed for model persistence and migration, administrator model APIs, tool catalogs, MCP runtime filtering, fallback-model behavior, exact-email sharing, authorization, and revocation-sensitive paths.
• All supported administrator and knowledge-base locale files parsed successfully.
• git diff --check passed.

Release Scope

• Knowledge-base exact-email sharing: 3aa97ce (fix(kb): require exact email for sharing).
• Model-level MCP defaults: 4a5dc7f (feat(models): configure default MCP tools).
• Immediate new-conversation navigation: 1c31966 (fix(chat): enter new conversations immediately).

Full Changelog: v2.2.10...v2.2.11

v2.2.10

What's Changed

Aivory 2.2.10 completes the context-compaction lifecycle for long conversations and improves the rendering performance of long, actively streaming responses. Compaction now preserves substantially more of the information needed to continue a conversation safely, handles large histories through bounded summarization requests, settles its own usage correctly, and remains consistent across edits, deletions, branches, concurrent requests, and multiple application replicas. On the frontend, completed Markdown blocks no longer repeat expensive rendering work whenever the response tail grows.

Automatic and Manual Context Compaction

• Automatically compacts older completed conversation history after the configured token threshold is reached while preserving recent messages verbatim.
• Keeps the complete visible conversation in storage. Compaction changes only the historical context sent to a model and does not delete the user's original messages.
• Retains both a minimum number of recent user and assistant rounds and the configured percentage of recent messages, keeping current instructions and active work outside the summary.
• Supports explicit compaction through /compact, with stable results for disabled compaction, insufficient history, an active generation, a changed conversation, model failure, persistence failure, and timeout.
• Adds real-time started, completed, and failed notifications for automatic compaction instead of allowing background work to appear silent or stalled.
• Treats abandoned streaming messages with a configurable grace window so a crashed generation cannot block later manual compaction indefinitely.

Summary Quality and Request Limits

• Replaces a fixed short summary target with an adaptive target based on source size and conversation rounds, preserving more decisions, constraints, unresolved work, and factual detail from long chats.
• Retries a materially under-produced summary when the source contains enough information to justify the requested target, without padding genuinely short or sparse conversations.
• Processes oversized summary sources through bounded map-reduce stages rather than sending one request that exceeds the selected model's context window.
• Adds an administrator-controlled per-request compaction budget with a default of 32,768 tokens and a minimum of 8,192 tokens; longer histories are split and progressively merged within that budget.
• Enforces the configured summary output ceiling in provider requests. Model reasoning or thinking defaults cannot silently raise the administrator's hard compaction limit.
• Bounds cumulative summary blocks and folds them in conversation order when their configured merge budget is exceeded.

Complete Tool, Citation, and Attachment Context

• Recovers complete recognized native tool results from provider data for summarization instead of relying only on the short preview stored in normalized chat blocks.
• Preserves important conclusions near the end of long search, paper lookup, webpage, database, and other tool results by splitting complete results across bounded map-reduce requests when necessary.
• Uses a provider-neutral internal tool envelope so OpenAI, Anthropic, and Gemini tool history can be summarized without replaying one provider's native payload through another provider.
• Adds citation titles, URLs, snippets, attachment metadata, document references, and generated-artifact details to the compaction source so retained references remain understandable.
• Persists image and hosted-image artifact references across the compaction frontier and rehydrates verified images for compatible vision models within a bounded aggregate byte budget.
• Keeps complete internal tool output private: normal conversation APIs continue to return the existing bounded preview rather than exposing raw results recovered for summarization.

Billing, Concurrency, and Data Consistency

• Adds independent credit reservation, settlement, and release for manual and asynchronous compaction, preventing positive usage records that were never deducted from the user's balance.
• Keeps inline automatic compaction inside the current response settlement while giving background and manual work their own attributable accounting lifecycle.
• Adds database-backed per-conversation compaction leases across manual, inline, and asynchronous paths, preventing duplicate model calls and duplicate charges across concurrent requests or application replicas.
• Serializes summary persistence with conversation edits and deletions and verifies source-content fingerprints, preventing stale asynchronous work from writing deleted or superseded content back into a summary.
• Revalidates the exact source messages immediately before the summary update and uses compare-and-swap protection when the summary state changes concurrently.
• Includes message-content fingerprints in the token-estimate cache key so equal-length edits invalidate old estimates and do not trigger compaction too early or too late.

Branch and Model Safety

• Orders connected summary blocks according to their actual position on the active conversation branch, preserving the sequence of requirements, decisions, and corrections.
• Protects shared-prefix summaries still required by sibling branches when one branch creates or merges its own summary blocks.
• Stops an asynchronous task when its explicitly captured branch leaf has been deleted instead of falling back to and compacting the conversation's latest branch.
• Validates a dedicated compaction model before use. If it is missing, disabled, deleted, or unavailable, Aivory falls back to the current conversation model and then the configured task model.
• Preserves provider output limits and prompt-tool behavior across fallback attempts without replaying incompatible raw history.
• Cleans up per-conversation command state when the user navigates away and rejects concurrent /compact requests before they can perform duplicate work.

Administration and Configuration

• Provides administrator controls for enabling compaction, the global token trigger, the model-level threshold cap, minimum retained rounds, and the percentage of recent messages retained verbatim from 10% to 50%.
• Provides separate controls for the new-summary output limit, adaptive summary target from 5% to 80%, accumulated-summary merge budget, and per-request input/output budget.
• Allows administrators to select a dedicated conversation model for compaction or inherit the conversation/task-model fallback chain.
• Allows a custom compaction instruction to be prepended to Aivory's built-in continuation-summary prompt.
• Validates the complete compaction configuration atomically so an invalid model, percentage, token budget, or prompt value cannot leave a partially updated settings set.
• Excludes runtime compaction leases from backup export and import, preventing restored conversations from remaining temporarily locked by state captured on another deployment.
• Updates the English and Simplified Chinese configuration references and synchronizes administrator and chat messages across English, Simplified Chinese, Traditional Chinese, Japanese, and French.

Long Response Rendering

• Splits rendered Markdown into independently memoized block views for headings, paragraphs, lists, code, Mermaid diagrams, blockquotes, formulas, separators, and tables.
• Prevents completed leading blocks from repeatedly running inline or block Markdown conversion, sanitization, and related React rendering work whenever new text arrives at the end of a response.
• Limits most streaming updates to the trailing block whose content is still changing, reducing avoidable CPU work and DOM updates on multi-section answers.
• Continues tokenizing the complete Markdown source so block boundaries, incomplete trailing syntax, citations, and final output semantics remain consistent with previous releases.
• Preserves code controls, preview identities, Mermaid behavior, KaTeX output, tables, citation clicks, line-break preferences, and block-level entrance animations.
• Keeps the final non-streaming render authoritative when generation completes. This optimization does not virtualize, hide, truncate, or delay visible response content.

Upgrade Notes

• Database migrations run automatically for SQLite and PostgreSQL; no manual SQL migration is required.
• The migration adds the conversation_compaction_leases runtime table. Existing conversations, messages, summaries, knowledge bases, files, and embeddings require no rebuild or re-upload.
• Existing compaction settings remain valid. Administrators should review the new request budget and summary target if longer, more detailed summaries are desired.
• Compaction applies to eligible older completed history. It does not replace provider context limits or the existing validation, document-routing, RAG, and sandbox paths for one oversized current prompt or attachment.
• No API, provider, model, billing, permission, or stored-message format change is introduced by the Markdown rendering optimization.
• For Docker deployments, set IMAGE_TAG=2.2.10 and leave SANDBOX_IMAGE_TAG unset after the matching application and sandbox image workflows complete.

Validation

• go build ./..., TypeScript type checking, and ESLint passed.
• Focused Go tests for LLM compaction, task-model fallback, billing, concurrency leases, branches, media recovery, API handlers, storage, backup behavior, and generation configuration passed.
• All 68 frontend test files and 415 frontend tests passed, including Markdown citations and context-compaction notifications.
• The production frontend build completed successfully. Existing Vite dynamic-import and large-chunk notices remain warnings rather than build failures.

Release Scope

• Context-compaction lifecycle hardening is based on 4affeb33f5a85139b55d3341881d9fa9f53c1a42 (`fix(compaction): harden co...

v2.2.9

What's Changed

Aivory 2.2.9 introduces layered access control across user groups, workspaces, individual knowledge bases, tools, and active chat sessions. Administrators can now decide which prompts, skills, tools, MCP services, and product capabilities each user group may use. Workspace owners can govern what each member may create or manage, while knowledge-base owners gain explicit read and write sharing with ownership-aware file controls. The chat composer also adds faster knowledge-base attachment through @, a clearer tool-selection workflow, and immediate UI reconciliation when access changes.

User Groups and Fine-Grained Access

• Reworked the user-group editor into four focused tabs: Plan, Quotas, Permissions, and Users, keeping the existing modal workflow while separating unrelated settings.
• Added a searchable, paginated group-member view with name and email filtering, total counts, and 20 users per page.
• Added three-state access policies for administrator-managed prompts, skills, and tools: all resources, selected resources, or no resources.
• Added searchable resource catalogs and selected-item counts so large prompt, skill, tool, and MCP inventories remain manageable inside the modal.
• Added independent user-group permissions for conversation sharing, knowledge-base access, personal knowledge-base sharing, file uploads, conversation export, voice recognition, memory, and drawing.
• Made knowledge-base sharing a dependent capability of knowledge-base access. Disabling knowledge bases also disables sharing instead of retaining a contradictory hidden setting.
• Preserved backward compatibility by granting the existing capability set to legacy groups whose stored permission object is empty or missing.
• Kept administrator accounts exempt from user-group restrictions while continuing to enforce instance-wide administrator master switches.
• Applied temporary group expiration before resolving permissions, so an expired plan cannot retain access until the next profile refresh.
• Added authorization-safe normalization for imported or stale group policies, including invalid modes, duplicate IDs, removed catalog entries, and contradictory capability combinations.

Knowledge Bases and Sharing

• Added a first-class knowledge-base action in the chat composer and an @ mention menu for attaching an accessible knowledge base without leaving the conversation.
• Added a clear user-group error when knowledge-base access is unavailable. The restriction applies equally to personal, project, workspace, and user-shared knowledge bases.
• Removed embedding-model selection from the user experience. New knowledge bases always use the enabled embedding model configured by the administrator.
• Prevented clients from overriding the embedding model in a create request, keeping embedding configuration under administrator control.
• Added personal knowledge-base sharing with read-only and upload-enabled roles.
• Added an owner-only sharing manager with user search, current-share listing, role changes, and share removal.
• Allowed upload-enabled collaborators to add files and to rename, retry, or delete only the files they uploaded themselves.
• Prevented collaborators from deleting another user's files or deleting the shared knowledge base itself.
• Kept the knowledge-base creator authoritative over every file, failed ingestion, share record, and knowledge-base setting.
• Revoked stale conversation selections when a share is removed, so later turns cannot continue using a knowledge base that is no longer authorized.
• Added share-revocation checks around active knowledge-base generation and document operations.
• Prohibited sharing workspace and project knowledge bases, which continue to use their own membership and scope models.
• Prevented a personal knowledge base shared by another user from being copied into a workspace.
• Expanded the knowledge-base file view with filename search, uploader filtering, upload identity, online preview, rename, retry, and ownership-aware delete actions.
• Applied the same file filtering and preview workflow to workspace knowledge bases.
• Added explicit capability metadata to knowledge-base responses so the interface can distinguish share, upload, delete, content-management, and member-management rights without inferring them from ownership labels.

Workspace Governance

• Added workspace-wide member permissions for project creation, private conversations, knowledge-base creation, knowledge-base file uploads, and knowledge-base content deletion.
• Moved all workspace-member permission controls into the existing member list, where the workspace owner can edit each member without opening a separate administration page.
• Granted the complete workspace permission set to newly joined members by default, preserving the behavior of existing workspaces until an owner intentionally restricts a member.
• Kept the canonical workspace owner permanently authorized for all workspace capabilities.
• Made new workspace conversations private by default when the member has private-conversation permission.
• Fell back to a public workspace conversation when the member is not allowed to create private conversations.
• Enforced project-creation and knowledge-base-creation permissions in both the interface and the server handlers.
• Added per-knowledge-base member permissions for adding files and deleting content inside standalone workspace knowledge bases.
• Kept per-knowledge-base permissions separate from workspace-wide member permissions. A library-level grant cannot exceed the member's workspace-wide ceiling.
• Allowed the workspace owner and the current knowledge-base creator to manage the knowledge base's member list and all of its content.
• Locked owner and creator rows in the per-knowledge-base permission editor so their required management access cannot be accidentally removed.
• Reconciled workspace navigation when membership or permissions change, including safe fallback from workspace-only routes and private drafts.

Tools, MCP, Memory, and Drawing

• Moved tool selection inside the Tool Calls control instead of presenting Tool Selection as a separate peer action.
• Removed the Auto, On, and Off mode label from the Tool Calls summary. Clicking the control now opens the actual tool selector directly.
• Reinterpreted the built-in tool choices on a model as that model's default selection rather than an immutable user allowlist.
• Added an explicit distinction between model defaults and a user-selected empty list, allowing users to clear every optional tool for a turn.
• Allowed users to manually select any tool that remains available globally and to their user group, even when it is not part of the model's default set.
• Displayed user-group-restricted tools in the selector as unavailable so users can understand the restriction without being able to select or invoke them.
• Kept administrator tool and MCP availability controls as instance-wide master switches. Globally disabled tools are removed from catalogs, model requests, and runtime execution.
• Added a final runtime permission check immediately before built-in or MCP execution, closing the window where a tool could be disabled while a model was deciding to call it.
• Removed the memory tool entirely when memory is disabled globally or for the current user group. It is never shown as a disabled selectable item.
• Applied skill policy to prompt injection, automatic routing, fallback models, explicit skill selection, and final tool execution.
• Hid image models, image styles, image-generation controls, and the sidebar drawing entry when drawing is unavailable.
• Rejected direct image-generation and drawing-tool requests on the server even if a stale client still submits them.
• Guarded the composer against a model that becomes unavailable after a permission update and required the user to select an accessible model before sending.
• Removed voice controls when voice recognition is unavailable while preserving the normal send action.
• Added server-side checks to recorded transcription, streaming transcription, and capability discovery endpoints.

Upload, Export, and Sharing Controls

• Applied file-upload permission to chat attachments, drag and drop, clipboard files, long-text conversion, project files, and writable knowledge-base uploads.
• Removed upload inputs and actions when permission is unavailable instead of leaving controls that fail only after selection.
• Added cancellation and reconciliation for uploads already in progress when upload permission is revoked.
• Rechecked upload permission after the server accepts a file so a mid-request revocation cannot leave an unauthorized attachment in the active draft.
• Applied conversation-export permission to single-response and account-level export actions.
• Applied conversation-sharing permission to share-link creation, inspection, and removal endpoints as well as their interface actions.
• Added stable, localized permission errors for knowledge bases, uploads, voice, memory, drawing, sharing, export, prompts, skills, tools, and workspace operations.

Live Authorization and Revocation Safety

• Added a shared permission snapshot and epoch system for user, group, workspace, knowledge-base, and global capability changes.
• Published permission changes across application instances and refreshed affected clients through the existing realtime event channel.
• Reconciled open prompt, skill, tool, model, knowledge-base, workspace, upload, and voice state as soon as access changes.
• Added generation watchers so active turns stop using revoked knowledge bases, skills, tools, MCP services, memory, drawing, or workspace access.
• Re-read current permissions at API boundaries instead of trusting the permission data embedded in an older authentication response.
• Enforced knowledge-base ownership, share roles, workspace membership, file ownership, and member capabili...

v2.2.8

What's Changed

Aivory 2.2.8 expands conversation document handling, knowledge retrieval, context compaction, MCP tooling, private workspaces, feedback workflows, and mobile usability. It also hardens provider streaming, document ingestion, sandbox recovery, and model-specific history replay.

Conversation Files and Retrieval

• Added a single document-routing decision for over-budget conversations. The task model receives only the current question and trusted metadata for every conversation document; recent conversation text and document previews are excluded from this latency-sensitive request.
• Preserved the fast path when all conversation documents fit the configured full-text threshold: routing is skipped and every document is injected in full.
• Added structured full_doc routing with validated document IDs. Selected documents are injected directly when they fit, or processed with complete-document map-reduce summarization when they exceed the context budget.
• Made targeted retrieval search the complete conversation file scope while continuing to inject small, intentionally unembedded conversation documents in full.
• Prevented an earlier pinned file from replacing the current upload when individually small files exceed the cumulative conversation threshold.
• Added document-level vector filters and regression coverage for current-file selection, multi-document overflow, full-document summaries, vector outages, and relational fallbacks.

Knowledge Bases and Document Processing

• Added lightweight iterative retrieval with evidence-sufficiency checks, follow-up query expansion, bounded candidate merging, and explicit found, partial, no-hit, and error states.
• Added scoped knowledge retrieval controls, localized UI, knowledge-base mentions, and per-message knowledge-base snapshots.
• Added retryable ingestion workflows and clearer document failure states without exposing embedding implementation details to end users.
• Improved complete-document context preservation, cumulative pinned-document budgets, hybrid retrieval, CJK tokenization, neighboring chunk windows, spreadsheet ingestion, and multi-knowledge-base retrieval.
• Added project-library isolation and compatibility checks for conversation, project, and knowledge-base scopes.

Context Compaction

• Expanded configurable automatic compaction with token triggers, retention targets, recent-round preservation, summary budgets, and dedicated compaction model selection.
• Added the /compact command for explicit conversation compaction and hardened its concurrency, billing, model fallback, branch, and lifecycle behavior.
• Improved summary merging and context accounting so long conversations retain durable state without silently dropping current attachments or tool history.

MCP and Tool Routing

• Added administrator-managed MCP servers and tools, including connection testing, transport handling, configuration, model exposure, runtime invocation, and regression coverage.
• Unified automatic tool routing across built-in, official, MCP, search, file, spreadsheet, memory, image, and skill capabilities.
• Added scoped retrieval controls and stronger allowlist enforcement while preserving model-specific tool configuration.
• Improved frontend asset caching and request activity handling for faster repeated navigation and tool configuration.

Workspaces, Feedback, and Administration

• Added private workspace conversations with workspace-aware creation, listing, sharing, forking, deletion, generation, storage, and teardown behavior.
• Added user issue feedback with screenshots and diagnostics, plus expanded administrator feedback and activity views.
• Added administrator credit adjustments with durable user notifications and clearer permanent-credit accounting.
• Added required announcement reading, localized announcement behavior, rotating home prompts, and refined mobile chat and payment-history layouts.
• Added MCP administration and broader operational visibility across channels, tools, files, users, usage, and feedback.

Provider and Runtime Reliability

• Preserved complete Gemini and Anthropic streaming responses across partial frames and provider-specific event boundaries.
• Prevented OpenAI Responses native history from replaying across incompatible models.
• Required versioned OpenAI-compatible base URLs to avoid ambiguous endpoint construction.
• Rebuilt expired sandbox sessions when the first input reset returns session not found or not running, then restored and restaged conversation inputs before retrying execution.
• Improved interrupted generation, fallback attribution, task-model retries, complete provider request capture, and conversation update signaling.

Upgrade Notes

• Database migrations run automatically; no manual SQL migration is required.
• Conversation file routing uses the existing RAG full-text threshold and task-model configuration.
• When all conversation documents fit together, they are still injected directly without an additional router request.
• Over-budget full_doc requests now require the task model to return valid document IDs; invalid IDs are rejected and safely fall back to current-turn attachments or the authorized conversation scope.
• Existing knowledge bases and conversation uploads are re-used; no manual re-upload is required.
• For Docker deployments, set IMAGE_TAG=2.2.8 and leave SANDBOX_IMAGE_TAG unset so application and sandbox images resolve to the same release tag once both workflows complete.

Release Boundary

• This release is built from commit 3dc70ff97f17333c1ac134a2f0c4e177c4336fc8.
• Commits after 3dc70ff are intentionally excluded from the v2.2.8 tag and source archives.

Full Changelog: v2.2.7...v2.2.8