Lolly 1.2.0: the faster one

These notes cover the 268 pull requests and 198 direct commits merged to main after v1.1.3 up to b2128b260 (9 November 2026), this release's own preparation included. The engine moves from 1.285.0 to 1.343.0, and the tool-author core from 1.5.0 to 1.8.0.

Lolly 1.2.0 opens more of the files you already have, prints closer to what a press expects, and gives animation springs and paths you can shape on the canvas. It adds Sales Quote for line-item quotes and a Quote card for quotations, and links you can share after sending a file. The new importers and converters run on your device, so a file is never uploaded just to be read.

Highlights

• Open InDesign, Affinity and DXF files, camera raw photos and editing timelines in Design.
• Print PDFs closer to what the press expects. Colours separate through a real press profile, and black text overprints.
• Springs, motion tokens and motion paths for animation.
• Sales Quote, a new tool: line items in, totals, discount and tax out, worked out as you type. A separate new tool, Quote, makes a quotation card with a speaker's picture, name and role.
• Every script stays vector. Text in scripts your design system's fonts don't cover, such as Arabic, Hebrew, Hindi, Bengali, Thai, Cyrillic, Greek, Chinese, Japanese and Korean, now exports as crisp vector outlines drawn with open Noto fonts. Each font downloads only when a document needs it (37 KB to 350 KB, and 2.0 MB to 3.8 MB for Chinese, Japanese and Korean) and stays for offline use. Japanese text takes Japanese letterforms and Korean takes Korean ones, following the text's language. Your design system's fonts always draw every letter they have, and the live page shows the same Noto font as the export.
• A snappier Cover Flow. In the gallery and on the Docs landing, a swipe glides straight to the cover it was thrown towards and rests in about a third of a second, where it used to take about 1.7. A trackpad moves the covers exactly as far as your fingers do, a mouse wheel steps one cover per notch, and on phones that support it each cover passing the centre gives a light tick (never with Reduce motion on).
• A gallery that shows the work. Covers now show real tool output on a real subject, in your colourway. They paint straight away from baked files, and a cover renders live when its baked file does not match. Presets and templates are now one list, and old preset links keep working.
• A greeting in place. A first visit now opens on a band at the top of the gallery instead of a dialog. The swirl lollipop draws itself once, one line says "Make the next thing beautiful.", and one action gets you started.
• Music you can shape. The Neurospicy player composes 26 genres as it plays, from Straya's banjo, yidaki and magpies to Metal's double kick, and the new music generator sets a tune out like a sequence editor, where each part can change instrument from one section to the next.
• Brand pages. Publish a design system at one address for people and for agents: colours, type, logos, tokens and DESIGN.md, on a page that runs no scripts. Download the folder and host it yourself, or publish to a Lolly Work instance that has the feature turned on. Lolly Demo's page is live at lolly.tools/brand/lolly-demo/.
• Bring a brand in. Add from… now reads a DESIGN.md or another brand's page folder. One changed file refuses the whole folder and names the file. Words from someone else's file stay a draft until a person keeps them, so agents do not read them as guidance.
• Connect an agent. Copy an AGENTS.md into a project, or set up the MCP server in Claude Code, Cursor or VS Code, with a plain statement of what each option can do.
• Files can lead back to the page. A publisher can turn this on for their own brand. Exports then record the page's address, shown on the Design system card, which can leave the record out. Verify shows the address as something the signer recorded. The setting does not travel with a pack or a copy.
• Colour roles in your own words. A design system can name its colours its own way, such as Main, Accent, Supporting and Tertiary, with values per colourway and for light and dark side by side. "Lolly reads this as" shows what tools do with each one, and every tool keeps working. Systems with no custom roles do not change. Lolly Demo and SUSE now use their own words, wherever a colour is chosen and on the brand page: Lead, Partner, Paper and Ink for Lolly Demo, and Primary accent, Supporting accent, Background, Text and Warm accent for SUSE. Every tool renders as before, and a SUSE PowerPoint theme now takes Persimmon as its third accent.
• Colour words wherever you pick a colour. Colour fields in tools and in Design now lead with a design system's own colour words, such as Main or Supporting, each with what it is for.
• Share a link after Send for files you send to Google Drive, Nextcloud, S3, Dropbox or OneDrive.
• Redaction that keeps text. Redact can black out parts of a PDF and keep the rest searchable.
• Two panes on iPhone Duo and foldables. The canvas sits under your drawing hand and the controls on the other side, with the fold as the divider.
• A friendlier start in Brand Studio. The Board opens with three ways in and shows the design system on a poster, a chart and a UI card as you build it.

Open files from other apps

• InDesign files (preview). Open a .indd file in Design, or from the terminal with lolly adobe indd. Lolly converts it to IDML on your device and imports that. In the web app the conversion runs in the background, with a Cancel button.
• IDML keeps more. Paragraph and character styles, master page items, tables and each object's fill, stroke, corners and opacity now come across. A story that flows through several frames no longer repeats in each one. Anything Lolly can only approximate, such as justified text or text wrap, is listed in the import report.
• Affinity files. Open .af, .afdesign, .afphoto, .afpub and .aftemplate files in Design or Unpack, or with lolly affinity. Each artboard becomes a frame, and its shapes, curves, text, tables and pictures become layers you can edit. Effects, adjustments, masks and master pages are listed in the import report. When the layers cannot be read, the file's own preview opens instead, with a note.
• DXF drawings. Design and lolly dxf open ASCII and binary DXF (R12 to 2018) as paths and text, with one group per layer, in the drawing's own units.
• Editing timelines. Design opens CMX 3600 EDL, OpenTimelineIO and Final Cut Pro XML (1.8 to 1.11) as a timed sequence, like Premiere XML, with drop-frame timecode. Point Lolly at the media files the timeline uses, or carry on with labelled placeholders.
• Camera raw photos. Darkroom and image import open raw files. DNG gets exact colour. CR2, NEF, ARW, ORF, RW2 and uncompressed RAF get colour matched to the JPEG the camera saved alongside, and the note shows how close the match is. Canon CR3 and a few others open the camera's preview image for now, labelled as such.
• Professional video. For a MOV, MP4 or MXF file, Lolly reads which codec it uses and asks your device whether it can play that codec. When it cannot, the file's Details explain how to get a copy that opens: export H.264, HEVC or AV1 from your editing app, or for ProRes, open the clip in the Lolly desktop app on a Mac. Lolly keeps your original file.
• Spreadsheets look as they do in Excel. Dates, currency, percentages and fractions keep Excel's formatting in the Data view, in data inputs and in the CLI. A formula the file saved without a result is now worked out.
• Photoshop files. A newer, safer PSD reader. All 258 files in the test set still open and save back unchanged.
• MIDI files keep note velocity when you import them.
• Lolly now opens 66 file formats and exports 66.

Print and PDF

• CMYK through a press profile. Print PDF, Print TIFF and EPS (CMYK) separate colours through the bundled Coated FOGRA39 profile, or through a profile you embed, instead of a formula. Greys print near their designed shade on the black plate. FOGRA51, SWOP and GRACoL still use the formula.
• Black text overprints. Black type prints on the black plate only and overprints the colour under it, so a slightly misaligned press leaves no white edge around the letters. A brand whose black is a rich mix still gets that mix on large black areas. Twelve test pages are now checked plate by plate.
• Redact can keep text. Switch on Keep text to remove only what sits under each bar and keep the rest of every page as real, searchable text. Lolly reads the result back and refuses to save it if anything is still under a bar. Flattening each page to a picture stays the default. From the CLI: --keepText=true.
• PDF accessibility report. For a PDF, the CLI's --export-report lists 32 checks, each passed, failed, not applicable or needing a person to look. It never claims that a PDF is accessible or compliant.
• Scaled text prints at its real size. Text inside an element scaled with transform: scale() now prints in PDF at the size it has on the page, instead of about twice that. Borders, corners and shadows under the scale are fixed too. No tool's defaults were affected, but your own HTML in Sandbox, or any page with a scaled element, could be, in every release from 1.0.1 to 1.1.3.
• Print spot inks as process. CMYK exports (Print PDF, CMYK TIFF and CMYK EPS) can print a design system's spot inks as process colour, so a brand that declares a spot for every colour still separates to four plates. It is an opt-in box in the export panel, _spots=process on links, --spots=process on the CLI, spots: "process" on MCP and a row in the terminal app. Finishes such as foil keep their own plate, and nothing changes unless you choose it. With the box ticked, the "Before you export" card and lolly preflight count only the four process plates and any finish plates, so a rate card does not price spot plates the file will not have. Lolly Demo's blacks print on the black plate only: Void at 100% K with no spot ink, so black in a Print PDF prints on the black plate, and Liquorice and Basalt at 100% K and 92% K, so small text stays sharp. Their screen colours are unchanged.
• Preflight counts the plates a file can have. lolly preflight and the "Before you export" card count only the four process plates for CMYK TIFF and EPS, so a rate card no longer prices plates those files can't hold, and they give that count even when no brand palette resolves. lolly preflight design --file=<tokens.json> now checks the design system the file gives, and a link's _themes choice is checked in the colourway it picks, as lolly run does. Before, preflight always counted the inks of the default colourway. This affected 1.1.3 and earlier.
• PDFs match what you see. PDFs now print a page's canvases (Timezone's globe, the 3-D charts in Print PDF) and the fill and border of buttons and other inline boxes (Claim, Redact, Pricing Table, Calendar). A layout whose shape differs from the page is fitted to the page's width and cropped, as the PNG is, instead of shrinking; SVG export now fits it the same way. These affected every release from 1.0.1.
• No more boxes in EPS, WMF, EMF and DXF. Text that no font covers, such as Tamil, Syriac or rare Chinese characters, now goes into EPS, WMF and EMF exports (EMF with Outline fonts on) as a picture of the words in the text's colour, and the export card names the scripts, where earlier releases drew empty boxes. A DXF export, which goes to cutters and CAD, now stops with a message naming the text instead of cutting boxes. This affected 1.1.3 and earlier. --text=outline on an EMF export, or _text=outline on a link, now outlines text even when the browser tier draws it.
• Every page, not just the first. Battlecards, Booklet, Print Sheet, Doc Studio and Markdown Slides now export PNG, JPG, WebP, SVG and the other single-image formats as one file per page, a ZIP when there are several, so no page is dropped. Print Sheet keeps its full sheet and cut marks at the chosen DPI. On the command line, a still export of a multi-page document says that it shows the whole canvas, and how to get one page or every page.
• Any name prints in the marks. Stamp details no longer stops a PDF when your name or the tool's name is in Arabic, Chinese or Cyrillic, or includes an emoji. Such a name prints as a picture of the words, and the export card says so.

Photos, audio and video

• Remove large objects. Retouch has a new Large area method for big objects. Small blemishes still use the existing methods.
• Trace an image. Right-click an image in Design and choose Trace image… to turn it into editable shapes, with Logo, Illustration, Line art and Centreline presets. Only the part of the image that shows in its box is traced, and the shapes appear as a group above the image. A running trace can be cancelled.
• Cleaner cut-out edges. A new switch in the matte dialog (lolly matte --clean-edge-colour in the CLI) replaces the old background's colour in soft edges with the subject's own, so a green-screen cut-out loses its green halo. It is off by default.
• More of your Camera Raw presets. Darkroom now reads the colour mixer, relative temperature and tint, grayscale, grain, sharpening and darkening vignettes. Controls it cannot use are listed.
• A ruler dial on phones. On a phone, Darkroom's sliders turn as a ruler dial: drag or flick the ruler under a fixed mark and it comes to rest exactly on a step, with the value always in view and a tap on the value to type one. The photo redraws once, where the dial comes to rest.
• Repair and measure audio. Clean 1.1.0 removes background noise, mains hum, harsh "s" sounds, clicks and reverb without an AI model, and shows the full EBU R128 loudness figures before and after. The CLI repairs WAV files the same way. The figure labelled "True peak" used to be the sample peak; it is now the true peak.
• Broadcast captions. Captions 1.1.0 exports TTML (IMSC 1.1 Text) and SCC (CEA-608, 29.97 drop-frame) as well as SRT and VTT, and reads them back. In the CLI: --export=ttml and --export=scc. Characters a broadcast caption cannot carry are refused, never silently dropped.
• Export songs as MIDI. Rondocode exports a Standard MIDI File with a tempo track and one track per synth, keeping each note's velocity, so you can carry on in a DAW. Synth sounds and effects stay behind; the export notes list them. In the CLI: lolly rondocode --export=mid.

Motion and animation

• Springs for keyframes. An ease can now be a spring, with presets, and the Keyframes popup tunes stiffness, damping and mass. A spring always ends exactly on the next keyframe, and dotLottie exports bake it into plain keys, so every player shows the same motion.
• Eases that follow the design system. A keyframe can use a motion token by name, so changing the token changes every animation bound to that token. Lolly Demo and Lolly Starter include a small motion scale to start from.
• Shape the motion path on the canvas. Drag the handles on a position keyframe to curve the path between two points, or edit them in the Keyframes popup. dotLottie files keep the curve.
• Key one property at a time. Fields show a diamond, the popup can show a single property, and time appears in the units you prefer.
• Animate how a shape looks. Fill and stroke colour, stroke width, corner radius and trim can all be keyframed, in the preview, in video and still exports, and in dotLottie.
• Steadier editing. Quick successive animation edits are all kept, and a failed edit no longer holds up later edits.

Music

• Lolly Sings is one family of generated stations. The Neurospicy player composes its music as it plays: Lolly Sings and 26 genres (Sugar, K-pop, Straya, Chiptune, City pop, Funk, Soul, Nu-disco, Hip hop, Trip hop, Reggae, Spanish guitar, Rock, Metal, Country, Blues, Jazz, Swing, Fantasy, Dreamscape, Synthwave, Acid, Electro, Dubstep, Brostep and D&B), and the three Lofi moods. The genres are tracks in the player's list, and the old recorded lo-fi songs and sample modules are gone, about 22 MB.
• Every tune is a seed. A station and a seed always compose the same tune on every device, so a shared link plays what you heard. Save to library keeps a tune as a recipe of about 70 bytes, and Lolly Demo and Lolly Start each ship six saved tunes. The new Generated music page explains what stays the same and what can differ.
• Songs that change as they go. Dance genres build with a roll and a riser into a drop on a crash; band genres play verses, a pre-chorus with a fill round the toms, a chorus, a solo and a last chorus. Instruments change between sections: softer keys in the quiet parts, a second lead and a bass switch-up in the last chorus, and intros that open on the beat, the bass, a lead or the whole band.
• Straya. A banjo picking rolls over a yidaki drone on the key note, with its breath pulses, toots, barks, the in-breath of circular breathing and a howl, over a stomp, claps and clapsticks. Magpies carol between the phrases, and now and then a kookaburra laughs.
• Country, Blues, Jazz and Swing. A train beat and a pedal steel, twelve-bar choruses with a harmonica answering its own call, a combo on the ride with a walking bass that trades fours with the drummer, and a big band's brass stabs over a jungle-tom intro.
• Fantasy, Dreamscape, K-pop and Metal. A harp and bells over a lydian melody; pads and a choir in a slow, wide room; supersaw stabs, claps on every beat, a chant and a last chorus a key higher; and a band with power chords, a metal lead and a double kick.
• More convincing instruments. A frequency-modulated slap bass, plucked guitars from nylon to steel to banjo, horns that brighten as they get louder with breath that buzzes at the note's pitch, cymbals that ring with metal, toms, and hand percussion (shaker, tambourine, congas, cowbell, clapsticks) chosen per genre. Nothing is sampled.
• The music generator. A new utility, #/music (also Open in the music generator in the player), sets a tune out like a sequence editor: sections, chords and every note in lanes for the lead, keys, bass, drums and effects. Type a seed, step it, shuffle it or drag across it; click a section in a lane to change that part's instrument there, the drums' snare and cymbals included. Make the track to download an M4A or WAV file or save it to your library. Every setting is in the link.
• Lighter on modest devices. The heavier dance stations offer Light visualiser, on by default on touch screens and on devices with four cores or fewer or 4 GB of memory or less, and the visualiser no longer freezes while the music keeps playing.

Design

• Stroke position and per-side widths. A stroke can sit inside, centred or outside a shape, and a rectangle can have a different stroke width on each side. SVG, PDF and the Penpot round trip keep them. A dotLottie export stops with a message when the design uses something Lottie cannot draw.
• A better pen. Shift steps the angle, points snap, open paths carry on where you left off, handles retract, and a Pencil tool shares the Pen's place in the toolbar.
• Text keeps its kerning. A list marker and its text, or a coloured word beside plain text, are spaced together, so the spacing matches the browser.
• Shortcuts and tokens. Shift+1, Shift+2 and Shift+0 work while an artboard title is selected. Picking a swatch changes the selected gradient stop at once, and an open token list stays open while you link a token.
• Design on a phone works like every tool. The inspector and the layers list share the same drop-down panel as every other tool's settings. Drag or tap its grip to move between a slim strip, half and full screen, and the selected item stays in view above the panel. The grip on every tool's panel is easier to catch too.
• Swipe between slides. On a touch screen, swipe left or right to move between slides while presenting. A Slide or Fade transition follows your finger, and the other transitions play when you let go. Scrolling inside a slide, pinching, and using an interactive web box are not taken as swipes.
• Rolling zoom figures. When Design's zoom bar shows its percentage, the figures roll to each new zoom step, and change at once when Reduce motion is on.
• Quicker. Changing the app's colours no longer restyles the whole page.

Your colours and Brand Studio

• Choose a colourway in Settings. Settings › Appearance sets the colourway. The app's colours follow your choice, and new work starts in that colourway.
• Make your own colourway in Brand Studio's Colours room. The Type room shows the design system's own typefaces.
• Logos on the right background. Logo and icon tiles follow the colour scheme, including the Brand theme, and show each logo on the surface it was made for.
• An empty colour means automatic. An unset colour reads as automatic, never as black, and Certificate, Timezone and Chart say what an empty colour draws.
• A compact Brand Studio. The bar and room strip take no more height than the old header, and on a phone the rooms sit in a bottom bar. Export and Tokens (.json) are in the bar and the More menu.
• A Board that shows what you have. Tokens tiles count what is really there, pale swatches keep an outline, and Type cards show each face's role. The room called Usage & rules is now Rules.
• Phone layout. Four colours to a row, logos two to a row, and Tokens tiles that wrap.
• Start here. The Board opens with three doors: Find a look, Add from… and Pick a colour. A blank design system gets large doors and a grey specimen that fills with colour when the first colour arrives. The Board's counts now match the rooms.
• In context. Beside the Board, a poster, a chart and a UI card show the design system as it stands. On wide screens the column stays in view and never grows taller than the window.
• Make it yours. While the design system is the one that came with the app, the bar's main action is a menu of Find a look, Add from… and Pick a colour. Once the system is your own, Export takes that place again.
• A calmer Colours room. Primary, Secondary, Surface and Text lead the room as chips you can reassign. Swatches show colour, name and hex, and checkboxes and drag handles appear in Select mode. Paste colours, or drop an image or a list of colours; nothing is added until you press Add.
• Charts in your colour roles. Chart has a new palette, "Design system - colour roles first", which leads with the design system's declared colour roles in its own order. The default palette is unchanged.
• Colour roles travel with the design system. DTCG and Tokens Studio files carry your colour words in full. DESIGN.md, Penpot and brand pages carry them as far as each format has room, and PowerPoint keeps their order in its six accents, though not the words. A file that brings its own colour words gets a review before anything changes, where each word can be renamed, read differently or left out. A design system without colour roles of its own exports the same files as before.
• Logos at their own shape. Horizontal lockups sit in wide tiles and vertical marks in squares, each with clear space a quarter of its height. Empty slots are drop areas. A blank starter's stand-in mark no longer counts as a logo of yours, and a copy of a shipped design system lists the logos it uses.
• Find a look previews in place. Clicking a look shows it on the poster, chart and UI card before you use it. Each look has its own Use button, and Compare is a toggle.
• Applying a look keeps logos and fonts. An example look changes colours and style settings only. Before, applying one over Lolly Demo dropped its logos and fonts. Using a saved design system still switches to it.
• Nothing lost mid-save. An edit made while Brand Studio says Saving… survives a reload, and a card offers to restore changes that didn't finish saving.
• Lolly's spin. Lolly's mark turns while it reads a file or applies a look, and stays still under Reduce motion. The page for a browser that can't draw with WebGPU names the browsers that work, with a koala in Lolly's line style.
• Company in the empty rooms. Line-drawn Australian animals, in the same style as the kangaroo, keep blank rooms company: a lorikeet by Pick a colour, a magpie at the Logos drop area and an echidna in the empty Files room. Each moves once when it first comes into view and turns towards what it watches; under Reduce motion it stays still.
• Accent words you can read. Words and icons that Lolly's controls draw in the design system's main colour, such as the chosen segment, the active menu item, tags and links, now use a shade of that colour that reads at 4.5:1 or more on the app's surfaces, and at APCA Lc 75 under High contrast. A main colour that already reads keeps its shade, so most design systems look the same. Under SUSE in Light those words turn a deeper green, and the lowest contrast in the tool sidebar and Settings rises from 1.98:1 to 4.67:1. The sidebar's STYLE and PRESENCE labels, at about 2:1 before, now use the muted text colour. Exports do not change.
• Colour previews keep their layout in right-to-left languages. In Arabic and the other right-to-left languages, Brand Studio's poster, chart and UI card previews ran off their left edge, and "01-03" read backwards. They now draw as they do in English.

Tools

• Sales Quote (new). A sales quote from a table of line items: each line's total, the subtotal, a discount, tax and the amount due, in the currency you choose. Paste a table and Lolly reads it by its headings. Leave a price empty to show "Priced later" outside the totals. A cell that starts with = is a formula and is worked out live; NOW, TODAY and RAND keep updating while you edit and are fixed when you export. Lay it out as a landscape page, a portrait sheet or a wide 3:1 screen.
• Snippet 1.7. Colourways and Mode now restyle the code window, and the style controls sit together in one Style section.
• Certificate 1.2.1. Colourway styles, every size, motion, and a print style that sets the look. A size you type sizes the name for that sheet.
• Logo Wall 1.8.0. Sponsors grouped into tiers in one SVG, tier headings in proportion and in the design system's heading face, brick rows at one logo size, and an example look with placeholder logos. Exporting at another shape lays the wall out again.
• Agenda. Colourways recolour the programme, defaults follow the brand, the styles are more distinct, and motion is staged.
• 3D Studio. Distinct marks for Tilt, Turn and Lean, and two-tone icons as a colour pair.
• Music player, Stationery and Battlecards. The brand mark is the design system's reversed logo, Stationery's letterhead prints its logo, and Battlecards sizes are in pixels.
• Tools use your design system's fonts. Seventeen tools named SUSE, SUSE Mono or a system font first in their own styles, so under another design system they drew SUSE, and a page and its export could disagree even in Latin text. They now take the design system's text and mono faces on the page, in exports and from the CLI. The changes include QR Code's call to action and barcode digits, Doc Studio's code blocks (Courier before), Annotate's marks, Redact's stamp and Sandbox text that names no font. Doc Studio sets all four heading levels in the heading face, as its Word export does. Org Chart and Doc Studio now call their font choices Brand Sans and Brand Mono, and saved work and links keep working.
• Sign 1.1.0. Add today's date sets the date in the design system's text face, on the page and in the signed PDF, where both used Helvetica. In the PDF the date is drawn as outlines. A date wider than its room moves left, and on a small page the signature group scales to fit.
• Annotate 1.1.1. A step pin's caption exported from the CLI, the terminal app or MCP came out as a white smear, because those exports drew the white halo over the words. The halo now goes underneath. Web previews and exports are unchanged.
• Sandbox 1.9.0. The export draws what the preview shows. A pen's own html and body rules, such as its font size and background, now reach the export; before, the export drew such a pen at 16 px in the design system's face, with no background. A face the pen declares with @font-face is outlined in the export, and a font uploaded to the design system now shows in the preview as well as the export.

Sharing

• Share a link after Send. After you send a file to Google Drive, Nextcloud, an S3 bucket, Dropbox or OneDrive, the Share dialog can make a link through that service. It shows who can open the link, where the file lives and when the link expires, and Links you've shared lets you stop sharing. Nextcloud links can have a password and an expiry date; S3 links last 1 to 7 days and cannot be stopped early. Lolly keeps no copy of the file and no sign-in token on a server.
• Links whose recipients can change the inputs. On a Lolly Work server, a rendered link can let the people you send it to change the tool's inputs and get a fresh image. Locked inputs stay as you set them. It is off by default and offered only to people who may render on the server.
• Preview moves into a locked tool's title row. In a tool shared with rules, such as a partner data sheet, Preview sat on a row of its own under the title, and on a phone it looked like the next step before anything was typed. It is now a small button at the right end of the title row. Preview still hides the inputs so the result fills the screen, and Edit inputs brings them back.

Everyday use

• A first visit greets you in place. A first visit now opens on a band at the top of the gallery instead of a dialog over a blurred gallery. The swirl lollipop draws itself once, in under 1.5 seconds, over one line, "Make the next thing beautiful.", and one action: Start making opens Design on the lorikeet poster under Lolly Demo, and on a new install Make it yours ("One colour is enough") opens Design System Setup. Below sit Bring a file, the privacy promise with What we store, and a language chip only when your browser's language differs from Lolly's. The gallery's previews load under the band. On a phone the band is the first screen, with the action at thumb height. Under Reduce motion, and on later visits, the finished mark shows at once.
• One loading screen, in your colours. The startup screen and the loading card show Lolly's mark in your design system's colour, and you no longer see both at once.
• Performance mode switches itself on. On a device that struggles, Performance UI turns on, for good on a weak device or for a while on a busy one. Settings says when and why, and Allow again brings back the full interface.
• A tidier file inspector. Technical details sit in one Details section, dates follow your locale, and on a phone you open them from the dialog header.
• Clearer Verify. The Verify panel starts with "You made this here", and text you typed stays private as a fingerprint, with a line explaining why.
• Link exports match the export panel's size.
• Cover Flow speaks. Screen readers now hear which tool is centred, for example "Chart, 2 of 6", when Cover Flow comes to rest after you move it with the arrow keys, a swipe or a trackpad.
• Faster first start. Direct links to a tool open faster, and the footer's Open button works straight away.
• Plurals in every language. Counts such as "3 files" follow each language's own plural rules, so Polish, Ukrainian, Arabic and the others read correctly. Nine wrong translations are fixed, including a Dutch message that read "That is not true".
• Cascadia fonts. Cascadia Code and Cascadia Mono join the font list.
• Model licences in one place. Each AI model family's licence is kept in one record that the download offer and your Profile both show.
• Simpler Tools and Utilities cards. In Grid, a tool's card is its picture and one line: icon, name and a template count, with the full wording in its tooltip. Descriptions stay in Card, List and the About dialog. Utilities become small icon-and-name tiles, about six across at 1280 px and two on a phone, where a phone showed one large tile per row. The smallest sizes fit about eight tools across at 1280 px, where six fitted. Card and List rows are all one height, and on a phone they leave the description out. Under Performance UI each tile shows the tool's icon instead of a blurred, empty box.
• Choose what the sounds are made of. A Sound shape slider under the Sound switch, in Settings › Accessibility, the profile menu and the Dashboard's Sound card, runs from Bouba to Kiki. Towards Bouba, sounds become soft drops, droplets and a low "bwah", with no hard starts and nothing above 2.6 kHz. Towards Kiki they become short metal pings, ratchets and scratches, with nothing below 200 Hz. The middle, and the default, is Lolly's chimes and notes as before, and most sounds match the chimes' loudness to within about 1 dB. The slider works while sound is off, and letting go plays a short preview. Switches now step up as they turn on and down as they turn off, and folding sections sound as they open and close. The robot voice that read out filter names is gone.
• Assets on one ground. Every tile in Assets, and the details sheet, sits on one soft checkerboard in the app's light or dark scheme. A Dark ground switch in the toolbar flips the checkerboard to the other scheme, so a reverse logo or a light icon can be checked on the surface it was made for, and this device remembers the choice. Grid tiles show the picture and its name only, without the Catalogue label or the format. On a phone the shared library lists its records before its notes, so the first record sits about 150 px higher.

Foldables and iPhone Duo

• Two panes on a big folding screen. On iPhone Duo's inner screen and on book-style Android foldables, Lolly shows a control pane and a canvas pane instead of a stretched phone layout or a squeezed desktop. In Design the Inspector, Layers and Export become tabs, and the tool rail stands along the canvas edge under your drawing hand.
• Controls follow your dominant hand. Settings, Accessibility has Dominant hand: Right or Left, and each control pane has Swap sides. Right-to-left languages mirror the panes.
• The fold is the divider. Where the device reports its fold, the panes meet at the hinge and nothing sits on the crease, dialogs included. On a flat screen you can drag the divider to a third, a half or two thirds.
• Tabletop. Half-folded on a desk, the canvas takes the top half and the controls become a deck below. Present shows the slide on top with the timer and next slide below; Sequence shows the preview over the timeline.
• Nothing lost when you fold. Folding, unfolding or rotating keeps your document, selection, open tab and the text you were typing.
• Fold signals. In Chrome on Android, Lolly reads the fold's position and posture from the browser. iPhone Duo is laid out from its screen size and shape, because its browser reports no fold.
• Two panes need a touch screen, so a desktop window of the same size keeps today's layout.

For agents and automation

Everything in Lolly can be driven from the lolly command line, the terminal app and the MCP server, so an AI agent can do what a person does in the web app. New in this release:

• New commands and flags.
  • lolly adobe indd, lolly affinity and lolly dxf open those files.
  • --export-report adds the PDF accessibility checks to an export.
  • --export=ttml, --export=scc and lolly rondocode --export=mid write captions and MIDI.
  • lolly matte --clean-edge-colour cleans soft edges.
  • --keepText=true keeps text when redacting a PDF.
  • --spots=process prints spot inks as process colour, and lolly preflight design --file=<tokens.json> counts the plates of the design system the file gives.
  • lolly check --kit=<partner-kit.json> checks a partner's marks against the kit's rules, such as minimum size and clear space.
• Text tools start in a fraction of a second. In the CLI, the terminal app and MCP, a text tool loads only what it needs instead of the whole engine, so it answers in a few hundred milliseconds instead of several seconds.
• Tools know the canvas size. Every tool is told the size it is being made at, on the web, in the CLI, the terminal app and MCP, and an MCP render follows the height you ask for.
• Pipe pictures into lists. The CLI fills a list of pictures (a sponsor wall's logos, say) from piped files, describe shows the picture flags, and the terminal app reads picture paths from a CSV.
• Safer picture handling. Text that only looks like a picture is refused, a refused web address is shown without its query or user name, and the terminal app refuses a pasted link to a local file.
• Design pages from operations. The terminal app and MCP keep a record of Design pages built from operations.
• Honest MCP labels. A test fails if a tool that changes anything is advertised as read-only.
• Start from what the piece has to do. An intent says what a piece must do for its reader, where it will be seen and what it has to say. lolly intent and MCP lolly_resolve_intent choose a tool for each place, say why, and list what they could not fill. No model is involved, and the same request gives the same answer.
• An agent can pass its user's prompt. Lolly never reads meaning from it. With no purpose set, the agent gets the purposes and tools back and chooses for itself.
• Intent in the file, if you want it. A render that starts from an intent can record its purpose, surface and tool in Content Credentials. Occasion, audience and region are recorded as fingerprints. The prompt is a fingerprint too, unless the agent asks for its words to go in, and the result says so when they do. On MCP, passing an intent turns the credential on for that render, and either can be turned off.
• Errors that say why a page is slow. When the CLI, the terminal app or MCP gives up waiting for its browser page to open a Design file (45 seconds by default), the error now says what the page showed: still loading on a busy machine, part way through opening the file, or stopped at its WebGPU start. Before, the error always said the web shell was out of date and should be rebuilt.
• Motion checks count every frame. MCP's motion inspection and the motion production checks now find each frame in ffmpeg's log by the frame's own fields. Under load, ffmpeg 9 prints some frame lines in the middle of another line, and those frames were skipped, so the audio duration came back undetermined. A video's own title or tags can no longer add black, frozen or silent spans to the review.

For tool authors and contributors

• New host functions. host.audio.loudness() returns EBU R128 loudness, and host.audio.align() finds the offset between two recordings of one event. The optional host.calc (evaluate, table, functions) works out spreadsheet formulas with 512 functions. host.pdf.redact takes keepText.
• Design-system controls inside your own section. The manifest field themeChoicesAfter puts the colourway and mode controls after the section you choose, as Snippet does.
• Pictures that ship with a tool can be read by asset inputs.
• Versions. The engine moves from 1.285.0 to 1.343.0, and the tool-author SDK, @lolly-tools/core, from 1.5.0 to 1.8.0. Both keep their own version numbers, which describe the tool-author contract rather than a release people install. The SDK adds the partnerMark intent role for a partner's logo in a co-branded piece, the partner kit format (@lolly-tools/core/partner-kit-v1) and the kit in the export record, the renditionOf manifest field (@lolly-tools/core/rendition-v1) for a tool whose output is a changed copy of one picture, and paths on host.pdf.stamp, so a tool can stamp words as outlines in the design system's face.
• Check before you push. pnpm run ci:local runs the same checks CI runs for a pull request. pnpm run test:plates checks print plates with Ghostscript if you have it installed.
• Share cards are byte-stable. Re-rendering a share card that shows the same picture keeps the committed file, so builds no longer churn the repository.

For people who run their own server

Lolly Work is released with the same version number as Lolly. The list starts with Lolly itself, up to and including the privacy line: a Lolly web app you build and host, and what the app does on a workspace. Everything after the privacy line is Lolly Work.

• YunoHost is Lolly Work. From 1.2.0 the YunoHost package is Lolly Work's, lolly-work_ynh: the same web app with sign-in, shared projects and the rest of Lolly Work. The static lolly package stays at 1.1.3 and gets no further releases. A guide for moving a static install onto Lolly Work at the same address follows, so everyone's saved work stays where it is and the app stays open to visitors.
• Smaller instance builds. When you build the Lolly web app yourself, LOLLY_INFO_LOCALES=en builds the /info guides in English only and points other languages at lolly.tools. build-delivery --codings br keeps only Brotli copies, and --no-validator-map leaves out the nginx map file.
• Instance packs for brands with variable fonts. Lolly's scripts/build-instance-pack.ts now packs variable font files with their whole weight range, records each face's real format and takes a licence file for each font family. Before, every face was labelled WOFF2, so a TTF would have been stored under the wrong type. --brand lolly-demo cuts a 4.6 MB Lolly Demo pack for a Work instance.
• No empty Utilities tab. In the Lolly app, when the tools someone may use include no utility, such as a partner programme that offers only Pricing and QR Code, the Utilities tab is hidden instead of opening on an empty page that pointed at feature flags. #/u still opens by address.
• The privacy line fits a workspace. In the Lolly app, when a Lolly Work workspace is connected, the first-run privacy line says what the workspace keeps: what you save to its projects or share through it, and a log of your sign-ins and what you do there. Before, it said that everything stays on this device. Without a workspace, nothing changes.
• Nextcloud on the same YunoHost server. Lolly Work's YunoHost package finds it and fills in a connection, which becomes a brand-file source and a delivery folder once an administrator pastes an app password.
• Garage file store. Docker Compose installs can add an optional Garage service to hold files.
• Coolify. A ready Compose recipe, with Coolify's proxy, generated secrets and domain setting wired in, and an install guide beside the VM, UpCloud and Dokploy guides.
• Bunny or Cloudflare in front of public files. An instance can put either service in front of its public files, with purge by tag and checks that the provider does not rewrite images or pages. Nothing changes until you configure a provider. Under the default EU-only policy, Cloudflare may front only a hostname that serves public files. A new Edge and CDN guide covers setup, and the edge probe checks a provider's caching and rewriting.
• HTML-layout tools render on the server through the render worker; an instance without a worker shows a message instead. Server renders keep design token colours.
• Tokens that do one job. A service token can name what it may reach (render, documents, files, delivery, catalog.read, audit.read) and which tools it may use. A new automation role renders without an admin's other authority. A token with no scopes works as it did.
• Render jobs catch up with the older job API. /renders and /render-batches gain signed callbacks, batches filled from a JSON or CSV source, a ZIP download and sending a finished render to a destination by reference.
• Output retention. An instance can expire finished render outputs after a set number of days. It is off unless you set it, and the record and evidence stay.
• An MCP endpoint for the whole instance. POST /api/v1/mcp lets an agent work under a service token. It runs the same checks as the HTTP routes, so an agent cannot exceed its token, and a tool the token cannot reach is not listed.
• Approval of the file itself. A request now carries the exact export. Reviewers see the artwork and decide, and the person who asked downloads that same file once it is approved. Before a decision the server does not hand the file to the person who asked, and a rejected or withdrawn request never releases it.
• "Until approved" works. A tool set to until-approved shows the PREVIEW mark on server renders and share links until an approved request matches its tool version, inputs and format. An instance that already holds this setting starts showing the mark on this upgrade, because until now the setting did nothing.
• Deleted documents can purge themselves. An instance can permanently remove deleted documents after a stated period. It is off unless you set it, and each run is audited.
• Move from a hosted render API. Work can take Bannerbear and Placid request shapes on /compat/, off by default, so moving means changing a base URL and a token. lw render-api lists your templates and builds a draft mapping. Bannerbear V5 templates import as editable Design documents. Bannerbear V2 and Placid return field names only, so those designs are rebuilt against a reference. See Known limits.
• Agents can send finished renders. The MCP endpoint gains deliver_render and list_destinations. A destination that needs approval stays with a person: a token cannot approve.
• Brand managers can edit without a rebuild. An admin or brand manager changes colours, colour roles and the brand page address in the studio and sends the result. Work serves it to members, signed with the instance's key, with history and rollback. Approval before an edit goes live and a second look after a new image are each one switch, both off by default. Store apps pinned to a publisher's key do not receive an edit.
• Partner programmes. Resellers, distributors and other partners each get a programme with its own tools, collections, design system or partner kit, people and end date. Partners see nothing internal until a programme grants it, and "everyone" no longer includes them. An administrator can add or remove people in bulk from a list or a verified email domain, and sees a preview before anything changes. A programme can also receive a single folder from a connected asset library, such as the photos from an event a partner sponsored. That folder stays in sync and is removed when the programme ends. Preview shows what each group gets before anyone is invited.
• A partner's own brand, set up once. A brand team gives each partner company its logos for light and dark surfaces and its details, and chooses which template inputs take them. Logos are checked on upload: a low-contrast logo is flagged and never refused. Preview draws a template exactly as a chosen company gets it. A partner's home opens on their company card, and their tools arrive with their logo and details already in place.
• Files say who they were made for. An export made for a partner records the partner company and programme beside the design system, and Verify shows it. Server renders now record the design system, colourway and partner in their Content Credential too. A file never records the person, their contact details, the token or the agent.
• Templates for partners. A brand team publishes a template to a programme or to one partner company, and chooses what partners may change, down to the colourway and mode. Partners find it on their home and in the tool's Start chooser, and see only the inputs left open to them. When a new version comes, they are told, and what they changed is kept. A Share with rules file from Design can be published the same way. Work rebuilds the tool from the file's data, so no code from the file runs. Server, API and agent renders follow the same rules and refuse a fixed input. A programme can also keep a tool to its templates: partners then do not see the plain tool, and a render must name one of their templates. A partner with a template waiting lands straight on their templates, without the "Make it yours" welcome. Each published template is one card on their home, with "Your copy" to carry on, and a "New version" button that brings in the update in one tap while keeping what they changed.
• Server renders of hooked tools work again. The render worker allowed each render a fixed 512 requests, and a QR code or a rules tool needed slightly more, so the server refused those renders. The allowance now follows what the app actually loads, and one render opens at most 32 connections at once. This affected Lolly Work 1.1.1 to 1.1.3.
• Ending a partnership, gently. Ending a programme or one partner company now marks it ended rather than deleting it. It retires the templates published only to that company, ends its provider folders and revokes its agent tokens, all listed in the preview first. Partners whose access is set to end are told in Lolly 14 days and 1 day before, with a link to Projects to download their work. Their company card on the home shelf also shows the date. An end can be reopened within 30 days: people, memberships, templates, folders and projects come back, while links, tokens and sessions stay ended.
• Behaviour change: someone in two programmes keeps their account. Ending one partner programme no longer disables a person who is also in another live programme. They leave that programme and keep their account.
• Limits for partner agents. A partner's agent works within limits the programme's manager can see and change: 120 calls a minute and 2,000 renders a day by default, with no monthly cap. Over a limit, the agent is told which one and when to try again. Internal tokens have no limits unless an owner sets some.
• Partner agents, with the brand's guidance. A programme's manager issues, limits and revokes tokens for a partner's agent. Agents read the brand's guidance over MCP and from /api/v1/context, and can describe, validate and render published rules tools. A partner's agent can ask for review of its own render; people still decide. Programmes show what each token, company and programme did, as counts only.
• One approval for a template's variants. Where a brand team turns it on for a tool, one approval can cover every price, logo and contact made from a template version, and the review card says so. Changed locks, or a change to what partners may edit, need a new approval. Each variant file made under that approval records it in its Content Credential, and Verify reads "Approved as a template" with the template and its version.
• Templates say what they are for. A published template can name the purposes it serves, so an agent asking for a webinar banner is offered the right template, and the API's schema for a template shows the company's own values.
• View as partner. An admin who manages a partner programme can view Lolly as one of its partner companies, from the account menu. A banner shows whose view it is, changes are not saved to the partner's account, and Stop viewing ends the view. Downloads still work and record the real person. The view never shows the admin anything their own access excludes.
• A partner's home keeps to what is theirs. It opens on their company card and the templates published to them, with one card per published template or rules file, Your copy and New version. The featured hero, the "Add your details" nudge and every status chip except Experimental are left out; Experimental stays because it says the export carries a PREVIEW mark. Their tabs, their programme's tools, Projects and Settings are unchanged.
• What partners can never do. Admin actions are refused for partner members, their agents and views, whatever the grants say. Anything outside what a partner's programme publishes to them answers with a plain "not available".
• Licences decide what reaches partners. Each programme's Licences card shows what reaches its people by the licence each file records. The brand team can mark its own files and share a held file anyway with one audience. An upgraded instance only reports until an admin turns the gate on; a new install gates from its first start. A programme receives only the files shared with it, so share the logos partners need.
• Credits travel with shared files. A collection ZIP starts with CREDITS.txt and credits.json, and the link page shows a credit line where a licence asks for one.
• End a partnership from the console. The End card shows what ending does, kind by kind, schedules an end with a notice, and offers Reopen for 30 days.
• Agent tokens in the console. A programme's Agent tokens card mints, limits and revokes partner agent tokens and shows today's use. What agents did shows the counts and exports them as CSV.
• Every limit, with where it comes from. The deployment page's Limits and quotas tab lists the limits Work enforces, each with its value and its source: configuration, environment or a built-in default.
• Partner kits. A brand team keeps a kit for each partner company: its logos, colours and rules such as clear space and minimum size. Design attaches the kit to a partner's work and lists advisory checks before export, saying plainly what it could not measure. Exports record the kit revision beside the partner, and Verify shows it. Set a kit up once in the console from a tokens file, a .lolly share or the company's SVG logos. Kit changes can wait for approval (off by default), and a partner's agents read the kit and its pinned logos over MCP.

Languages and guides

• The new and changed text up to 7 November is in all 26 languages, including the landing page. Text added since 7 November, such as the Sound shape slider, View as partner, partner kits in the app, the Dark ground switch in Assets, the docs picture viewer and the first-visit greeting, is in English in the other languages until the next translation pass.
• New guides: working with partners; the Brand Studio's bar, Board and Rules; springs and motion paths; keyframing one property; the automatic Performance UI switch; making a colourway your own; brand architectures; content sovereignty and connected DAM workflows; tracing an image; broadcast captions; camera raw photos; exporting MIDI; colour roles from end to end, including every --brand- variable a tool reads and how a manager edits an instance's colours from the studio.
• A new landing page that starts from who you are, with a terminal example and a Verify badge that says what it proves.
• Docs that read like part of Lolly. In the app, the docs use the app's own top row, with one side list per section that folds open as you need it, and the bottom bar's What? is now Docs. On a phone, one bar opens the sections, the pages and this page's headings, and the bottom bar steps aside while you read down the page. Wherever you came from, one press takes you back. Every page shows its section and ends with Previous and Next, lines are a comfortable width, and the docs honour Large text.
• Search finds the page first. Searching the docs, in the app and on the website alike, now puts the page you meant ahead of the sections inside it.
• Read the guide from a tool. Many tools have a "Read the guide" link in their help that opens the right part of the docs; one press brings you back to your work.
• Zoom into pictures in the docs. A screenshot, diagram or figure in the docs, in the app or on the website, opens full screen with a tap or its Enlarge button. On a phone, pinch to zoom, drag to move, double-tap for the screenshot's own size, swipe down to close and swipe sideways for the next picture. On a computer, the wheel or a trackpad pinch zooms around the pointer, and +, − and 0 zoom in, out and to fit. Buttons do the same, so nothing needs a pinch or a swipe.
• "Choose the format last." The landing page says it plainly, and "is sovereign" is back as the first word.

Safety and reliability

• PDF passwords: please read this if you used them. Some routes accepted a password and wrote an unprotected file with no warning. MCP lolly_render on HTML-layout tools did this for pdf from 1.0.7 through 1.1.3. pdf-cmyk, a PDF with bleed or marks, and formats that cannot hold a password did this on the CLI, the terminal app and web links, going back to at least 1.0.1. A requested password now protects the file, or the call fails and writes no file. If you relied on a password from these routes, check the file with qpdf --is-encrypted and export it again. On affected versions, a Weak password set in the export panel also went into the address bar and the copied link, and into the address that drives the browser on the CLI, the terminal app and the desktop renderer. It no longer does.
• Turning credentials off now holds. c2pa: "off" was ignored on MCP server renders, and the terminal app's off row stamped a credential anyway. An SVG with an inlined logo also kept that logo's own credential. Off now means no credential on these routes, and the MCP result says what the file holds.
• A view could fail to load on a first visit. Opening a tool in two tabs before its emoji pack was stored could show "This view didn't finish loading", and a placed tool could say it was not available. The two-tab case dates from 1.0.9 and the placed-tool case from 1.1.1. Both are fixed.
• Self-hosting with Lolly Demo. A Work instance mounting a Lolly Demo pack from 1.1.2 or 1.1.3 answered 503 for every asset, because two asset ids shared one file. Rebuild the pack from 1.2.0. A production server now refuses such a pack at startup and names the file.
• Rebuild palette keeps your settings. A rebuild used to drop house rules, share cards and the emoji choice.
• Placed tools can be edited under Lolly Demo. The Tool section's fields did nothing, because the emoji style made the tool's link too long.
• Design files from the CLI use your colours. Design SVG, SVGZ and outlined PDF exported from the CLI without a browser drew a template's grey fallback, such as #1e293b, wherever a design system colour was meant. They now draw the design system's colours. Web exports and MCP renders were already right. Render again from the CLI if you need the corrected colours.
• Emoji packs stay out of your uploads. From 1.0.9, opening a tool copied the emoji set it needed into Your uploads, labelled as yours: 8 MB on Lolly Start and 21 MB on Lolly Demo, plus duplicate cache copies. Sets are now kept as catalog material, and they still draw offline. Copies already stored stay, because Lolly cannot tell them apart from a file you imported yourself.
• Escape closes Design's colour popover on the first press.
• PDFs no longer print question marks. Since 1.0.8, text that a design system's fonts did not cover printed as ? in PDF: Arabic, Urdu, Hebrew, Hindi, Bengali, Thai, Chinese, Japanese, Korean, Russian, Greek, and some Vietnamese under Lolly Demo. Such text now prints correctly, outlined and shaped from the design system's fonts or from a bundled Noto font. A rare character no font covers goes in as a high-resolution picture of the words, and the export card says so. If you exported PDFs in these scripts, check them and export again.
• Right-to-left text reads correctly in SVG. Arabic, Hebrew and Urdu lines lost their direction in SVG export, so a closing full stop, Latin words and numbers moved to the wrong end, and Latin or digits inside Arabic could come out reversed. Lines are now shaped piece by piece in reading order.
• A choice in a dialog takes you where you chose. In Chrome and Edge, picking where a dropped or opened file should go, installing a tool from a .lolly file or opening a shared design could put you back on the gallery, because the closing dialog undid the move. This dates from 1.0.8.
• A file dropped while Lolly loads is kept. A file dropped while Lolly was still loading, on the loading screen or on any view, made the browser open the file itself and leave Lolly. It is now kept and opened once the page under it is ready. One drop is kept at a time; a second one gets a note asking you to drop it again. This affected every release from 1.0.1 to 1.1.3.
• The programme editor keeps every edit. In Agenda's programme editor, and any tool with a table editor, an Undo, a cell edit or a button press made while the previous edit was still saving was lost. Edits now apply one at a time, in order. This affected 1.0.9 to 1.1.3.
• The first flight in a presentation starts from the slide. The first Fly between artboards move now starts from the slide on screen, instead of zooming down from the whole canvas.
• PowerPoint and Word files carry your brand. Design's PowerPoint export names the brand typeface on every text run, even without a slide master, and keeps circles, ellipses and pills as native editable shapes instead of rectangles. Doc Studio's Word export sets the brand's fonts and text colour through the document's styles, follows the page size you choose where it was always US Letter, and adds a PNG beside an SVG logo for apps that cannot draw SVG. Both affected 1.1.3 and earlier.
• An SVG's credential is where readers look. An SVG that inlines a logo with its own Content Credential now carries the export's credential at the root, where c2patool reads it. Every earlier release wrote it inside the logo, and c2patool reported "No claim found". This affected 1.1.3 and earlier.
• Server credentials keep the pictures you placed. When the MCP server writes a Content Credential for a file with a lifetime or an intent, or the CLI writes one with --sign-key or an intent, it now keeps the record of the pictures placed on the page, AI-made ones included. Every earlier release dropped that record. A PDF with a lifetime, and any render with an intent, never had it. This affected 1.1.3 and earlier.
• Every placed picture is in the credential. A Design page with several uploads that carry their own Content Credentials gets its credential again, listing every picture as a component of the page. Frame and Work Avatar now record pasted-in pictures in PDF and PNG as well as SVG. GIF, APNG, animated WebP, MP4 and WebM exports now record the pictures they draw, as stills do. This affected 1.1.3 and earlier.
• Edited photos name their original. Darkroom 2.6.0, Filter 1.7.0 and Asset Export 1.2.0 now record the picture they change as the parent of the export, with what was done to the picture, such as "Adjusted the colours". Before, they listed the picture as one more placed part of a file marked as newly made. A picture passed in a link as a data: address was not recorded at all, and now is. A picture with no credential of its own changes nothing.
• The same input gives the same file. Renders from the CLI, the terminal app and MCP now draw canvases on the CPU, and repeat SVG exports name an inlined picture's parts from its content, so the same input gives the same bytes every time. Exports from your own browser still draw on the GPU. This affected 1.1.3 and earlier.
• No dark flash when a phone turns. When a window narrows past phone width or a phone turns upright, the closed Export sheet no longer flashes a dark backdrop over the screen and swallows a tap. This affected 1.1.3 and earlier.
• Menus and pickers open on top on phones. On a phone, Design's artboard size picker opened behind the inspector, so its sizes could not be tapped. The lower rows of the More and File menus, the context menu, the camera controls and the Document info, Custom CSS and Import panels sat under the inspector too. They now open above the inspector. The size picker also fits the screen with Large text and closes with Escape. This affected 1.0.9 to 1.1.3.
• Arrow keys on a slider start from its value. A slider at 0 whose range starts below zero, such as Darkroom's Temperature, jumped to its lowest value on the first arrow key.
• A tool turned off for a group stays off. On Lolly Work, a tool denied to a group was still listed in the app and its files were still served, and the app ignored an export rule set for one tool. Both now follow the rule. A link made by an account that is later disabled stops working while the account stays disabled.
• Typing right after a document opens is kept. Opening a saved document announced "Tool loaded" while the Opening card was still on screen, so text typed straight after the announcement was lost. The announcement now waits until the editor takes input. The Opening card now puts focus on its title instead of Cancel, so a stray Space or Enter, such as the Enter still held from opening the document, cannot stop the open. Escape and Cancel still work. This mostly affected screen reader and keyboard users, in 1.1.1 to 1.1.3.
• Exports stay where the page put them. On a busy machine, a PDF, Print PDF, SVG, EMF, EPS, WMF, DXF or PowerPoint export from the CLI, the terminal app or MCP could come out with every box shifted, about 170 px to the left on a Design page, because the page was still settling when the export began. In one test with the CPU slowed four times, 3 of 15 exports were shifted before the fix and 0 of 6 after. Each box is now measured against the page as it stands when the box is read. PNG, JPEG and the other picture formats were not affected.
• The tool sidebar keeps its colours after a PDF preview. The first PDF preview in a session loaded the PDF viewer's own stylesheet for the whole app until a reload. On a computer set to dark mode, the tool sidebar then turned dark navy under light-theme text, and the Light and Dark switch lost its "Light" label. The viewer's styles now stay inside the viewer, which follows Lolly's theme instead of the computer's. This affected 1.1.1 to 1.1.3.
• Delete storage removes service workers too. Settings › Delete storage now unregisters Lolly's service workers before it clears the caches. An old worker can no longer keep serving files from an earlier build, or fill a cache again during the clear. The report lists each worker removed.
• No new patent-pool codecs. This release adds no decoder for ProRes, DNx, H.264, HEVC, AAC or AC-3. For video, Lolly asks your device to play what it can.

Known limits

• InDesign import is a preview. Check imported layouts before you rely on them.
• Affinity effects are not applied. Effects, adjustments, masks and master pages are listed in the import report.
• Lolly's own PDFs fail the tagging checks. The accessibility report shows this, because Lolly does not write PDF tags yet.
• No PDF/X-4 claim. The bundled FOGRA39 profile is ICC version 4.3, which PDF/X-4 does not allow, so a Print PDF states its print condition without claiming PDF/X-4.
• Camera raw. Lolly stores a developed picture, not the raw file, and HDR editing does not apply to raw photos yet.
• SCC captions have not yet been checked in a real broadcast tool.
• Some guides are English only: Design import, the colour engine, the host API, Sequence, the utilities pages, Generated music and the Lolly Work guides, including the new guides for partner programmes.
• Platforms. This release has no new desktop or mobile builds. Intel Macs are deprecated. Windows, Linux and Android builds still wait for a hands-on WebGPU check on real hardware.
• Render API moves are not tested on live accounts. The Bannerbear and Placid adapters come from public documentation and fixtures, and have not run against a real account. Their guide has a check list for anyone who holds one. Bannerbear's registered webhooks, its signed URLs, and the separate animation, video, PDF and collection endpoints are not supported on the migration API.
• A recorded prompt is what someone wrote, not an instruction. Verify and MCP label it as data, because files travel.
• A recorded brand page address is not proof of ownership. It shows what the signer recorded, and it does not show that the page belongs to anyone.
• An imported brand skill stays on this device. A draft or kept skill from someone else's file does not travel in a design system pack, and it stays out of a published brand page.
• A Standard PDF password is a deterrent. It uses 40-bit RC4 for wide compatibility. Use Strong for anything that matters.
• ?password= still works on a link. The address is cleared on arrival, but a browser may remember it, so avoid putting a password in a link.
• Some text still goes in as a picture: scripts with no fallback font, such as Tamil, Ethiopic or Syriac, and the rare Chinese, Japanese and Korean characters outside each language's standard set, including Hong Kong-specific characters. In PDF, EPS and WMF those words are a picture: they cannot be selected or searched, and they stay RGB in a Print PDF. The same goes for a non-Latin name in the print marks. A DXF export with such text stops and names it.
• resvg ignores text direction. A right-to-left line kept as live text in an SVG can run off the canvas in resvg-based viewers. Browsers and Inkscape draw it correctly.
• Some colour role detail stays behind in other formats. DESIGN.md holds one colourway per file, a PowerPoint theme has no room for the words, and a Penpot file keeps only names and descriptions, not a tool's own binding or house rules.

In the next desktop and mobile builds

The desktop and mobile apps carry their own copy of the web app, so 1.2.0's changes reach them with their next builds, together with these:

• Ask an agent. The desktop app can find Claude Code or Codex installed on the same computer and let it edit the open Design document, with your own sign-in and subscription. Each edit is one undo step and the agent appears in People. Nothing is looked for until you open the panel, the app tells you where your document goes before the first use, and an administrator can switch the feature off with the agents AI policy on Lolly Work. No MCP server is needed on your computer.
• Desktop updates on Mac and Linux. Settings chooses Notify, the default, which checks once a day and shows the release notes; Update automatically, which downloads and checks a release in the background and installs it when you quit or choose Restart now; or Off. The app never restarts itself: an install waits until every save has finished and any recording or export has ended, and quitting with unsaved work asks first. Every update is signed with Lolly's updater key, and the app checks the signature before installing anything. The AppImage, .deb and .rpm builds update the same way; they were tested on ARM (aarch64) Ubuntu and Fedora, not yet on Intel or AMD (x86_64) machines or on AppImages run through FUSE. Apps from 1.1.3 and earlier can't check an update's signature, so the first release with updates is installed by hand once.
• Crash-safe saves. Documents are written to a temporary file and then swapped in, so a crash or a full disk leaves your last saved document intact.
• Updater security fix. The desktop updater component moves to a version with a fixed zip library (RUSTSEC-2026-0429 and three earlier advisories). Automatic updates were not switched on, so no installed app was exposed.
• Fold signals in the Android app. The Android app reads the fold's position and posture from the system.

Platforms and downloads

1.2.0 is a release for the web app, the terminal, servers and Kubernetes. The desktop and mobile apps keep the builds below.

Platform	Version	Status
lolly.tools	1.2.0	Hosted. Runs Lolly Demo and offers Lolly Starter.
Web container image	1.2.0	Signed image from the release commit; digest below. Carries Lolly Demo.
MCP, CA and Penpot images	1.2.0	Promoted from the release commit; digests below.
MCP browser image	1.1.3	No 1.2.0 image. Its qualification probe still expected the tool list from before lolly_resolve_intent, so the 1.2.0 build was not promoted; the image itself was not at fault. lolly-mcp-browser:1.1.3 stays current, and the next release ships the image again.
Lolly's Helm charts (deploy/helm, sovereign profile)	1.2.0	In the repository at the release tag.
Penpot plugins (Charts, Export, Filters)	1.2.0	Published to each plugin's GitHub Pages address.
Lolly Work and its Helm chart	1.2.0	Published: Work v1.2.0 and the chart on Artifact Hub.
YunoHost (lolly-work_ynh)	1.2.0	Lolly Work 1.2.0 with the lolly-web-1.2.0-ynh1.tar.gz web app. The static lolly package stays at 1.1.3.
Terminal (CLI and TUI)	1.2.0	Packed and tagged as cli-v1.2.0; the npm publish follows.
macOS, Apple silicon	1.1.3	No 1.2.0 build. 1.1.3 stays current, and lolly-latest.dmg still points at it.
iPhone and iPad	1.1.3	No 1.2.0 build.
macOS Intel	1.1.0	Deprecated. 1.1.0 is the last build for Intel Macs. It stays downloadable and gets no updates.
Windows, Linux desktop and Android	1.1.0	Held at 1.1.0 until their web views pass the WebGPU check on real hardware, as in 1.1.3.

Container images

The four signed 1.2.0 images are public on GHCR, for Linux amd64. Each was built from the release commit b2128b260525e82cd6d7d29647eef915354ffc8f and promoted as 1.2.0 with the lolly-demo profile, the one lolly.tools ships. No image contains model files.

Image	Digest
ghcr.io/lolly-tools/lolly-web:1.2.0	sha256:1bbf55dab98704a21581d5f08e740780dc0210cc2321a0bc6387fceacc09307d
ghcr.io/lolly-tools/lolly-mcp:1.2.0	sha256:ae95c361c3c1ff3adec8fd8ac7502be8220bf349bba314c872a15cb24c3a3921
ghcr.io/lolly-tools/lolly-ca:1.2.0	sha256:50f9e4bf093b37d9e4c9feb90499acbee4ce5adabb1c1a736deac9a097748569
ghcr.io/lolly-tools/lolly-penpot:1.2.0	sha256:138aa19b7bdd0a997edcab0bf42ca229280c2de45ecae2fa23fc665d7e00705b

Promotion gave each image a keyless cosign signature from release-images.yml@refs/heads/main, plus SPDX SBOM and SLSA provenance attestations, and moved no digest. For an anonymous client each 1.2.0 tag resolves to the digest above, and every signature was checked against its digest. The attached images.json records the repository, digest, source, profile and workflow runs. Verification, mirroring by digest and the model volume layout are in the image guide:

cosign verify ghcr.io/lolly-tools/lolly-web@sha256:1bbf55dab98704a21581d5f08e740780dc0210cc2321a0bc6387fceacc09307d \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity https://github.com/lolly-tools/lolly/.github/workflows/release-images.yml@refs/heads/main

The full list of changes is v1.1.3...v1.2.0.