Skip to content

Lens Agents release notes#

Versions of the Lens Agents platform Helm chart, newest first.

helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reuse-values --wait

Database migrations run at startup. Sandboxes keep running across an upgrade and reconnect when the new server process is ready.

0.26.0 — 25 August 2026#

Two themes: a managed-inference backend billed on what it actually charged, and policy rules that can name the caller.

OpenRouter is available as a managed-inference backend. Set inference.openrouter.token and a project's policy can select openrouter — one API key in front of roughly 400 models from around 60 vendors, with no cloud account, IAM, or region decision first. Both wire formats are served off that key — the Anthropic Messages API, and OpenAI chat completions, responses, and embeddings — and unlike Foundry or Bedrock Mantle the two surfaces are not model families: an agent speaking the Anthropic API can drive a Gemini or Llama model. Choosing the model is the agent's job, per request — inference.openrouter.model seeds a starting model only, and policy environment still overrides it. See Inference providers.

Agents are told which backend they were given. LENS_MANAGED_INFERENCE_PROVIDER and LENS_MANAGED_INFERENCE_MODEL are resolved for each sandbox, so a template authored before anyone picked a provider follows a later policy edit instead of pinning Bedrock. The backends a deployment cannot serve are shown as unavailable in the admin UI picker rather than left out of it.

OpenRouter is billed on what it charged, not on a rate card. OpenRouter states its cost on every request, streamed or not, and that figure is now what cost aggregation and the spending-limit reconciler use. Models absent from the vendored rate card — openrouter/auto and openrouter/fusion among them, which is where a policy naming no model routes — previously metered as zero and were invisible to the cap entirely. Where a request reports no cost, its tokens are still priced from the table, so the other backends are unaffected.

A sandbox whose spend escapes metering says so. Metering happens at the managed-inference endpoint, so a sandbox dialling a provider directly writes no usage record and contributes nothing to its spending limit — a cap set on it reads as a cap on its spend and is not. A card on the sandbox names the hosts, presents the call count as a floor, and points at the managed endpoint rather than a deny rule as the remedy. A sandbox's cost decisions also get a tab of their own, and the spend figures repeat on the Costs tab.

Policies can scope a route by caller binary and by GraphQL operation. A domain entry carries binaries and an HTTP rule carries graphql, both editable on a domain in the admin UI: admit git to a host but not another binary, or admit one GraphQL operation rather than the whole endpoint. Org ceilings compose both and only ever narrow — two callers meet at the binaries they share. nexusctl policy describe now shows every fence on a domain, not a subset.

The CLI installs from your own server. curl -fsSL https://agents.example.com/install.sh | sh verifies a checksum, installs a nexusctl built for the version of the server serving it, and writes ~/.nexus/config.json so later commands need no --server. Both routes are unauthenticated by design — you have no credentials until the CLI that obtains them exists — and an air-gapped site needs no package registry. See Set up the CLI.

Name the people who run the installation. config.ownerEmails names your owners, typically an IT department. On an installation that names them, only they may create organizations, and a signed-in person is admitted at all only if they belong to an org, may create one, or hold a pending invitation. That second rule matters behind a corporate identity provider, where every employee otherwise signs in and collects an account. Refusals are 403, and an empty list keeps the behaviour you have today.

Fixes:

  • A truncated stream is recorded as the failure it is. A stream that died part-way through carried the upstream's 200 into the audit trail and read as a success; it is now an error carrying streamTruncated, and the response body fails rather than ending as though complete, so an agent cannot act on a partial answer believing it whole. A caller that hangs up is still settled as caller-side.
  • Three pricing corrections and a refresh. A model variant suffix is priced as the model it serves, Bedrock cross-region inference profile ids are priced instead of metering zero, and model pricing was resynced from models.dev.
  • A partial policy edit merges instead of replacing. Updating one key of a sandbox's embedded policy no longer drops the keys the request did not mention — the server merges, and the admin UI sends only what you edited.
  • Four policy-fence corrections. A narrowing could slip past a fence; caller and request fences now union rather than shrink each other; a caller-binary path padded with whitespace is refused; and a binary must be an absolute path.
  • Credentials survive a rolling deploy, and existing OAuth consents are carried onto the unified credentials — an oauth-authorization-code actor is not silently sent back through "Authorize as me" after upgrade.
  • MCP tool names stay inside the 64-character budget, so a long connector name no longer pushes a tool out of reach of clients that enforce the limit.
  • Admin UI. Stop is allowed from creating and starting, so a wedged sandbox is recoverable; a sandbox that has not been checked reads differently from one that came back clean; and only the model block the platform owns is rewritten in a managed agent's config.yaml, leaving the rest parseable.

Cost accounting changes in this release

OpenRouter traffic is now billed on the provider's reported figure, models previously absent from the rate card start counting toward caps, and the models.dev refresh moves some rates in both directions. Review any spending limits set against pre-0.26.0 figures before upgrading.

0.25.0 — 17 August 2026#

Manage hosts from the blocked-requests card. When a sandbox request is blocked on host, the admin UI lets you allow or deny that host inline, without opening the policy editor separately.

The sandbox detail page is redesigned, and its destructive action carries its own outline so it reads as destructive at a glance.

Fixes:

  • Bedrock traffic is priced and attributed as Bedrock. It was priced against the wrong provider's rate card, and some of it was attributed to the wrong provider entirely. An explicitly-chosen provider now outranks a bare model alias when both could resolve a price.
  • Bedrock embeddings and other non-Anthropic shapes are metered instead of recording zero usage, along with a converse-stream metadata frame the meter previously ignored. Cached rates are no longer dropped, and a model-profile id is no longer mistaken for a model name.
  • Model pricing was resynced from models.dev. Several current models changed rate, some up and some down. Five older Anthropic aliases were dropped upstream; claude-3-opus, claude-opus-4-1, and claude-3-5-haiku keep their rates through a fallback entry, but claude-3.5-sonnet and claude-3-sonnet now resolve to no price.
  • A dropped deny entry no longer reads as drift. Where an org ceiling drops a deny rule, policy-binding list-drift reported drift on projects that had not changed.
  • Sandboxes ride out a longer outage. The ingress data tunnel retries indefinitely instead of giving up, so a sandbox reconnects on its own rather than needing a restart.

Cost accounting changes in this release

The Bedrock pricing, attribution, and embeddings-metering fixes all raise recorded cost toward your real invoice, and the pricing refresh moves some rates in both directions. Review any spending limits set against pre-0.25.0 figures before upgrading — and repoint any agent or model profile pinned to claude-3.5-sonnet or claude-3-sonnet, since unpriced traffic no longer counts toward its limit.

0.24.0 — 12 August 2026#

Realtime voice runs through the managed backend. OpenAI's realtime speech API is relayed over a WebSocket by the managed-inference backend, so an agent can hold a low-latency speech session. The path, bearer, project access, policy, and concurrency checks all run before the upstream connection opens, so a refused session never opens a billing connection. Each response writes an audit trail record in the same shape the HTTP path writes, attributed per response. Sandboxes need no new configuration — the OpenAI SDK derives its realtime URL from the base URL they already receive.

Two governance controls behave differently on a realtime session. Any project whose policy selects openai can open one. PII masking does not run: the session is served unmasked and every audit record carries piiMaskingSkipped, where the HTTP path fails closed. And because usage is reported only as the session runs, its spending limit is re-checked per response and closes the session once exceeded — it trails actual spend by roughly 90 seconds and acts as a backstop rather than a gate. Concurrent sessions are capped at eight per project, counted per replica and not exposed as a Helm value.

Fixes:

  • Cached OpenAI tokens are no longer billed twice, and audio is metered. OpenAI reports token details as a breakdown of the totals, not an addition, so a cached prompt token was charged the input rate and the cache-read rate together. Recorded cost for existing OpenAI traffic drops accordingly. Audio is now a metered dimension of its own; where a model publishes no audio rate it is charged at that model's text rate.
  • First-party model prices take precedence over aggregator entries. An aggregator entry owned the pricing key for gpt-realtime-2.1 and carried no audio rates, so audio was priced at the text rate of $4/$24 per million against OpenAI's $32/$64. Reported cost for realtime and audio workloads rises to match the provider's invoice.

If you run OpenAI workloads

Both billing fixes move recorded cost, in opposite directions — cached-token cost drops, realtime and audio cost rises. Review any spending limits tuned against pre-0.24.0 figures before upgrading.

0.23.0 — 12 August 2026#

OpenAI is available as a managed-inference backend. A deployment holding its own OpenAI platform account can select openai as a managed-inference provider. Set an OpenAI API key and the platform key replaces the agent's bearer token upstream, with metering, spending limits, PII masking, and audit behaving as they do for the other backends. This backend serves GPT only — installs that need both model families keep choosing Foundry or Bedrock Mantle.

The OpenAI endpoint is configurable. inference.openai.baseUrl points the backend at any OpenAI-compatible endpoint — a corporate gateway, LiteLLM, a self-hosted server. The agent's request path is appended to the root unchanged. The root must be https, and it needs an API key beside it: the chart rejects an endpoint set on its own.

Only metered paths are proxied. The backend serves chat completions, responses, and embeddings; any other path answers 404 and names the set it does serve. Batches, fine-tuning, and uploads bill the provider key but report no token usage, so proxying them would let a sandbox spend past its spending limit.

Fixes:

  • PII masking skips multipart uploads. Masking parses a request body as JSON, so an audio, file, or image upload failed closed as an opaque 500. Such requests now reach the provider unmasked, recorded in the audit trail as piiMaskingSkipped. The skip is multipart only.
  • Model pricing refreshed. The table picks up newly published models. No existing rate changed.

0.22.0 — 11 August 2026#

Sandboxes record what they were given. Each sandbox keeps a record of the policies, credentials, and configuration it was provisioned with, so an investigation can answer "what did this agent actually have" without reconstructing it from history.

Fixes:

  • Model pricing refreshed, so usage costs and spending limits reflect what you are really being billed.
  • Admin UI. The sandbox list answers common questions inline, and breadcrumbs are built from the URL rather than guessed from name fragments — so deep links and names containing slashes behave.

0.21.0 — 10 August 2026#

The largest release in this series. Two themes: sandboxes that carry their own governance, and a much faster PII engine.

Sandbox-owned policies and credentials. A sandbox can carry its own embedded policy and its own credentials, created atomically with the sandbox and deleted with it. Use it for the one domain a single agent needs, without adding a policy to the shared catalog that every other team then has to reason about. Sandbox-owned credentials support the same header injection as project credentials.

Author sandboxes as YAML. nexusctl sandbox create -f sandbox.yaml drives the whole sandbox from a spec file, and the admin UI gained YAML authoring for sandboxes and policies. This is what makes an agent's configuration reviewable in git.

See the effective policy. A read-only effective-policy view shows what a sandbox's merged, ceiling-clipped policy actually resolves to — the fastest answer to "why can my agent not reach X".

PII masking is substantially faster. Named-entity recognition runs in a pool of child processes with per-project result caching and batched cache-miss detection. Long-running agents that send similar prompts repeatedly see the largest improvement.

Fixes:

  • Connector credential handling hardened. Header reconciliation is now non-destructive, connector secrets are stored as proper credential values, and a header format that would embed a secret inline is masked rather than displayed.

If you use connectors with header credentials

Header formats that contained a secret inline are backfilled into templates on upgrade. Review your connector credentials afterwards and confirm each one still reads the way you expect.

0.20.1 — 31 July 2026#

Org ceilings intersect HTTP rules. Where an org policy and a project policy both carry HTTP method and path rules, the effective rules are now the intersection rather than the union. This is a correctness fix with real consequences: a project can no longer widen the org ceiling's HTTP rules by adding its own.

Review policy-binding list-drift after upgrading. Projects that were unintentionally relying on the previous behaviour will show as clipped.

Masked PII is restored in tool-call arguments, so an agent receives usable values back from a masked round trip.

Database sessions are pinned to UTC, which fixes charts and time-bucketed queries drifting for installs in non-UTC regions.

0.20.0 — 30 July 2026#

PII masking fails closed, properly. A dead masking worker now returns 503 rather than forwarding unmasked content, and it does so even when the policy sets failOpen. An infrastructure failure is not a licence to leak.

Exec across replicas. Sandbox exec and terminal sessions route correctly on multi-replica installs, so interactive sessions no longer depend on reaching the right pod.

0.19.1 – 0.19.3 — 27–29 July 2026#

Stability and isolation fixes.

  • Credential domains no longer grant egress. Attaching a credential for a domain no longer implicitly allows the sandbox to reach it. A policy must allow the domain explicitly. Check your policies after upgrading — an agent that relied on the implicit grant will start being denied.
  • Sandbox principals get a real Kubernetes impersonation identity, so cluster-side audit names the agent.
  • Idle-connection and job-queue errors no longer crash the process.
  • The cluster relay forwards real upstream 101 headers, fixing protocol upgrades over the tunnel.

0.19.0 — 22 July 2026#

Agents can read their own spend. A sandbox identity can query its own spending status and usage over MCP, scoped to itself. A well-behaved agent can wind down before it hits its cap rather than being cut off mid-task.

Sandbox cost and limit reads are force-scoped to the calling sandbox, and a malformed sandbox context is denied instead of falling back to an org-wide read.

0.18.0 — 22 July 2026#

Per-sandbox CPU and memory, with a ceiling. Every sandbox declares its own resources, bounded by an install-wide ceiling. A request above the ceiling is rejected rather than silently clipped, and the ceiling is validated at startup.

Breaking change

cpu and memory are now required on sandbox creation. Update any automation that creates sandboxes without them. Set the install ceilings with sandbox.k8s.cpu and sandbox.k8s.memory. See Install on Kubernetes.

Project admins can manage project-scoped resources, and API tokens with project admin get the full sandbox tool set over MCP.

Connector credentials are selectable inline on a policy's connector row in the admin UI.

0.17.0 — 17 July 2026#

Chiefly a PII masking release, and a substantial one.

Masking covers far more of a request. The top-level system prompt, tool-call arguments in chat history, document title and context, refusal and JSON tool-result content, and array-shaped function-call output are all masked now. Structural metadata is deliberately left alone, so masking no longer breaks request shapes.

Long inputs are handled honestly. Named-entity recognition runs over a sliding window with a bounded budget, and coverage truncation is reported per call rather than passing silently. Over-budget fields are truncated to keep masking complete.

Signed thinking content is never rehydrated on the response side.

Sandbox tokens are pinned to their project, closing a cross-project access path.

0.16.0 – 0.16.1 — 10–13 July 2026#

Bedrock Mantle is available as a managed-inference backend, serving both Claude and GPT off the same Bedrock key. It appears automatically when a Bedrock token is configured.

PII propagation is faster and safer. The propagation sweep is a single-pass Aho-Corasick scan with bounded memory, deterministic results, and fail-closed behaviour on long text.

0.15.0 — 9 July 2026#

Response-streaming correctness for exposed ports and the cluster tunnel: chunked responses are dechunked correctly, hop-by-hop framing headers are stripped, stale Content-Length headers are dropped, and ingress streaming has backpressure and an idle deadline.

If an agent's web UI behaved oddly behind the sandbox ingress before, this release is the fix.

0.14.0 — 8 July 2026#

Microsoft Foundry managed inference. Claude on the Anthropic Messages API and GPT on both Chat Completions and the Responses API, from one Foundry resource and key. Streaming usage is metered, so spending limits apply to streamed responses too.

The proxy enforces the policy's provider selection at the boundary: a policy naming a provider the install has not configured is refused rather than quietly falling back. See Inference providers.

0.13.0 — 7 July 2026#

The symmetric org and project policy model. This is the release that introduced org policies as a ceiling rather than a default, with a sandbox policy-clip report and an effective-policy readout so clipping is visible instead of mysterious.

Connector tools inside agent sandboxes. A project's connectors are exposed as MCP tools within agent sandboxes, so an agent reaches them the same way whether it runs inside the platform or connects from outside.

The audit trail resolves sandbox names and surfaces PII masking status, so entries read as something other than a wall of identifiers.

0.12.0 — 2 July 2026#

On-prem activation. The device-flow activation shipped in the chart, along with air-gapped license-file activation for installs that must never reach Lens Cloud. activation.apiUrl defaults to production Lens Cloud.

Sandbox templates for well-known agents, and egress policy templates for common domains, so a first agent does not start from an empty form.

Per-sandbox spend and spending limits are visible in the admin UI.

Earlier releases#

Versions 0.7.0 through 0.11.0 (May and June 2026) built out identity, RBAC, the audit trail, connectors, and the sandbox runtime ahead of the on-prem chart.

Upgrading#

  1. Read the notes for every version between yours and the target, not only the newest — the breaking changes above are cumulative.
  2. Back up the database.
  3. helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reuse-values --wait
  4. Run nexusctl policy-binding list-drift --org <org> afterwards. Policy-resolution fixes are the changes most likely to alter what your agents can reach.

Planning an upgrade across several versions, or running an air-gapped install? Talk to us.