Skip to content

Lens Agents release notes#

Versions of the Lens Agents platform Helm chart, newest first.

helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reset-then-reuse-values --wait

Database migrations run at startup. Sandboxes keep running across an upgrade and reconnect when the new server process is ready.

0.31.0 — 8 October 2026#

Teams are replaced by project roles given straight to people and API tokens, idle sandboxes can stop and delete themselves, and the forward proxy holds every CONNECT to the sandbox's policy.

Project members. An org admin gives an org member or API token ADMIN or MEMBER on a project from the new Members page, nexusctl project member set, /v1/projects/{projectId}/members, or the set_project_member MCP tool. Changes are audited as project-member. See Project members.

Sandbox timers. --auto-stop 30m stops an idle sandbox, --auto-delete 1d deletes a stopped one with its volume, and --auto-start starts an auto-stopped sandbox again on the next exec, terminal, or private-port request. Set them on create, in a spec file, or in the UI, and change them with nexusctl sandbox update without a restart. Timers are opt-in. See Stop and delete idle sandboxes.

Sandbox restart. POST /v1/projects/{projectId}/sandboxes/{sandboxId}/restart or the restart_sandbox MCP tool re-provisions the active revision, or starts a stopped sandbox. See Restart.

Policy drift shows what the org ceiling removed. drift.narrowedDomains, drift.blockedDomainDetails, and the sandbox Policy tab. See Policy bindings.

Exposed ports. sandboxIngress.corsOrigins lets browser apps on other origins call private ports with a bearer token. The session cookie now counts only on requests from the sandbox's own private-port origins. Public ports now receive the Authorization header. See Exposed ports.

Install and inference.

  • config.maxHeaderBytes sets the largest request header block, default 32768.
  • A policy with no provider gets Bedrock where available, otherwise the first backend the install serves with its own key. GET /v1/inference/providers reports it as defaultProvider.
  • OAuth catalog entries take an optional manageAccessUrl. See OAuth applications.
  • The client API can serve an agent-facing MCP at /mcp/client (bff.clientMcp.url) and forward each person's own token with bff.nexusAuth=forward.

Fixes:

  • GitHub connector sign-ins and refreshes work.
  • Claude Code and Codex finish signing in instead of failing with an issuer mismatch.
  • Multi-replica installs behave as one: MCP sessions and cluster tunnels work across replicas.
  • Re-applying an unchanged spec no longer restarts a sandbox.
  • A sandbox in error starts recovering at once.
  • Public port hostnames stay reachable after the sandbox's data tunnel drops.
  • Status 204, 205, and 304 responses pass through instead of becoming 502.
  • Model pricing was refreshed. Claude Haiku 5.5 is priced.

Before you upgrade

  • Back up the database. The upgrade converts teams to project roles and drops them, irreversibly. Each principal keeps its highest role per project.
  • Rebind cluster RBAC. Users and API tokens now arrive with <org>/<project> and <org>/<project>:admin or :member in place of <org>/<team>. A binding on <org>/<project> now also covers everyone with a role on that project.
  • Move scripts off team surfaces. nexusctl team, the team routes and MCP tools, and the Teams pages are removed.
  • Allow <public URL>/oauth/callback on an oidc.clientId you provisioned yourself. Loopback sign-ins, such as Claude Code and Codex, now use it with PKCE S256.
  • Check forward-proxy traffic. A CONNECT to a host the policy does not route upstream is now refused with 403 and audited. Add hosts agents still need to their policy.
  • Bedrock without a token is offered only when the AWS credential chain finds credentials at boot. Override with inference.bedrock.ambientCredentials. See AWS Bedrock.

0.30.0 — 2 October 2026#

Organizations can bring their own inference keys, the API can require a realm role, and the project shell sandbox is replaced by agent sandboxes.

Org inference keys. An org admin sets the org's own key for a backend on the new Inference Keys page or with PUT /v1/orgs/{orgId}/inference/keys/{source}. The org's key takes priority over the install's. Every deployment token is now optional; inference.deploymentKeyFallback (default true) decides whether organizations without a key use the install's. See Inference providers.

The Inference Keys page: one row per key source the install serves, here AWS Bedrock, Azure, OpenAI, and OpenRouter, with the backends each key serves, whether it uses the platform default or is not configured, and a button to add an org key.

Direct-access gate. With oidc.directAccessRole set, only people with that realm role can use the admin UI, nexusctl, the REST API, or an MCP client directly. It is off by default; roll it out with oidc.directAccessReportOnly: true first. See SSO.

Client API subchart. bff.enabled=true installs the Lens Agents client API on its own public host, with per-person token exchange (Keycloak 26.2 or later). See Client API.

OAuth and credentials.

  • config.upstreamOAuthAdditionalRedirectUris lists extra redirect URIs a project admin can allow on an OAuth Login credential. See Allow extra redirect URIs.
  • A credential can hold an OAuth client (OAuth client credentials); the platform mints and renews the token outside the sandbox. See Credentials.
  • Prism Agent connects to Microsoft Teams.

CLI. nexusctl sandbox run runs one command in a new sandbox (--rm deletes it afterwards), and nexusctl sandbox cp copies files to and from a sandbox. See CLI reference.

GPT-Live voice sessions are proxied for policies that grant openai or azure, like Realtime.

Fixes:

  • Google connections stay signed in when the shared OAuth application sets "accessType": "offline" and "prompt": "consent".
  • The forward proxy refuses internal targets: loopback, link-local (cloud metadata included), and the server's own address.
  • One admin UI session across tabs.
  • New Hermes Agent and OpenClaw sandboxes default to Claude Opus 5.5, except on LiteLLM.
  • Model pricing was refreshed. Claude Sonnet 5.5 and the GPT-6.1 Sol family are priced.

Before you upgrade

  • Pin a model. The platform no longer sets ANTHROPIC_MODEL in sandboxes, and the inference.*.model Helm values are removed. Set ANTHROPIC_MODEL in the policy env.
  • Recreate Hermes Agent sandboxes created before 0.30.0, or set LENS_MANAGED_INFERENCE_MODEL in the policy env until you do.

  • Move off the shell sandbox. nexusctl shell exec, POST /v1/shell/exec, the shell-session endpoints, and the shell_* MCP tools are removed. Use nexusctl sandbox run --rm or sandbox exec, and drop sandbox.image, sandbox.k8s.workspaceStorageClass, and sandbox.k8s.activeDeadlineSeconds from your values. Delete the old shell workspaces when you no longer need them:

    kubectl get pvc -n <sandbox-namespace> -o name | grep '/sandbox-workspace-' | xargs kubectl delete -n <sandbox-namespace>

  • Verify owner emails. An address in config.ownerEmails is refused when its token says email_verified: false.

  • /oauth/token relays only interactive grants: authorization_code, refresh_token, and the device-code grant. Others get 400.

0.29.0 — 28 September 2026#

Your own LiteLLM proxy as a managed-inference backend, and OAuth applications configured once for the whole install.

LiteLLM backend. Point the install at your LiteLLM proxy with inference.litellm.baseUrl and a token, and select it in a policy with provider: litellm. Sandboxes get both wire formats. Spend is the cost LiteLLM reports; a call with no reported cost counts zero against spending limits, so price every model in LiteLLM and set include_cost_in_streaming_usage. inference.litellm.forwardTags=true tags each call with its project. See Inference providers.

Microsoft Foundry serves Realtime voice sessions for policies that grant azure. See Realtime voice sessions.

OAuth Login applications for every organization. An operator stores a JSON catalog of OAuth clients in a Secret (oauthApplications.existingSecret), and project admins pick an application in a connector's Authentication dropdown. The catalog is read at startup; restart every replica after an edit. See MCP connectors.

agent-sandbox runtime. sandbox.provisioner=kubernetes-agent-sandbox runs each sandbox as a kubernetes-sigs/agent-sandbox Sandbox. Install the controller first, and stop every sandbox before you switch. See Sandbox runtime.

Private ports identify the caller with x-forwarded-user-id and x-forwarded-user-display-name (percent-encoded).

ADDRESS is a PII masking type again. Re-add it to policies that should mask street addresses.

Fixes:

  • A saved OAuth scope can be cleared with "scope": null.
  • OAuth Login forms are consistent across the connector and credential dialogs.
  • The Prism Agent template uses Microsoft Foundry as the voice backend and sets EXIT_ON_UPDATE=1.
  • Model pricing was refreshed. Claude Opus 5.5 and the GPT-6 Luna and Sol families are priced.

0.28.0 — 16 September 2026#

A sandbox can hold more than one inference backend, and admins can read and repair header formats.

Multiple inference backends per sandbox. A policy names a primary in managedInference.provider and every enabled backend in managedInference.providers. Each backend gets its own endpoint and placeholder credential under LENS_INFERENCE_<PROVIDER>_*, and all are metered against the same spending limits. The agent chooses between them; restart a running agent after you change its providers. The admin UI authors the list from the sandbox template. See Inference providers.

Project admins can read header formats in their own project, so a format masked as [REDACTED] can be inspected and rotated. See Injection.

Header formats accept Basic-auth literals. {base64:<prefix>{value}} and the usernames x-access-token, oauth2, and x-token-auth let one GitHub PAT serve both api.github.com and git-over-HTTPS.

MCP connector OAuth providers are discovered from RFC 9728 protected-resource metadata, falling back to origin discovery. When a provider changes its issuer or resource, create a new authorization-code credential and move the connector's policies to it.

Deleting a project keeps its audit and billing history, so organization totals do not change. Deleting an organization still erases its history. See Audit trail.

Fixes:

  • A healthy sandbox is no longer failed for landing on another replica.
  • A blocked project or organization delete answers 409 naming what to remove, instead of 500. Repoint automation that retried the 500.
  • A stopped sandbox's spec can be corrected, and a new revision can be promoted straight to active.
  • Provisioning claims survive a lost replica.
  • Slack calls from a template authenticate. An injection can name a urlencoded body field.
  • Credential dialog corrections.
  • Model pricing was refreshed.

0.27.0 — 3 September 2026#

Project and organization overview. Counts of sandboxes, policies, and credentials, 30-day inference spend, and daily spend by sandbox, model, or provider.

The project overview page: tiles for sandboxes, policies, credentials, and 30-day LLM cost, above a daily spend chart broken down by sandbox and a card splitting cost into input, output, cache read, and cache write.

Emergency halt. Cut network access stops managed inference, connector calls, both proxies, and Kubernetes exec, attach, and port-forward for a whole organization, and pushes a deny-all policy to every sandbox. Sandboxes keep running. Admin UI and REST API only. See Emergency halt.

The confirmation dialog for cutting network access, naming the organization, listing what stops, and requiring a reason.

Up to four exposed ports per sandbox, each with its own auth. Sandboxes created before the upgrade serve one port until they restart. See Exposed ports.

Requests arrive with the browser's own Host header.

Spending limits can name a project. Org and project limits are set by an org admin; a project admin can cap a sandbox. See Spending limits.

GraphQL policy rules can bound arguments with a JSON pointer and a glob. See Binding a GraphQL operation to a subject.

Prompt cache costs appear on the cost card, with a cache hit rate.

A sandbox cost card, splitting 30 days of spend into input, output, cache read, and cache write, above a token-mix chart with a cache hit rate.

OpenClaw is a built-in sandbox template (2026.8.2). Hermes Agent moved to v2026.8.19.

The Create Sandbox menu in the admin UI, listing Custom sandbox, Prism Agent, Hermes Agent, and OpenClaw.

Fixes:

  • A credential and its header injection are written together.
  • OAuth client-credentials tokens are renewed before they expire.
  • Metered spend is attributed to the project's organization.
  • Five policy-resolution fixes. Re-run policy-binding list-drift after upgrading.
  • The audit trail attributes a request through several proxies to the original caller.
  • Audit-trail queries accept excludeReads=true.
  • MCP session recovery, tools/list_changed, and stdio fixes, and admin UI fixes.
  • Model pricing was refreshed.

Cost attribution changes in this release

Spend that was attributed to no organization now counts toward org totals and spending limits, and some rates moved. Review org-level limits before upgrading.

0.26.0 — 25 August 2026#

OpenRouter backend. Set inference.openrouter.token and a policy can select openrouter: one key for many vendors' models, served in both the Anthropic and OpenAI wire formats. It is billed on the cost OpenRouter reports. See Inference providers.

Agents are told which backend they were given in LENS_MANAGED_INFERENCE_PROVIDER and LENS_MANAGED_INFERENCE_MODEL.

Unmetered spend is flagged. A sandbox that calls a provider directly, outside managed inference, shows a card naming the hosts, because that spend escapes its spending limit.

Policies can scope a route by caller binary and by GraphQL operation, with binaries on a domain and graphql on an HTTP rule. Org ceilings only narrow them.

The CLI installs from your own server. curl -fsSL https://agents.example.com/install.sh | sh installs a matching nexusctl. See Set up the CLI.

Installation owners. config.ownerEmails limits who may create organizations; other people are admitted only with an org or an invitation. See SSO.

Fixes:

  • A truncated stream is recorded as an error (streamTruncated) in the audit trail, and the response fails.
  • Pricing corrections: model variant suffixes and Bedrock cross-region profile ids are priced.
  • A partial policy edit merges instead of replacing the embedded policy.
  • Four policy-fence corrections. A binary must be an absolute path.
  • Credentials survive a rolling deploy, and OAuth consents carry over to credentials.
  • MCP tool names stay within 64 characters.
  • Admin UI: stop works from creating and starting.

Cost accounting changes in this release

OpenRouter is billed on its reported cost, models missing from the rate card now count toward caps, and some rates moved. Review spending limits before upgrading.

0.25.0 — 17 August 2026#

Allow or deny a blocked host from the blocked-requests card, without opening the policy editor.

The sandbox detail page is redesigned.

Fixes:

  • Bedrock traffic is priced and attributed as Bedrock.
  • Bedrock embeddings and other non-Anthropic shapes are metered instead of recording zero.
  • Model pricing was resynced. claude-3.5-sonnet and claude-3-sonnet now have no price.
  • A dropped deny entry no longer reads as drift in policy-binding list-drift.
  • The ingress data tunnel retries indefinitely, so a sandbox reconnects after a long outage.

Cost accounting changes in this release

Recorded Bedrock cost rises toward your real invoice. Review spending limits before upgrading, and repoint anything pinned to claude-3.5-sonnet or claude-3-sonnet, because unpriced traffic does not count toward limits.

0.24.0 — 12 August 2026#

OpenAI Realtime voice sessions run through managed inference over a WebSocket, with audit per response. PII masking does not run on them (piiMaskingSkipped), the spending limit is checked per response, and each project can hold eight concurrent sessions per replica.

Fixes:

  • Cached OpenAI tokens are no longer billed twice, and audio is metered.
  • First-party model prices take precedence over aggregator entries, so realtime audio is priced at OpenAI's rate.

If you run OpenAI workloads

Cached-token cost drops and realtime and audio cost rises. Review spending limits before upgrading.

0.23.0 — 12 August 2026#

OpenAI backend. Select openai as a managed-inference provider with an OpenAI API key; it serves GPT only. inference.openai.baseUrl points it at any OpenAI-compatible https endpoint. Only chat completions, responses, and embeddings are proxied, because other paths are not metered.

Fixes:

  • PII masking skips multipart uploads, recorded as piiMaskingSkipped in the audit trail.
  • Model pricing was refreshed.

0.22.0 — 11 August 2026#

Sandboxes record what they were given. Each sandbox keeps a record of the policies, credentials, and configuration it was provisioned with, so an investigation can answer "what did this agent actually have" without reconstructing it from history.

Fixes:

  • Model pricing refreshed, so usage costs and spending limits reflect what you are really being billed.
  • Admin UI. The sandbox list answers common questions inline, and breadcrumbs are built from the URL rather than guessed from name fragments — so deep links and names containing slashes behave.

0.21.0 — 10 August 2026#

Sandbox-owned policies and credentials. A sandbox can carry its own embedded policy and credentials, created and deleted with it.

Sandboxes as YAML. nexusctl sandbox create -f sandbox.yaml, and YAML authoring in the admin UI for sandboxes and policies.

Effective policy view. See what a sandbox's merged, ceiling-clipped policy resolves to.

PII masking is substantially faster.

Fixes:

  • Connector credential handling hardened. A header format with an inline secret is masked.

If you use connectors with header credentials

Header formats that contained a secret inline are converted on upgrade. Review your connector credentials afterwards.

0.20.1 — 31 July 2026#

Org ceilings intersect HTTP rules. Where an org policy and a project policy both carry HTTP method and path rules, the effective rules are now the intersection rather than the union. This is a correctness fix with real consequences: a project can no longer widen the org ceiling's HTTP rules by adding its own.

Review policy-binding list-drift after upgrading. Projects that were unintentionally relying on the previous behaviour will show as clipped.

Masked PII is restored in tool-call arguments, so an agent receives usable values back from a masked round trip.

Database sessions are pinned to UTC, which fixes charts and time-bucketed queries drifting for installs in non-UTC regions.

0.20.0 — 30 July 2026#

PII masking fails closed, properly. A dead masking worker now returns 503 rather than forwarding unmasked content, and it does so even when the policy sets failOpen. An infrastructure failure is not a licence to leak.

Exec across replicas. Sandbox exec and terminal sessions route correctly on multi-replica installs, so interactive sessions no longer depend on reaching the right pod.

0.19.1 – 0.19.3 — 27–29 July 2026#

Stability and isolation fixes.

  • Credential domains no longer grant egress. Attaching a credential for a domain no longer implicitly allows the sandbox to reach it. A policy must allow the domain explicitly. Check your policies after upgrading — an agent that relied on the implicit grant will start being denied.
  • Sandbox principals get a real Kubernetes impersonation identity, so cluster-side audit names the agent.
  • Idle-connection and job-queue errors no longer crash the process.
  • The cluster relay forwards real upstream 101 headers, fixing protocol upgrades over the tunnel.

0.19.0 — 22 July 2026#

Agents can read their own spend. A sandbox identity can query its own spending status and usage over MCP, scoped to itself. A well-behaved agent can wind down before it hits its cap rather than being cut off mid-task.

Sandbox cost and limit reads are force-scoped to the calling sandbox, and a malformed sandbox context is denied instead of falling back to an org-wide read.

0.18.0 — 22 July 2026#

Per-sandbox CPU and memory, with a ceiling. Every sandbox declares its own resources, bounded by an install-wide ceiling. A request above the ceiling is rejected rather than silently clipped, and the ceiling is validated at startup.

Breaking change

cpu and memory are now required on sandbox creation. Update any automation that creates sandboxes without them. Set the install ceilings with sandbox.k8s.cpu and sandbox.k8s.memory. See Install on Kubernetes.

Project admins can manage project-scoped resources, and API tokens with project admin get the full sandbox tool set over MCP.

Connector credentials are selectable inline on a policy's connector row in the admin UI.

0.17.0 — 17 July 2026#

Chiefly a PII masking release, and a substantial one.

Masking covers far more of a request. The top-level system prompt, tool-call arguments in chat history, document title and context, refusal and JSON tool-result content, and array-shaped function-call output are all masked now. Structural metadata is deliberately left alone, so masking no longer breaks request shapes.

Long inputs are handled honestly. Named-entity recognition runs over a sliding window with a bounded budget, and coverage truncation is reported per call rather than passing silently. Over-budget fields are truncated to keep masking complete.

Signed thinking content is never rehydrated on the response side.

Sandbox tokens are pinned to their project, closing a cross-project access path.

0.16.0 – 0.16.1 — 10–13 July 2026#

Bedrock Mantle is available as a managed-inference backend, serving both Claude and GPT off the same Bedrock key. It appears automatically when a Bedrock token is configured.

PII propagation is faster and safer. The propagation sweep is a single-pass Aho-Corasick scan with bounded memory, deterministic results, and fail-closed behaviour on long text.

0.15.0 — 9 July 2026#

Response-streaming correctness for exposed ports and the cluster tunnel: chunked responses are dechunked correctly, hop-by-hop framing headers are stripped, stale Content-Length headers are dropped, and ingress streaming has backpressure and an idle deadline.

If an agent's web UI behaved oddly behind the sandbox ingress before, this release is the fix.

0.14.0 — 8 July 2026#

Microsoft Foundry managed inference. Claude on the Anthropic Messages API and GPT on both Chat Completions and the Responses API, from one Foundry resource and key. Streaming usage is metered, so spending limits apply to streamed responses too.

The proxy enforces the policy's provider selection at the boundary: a policy naming a provider the install has not configured is refused rather than quietly falling back. See Inference providers.

0.13.0 — 7 July 2026#

The symmetric org and project policy model. This is the release that introduced org policies as a ceiling rather than a default, with a sandbox policy-clip report and an effective-policy readout so clipping is visible instead of mysterious.

Connector tools inside agent sandboxes. A project's connectors are exposed as MCP tools within agent sandboxes, so an agent reaches them the same way whether it runs inside the platform or connects from outside.

The audit trail resolves sandbox names and surfaces PII masking status, so entries read as something other than a wall of identifiers.

0.12.0 — 2 July 2026#

On-prem activation. The device-flow activation shipped in the chart, along with air-gapped license-file activation for installs that must never reach Lens Cloud. activation.apiUrl defaults to production Lens Cloud.

Sandbox templates for well-known agents, and egress policy templates for common domains, so a first agent does not start from an empty form.

Per-sandbox spend and spending limits are visible in the admin UI.

Earlier releases#

Versions 0.7.0 through 0.11.0 (May and June 2026) built out identity, RBAC, the audit trail, connectors, and the sandbox runtime ahead of the on-prem chart.

Upgrading#

  1. Read the notes for every version between yours and the target, not only the newest — the breaking changes above are cumulative.
  2. Back up the database.
  3. helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reset-then-reuse-values --wait
  4. Run nexusctl policy-binding list-drift --org <org> afterwards. Policy-resolution fixes are the changes most likely to alter what your agents can reach.

Planning an upgrade across several versions, or running an air-gapped install? Talk to us.