What's new

• 🌐 A browser beside the chat (desktop app). The globe at the top right of the chat opens a panel with real Chromium tabs, the one bundled with the app: address bar (a bare host opens as https, local addresses as http, anything else searches), back, forward, reload, a button to open the page in your system browser, and a draggable edge. Sessions persist between restarts in the panel's own profile; a page never gets the camera, microphone, your location or notifications; links that want a new window open as a new tab here. The panel remembers whether it was open, its width and its tabs.
• 👁️ Each tab has an eye that says whether an agent may read it: the tab you are looking at is readable, the others stay hidden unless you switch them on (and you can hide the active one too). This version records your choice; the tools that let agents read a tab and open pages in the panel come next.
• 🖥️ The panel needs the desktop app: in server mode (the interface in a plain browser) the globe does not appear.

• 🩹 Fix for 0.1.82 on Windows: the app would not start after updating. The key store folder and the data folder are the same folder on Windows (%APPDATA%\hydraops and %APPDATA%\HydraOps only differ in case), and 0.1.82's one-time tightening of the store's permissions reached data\, leaving the database and the .env without permissions: the API died at startup and the interface stayed on the waiting page. This version never changes the folder's permissions on Windows or macOS (only the store files are made private) and **repairs an installation that 0.1.82 damaged** the first time it starts, restoring the folder's inherited permissions. If your app is stuck on the waiting page after 0.1.82: install this version from the Releases page, or reset the permissions yourself from a terminal (icacls "%APPDATA%\HydraOps\data" /reset /T and the same for backups), then start HydraOps again. Linux installations were not affected.

• 🔐 Your API keys and tokens are now stored encrypted. keys.json, the ChatGPT store and the X store become AES-256-GCM envelopes that reveal nothing without the key that opens them, and refuse any altered byte. The key is generated on your machine the first time and kept in your system's keyring (Windows Credential Manager, macOS Keychain, or the desktop keyring on Linux), never in a file. Nothing to do on your side: the existing plain store is encrypted in place the first time the updated app reads it, after checking it reads back. Settings → API keys says how the store is protected.
• 🖥️ Servers without a desktop have no keyring: put HYDRA_KEYSTORE_PASSPHRASE=<a long phrase> in the service's .env before updating and the key is derived from it on every start, never stored. Without it HydraOps falls back to a master.key file next to the store (readable by the service's user only) and says so in Settings. See the manual's Server mode and Security chapters.
• 🧱 The store is private at the file level too: mode 600/700 on Linux and macOS, an access list naming your user alone on Windows; writes are atomic; an existing store folder is tightened on the first start. Backups now include the X store and never the master key. Keys cannot be moved to another computer by copying the file: enter them again there.
• 🛡️ An undecryptable store is treated as an error, never as "no keys": nothing overwrites it, and the key-proxy keeps the keys it already had. The agents' guard blocks master.key and the other stores like it already blocked keys.json.

• 🧊 3D: Front view and Turn 360°. Two buttons in the viewer's toolbar. Front view puts the camera in front of the model (its front face centered, seen from about 30° above) so the PNG you save is a proper front shot and not whatever angle you happened to be looking from. Turn 360° makes a full, even turn around the finished model in about eight seconds and ends in front again; the controls are off while it turns.
• 📅 Calendar view polish. Month arrows beside the mini month; a time zone selector in the toolbar (with a note when your browser is in another zone than the calendar, and a one-click switch to it); readable icon arrows beside Today; a toolbar that keeps two fixed rows and never pushes the buttons down when you change to Week or Day; the entry's last-run date in the interface's language.
• 🔒 @hono/node-server 2.1.5 (GHSA-rmxm-3fg6-px4f).

• 📅 The Calendar view. Complementos → Calendar shows the shared calendar: a mini month with a dot per owner and the agenda of the coming days on the left; month, week and day in the middle, with search and a New entry button; the selected entry or the form on the right (note or action, title, date, time or all day, repeat until a date, time zone, the agent and its task, notes). Owner colors; a square is an action, a circle a note; done, missed and removed entries show greyed; double-click a day to create there. The detail shows when and where, the owner, the agent and approval of an action, the last run and its task, the reserved attachments; Edit and Remove.
• 🕒 The calendar's time zone is set in Settings (the system's unless you pick one); each entry keeps the zone it was created in.
• ✅ A readable approval card when an agent schedules, changes or removes a calendar entry: what, when, which agent, the task text, the attachments, and what approval does — not a list of arguments.
• 📨 A task the calendar started shows in the agent's chat as your message with a "From the calendar" mark and the prompt as written; the agent is told it was scheduled. Telegram notices from the calendar come in the machine's language (HYDRA_LANG overrides).
• 🧩 Skills: Update and Delete answer in the row. The outcome ("up to date · b7cc0c0", "updated…", or the error) shows under that skill's own buttons; before, it went to a notice far above the list and a click looked like nothing happened. A skill may be up to 1 MB (was 512 KB): unity-cli from Unity's official skills now installs.
• 📖 README (English and Spanish) caught up with everything since 0.1.46.

• 📅 A shared calendar. Every agent now reads a calendar and, with your approval, writes to it. A note (a meeting, a delivery, "no GPU until the 20th") is context: each task starts with the agenda of today and the next 7 days in front of it, and a note with a time reminds you on Telegram. An action is a task set for later: "Thomas, publish this thread on Friday at 10" — at that time the agent gets it as a new task in its chat, with the files the action reserved (copied when you approved it, so they survive the task vault's cleanup). Repeats daily, weekly, monthly or yearly; the time zone is stored with each entry (yours by default); an action that came due while HydraOps was off still runs within 6 hours, later it is marked missed and you are told. Give an agent the tools with - calendar in its tools.md; the Calendar view in Complementos comes next. See the "The calendar" section in Scheduled tasks.
• 🔒 Outside content stays outside. A calendar entry written by a task that had read a web page or a feed keeps that origin: it is left out of the agenda the agents get, reaches them only marked as external data, and a task it starts is treated as tainted, the way a delegated task is.
• 🧱 qs 6.17.0 (Dependabot #90).

• ✏️ Editing a message sends it again. Hover one of your messages, press the pencil, change the text and save (Ctrl+Enter; Esc cancels): the message goes out again as if you had just typed it, the old exchange with its reply leaves the chat, and the agent answers the new text. A task still waiting in the queue is just rewritten. Before, saving only changed the stored text and nothing happened. The edit box is now as wide as a message and as tall as the text.
• 🖼️ image_edit: plain image edits without a GPU or Blender. A new native tool measures an image of the task (size and the subject's box), crops, flips, rotates, resizes, trims the plain background away, or composes several images on one canvas (a sheet of views from single pictures, a mirrored profile next to the original, with equal_heights so the figures match). The result is saved in the task's folder, shows up in the chat and the agent is shown it to check. Nothing outside the task is touched, so it runs without approval. Add image_edit to an agent's tools to give it.
• 🔌 The real answer from a model's service, not "fetch failed". When a service (Anthropic, OpenAI, Hugging Face…) answered before reading the whole request — a 429, a 529 "overloaded", a 400 for an image too large — the key-proxy turned it into a blind "Upstream request failed" and the SDK retried without knowing why. The request body now goes out whole, so the real status reaches the caller and the log says the cause.
• ⏱️ The 3D plugin stops a model call it gave up on. The 10-minute wait for a scene (3 for a brief) now aborts the call: before, the plugin reported a timeout while the call went on alone, finished later and was billed. The message names the model and the wait; THREED_TIMEOUT_MIN raises it for slow reasoning models.

• 🧩 Values set on a ComfyUI workflow reach the server. comfy_workflows has an action set that writes values on the prepared copy of a workflow by address (<node>.<input>, the addresses list_workflow_slots prints): a prompt, a seed, a step count, and also a node's record value such as ImageCropV2's crop region. Setting a crop region through the connection's set_workflow_slot left the server running the node's default (the same 512 × 512 corner four times in a multiview template); set keeps those values in the form the converter reads. A value fed by another node is refused, naming the link.
• 📐 Uploaded images come with their size. prepare notes the pixel size of each image it uploads (uploaded "sheet.png" (1360 × 768 px)), so an agent can work out crop regions instead of guessing.
• 📦 Skills with more reference files. A skill may carry up to 50 files (was 40); some published skills, such as the official Unity ones, ship more than 40 reference files and could not be installed.
• 🐦 X posts that come back without a link. When X creates a part of a thread but does not return its id, the part is reported as published without a link (it is under the previous part on X) instead of a broken address or a second attempt; the next part replies to the last post whose id is known.

• 🎬 Videos on X. x_post now takes a video (an MP4 with H.264 video and AAC audio, such as the ones ComfyUI makes) as a post's attachment, or a GIF of up to 15 MB. The video is uploaded in pieces and X processes it before the post goes out, so a post with a video takes minutes; the approval card plays it. A video or a GIF goes alone in its part; images stay at four per part.
• ✔️ X Premium accounts. Tick "X Premium account" on an account in Tools → X and the agents may publish long posts (up to 25,000 characters instead of 280) and long videos on it; the approval card and the Telegram notice count against that limit.
• 🧠 Conversation memory per agent. Each agent has a setting for how much of the earlier chat goes with every new message: none, short, normal or long (the default, as before). Earlier chat is sent again on every step of a task, so an agent whose requests stand on their own works noticeably cheaper with less.

• 👁️ Agents look at what they generate. When a ComfyUI job makes an image, the agent is shown it (a lighter copy; your file stays the original) and checks it against what you asked — the character, the colors, whether several views match — before it reports, instead of saying it has not seen it. Models that cannot see images still say so.
• 🔁 Feeds that bounced through a sign-in check read again. Some sites answer only on a second pass and send a reader round a redirect loop first; the Android Developers Blog feed is one. fetch_url now keeps the cookies a site sets while it follows those redirects, for that one request only, so the feed comes back instead of "Too many redirects".

• 🔧 Approved downloads and uploads work fully. A model download you approve now keeps its progress note (so the agent can tell you how it is going in a later message) and reaches the ComfyUI your connection points to; an approved Hugging Face upload finds the task's files.

• 🤗 Hugging Face, from your agents. New Hugging Face tools (one huggingface line in an agent's tools). Reading runs on its own:

  • search models, datasets and Spaces;
  • read a model's card, license and files with their download links;
  • preview a dataset's first rows;
  • follow discussions;
  • check whether your token has access to a gated model.

  Creating a repository, uploading files and posting in a discussion wait for your approval every time. Public content needs no token. Add one in Tools → Hugging Face for gated and private repositories, or for writing.

• 🧬 Civitai, read-only. Civitai tools (one civitai line):

  • search checkpoints, LoRAs, VAEs and more;
  • read a model's versions, trigger words, license and files, with Civitai's safety scans;
  • learn from example images with the prompt, sampler, steps, CFG and seed that made them;
  • find out which Civitai model a file you already have in ComfyUI is.

  Adult content is blocked unless you allow it in Tools → Civitai, and the agents cannot change that switch. The API key is optional; it only needs Read on Models and on Profile & Settings.

• 📥 Gated and sign-in models download too. comfy_download_model uses your Hugging Face token and Civitai key: a gated model such as FLUX.1-dev (once you accept its terms) and a Civitai model behind a sign-in now download into the right ComfyUI folder. The key goes only to that site, never to the server the file comes from. A Civitai link names its file by itself, and civitai.red links work.

• 🧩 Workflows say which models they need. Official ComfyUI templates carry each model's folder and download link. Preparing a workflow now lists them and says which are missing, so the agent downloads exactly the file the template asks for instead of guessing a link. An agent with comfy_download_model no longer tries the ComfyUI connection's own download first, which failed and could hold later steps for approval.

• 📥 Agents can download the models a ComfyUI workflow is missing. The new comfy_download_model tool saves the file into the folder your own ComfyUI reads for that kind of model (ComfyUI itself reports it, so portable, desktop, git and extra-path installs all work). Every download waits for your approval; only https and .safetensors or .gguf files, never over an existing file. It runs in the background, and comfy_workflows "downloads" tells how it is going. Models behind a login (gated on Hugging Face, some on Civitai) are not downloaded yet.
• 🎛️ Truer reports of what a workflow used. When a value comes from another node, such as a width fed by a resolution selector or a seed from a primitive, the agent now sees it and stops reporting the number written in that field, which ComfyUI ignores.
• 🧹 Official templates with an invisible line separator run again. Some ComfyUI templates (MiniMax H3 among them) carry a U+2028 inside a prompt, which left the ComfyUI connection unable to read the workflow; preparing it now turns it into a normal line break.
• 🛡️ Dependency updates. zod moves to 4.6 across the backend, with the AI SDK and its providers on the releases built for it; undici 7.30.1, multer 2.5.0, body-parser 2.4.0 and fast-uri 4.2.3 close the remaining security advisories.

• 🪟 No more black window when HydraOps starts with Windows in the tray. The window used to load the interface while hidden, and on opening it from the tray it could stay black until View → Reload. Now it waits without a page and loads the interface the first time you open it.
• 🛡️ Safer chat rendering. DOMPurify, which cleans the HTML of the models' replies before the chat shows it, moves to 3.4.17 (three advisories, in modes HydraOps does not use), and ip-address, under the MCP connections' rate limiter, to 10.7.4.
• 𝕏 Small touches on the X card. The Callback URI row no longer sits glued to the Client ID and Client Secret row, and the manual's screenshot of X's settings shows only the panel that matters.

• 𝕏 Your agents can post on X, with your approval. Connect your own X developer app in Tools → X and, through it, as many X accounts as you manage (a project's, a brand's, a personal one). Each account lists the agents allowed to post on it, and a new account starts with nobody. An agent with the x_accounts and x_post tools publishes a post or a thread, with up to four images per part, and every post waits for you: the approval card shows the account, every part as it will go out with its character count, the images and the estimated cost, and so does the Telegram notice. The server publishes only the exact post you approved, once. X's API is pay-per-use (about 0.015 USD per post, 0.20 USD with a link), charged to your developer account.
• 🔗 Your own callback page. X only sends the browser back to an https address, so you publish a small page HydraOps gives you (download it from the X card) on any hosting, free or paid. The manual walks through GitHub Pages step by step. On that page, Continue finishes the connection on this computer, and Copy gives you the address to paste in the card when HydraOps runs on another machine.
• 🧲 Searching a project no longer pulls its files into the chat. The harvest that runs after every connection tool call now leaves alone the files that already existed before the task started, so a model a Unity search listed no longer shows up as a card.

• ⬆️ Updating lives in the sidebar now. Above the version line, in every view, one block says what there is to do: Update to x.y.z when you run from source (it pulls, rebuilds and restarts the services, showing the step in progress), Downloading x.y.z with its progress and then Restart and install x.y.z in the installed app, where the native dialog that used to pop up is gone: the download stays automatic, you choose when to restart, and closing the app installs it anyway. If something fails, the block says why and System keeps the log. The banner at the top (which linked to the release page) and the card in System are gone. Clicking the version line checks again right away.
• 🐧 Updating from the app works under the hardened systemd unit. The unit let the service write the key store but not the folder where the copies of the installation go, so the update always stopped at "the copy could not be made". The unit in deploy/ gains that line; an installed unit needs it added by hand (see the server-mode manual).

• 🛡️ The desktop shell moves to Electron 44. The 41 line the app ran on no longer receives security fixes; a reported flaw let HID and USB permission checks be attributed to the wrong origin. Electron 44.9.3 brings Chromium 152 and Node 24.22 to the shell and to the services it runs. Nothing changes in how the app looks or behaves; the packaged app was verified end to end on the new line.
• 📦 Vite raised past five advisories in its development server and its editor launcher. It comes with the Angular build tooling and never ships with the app.

• 🐙 Skills from any public GitHub repository. In Tools → Skills, paste the address of a repository, one of its folders, or a SKILL.md kept in the open Agent Skills format (Unity's official skills, the lists the community maintains, a repository of your own) and press See what it holds. Nothing is installed yet: the panel lists every skill the address holds with its description, folder, files and size, and what each one carries — source code (installed as read-only text, never run), scripts, a terminal expected, a name you already have, or why it cannot be installed — plus the repository's license, or that none is declared. View opens a skill in full before you decide: origin (repository, branch, commit, folder), license, the safety scan, the files left out and why, and each file as text. Pick the ones you want and install them at once; a name taken by a skill from elsewhere is replaced only after you confirm.
• 🔄 Skills from GitHub remember where they came from and can be updated. Opening the Skills view asks GitHub, once per repository, whether the folder moved on; when it has, the row says so, and Update reinstalls it from the same place after the safety scan runs again. HydraOps redistributes nothing: each skill comes from its author's repository, under the license the repository and the skill declare.
• 💤 Reading a repository is thrifty with GitHub's limit (60 API requests an hour per computer without a token): a preview spends three, and viewing or installing what was just previewed spends none, because the answers are kept for a few minutes.
• 📦 Two dependencies are raised past reported vulnerabilities: hono (reached through the MCP SDK; HydraOps serves nothing through its static handler) and http-cache-semantics (build tooling only, never shipped with the app).

• ⏳ A long ComfyUI generation is let go, not waited for. On a modest GPU a workflow can take an hour, and the agent used to sit polling it until the task's own time limit cut it. Now comfy_workflows waits a couple of minutes at most and, when the job is still going, says so (running, or queued with N jobs ahead, and for how long): the agent tells you and ends its reply. Ask later whether it finished and it collects the result, or tells you how long it has been going and offers to cancel; the new action cancel interrupts a running job or removes a queued one. The last job each agent launched is remembered, so the question needs no id, even if the task that launched it was cut short.
• 🧩 A continuation keeps the skills the agent had open. When you decide on a held call, the task that carries on now receives the text of the skills the original task had opened, so the agent keeps following the same procedure instead of drifting into code it finds in the chat's history.
• ⚠️ A task whose model never answered ends as failed. A rejected key, a monthly spend limit reached, a model that does not exist: the task used to end as "completed" with an empty reply. Now it ends as failed, with the error kept, counted as such in the statistics and announced like a crash, so a cron's subscribers hear of it.
• 📂 Only files a task made come into the chat from a connection's folders. An asset a tool's answer merely named (a model a search listed) used to be brought in as a card; now only a file written while the task ran is.
• 🐧 The systemd unit lets comfy-cli write its job records (~/.config/comfy-cli), so the ComfyUI connection no longer fails right after ComfyUI took the job. Create that folder before the first start, as the unit's comment and the server-mode manual now say.
• 💬 The ComfyUI result tool tells the agent that you already see the files as cards under its reply, so it stops saying it has no way to attach them.

• 💾 Backups live outside the data folder. A copy of the installation was kept under backups/ inside the data folder; running from source that folder is the clone itself, so deleting the clone to "reinstall" took the agents, the chats and every copy with it. Copies now go to your own configuration folder (%APPDATA%\HydraOps\backups on Windows, ~/.config/HydraOps/backups on Linux, ~/Library/Application Support/HydraOps/backups on macOS), one subfolder per installation, and HYDRA_BACKUPS_DIR moves them elsewhere. Copies made before this stay where they are, listed, restorable and deletable, marked in the data folder.
• 📂 System says where your data is. The System view now shows the data folder (agents, chats, settings) at the top and, running from source, that it is the clone itself: update it with git pull, never delete it to reinstall, make a copy before touching it. The installation manual says the same.
• 🧠 Current Claude models as the fallback. When Anthropic's model list cannot be fetched, the choices offered are Sonnet 5.5, Haiku 5.5 and Opus 5.5 instead of one older model.

• 🖼️ A picture a tool returns is a card in the chat. When a connection's tool answers with an image (Unity's scene and game captures, Blender's viewport capture, a browser screenshot), the picture was kept for the model only, and a card appeared under the reply just when the tool had also saved a file in a folder the connection is configured with. Now the inline picture itself is written with the task and shown as a card, so "show me a capture" needs no save path and nothing in the application's own folders; when the tool did save a file within reach, that file is the one card.
• 📁 A relative path in a tool's answer is found under the connection's folders. Unity's capture tools answer with a path relative to the project (Assets/Screenshots/view.png) and the chat got no card for it, since only absolute paths were recognised. Such a path is now looked for under the folders the connection is configured with (the project given to --project-path, for instance), only there, and never outside them.

• 🎮 Unity, from the catalog. The unity preset connects an agent to the Unity editor through Unity's own CLI (unity mcp), a native program with no uvx/npx form: the catalog now accepts it as a launcher, and View checks it is installed and, when it is not, shows how to get it. A preset may write {{VAR}} placeholders in a server's arguments (--project-path {{UNITY_PROJECT}}), filled in from the connection's variables when the server starts; a variable may be left empty after installing and its argument is then dropped, so the program uses its own default. Filling a variable in no longer marks the connection as hand-edited.
• 🛑 The approve tool class. Every call to such a tool waits for the user, whatever the task said and whatever the security mode, the way create_skill already behaves; approve for the rest of the task does not cover it. Meant for tools that run or write code inside an application (Unity's eval, run_script, write_text_file, menu). Shown in red in the classes legend and the tool list.
• 📁 A connection's folders are a source of media. A tool that saves into the application's own project (a Unity capture under <project>/Assets/Screenshots) stayed out of the chat, since the harvester looked only in the temp folder, the task's folder and HYDRA_MEDIA_DIRS. The absolute folders in a connection's arguments and variables now count too.
• 🔁 A connected server with no tools is retried. Unity's CLI answers without tools until the editor is open, and the connection stayed connected · 0 tools until HydraOps was restarted. Such a server is now retried once a minute like a failed one, counted from the connection itself; open the editor and the tools are there within a minute or two. A Reconnect button in Tools → Connections restarts one at once, hand-made connections included, and the state column says Connected · no tools · retried automatically.

• 🚑 0.1.61 would not start from the Windows installer. The backups module added in 0.1.61 is CommonJS and the packaged backend is an ES module package, so Node read it as ESM, the API died on its first require and the desktop stayed on the "Starting HydraOps…" page. The module is now a .cjs file, which Node loads as CommonJS wherever it sits. Nothing else changes: install this version over 0.1.61 and the app starts with the backups feature intact.

• 💾 Backups, from the System view. A new Backups section keeps copies of what makes the installation yours: the agents, the installed skills and add-ons, the users, the settings and the database with every chat, task, schedule and connection. Make one whenever you want (task files and API keys are optional, off by default); one is made on its own before every update, with the five newest automatic copies kept. Put back replaces the current data with a copy and restarts the app: tasks in progress are cancelled, the services stop, the files are swapped and everything starts again, on the desktop, under pnpm serve and under systemd alike. The state you had right before is kept as a copy too, so a restore can itself be undone. A copy is a plain folder under backups/ in the data folder, with a manifest: nothing to unpack, easy to copy elsewhere. Documented in Statistics & System and in Troubleshooting.
• 🧩 ComfyUI: a crop region reaches the server as saved. The connection's converter (comfy-cli 1.22.0) drops a widget whose value is a record, such as ImageCropV2's crop region, and the node ran with its default: the four crops of a multiview workflow all became the same corner of the picture and the model came out as a symmetric tower. prepare now writes such a node's values by name, which the converter honours, and reports it. Twenty-one node types with record widgets (crop regions, video trim and crop, curves, painted masks, bounding boxes) are covered.
• 🖼️ ComfyUI previews stay out of the chat. A job's intermediate previews (the mask, the UV atlas, the baked texture maps) were brought in as result cards, eight of them above one model. Only what the workflow saved is shown now, as collect already did.

• ⏱️ The model's time limit is per round, not per task. A task could keep the model working for 10 minutes in total (15 with the local model), tool calls included, and then it was cut: a Blender build of fifteen rounds hit that wall with the building half done, and a 3D job in ComfyUI was cut while ComfyUI was still finishing. The clock now starts when a round begins, pauses while that round's tools run (each connection has its own limit) and restarts on the next round, so a long task of many rounds is never cut for being long; a model that never answers still is. A task cut this way keeps the token usage and the per-round breakdown of the rounds that finished, so the Stats stay right.
• ⚙️ Set in Config. Longest model answer: minutes per round, 1 to 25 (LLM_ROUND_TIMEOUT_MIN). Empty keeps 10 minutes in the cloud and 15 with the local model. The per-task clock stays as a last resort, now 25 minutes for every provider; HYDRA_LLM_TIMEOUT_MIN in .env can only lower it. The troubleshooting page explains the new message ("The model gave no answer within N minutes (round M)").

• 🔄 The Update button hands over to a fresh supervisor. On an install from source, pressing Update fetched and rebuilt the release but the process that runs the stack kept its old code and told the services the old version, so the app kept offering the same update; and the state file it left made git status dirty, which refused the next update. Now the stack is stopped and a new supervisor takes over (under systemd the service exits with code 3 and the unit starts it again; under a plain pnpm serve a new one starts in place; the desktop relaunches itself), the services report the version just installed, and nothing is left untracked in the clone. The first update that reaches this version still runs under the previous supervisor, so that one time the version label is stale until the service restarts.
• 🧰 Tools stay loaded for the whole task. With tools on demand, a tool left unused for three steps was unloaded to keep the definitions short. The per-round data showed the opposite effect: the tool list is the first thing in every request, and any change to it made the provider re-read the whole conversation at the full price (a Blender task with Opus 5.5 spent 512k of its 662k input tokens uncached). Loaded tools now stay for the rest of the task, and the model is asked to load in one call everything it will use.
• 🐧 systemd unit, complete. The service finds uvx (its PATH now includes ~/.local/bin) and can write the caches of uvx and npx, so connections such as BlenderLab start under the service; a missing cache folder no longer keeps it from starting. The server-mode docs say which lines to add to a unit installed earlier.
• 🔧 Self-update migrations on Windows. The migration step of a self-update went through the shell and broke on a Node path with a space (Program Files), silently; it no longer does, and a failure is written to the update log.

• 🔒 NATS stays on this computer. The message bus between the API and the agents now listens on 127.0.0.1 only. It used to bind every network interface with no authentication, so on a machine without a firewall anyone on the local network could reach it. Desktop app and pnpm serve alike.
• 🌐 Server mode says the right thing on its first start. With HYDRA_HOST=0.0.0.0 and no token yet, the API generates HYDRA_AUTH_TOKEN and saves it in the .env; pnpm serve now reads it back and prints the network URLs (http://192.168.x.x:3000) instead of warning that the API stayed on loopback while it had in fact opened the port. The API's listening on line shows the real address.
• 🛡️ Media harvesting, hardened. An image, video or 3D file a connection's tool names in its answer is fetched only from that connection's own server (the address in its settings), never following redirects, with a streamed size cap (300 MB) and a cap on attempts and time per result; duplicates are told apart by content, not by name and size.
• 📊 Each model step's size travels with the result. The task's result keeps, per round, the provider's token counts and how many characters went to instructions, history, tool results and tool definitions — the data needed to see what weighs in a call. The same file produced twice in one task is registered once.
• 📖 Docs: a fresh install starts with no agents (the installation page said it seeded an example one).

• 🖼️ ComfyUI results in their card. An image, video or 3D model a connection's tool names in its answer (ComfyUI's fetch_outputs, for instance) is brought into the task and shows in its card under the reply, like a generated image. It is taken straight from your ComfyUI under the name it saved it with, whatever the model; a temporary copy is used only as a fallback, and only from where tools leave their output.
• 🧰 Tools on demand, leaner. A connection with more than 15 tools is no longer loaded whole: the model gets its list and names the ones it needs. A loaded tool left unused for 3 steps is unloaded, and the previous task's tools are preloaded only when your message does not name another connection. Measured: about 7,000 input tokens per tool call, down from about 36,000.
• 🎨 Tools by color in the agent's profile. Add-ons, built-in tools and MCP servers each have their color, with a legend.

• 🧰 Tools on demand. When an agent has more than 12 tools, the model no longer gets every definition on every call (tens of thousands of tokens, even to answer one line): it gets an index, name and one line per tool by connection, and loads the full definition only of the ones it is going to use. Tools you name in the message and the ones the chat used in its previous task start loaded. Measured on a request for a prompt: 19,464 input tokens down to 4,267. A switch in Settings turns it off.
• ✅✅ Approve for the rest of the task. A held call's card, and its Telegram notice, offer a third choice: the call runs and the same tool no longer asks in that task and its continuations. Tools that always ask keep asking.
• 🔁 Approval chains that never go silent. A task can resume up to 20 times after your decisions (it was 5), and if it ever reaches that limit the chat gets a note with what ran and how to go on, instead of nothing.
• 🧩 ComfyUI: your saved workflows first. The agent is told to list the workflows saved in your ComfyUI before the online templates (held for approval, with models you may lack), and to bring a finished job's files into the chat itself instead of leaving them in a temporary folder.

• 💬 Replies through a ChatGPT plan arrive. Since 0.1.53 every answer through the plan came back as "the model did not return any response": OpenAI's plan route sends the reply in the streamed items and closes with an empty list, and the key-proxy only read the closing event. The reply is now rebuilt from the items, tools included.

• 🔐 Connecting a ChatGPT plan no longer looks like it failed. Once the browser came back, the section could say "Not connected" for a second while the permission was being saved, so people signed in twice. It now says "Connecting…" until it is done.
• 🛡️ Dependencies past this week's advisories. sharp and the MCP SDK are bumped, and three transitive packages (katex, source-map-js, proxy-addr) are pinned past their fixed versions.

• 🔐 Your ChatGPT plan as a model source. With ChatGPT Plus or Pro you can now connect HydraOps to your subscription instead of an OpenAI API key, through OpenAI's "Sign in with ChatGPT" for open-source apps. Config gets a section to connect from the browser, see the account and the models the plan serves, and disconnect; the models appear in the selector as "ChatGPT (plan)", each agent picks one, the chat says a reply came from the plan at no per-token cost, and the weekly cap you set in ChatGPT is reported in the chat when reached. Tokens stay on your computer, handled by the key-proxy.
• 🧊 3D models, images and videos get a card in the chat. A model a task delivers (GLB) shows a card with its size and triangle count and a viewer that opens on request; an image or a video a task brings gets a card with a preview and a download.
• 🎨 "To Blender" from the card. A 3D model can be sent straight into your open Blender through a Blender connection (BlenderLab), without going through a model.
• ⏻ /exit and /restart. Shut down or restart HydraOps from the chat, Telegram or a CLI. Both describe what would happen (tasks in progress, scheduled tasks, how to come back) and wait 60 seconds for a confirmation that only the person who asked can give; the app shows a card with the buttons.

• 🧩 ComfyUI workflows, ready to run. A new tool, comfy_workflows, lets an agent use the workflows you saved in your own ComfyUI: it lists them, prepares one (a copy, with the files you attached uploaded and placed in its inputs) and brings back what the finished job saved, under a recognizable name and with its real size. It works next to a ComfyUI connection, through ComfyUI's address; your saved workflows are never changed.
• ⏱️ Connections whose tools take minutes. A tool call of a connection was always cut at 30 seconds. A connection can now be given more (toolTimeoutSeconds, up to an hour) for tools that wait on a render or a generation; catalog connections that need it carry their value.
• 🖼️ The agent knows the file behind an attached image. The model was shown the picture but not the name it is stored under, so a tool that needed the file was given an invented name. The stored name now travels with the image.
• 💸 Claude models cost much less in long tasks. Prompt caching is now asked for with Claude models, through Anthropic's API or OpenRouter: each tool round used to pay the whole conversation again at the full input price.
• 🧾 A failed or cancelled task shows what it used. The tokens of the rounds that finished before the failure were billed but stored as zero; they are now recorded and counted in Stats.

• 🔀 OpenRouter models go to OpenRouter. A model chosen with an OpenRouter id whose name also belongs to a provider with its own key (google/gemini-…, openai/gpt-…, anthropic/claude-…, mistralai/…, x-ai/grok-…) was sent to that provider's API and failed with "Not Found"; ids with a size in the name (meta-llama/llama-…-70b) were sent to the local server. Any vendor/model id now uses OpenRouter and its key. Local models and ids without a vendor prefix work as before.

• 📎 Drop files on the chat, or paste an image. Dragging files over the chat shows where to drop them, and dropping attaches them like the paperclip does. Ctrl+V in the message box attaches a copied image, a screenshot for instance.
• 🔗 Leaving the app asks first. A click on a link to another site opens a small balloon with the full address, the site in bold, and Cancel / Accept. Links the agent did not open or see are now marked with a yellow warning triangle instead of a question mark.
• 🪜 Steps per task, per agent. Each agent's profile has a new setting: 15 (the default), 30 or 45 tool rounds per task. An agent that builds long things can get more without raising the cost of every other agent.
• ⚠️ No more false "executed successfully". When a task used up its steps and the final answer could not be written (the provider out of credit, a rate limit), it ended with a success mark and no report. It now says what happened and why, and that the work the tools did is real.
• 🔎 A blocked web search says so. When DuckDuckGo refuses a search, web_search used to answer "No results found" and the agent concluded the thing did not exist. It is now told the search was blocked and nothing was searched.
• 💸 A little less per step. Tool images leave the conversation in blocks, so the provider's prompt cache is not thrown away on every capture, and a skill opened twice in a task is sent once.

• 🔒 Security hardening. A review of every open code scanning alert. One was a real defect: creating a worker from the API accepted a name with ../ and could write outside the apps/ folder; the name must now be plain letters, digits and dashes. The rest tighten code that was already guarded: every path built from a request is resolved inside its folder (worker logs, agent files, uploads), the API has a cap on requests per client that normal use never reaches, the About window's links are fixed addresses, and two patterns that could be slowed down by crafted input are gone.

• 🗞️ Scheduled tasks no longer deliver the same news again. A task like "read this feed and bring me what is new" kept a memory of only its last three answers, so two "nothing new" days in a row made it forget the list and send it again. Each task now keeps a record of the links it delivered and of what each page it read said, and the app itself removes what was already delivered: an unchanged feed gives one line, a changed page is kept. Ask for the link of each item in the task; an item without one cannot be told apart from a new one.
• 📭 A scheduled task has to open its sources. If a task names its feeds or pages and the agent answers without opening any of them, it is asked once more; if it still does not open them, you get a notice instead of a digest that could be made up.
• 🧠 Agents remember the last 30 days of a chat. An agent used to see only the last 24 hours, so "the sites you suggested yesterday" drew a blank. It now gets the last 20 exchanges of the last 30 days (less with a local model, so its context does not fill up), older messages carry their date, and the chat shows the same 30 days.
• 📋 Text meant to be copied comes in a frame with a copy button. Prompts, commands and messages to send now arrive in their own block, separate from the agent's comments, and long text in the frame wraps instead of scrolling sideways. Telegram shows it as one block too.
• 🖱️ Selecting text in the chat works again. A selection in an agent's reply was wiped a second later, because the reply was redrawn on every refresh of the history.
• 🔒 Build tooling updated for a critical advisory in piscina (used only while compiling the interface; it does not ship in the app).

• 👁️ Agents can see the pictures their tools return. A viewport capture from Blender or a page screenshot from a browser server used to reach the model as the words "image omitted", so an agent "checked the viewport" without seeing it. Now a model that can see images (OpenAI, Anthropic and Gemini chat models, among others) is shown the picture right after the tool result, and a model that cannot is told plainly that it was not shown, so it does not claim to have looked. With a local model, set LOCAL_LLM_VISION=1 if your server has the multimodal projector loaded.
• 🧭 Choose the model that routes the main chat. Config has a new field, "Main chat routing model": the model that reads each main-chat message and picks the agent. Left empty it uses the default model, as before; with a heavy local default, a fast model here turns a wait of several seconds into about one.
• ⏳ A connection's first start is no longer cut short. A server started through uvx, npx or docker has to download itself the first time, which can take a minute; HydraOps gave up after 10 seconds and killed the download with it. Local servers now get three minutes to connect.
• 📚 The README and the manual are caught up with the last releases (Skills, /plan, approvals, the task vault, Connections, the 3D plugin), and the Spanish interface says "predeterminado" where it said "por defecto".

• 🗄️ No more approval cards for work that read nothing from outside. Reading a document back from the task vault used to mark the task as having read third-party content, whatever the document was, and from then on every tool that acts waited for your approval. Now only documents that did come from outside (a web page, a search) mark it: an agent modelling in Blender, with no web reading, runs straight through.
• 📖 Skills reach the agent whole. An installed skill longer than 2,500 characters was being handed over as a short digest, so the agent had to go back for the rest of its own instructions. It now gets the full text in one go.
• 🎨 Image generation with Google works again. The default engine pointed at an Imagen model that Google has retired, so an agent with its image engine on "automatic" failed every drawing. The Gemini image models (gemini-3.1-flash-image and its siblings) are now supported, and one of them is the default.
• 🔒 Angular 21.2.25 and DOMPurify 3.4.16 (two security advisories).

• 🔌 Connections: MCP servers ready to use. Tools → Connections lists a catalog of servers that are already configured: Blender (build and edit 3D scenes), Playwright (a real browser for pages that need JavaScript) and Documents (web pages, PDFs and Office files as Markdown). "View" shows what each one needs on your computer, the exact command it is started with and what every tool does; "Install" adds it, and you give it to an agent in Agents → Tools. A connection is configuration, not code: the server's version is pinned and only changes when you press "Update".
• 🏷️ Each MCP tool says what it does. A server's configuration can now classify its tools (toolRisk: looks up, reads outside content, changes something). Tools that only read run freely, and only the ones that act wait for your approval once the task has read third-party content; before, the second call to any unknown server was held. The catalog's connections come classified, and the card tells you when a server publishes a tool nobody classified.
• 🔁 MCP servers recover on their own. They start connecting when the app opens instead of on the first task, one that failed (the application was closed, docker was still starting) is retried on the next task, and one that lost its link is restarted. No more editing the configuration to wake a server up.
• ⚙️ Each worker starts only the servers its agents were given, and changing one server no longer restarts the others.

• 🔒 Security update. Nine advisories were published on 29 September for libraries HydraOps ships, three of them high-severity in Electron (windows opened from sandboxed pages, cross-origin reads through the file/HTTP handlers, Node.js in <webview> workers). This release moves to electron 41.10.7, brace-expansion 5.0.12, fast-uri 4.2.1 and js-yaml 5.4.2. Nothing else changes; updating is recommended.

• ▶️ The agent carries on after you approve. Until now, approving a held call ran it and that was it: the agent had already answered "approve and I'll continue" and never saw the result, so the next request started over. Now, once you have decided on every call a task was holding (and at least one ran), the agent continues by itself in the same chat, with what each call returned and which ones you rejected, from where it stopped and with what it had already read. The chat shows it as "The agent continues after your decision", the action card shows the result, and if you approved from Telegram the follow-up reaches you there too.
• 🔒 Three security updates in dependencies: multer 2.4.0 (an aborted upload could leave files behind), undici 7.30.0 and ip-address 10.7.2.

• 🗄️ The vault keeps the conversation lean. Before each step of a long task, the tool results in the conversation are measured against a budget (about 90,000 characters for an API model, 40,000 for a local one; HYDRA_TOOL_CONTEXT_CHARS overrides it). Over budget, the oldest results already in the vault are replaced by a one-line stub that says how to read them again; the last two rounds are always kept. Nothing is lost, and a research task no longer grows until the model chokes.
• 📝 vault_note: findings that survive. The agent can write down a figure, a quote or a conclusion (with the document it comes from) as it works; the notes are kept with the task and repeated to it on every step, so compaction never takes the facts it needs for the final answer. "Show steps" lists them as "Noting: …".
• 🗺️ A plan's reading carries over. When you approve a /plan, the task that carries it out starts with the documents the agent read while planning, numbered as before and listed in its context, instead of fetching them again.
• 🔧 Three tools called in parallel could receive the same vault number and overwrite each other's file; fixed.

• 🗄️ The task vault: long pages are no longer cut. Until now each tool trimmed its result (a web page at 4,000 characters, a transcript at 15,000) and whatever fell off was gone, so a question about something deep in a page could not be answered. Now every long result is kept whole for the task and the agent gets the beginning, an index of the document's sections and a [vault #n] marker; with vault_read it opens a section or keeps reading, with vault_find it searches what it stored. The working row shows vault: N with the documents kept so far, and "show steps" names each read-back ("Reading back from the vault #1 · Reception"). Vaults are removed after 24 hours.
• 💬 The chat stays where you left it. The history poll no longer moves the view every couple of seconds: it only scrolls when a new message arrives or a reply finishes, so you can read the links, sources and model line under a long answer without being pulled back to its start.
• 👤 The typing bubble has a name from the first moment. In an agent's chat it is born with the agent's name and avatar instead of reading "Agent" for a second and then changing.

• 🗺️ Plan before doing. Put /plan in front of a big, costly or hard-to-undo request and the agent proposes first: it only has the tools that read, so nothing is sent, saved, delegated or generated until you say so. The plan arrives as a card with the goal, the numbered steps and the tools each one uses (orange for the ones that act), the agent a step is delegated to and the questions worth settling first. Approve and run, Edit the text and approve that version, Ask for a revision (the next version lands in the same card with new / changed / removed marks and what the change implies; v1 · v2 · v3 chips jump between them) or Discard. While a plan is waiting, what you type is a revision of it. On Telegram it arrives with ▶ Approve / ✕ Discard.
• 🧠 Long research jobs finish properly. When an agent hits the limit of tool calls in one task, the final answer is now written from everything it gathered instead of the last round only, and it is told the limit was reached. No more "my searches did not run" after twenty sources were read. The limit is 15 steps (override with HYDRA_LLM_MAX_STEPS).

• 👀 See what your agents are doing. While an agent works, the line under the dots tells you its current step and how long it has been at it: searching (with the query), reading a page, opening a skill, checking GitHub, waiting for your approval, thinking… show steps lists everything it has done in that task so far, so a long research job is no longer a black box.
• 💬 Long replies open at their start. When a reply is taller than the chat, the view now stops at the agent's avatar and the beginning of its text instead of jumping to the end, so you read it top to bottom.
• 📊 Tighter agent cards. The Statistics cards are shorter again: the name sits right under the avatar and the attributes take less room.

• 🛠️ Approvals work for every agent. Approving an action held for a coder agent (like a new skill it wrote) did nothing: it stayed "approved" and never ran. It runs now, and if a held action ever fails after you approve it, it says so with the reason instead of waiting forever. On Telegram, deciding in the app takes the buttons off the notice and adds how it went.
• 🧩 skill-creator comes with HydraOps. The guide agents follow to write new skills is included and cannot be deleted, and every agent allowed to create skills gets it, even without the skills tool. Tools now opens with the Skills card, then Telegram and GitHub.
• 📊 Skills on the agent cards. Statistics cards have a new Skills attribute: hover it to see how many times each agent used skills and which ones.
• 🧊 3D: every object framed, and a clean view for pictures. A 20 cm flower pot now fills the view like a house does, and the grid follows its size. The clean view hides the grid and adds a soft backdrop and shadow; PNG saves the view at twice the resolution. If a change can't be made to work, your previous version stays on screen and Keep fixing picks up from where it failed.
• 💬 Approval cards don't hide below the window. When a reply and its Approve / Reject card are taller than the chat, the view follows them to the buttons, without pulling you away from older messages you are reading.

• 🧩 Skills for your agents. Skills are step-by-step know-how, like how to research in depth, write for X or YouTube, audit a page's SEO, or write so it reads human. Install them from the official catalog in Tools → Skills, or copy one into the skills folder by hand. An agent uses them only if you give it the skills tool; it sees just the names and opens a skill when a request needs it.
• ✅ Agents can propose their own skills, and you decide. An agent with create_skill can write a new skill after working something out. It is never saved on its own: it waits for your Approve / Reject in the chat, in the Skills panel or on Telegram, and it stays on your computer.
• 🔍 A safety check before installing. View shows every file of a skill and flags phrases that try to take over the agent, credential file names, "download and run" commands and hidden text. Downloads are checked against the catalog so a tampered file is not installed.
• 🔗 Links show where they really go. Hover a link in a reply to see its real address. A link whose text names one site but points to another gets an orange ⚠, and a link the agent didn't actually open or see in this conversation gets a small "?".
• 📐 Replies look like documents. Tables got rounded corners and a soft accent colour that works in both themes, and lists, headings and quotes in agent replies have their proper shape again.

• 🛡️ The outside-content guard now follows it everywhere. Saving to an agent's permanent memory after reading a page is always held for your OK — even for agents you marked as trusted. When recall brings back an old answer written after reading outside content, that task is marked too; and a task an agent delegates from a marked task starts marked, so the other agent's actions are held as well.
• 📱 Approve or reject from your phone. Each held action reaches Telegram with ✅ Approve / ❌ Reject buttons (only for your paired chats). System → Security shows the log: which tasks read outside content and what happened to every held action.
• 🔑 Opening HydraOps to your network got easier. Set HYDRA_HOST and HydraOps generates its own access token, saves it, and shows it (with a copy button) only on the server itself in Config → Network access. The manual explains how to reach it from outside home with Tailscale, without opening router ports.
• ⏱️ Research agents get time to finish. A task can now keep the model working for 10 minutes with cloud models (15 with the local one) instead of 2 (5), so long market or news analyses no longer get cut — and if one still runs out of time, the chat says so in your language.
• 📊 Tables and 3D prompts, readable. Tables in agent replies have lines, a header row and full width; in the 3D plugin every iteration's prompt can be read whole and reused with one click.

• ⏸ Actions wait for your OK after an agent reads outside content. If an agent opened a page, a search or a third-party file and then wants to send a message, write to GitHub, save to its permanent memory, generate a video or use an MCP tool that acts, the call is not run. A card appears under its reply with the tool, the exact arguments and where the content came from: Approve runs that stored call as-is, without the model; Reject discards it. Undecided calls expire after 24 hours, and Telegram tells you when some are waiting.
• 🛡️ You choose how strict. Each agent's profile has an Outside content setting (ask for approval, the default, or trusted), and Config has a global switch (ask / trust / off). Images are not held — they are already limited to one per task.
• 📊 Diagrams in colour. Mermaid diagrams from your agents now use HydraOps' own palette in both themes, take the full width of the chat, and open full screen with a click (Esc closes).
• 📘 Updating from source, documented. The manual now explains how to update a Linux, macOS or from-source install — the in-app Update button or git pull + pnpm serve — and what to do if git pull reports divergent branches on an older clone.

• 🛡️ Outside content is data, not orders. Every tool now declares whether it reads third-party content (web pages, searches, transcripts, GitHub, most MCP servers) and whether it is sensitive (sends, writes, runs code, remembers, generates paid media). What comes back from a page reaches the model wrapped in "this is data" markers, and agents are told to report any instruction found there instead of obeying it. Each task records when it took in outside content and every sensitive call made after — visible at GET /api/security/events. This stage observes; holding those calls for your approval comes next.
• 💸 One paid image or video per task. A page saying "make 8 variations" can no longer make an agent spend 8. Image agents make one image per task (with a retry if the engine fails), video agents one render. Models firing tool calls in parallel cannot slip past the limit.
• 🧼 Everything the chat renders is sanitized. Markdown replies, What's new and the manual go through DOMPurify: no scripts, forms, iframes, overlays or javascript: links, and images only from the app's own storage — a remote image becomes a plain link, so a reply cannot phone home. Links between manual pages work again.
• ⏱️ Honest times in the chat and Stats. Opening a conversation no longer changes when its replies "finished": the reply keeps its real time and Stats durations are measured from creation to completion.
• 🔬 A prompt-injection battery ships in tools/injection-battery: canned attacks run against a real model through the real pipeline, on an isolated stack.

• ⏹️ Stop a task. A Stop button sits next to the "typing" dots, and /cancel does the same from the chat box or from Telegram. The task turns Cancelled at once and the worker really aborts the model call: a cloud model stops generating and billing, your local model frees the GPU. Tasks still waiting in the queue can be cancelled too.
• 🎨 Image, video and 3D can be stopped as well. Image and video agents stop waiting for the render and discard the result, and the 3D plugin has a Cancel button on its working badge — handy with reasoning models that take minutes.
• 🔎 Answers keep their sources. When an agent searches the web or opens pages, Sources · N appears under its reply: ● pages it opened, ○ pages that came up in a search. The same addresses stay in the conversation, so a later "give me the link" returns the real one.
• 🤝 No more made-up links. Agents now follow a rule: only give a URL they actually opened or saw, never rebuild one from memory, and never call it "verified" unless they opened it in that same turn.
• 🔗 Links in replies are blue, in both themes. Cancelled tasks no longer count against an agent's success rate in Stats.

• 🔗 Links can no longer take over the app window. Clicking a link in an agent's reply used to navigate the HydraOps window itself to that site, with no way back to your chats. Links now always open in your browser (or a new tab, when you use HydraOps from a browser) and the app window stays on the app.
• 🛟 No more blank window. If the interface cannot load because the services are still starting, the window shows a "Starting HydraOps…" screen and reloads by itself as soon as they are ready, instead of staying blank.
• 🧩 Safer start-up next to other copies. The desktop app only reuses services that really are its own: a service is adopted by its port, and processes from another checkout or install are ignored. This fixes the app starting without its API when a developer stack was running on the same machine.

• ✨ What's new, inside the app. After every update a closable What's new tab appears in the chat with what the release brings — and if you skipped versions, it lists the ones you missed. The notes ship with the app, so they work offline. Type /whatsnew to read them again at any time.
• 🧊 3D: "Improve prompt". One click turns a short idea ("a treasure chest") into a build brief with size, main shapes, details and palette, in your language. Read it, tweak it, then generate; Undo brings your original text back. Helps mid-size and local models the most.
• 🎨 3D: style presets — Free, Low-poly, Voxel, Game prop, Realistic. The style shapes both the brief and the code, is saved with the scene and remembered between sessions.
• 🛟 3D: no more silently blank canvas. Helper calls with the wrong arguments now fail with a clear message that goes back to the model for an automatic fix, NaN geometry is caught instead of reported as "ok", and roundedBox takes the same argument order as box.
• 📦 Export notes now cover Unity, Unreal and Blender: how each one imports a .glb (Unity needs the official glTFast package).

• 🧊 New plugin: 3D (beta) — describe an object and the model writes the Three.js code that builds it; an isolated canvas renders it on the spot. Orbit it, iterate ("make the stripes blue and add a boat"), and export .glb straight into Unity. Works with any text model, including your local one, and ships Three.js inside the app — no internet needed.
• 🛠️ Built to look right on the first try — the model gets a helper kit (lathe profiles, extruded outlines, mirror, ring/grid repetition, shared materials), a design method and a worked example; runtime errors are sent back to the model and fixed automatically (up to twice). Studio-style lighting makes metals shine instead of rendering black.
• 🖼️ Reference image for vision models, saved scenes with thumbnails, a Code tab to read or hand-edit the result, and a live "working" badge with elapsed time for slow reasoning models.
• ⌨️ New commands: /3d, /plugins and /open <view> (jump to docs, config, stats, tasks…). /engine now shows the engine by name, and the docs list every alias.
• 🔒 Generated code runs in an opaque-origin sandbox: it cannot reach the app, your data or your keys.

• 🖥️ HydraOps lives in the system tray. Closing the window no longer stops anything: agents, scheduled tasks and the Telegram bot keep running while the icon sits next to the clock. Click it (or launch the app again) to bring the window back; Quit in its menu is the only thing that stops the stack. New in Config → Desktop: Start with Windows and Start in the tray, for a machine that runs 24/7. Every shutdown is written to shell.log with its reason.
• 🧭 The main chat picks the right agent. Messages without an @mention used to be dealt out in turns. Now a fast model reads the message and each agent's role and routes it: C# questions reach the coder, game assets reach the illustrator, AI news reach the researcher. Falls back to the old rotation if the model does not answer; ROUTER_MODEL picks a cheaper model for it.

• ⌨️ Commands, phase 2. Fifteen more verbs in the chat palette (and in Telegram): /model, /engine and /aspect to configure the active agent without leaving the chat; /tools, /grant and /revoke to edit its tools; /crons, /cron mon-fri 09:00 …, /pause, /resume and /run for scheduled tasks — /cron understands plain schedules in English and Spanish and opens the task form pre-filled; plus /retry, /profile, /lang and /theme.
• 📖 Docs that match the app. New README (banner, badges, everything shipped in September) and the manual's Telegram, scheduled-tasks, agents and add-ons pages brought in line with the commands, the schedule picker and delegation.

• ⌨️ Commands. Type / in the chat box and a palette lists what you can do without spending a single token: /agents, /use luna, /status, /tasks, /delegate karen …, /remember, /recall, /memory, /telegram, /oneshot, /help — plus /<agent> <message> to talk to an agent without switching tabs. English names with Spanish aliases. The same commands work in the Telegram bot. See the new Commands page in the docs.
• 🤝 Agents can delegate. The new delegate_task add-on lets an agent hand a task to another one (grant it in the agent's tools.md). And every agent now has a standing rule: if a request needs something it has no tool for, it says so — it never claims to have done it.
• ⏰ Schedule picker for scheduled tasks. No more typing cron syntax: pick every N minutes, every day at…, weekdays at… or once a month; existing jobs open already translated. The raw expression is still there for the curious.
• 💬 Chat drafts survive. What you were typing stays in its tab when you switch chats or visit another view, and a transient poll error no longer blanks the conversation.

• 🎬 Three video engines. Valentina can now render with Google Veo 3.1 (long-running operation, polled until the clip is ready), xAI Grok Imagine video, and Leonardo Motion. The engine selector only lists what the backend can actually drive, and the aspect selector only offers what the chosen engine supports (Veo: 16:9 / 9:16; Grok: all seven; Leonardo: 16:9, 9:16, 3:4).
• 🏷️ The chat footer names the engine. Generated images and videos show the LLM that wrote the prompt and the engine that rendered it, by its readable name ("Flux Dev", "Isometric Fantasy", "veo-3.1-fast-generate-preview") instead of an id.
• 🛠️ Sturdier media workers. A Leonardo model id can no longer be mistaken for a local LLM, and when a model narrates its generate_image / generate_video call instead of making it, the worker renders anyway with the prompt the model wrote.
• ⏱️ Video polling waits up to 8 minutes for both engines, and Leonardo requests use only sizes its 480p tier accepts.

• 🖼️ Generated images finally show up in the chat — the UI requested them from the wrong path (/api/storage) and silently got the app shell instead; attachments and videos are served from the right place too. Files are also saved with their real format (Flux returns JPEG).
• 🎬 Video agents now really render — ask for a clip in any wording and the agent decides to shoot, writes the engine prompt itself (shot, motion, light) and shows the MP4. No more "I have no video engine" — and unsupported engines fall back to Leonardo with a logged warning instead of silently.

• 🎨 Graphic agents now really draw — ask for an image, sprite or asset in any wording and the agent decides to draw, writes the engine prompt itself (style, palette, transparent background…) and shows the result. No more "magic phrase". Also fixes engine auto using the chat model, and Leonardo engines saved as bare ids.
• 🛡️ No more raw tool-call markup in the chat — when a model leaks its internal tool syntax as an answer, HydraOps retries for a real reply and, failing that, shows a clear localized message.
• 🧟 Stuck tasks time out — a task assigned to a worker that never finishes is failed after 30 minutes with a localized notice, so agents stop showing "working" forever.
• 👥 Steadier startup — the "create your first agent" screen no longer flashes while the API is still booting after an update.
• 🔒 Security — Angular runtime packages bumped to 21.2.23 (three moderate advisories).

• 🧠 Perplexity joins the add-ons — agents can ask Perplexity (Sonar) and get a synthesized, up-to-date answer with cited sources. Paste your API key on its card and grant perplexity_search to your agents.
• 🏷️ Friendlier add-on cards — Web Search, Brave Search, Fetch URL, YouTube Transcript, Remember, Recall instead of technical ids.
• 🔴 Honest status dots — a dead worker shows red again; grey now means simply idle. The legend covers all four states.
• 🟢 Green dots finally turn off — opening an agent's chat marks its cron and Telegram results as read.
• 🔒 Security — patched sharp (high) and hono (transitive) vulnerabilities.

• 🧲 One Shot — new nodes and groups now appear at the centre of your current view, so they never spawn off-screen after panning or zooming.
• 📊 Chat — every agent reply now shows which LLM answered and what it cost in tokens, right next to the copy button (hover for the input/output split).
• 🔔 Telegram — reports finally render bold text and headings instead of raw markdown characters.
• 📰 fetch_url — when a page is behind bot protection (Cloudflare & friends), the agent now falls back to the site's RSS feed instead of giving up.
• 🔒 Security — patched multer (DoS via file-descriptor leak on aborted uploads).

• 🗂️ One Shot: group frames — drop nodes into a titled, colour-tinted frame (Substance style) and drag the whole group together; resize it, paint it from the palette, pull a node out to ungroup it.
• ✨ One Shot: cleaner connections — curves replace the overlapping right-angle lines, always leaving and entering perpendicular to their dot, and Clear now asks before wiping the canvas.
• 📈 Diagrams in chat — agents can answer with real Mermaid diagrams (flowcharts, sequences, pies, timelines) rendered right in the conversation, in both themes.
• 🧠 Smarter scheduled runs — cron tasks no longer see old chat history, so agents stop accidentally re-executing stale instructions from days ago.

• 🔎 recall — agents can now search their own past conversations, remembering things beyond the recent history.
• 🌱 Better defaults — new agents are born with web search, page reading, remember and recall already granted; everything else stays off until you allow it.
• 🎨 One Shot polish — pick an icon for each node and paint node headers from a 24-colour palette; create several connections from the same dot.
• 📚 Manual caught up — agents, add-ons and plugins pages now match the app; transitive dependency vulnerabilities patched.

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.8...v0.1.9

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.7...v0.1.8

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.6...v0.1.7

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.5...v0.1.6

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.4...v0.1.5

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.2...v0.1.3

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.1...v0.1.2

Full Changelog: https://github.com/TraX22/HydraOps/compare/v0.1.0...v0.1.1

Full Changelog: https://github.com/TraX22/HydraOps/commits/v0.1.0