v2.2.13

What's Changed

Aivory 2.2.13 improves image generation reliability, image attachment handling, tool selection, Gemini function calling, and long-chat compaction behavior. It also adds a request-body privacy control for provider diagnostics, makes MCP tools opt-in at the model level, tightens the main sidebar, and refines the shared composer focus treatment.

Image Generation Reliability

• Adds a one-time fallback channel for both direct image-model conversations and the image_generate built-in tool.
• Tries the configured primary channel first and moves to the fallback only when the first generation attempt fails.
• Attributes successful usage to the channel that actually served the image, including a fallback marker for operational review.
• Records failed primary and fallback attempts as zero-cost error usage entries so administrators can diagnose provider failures without charging users for unsuccessful work.
• Reuses one quota reservation across both attempts and prevents duplicate billing, artifact persistence, and success records when fallback is used.
• Keeps fallback behavior scoped to image generation; normal chat and unrelated tools retain their existing routing behavior.

Image Prompts, Uploads, and Downloads

• Adds a prompt-optimization switch below the composer when a direct image-generation model is selected.
• Enables prompt optimization by default and lets users turn it off to send their original prompt directly to the image model.
• Preserves the choice across normal send, edit-and-resend, and regenerate flows.
• Leaves images of 3 MiB or less byte-for-byte unchanged before upload.
• Compresses larger browser-decodable images automatically toward a provider-safe size below 3 MiB, without asking the user to resize the file manually.
• Tries high-quality encoding at the original dimensions first and reduces dimensions only when quality adjustment alone cannot meet the upload budget.
• Prefers transparency-preserving WebP or PNG output for non-JPEG sources and uses JPEG as a compatibility fallback.
• Uses orientation-aware browser decoding and limits temporary canvas size to avoid excessive memory use on large mobile photos.
• Opens generated images and image attachments in the existing lightbox and provides an explicit download action for the original served file.
• Avoids treating the rendered chat preview as the downloadable image, preserving the available generation resolution.

Tool Selection Experience

• Restores the three existing tool-use modes: Automatic, On, and Off.
• Places Tool use in the composer's add menu and opens a focused second-level mode panel instead of exposing a disconnected tool-selection submenu.
• Adds the tool-selection action to the mode-panel title area, keeping mode choice and tool choice in one workflow.
• Applies Automatic and On only to the tools the user selected; Off continues to disable tool declarations for the turn.
• Shows the current selection summary and selected count without exposing implementation categories in the user-facing list.
• Corrects selected-state checkmark alignment and gives long tool catalogs a bounded, independently scrollable results region.
• Preserves loading, retry, empty, search, unavailable, select-all, and clear states in the tool dialog.

SearXNG Engine Selection

• Adds an administrator-only engine selection field to the Web search settings when SearXNG is selected.
• Accepts SearXNG engine names or shortcuts separated by commas or spaces, so custom engines do not need to be added to Aivory's frontend catalog.
• Sends the selected list as SearXNG's engines query parameter, making a search use only the configured engines.
• Treats an empty list as "use the SearXNG instance defaults", preserving existing installations and custom SearXNG engine configuration.
• Normalizes names to lowercase, removes duplicates, limits the list length, and rejects invalid characters before saving.
• Applies changes on the next search without restarting Aivory and leaves Serper and Brave behavior unchanged.

Gemini Function-Calling Compatibility

• Normalizes every tool parameter schema sent to Gemini, covering built-in, hosted, and administrator-managed tools through the same provider path.
• Removes unsupported JSON Schema metadata such as $schema and translates broader schema constructs into Gemini's accepted function-declaration subset.
• Resolves local $ref definitions, simplifies external or recursive references, and preserves useful constraints in descriptions when Gemini cannot represent them directly.
• Handles objects, arrays, tuples, enums, constants, nullable values, unions, required fields, property ordering, numeric bounds, string bounds, and examples defensively.
• Filters required and ordering entries that no longer have a matching property after normalization.
• Enforces depth and node limits so an unexpectedly complex external schema cannot consume unbounded processing time.
• Leaves the original schema unchanged for providers that support the broader JSON Schema vocabulary.
• Prevents the Gemini 400 responses caused by unsupported $schema and additionalProperties fields in ordinary and MCP tool declarations.

MCP Defaults and Navigation

• Changes model-level MCP defaults to opt-in: an omitted, null, or empty configuration now selects no MCP services.
• Requires administrators to explicitly select each MCP service that a model should enable by default.
• Retains explicitly stored service IDs when a service is temporarily disabled, unavailable, unsynchronized, or no longer present in the live catalog.
• Continues to apply global tool availability and user-group permissions as hard runtime limits over model defaults and user selections.
• Keeps user selections authoritative for the conversation while preserving the existing Automatic, On, and Off behavior.
• Reduces spacing, row height, padding, and corner radius in the six primary sidebar actions so they align more closely with the conversation list.
• Softens the divider between navigation and conversations and adds a shallow top fade only after the conversation list begins scrolling.
• Preserves mobile tap targets, collapsed-sidebar behavior, active states, tooltips, and reduced-motion preferences.

Context Compaction

• Keeps automatic context compaction silent in the user interface; progress and outcome notifications are now reserved for an explicit /compact command.
• Skips automatic compaction when there is no eligible old conversation prefix beyond the current summary frontier.
• Applies the same user-message boundary and active-stream protection when deciding whether an automatic pass can make progress.
• Detects requests that would remain above the token trigger even after the deepest safe conversation cut, such as requests dominated by system instructions, tool declarations, attached context, or a very large recent turn.
• Stops repeatedly scheduling token-triggered no-op summaries for those irreducible requests while retaining the independent round-retention cadence as the conversation grows.
• Preserves inline compaction for genuine large backlogs and substantial token spikes when summarizing old turns can materially reduce the request.
• Prevents already fully compacted conversations from launching another summary task on every subsequent message.

Logging, Usage, and Interface Refinements

• Adds an administrator setting under Logging to disable persistence of complete upstream request bodies.
• Retains request method, URL, sanitized headers, status, timing, and provider error details when full request-body storage is disabled.
• Redacts multipart image bytes and large Base64 payloads from provider diagnostics to avoid storing oversized binary content in logs.
• Fixes the administrator Usage table with stable column widths, single-line truncation, and tooltips for values that do not fit.
• Replaces the detached composer light bar with a fine accent outline, a shallow reflected shadow, and a one-pixel focused lift.
• Uses the same focus behavior on the home and conversation composers and provides a distinct drag-over state.
• Disables composer movement under reduced-motion preferences while retaining a clear keyboard-focus response.
• Adds or updates interface text for English, French, Japanese, Simplified Chinese, and Traditional Chinese.

Upgrade Notes

• No manual database migration is required for this release.
• Existing model rows whose MCP policy is omitted or null now resolve to no default MCP services. Administrators should open each model and explicitly select the services that should start enabled.
• User-selected tools, administrator-wide availability, group permissions, and saved MCP connection settings are not changed by the default-off policy.
• Configure an image fallback channel only when a second provider or endpoint is available for the same image model behavior. A failed primary attempt and the fallback result remain separately visible in usage diagnostics.
• Prompt optimization affects direct image-model turns only. Turning it off bypasses the prompt-rewrite task and sends the user's prompt as entered.
• SearXNG engine selection is optional. For example, entering bing, wikipedia limits SearXNG searches to those two engines; clearing the field restores the instance's enabled defaults.
• The request-body logging switch affects newly captured provider diagnostics; existing stored records are not modified.
• Automatic compaction continues to run when configured and useful, but it no longer emits user-facing progress notifications. Use /compact when an explicit, visible compaction pass is needed.
• For Docker deployments, set IMAGE_TAG=2.2.13 and leave SANDBOX_IMAGE_TAG unset after the matching application and sandbox image workflows complete.

Validation

• Focused Go tests cover Gemini schema normalization, image fallback and per-attempt usage attribution, request-body privacy, model MCP defaults, selected-tool filtering, and automatic compaction planning.
• Focused frontend tests cover image upload preparation, image prompt preferences, model MCP selection semantics, tool-dialog behavior, and compaction event handling.
• TypeScript type checking and the production frontend build passed.
• git diff --check passed.

Release Scope

• Composer focus treatment: c7bd8c3 (fix(chat): refine composer focus treatment).
• Gemini function schema normalization: ca86fa2 (fix(gemini): normalize MCP tool schemas).
• Tool mode and selection workflow: 6160766 (fix(chat): restore tool mode selection).
• Image fallback, upload handling, prompt controls, logging privacy, and Usage layout: 429cde5 (feat(image): add generation fallback and request privacy controls).
• MCP default-off behavior and sidebar density: 7eb30c1 (fix(tools): default MCP services off and refine navigation density).
• Automatic compaction scheduling and silent notifications: f50afab (fix(compaction): avoid redundant automatic runs).
• SearXNG engine selection: 2c8a416 (feat(search): select SearXNG engines).

Full Changelog: v2.2.12...v2.2.13