Onyx Code 2.5.0

Chat can now run the commands you allow and show you what they print, attaches a file as you type @, and lets you choose its context window with the memory each size takes. Edits from local models land more reliably and never lose code unseen, the setup wizard says where your data goes, and Onyx Code's AI servers answer to Onyx Code alone.

Downloading

If you're installing manually:

macOS

• Apple Silicon Mac (M1 or newer): download OnyxCode-darwin-arm64.dmg (smaller, native).
• Intel Mac, or unsure: download OnyxCode-darwin-universal.dmg (runs on both).

Open the .dmg and drag Onyx Code to /Applications/. Both macOS downloads are signed and notarized by Apple, so they pass Gatekeeper and open without security warnings.

Linux (x64)

• Debian / Ubuntu: download OnyxCode-linux-x64.deb and install it with sudo apt install ./OnyxCode-linux-x64.deb.
• Other distributions: download OnyxCode-linux-x64.AppImage, make it executable (chmod +x), and run it. On Ubuntu 24.04 (which lacks libfuse2) run it with --appimage-extract-and-run.

Windows (x64)

Install with winget: winget install OnyxCode (recommended). It runs through Microsoft's App Installer (a trusted Microsoft Store app) with a package listing reviewed in Microsoft's community winget repository, so it verifies the download and gives a smoother first-run experience. The same installer (OnyxCode-win32-x64-winget.exe) is also attached here for manual download; note it is not code-signed yet either way, so Windows may still show an "Unknown publisher" warning. A code-signed installer is planned for a later release.

The *-autoupdate.zip, darwin-*.json, linux-x64.json and win32-x64.json files are plumbing for Onyx Code's
built-in auto-updater. They are not designed for manual install and will give
you a worse first-run experience than the download above.

What's New

Chat runs the commands you allow. Ask chat to run your tests or a build and it proposes the exact command on a card with Allow and Deny. Nothing runs until you press Allow, every time and in every mode, Auto included. The output streams into a panel under the reply with how the command ended, and the model answers from it, with secrets redacted. Commands run in your project folder with your shell's environment, minus variables named like secrets, and Stop ends them. Some commands are refused before you are asked: sudo, a download fed to a shell, a write into .git or into the files that set what AI may do, deleting your home or project folder, and anything a Shell(...) deny rule in .onyx/permissions.json matches. Commands run without a sandbox, as in your terminal, so read each one before you allow it.

Type @ to attach a file. Type @ and part of a file's name in the chat input, pick it from the list, and it is attached with the same checks as /file. With several folders open, each row names its folder, and on a large project the list says when it is still searching.

Choose the context window, and see what it costs. The context window is how much the model reads at once: your messages, the files you attach and the code Onyx adds. Each token of it takes memory beside the model, so a larger window needs more memory. Click the context usage beside the send button to pick Auto or any size up to the model's maximum, each shown with the memory it needs; a size that does not fit starts on Auto with a notice. On Auto, Onyx Code runs the model at the window it was trained for, or the largest that fits in your memory beside Onyx Tab and the codebase index, on the GPU or the processor. Some models reach further than they were trained for with YaRN: Qwen2.5-Coder was trained on 32K and reaches 128K, so the model lists show "128k ctx", Auto runs it at 32K, and a size past 32K in the picker turns YaRN on, which costs a little on short questions. The chip's hover, /model and /stats say why the window is the size it is, and a model too large for your memory is said so, with its size beside the memory there is. For what the window, its memory, the cache and YaRN are, with your model's own numbers, choose About the Context Window at the foot of the picker.

A larger window in the same memory. The chat model keeps what it has read in a cache, and Onyx Code now keeps it in 8 bits instead of 16, in about half the memory, wherever that fits a larger window: on a 24 GB Mac, Qwen2.5-Coder 14B gets its whole 32K window where it got about 21K, and the 7B its 32K beside Onyx Tab and the codebase index where it got 26K. Where the window fits at 16 bits, as on a machine with memory to spare, the cache stays at 16, as 8 bits read short prompts about a tenth slower; in testing the answers matched. The window picker shows each size at the cache it would use, and /model says which one runs and why. The setting onyxcode.chat.kvCacheType is on Auto; set it to 16-bit or 8-bit to keep one.

Long prompts show their progress. While the model reads a long prompt (whole-codebase mode, a long chat), a note under "Thinking" shows how far it has got, for example "Reading the prompt: 49,152 of 163,424 tokens (30%)".

Long chats stay quick and keep their thread. Later messages in a chat reuse what the AI server has already read, so the answer starts within seconds deep into a conversation. The context chip counts exactly what chat sends, summaries of earlier turns reach the model, and a small window holds more of the conversation. Onyx Code's AI servers keep earlier prompts only in memory your computer can spare.

Edits land, and code is never dropped unseen. Local models edit the file you ask them to change, and their edits go through more often on the first try. When an edit would lose code outside the change it marks, or leave a function without its closing brace, chat hands it back to the model to fix before anything is staged. Adding a function keeps the one beside it, new files arrive whole, in the folder you asked for, and a kept edit ends your file as it ended before. DeepSeek Coder V2 Lite is sent the chat format it was trained on, so it makes the changes you ask for.

Answers come from your project. Ask about a file by name and chat reads it before it answers. When the code chat picked up front does not hold the answer, it searches your project before replying, and a search hit on a comment brings the code beneath it, so a value is quoted from your code. A step that was refused or found nothing says why on hover, and a note under a reply flags a change or a test result the reply claims but no step produced.

The setup wizard explains privacy, and can turn on Air-Gap. A new Privacy step says where your code and prompts go, what Onyx Code itself goes online for, and what Air-Gap Mode blocks and what it leaves to you, then turns Air-Gap on in one click if you want it.

Onyx Code's AI servers answer to Onyx Code alone. The servers that run your chat model, the codebase index and Onyx Tab take requests only with a key Onyx Code makes at each start, so a web page in your browser cannot use them. When another program holds one of their ports, the status bar and a notice say which port.

The AI engine and your models are verified. The bundled AI engine is checked before it starts: on macOS its signature, on Windows and Linux each file against the hash recorded when it was built. Model downloads are checked against the SHA-256 Hugging Face lists for the file, and stop at the file's size.

Your protections hold everywhere. Deny rules in .onyx/permissions.json apply in chat, in every folder of a workspace, and however a file's name is spelled, and the codebase index keeps no file a Read(...) deny keeps from chat. An .onyxnoai that cannot be read keeps its whole folder from AI. Changes to your rules files, to Onyx Code's own folders and /init's drafts wait for your Keep in every mode, as do new shell, editor and git start-up files and login items when your home folder is open, and an MCP tool you always allow still asks before it touches them. Whole-codebase mode checks each file's path as it reads it, so a folder swapped for a link cannot bring a file from outside the project into the prompt.

Secrets stay out of what chat sends. Hex keys, UUIDs and short random keys after a name such as SECRET_KEY= are redacted, a key matched in part or cut short is redacted whole, and file paths go through as you wrote them. Autocomplete with an external server and drafted PR descriptions redact too, every redaction is recorded in the AI activity log, and Chat History keeps attached files by their path only.

Your pending changes are safe when you close. Closing, quitting or reloading the window with chat's changes waiting for review asks Keep All, Discard All or Cancel, as an unsaved file does. Keep and Revert leave any edit you saved since untouched, and a change's review shows the file exactly as the change found it.

Auto and worktrees keep to their own copy. Auto writes only into its own chat's worktree, and lists, searches and edits that copy. A worktree runs none of a project's git hooks, works for a package inside a larger repository, and applies large changes whole; chat tells you when a file it would write there is one git ignores, so nothing is lost on Apply. Deleting a chat asks what becomes of its worktree.

MCP tools work more reliably. Chat lists the tools your message is about first, explains a tool's actions to the model, and tells you when the model wrote a tool call out rather than running it. Values written over several lines, with \n, or in quotes reach the tool whole, and a tool's names, arguments and allowed values reach the AI only in short, single lines. Signing in to an MCP server stays on your computer, respects Air-Gap and renews quietly, and a redirect to another address carries none of your keys.

Project memory (Pro). Ask chat to remember something for the project and it saves a note once you allow it; every later chat in the project is given the note, and chat reads it back when you ask.

/compare, Chat History and slash commands are steadier. A comparison keeps your own model active, each column shows how its run ended with its numbers and load time, and the answer you keep is the one the model reads next. A reply that finishes after New Chat is saved with its chat, a summarized chat keeps its title, Stop works while a message waits for its summary, and slash commands say what they did.

Models and the codebase index. An offline AI server is one click from a restart: a Start Server button on the model's card, a restart icon beside the Chat Models heading, and "Onyx: Restart AI Server" in the Command Palette, each of which also starts a server that never started and says when it is ready. Browse Models shows the folder your models download to and each model's true size, embedding models download straight to disk and run with their own pooling, and all-MiniLM-L6-v2 downloads. The codebase index keeps the code a small embedding model cannot read whole, and follows folders you delete or move outside Onyx Code.

Pro offline, stated plainly. Activated online, Pro works offline for up to 30 days between renewals and renews on its own; from an offline license file, for a year. An online license past its renewal comes back by itself at the next start online, and you can confirm a device removal from any mail client with the code in the email.

Onyx Code throughout. The Extensions view, settings, sign-in pages, macOS permission prompts and the first-run screens name Onyx Code, and Copilot's leftover buttons are gone. Help > Report Issue, the first launch after an update and MCP sign-ins make no request to Microsoft's servers. On Linux, software centres show Onyx Code, and sudo apt purge onyxcode removes it cleanly.

On Windows. Onyx Code now updates itself on Windows: an installed copy downloads the new version in the background and offers Restart to Update, its updates keep a folder of their own apart from Visual Studio Code's, and the About box says why updates are off when the Update: Mode setting, running as administrator or your organization's policy turns them off. A second copy, such as a second profile, leaves the first one's models running. Chat's edits keep a file's Windows line breaks, a chat's worktree applies whatever your git line-ending settings and however long its paths, and chat runs git from your PATH's folders alone. The installer, Settings > Apps and the Start menu name Onyx Code and its publisher.

After you update. A Qwen2.5-Coder model shows a 32K window on Auto, the window it was trained for, where it may have shown 128K: to go past 32K, pick a larger size in the window picker, which turns YaRN on and takes more memory. Where memory is tight, the chat's cache now runs at 8 bits on its own; to keep 16 bits as before, set onyxcode.chat.kvCacheType to 16-bit. Your codebase index is built again once, as each index now records the embedding model that made it. The embedding model, its pooling mode and the draft model are now read from your user settings only, as the model server and the active model already were: if you had set one in a project's settings, set it again in your user settings. onyxcode.ai.rag.enabled and onyxcode.ai.rag.excludePatterns, which had no effect, are gone (use onyxcode.index.enabled and onyxcode.index.excludeGlobs), as are onyxcode.ai.port and onyxcode.ai.embeddingPort.

System Requirements

• macOS 11 (Big Sur) or later.
• Apple Silicon (M1 or newer) or an Intel Mac. The Universal download runs natively on both.

Installing

1. Download the .dmg that matches your Mac (see "Downloading" above).
2. Open it and drag Onyx Code into your Applications folder.
3. Launch it from Applications. Because the build is notarized, it opens without a security prompt.

Verification

This build is signed and notarized by Apple. macOS verifies it on first launch, so it opens as an app from an identified developer without security warnings.