What changed, starting with the version you run

Orchestration auto-dispatch was tuned against a benchmark, so the decision to open a discussion or hand work to a background task follows a measured pattern rather than a first draft. Shadow instrumentation now stores a preview of the query behind each decision, which is what makes a dispatch record readable after the fact.

The model can now assign discussion and background task delegation as tools of its own, exposed only on the turns an intent prefilter matches. It ships behind ORCHESTRATION_AUTO_DISPATCH and does nothing until you enable it, while shadow instrumentation records what it would have decided.

LLM_GATEWAY_PROVIDERS routes external provider inference through the LiteLLM gateway instead of calling each provider directly. Leave it unset and every provider keeps its direct path; Ollama Local and ChatGPT OAuth stay direct either way, and a single provider is rolled back by removing it from the list. Router vocabulary work in the same release moved routing accuracy to 93.3%.

Report-intent requests now produce structured report data that the server renders through a fixed HTML template. Report artifacts can be exported to PDF or DOCX, and report work can be delegated to an agent task when the request needs more research turns.

Desktop 1.7.1 fixes a packaged-build defect that could omit agent-browser.js and leave the app window missing. The release also adds a post-package ASAR require check to prevent the same omission from shipping again.

The Desktop app can run an agent browser tool in local Electron Chromium (Cowork D3). Artifact actions now verify whether generated code is executable before exposing a Run control.

MCP environment credentials and external-provider keys or OAuth tokens now fail closed when decryption fails, instead of allowing a broken decryption path to continue.

Scheduled agent reports can publish artifacts automatically, and registered MCP server credentials can be replaced. The release also fixes several credential-handling issues in the MCP execution path.

Agent tasks gained better subfolder awareness, and Desktop makes the connected local folder visible so users can tell which workspace a local task can access.

External BYOK provider usage is explicitly exempt from the local token quota, so a user who brings their own key is not billed twice against the workspace limit. The ChatGPT OAuth role path also records usage, which closes a gap where an operator could not tell which route had been taken.

Deep Research now connects configured skill knowledge and MCP tool evidence into the research pipeline, so a report can draw on your own connected sources instead of web search alone.

External models that cannot actually be used are excluded from the list, an over-eager vision block on external models was corrected, and a failed external vision call now falls back to the local model instead of erroring out.

Automatic skill selection reaches agent tasks, not just chat, when it is enabled. A role-assigned ChatGPT model that returned 403 and silently fell back to the local model was also fixed.

A ChatGPT subscription OAuth provider was added and external models were opened to the /v1 API surface. The flow is unofficial and depends on the provider's policy, so treat it as an opt-in convenience rather than a supported integration.

An OS-level sandbox (sandbox-exec) was added to desktop command execution, completing the three-layer defense: an immediate denylist, non-bypassable confirmation, and OS-enforced isolation. The mcp-runtime image also bakes in its Chromium system dependencies.

Desktop security hardening and the local bridge execution trust model landed alongside thirteen fixes from a source security audit covering IDOR, RCE, SSRF, authentication, CSRF, and general hardening. Personal identifiers and fixed credentials were removed from the public repository.

The desktop app gained a self-updater driven by a server manifest, which is the mechanism behind today's SHA-256 verified update path.

The desktop menu shows which local folder is connected without sending its full path to the server. The local bridge keeps realpath-scoped access, per-command confirmation, and sandbox protection, so an agent task can work on your machine without becoming a remote shell.

The 1.6.0 line began with the local bridge executor itself: agent tasks can run tools on the user's machine once a folder is connected, with a composer toggle and a badge in the task list showing when that is happening.

1.5.7 fixed version and git tag reporting in the /health response. Earlier releases remain useful for upgrade context — compare the changelog in the repository when a change affects your deployment.