Prism Agent release notes#
Releases of the Prism Agent image, newest first. Releases are tagged vYYYY.M.DDHHMMSS — the timestamp of the build — and that tag is the pullable image tag.
v2026.9.16141000 — 16 September 2026#
The agent can now use the computer in a chat. Ask for website or desktop work in chat, in a goal or in a scheduled task, then open Computer in the web UI to watch it, and work continues after you leave the page. Click the screen to take the pointer and keyboard, and press Esc or Return control to hand it back.
The agent can ask you to finish a step it cannot do. When a sign-in, a CAPTCHA or a device approval blocks it, it sends a help request linking to Computer, where you click the screen, complete the step and press Esc or I'm done to let the original request continue. Dismiss closes a request the agent should stop waiting on, and other work keeps running on connectors and shell tools while the desktop is blocked.
Voice now resolves its own OpenAI Realtime endpoint, independently of the chat provider. A deployment on Bedrock or Azure uses Lens-managed OpenAI for voice chat and meetings when LENS_INFERENCE_OPENAI_BASE_URL and LENS_INFERENCE_OPENAI_API_KEY are injected, so audio rides Lens metering and no OPENAI_API_KEY is needed to register the meeting tools. OPENAI_REALTIME_URL and OPENAI_REALTIME_API_KEY override that resolution, and OPENAI_API_KEY remains the direct-to-OpenAI fallback.
A meeting join that fails now reports the reason and the step that failed. A link that would not load, a lobby that refused and a container with no microphone all answered with the same "a host needs to admit me" message before; the wait for a host is unchanged, so ask for meeting status to find out whether the agent got in. Joins also work again on a host that cannot reach www.google.com.
v2026.9.15100101 — 15 September 2026#
Adds a Computer page where the agent has a desktop of its own. Open Computer from the web UI sidebar and a voice call starts with your microphone muted, showing the agent's screen while it uses a browser, a terminal or a file manager; click the screen to take the pointer and keyboard, press Esc to give them back, and Share screen to show the agent your own screen. The page needs OPENAI_API_KEY, and a call here is refused while another call already holds the agent's voice.
Every identity document on the Profile page is now editable. Soul, User, Memory, Vision, Heartbeat and Bootstrap were read-only viewers; each tab now has the editor the Agent guide had, with an optional note about what changed that the version history keeps.
The agent acts on an untagged instruction in a thread it is already in. An approval or a "go ahead" posted in Slack without a mention now starts the work instead of getting only an emoji, and a colleague tagged earlier in the thread no longer stops the agent reading a later message meant for it.
A meeting agent stops signing in to Google on every join. It checks the stored session before starting a login, and quits the browser cleanly so the session survives a teardown.
Fixes the Windows installer putting the agent's shell workspace outside the install directory. It now creates workspace under PRISM_HOME and passes SHELL_WORKSPACE_ROOT to the scheduled task, as the macOS and Linux installers already did.
Also in this release: 23 dependency advisories are closed across 11 packages; and the Slack account-linking messages name Prism Agent and the agent that is about to answer you.
v2026.9.11082951 — 11 September 2026#
Identity documents now keep a version history. Each document on the Profile page has a Version history sidebar listing saved revisions with their change notes, authors and dates, and Compare versions diffs a saved version against the current document or against another saved version. Restore this version puts a version back after a confirmation, keeping the latest 500 revisions per document; restoring the Heartbeat document also restarts the heartbeat.
Codex can authenticate with a saved login. A delegated coding task on Codex now reads CODEX_API_KEY, then OPENAI_API_KEY, then an auth.json in CODEX_HOME, then Bedrock credentials — so an existing codex login works with no API key set. Point CODEX_HOME at that writable login directory before starting the agent; unset, it is .codex under the data directory.
A delegated coding task can pick a model tier and reasoning effort. coding_agent takes an optional model (small, medium, large) and effort (low, medium, high), on a new task or a resumed session, and you can ask for either in words; omitting them keeps the model and effort the deployment is configured with. Operators can point a tier at a different model with CLAUDE_CODE_MODEL_SMALL, _MEDIUM and _LARGE (haiku, sonnet, opus) and CODEX_MODEL_SMALL, _MEDIUM and _LARGE (gpt-5.6-luna, gpt-5.6-terra, gpt-5.6-sol).
v2026.9.8130916 — 8 September 2026#
You can now talk to the agent from the web UI. A microphone button in the chat composer of the web UI starts a voice chat and the same button ends it, with a mute button beside it while the call runs; the only requirement is OPENAI_API_KEY. Nothing said in a call is written into the thread, and a call is refused while a Meet call is live; the terminal UI has no voice control.
Adds Codex as an alternative coding sub-agent. CODING_AGENT selects claude-code or codex for delegated coding tasks, and a single task can override it; unset, the agent uses Claude Code, or Codex when only an OpenAI key or Bedrock credentials are present. The tools are renamed coding_agent, coding_agent_status and coding_agent_stop, so an Agent Guide or risk-gate rule matching on the old claude_code names has to be updated.
A heartbeat alert is no longer dropped when the turn ends on a tool call. The delivered text is the last thing the agent wrote rather than the text of the final step, which could be empty after a tool result. This covers scheduled heartbeats and Slack-triggered ones.
Also in this release: the Docker image ships the Codex CLI alongside Claude Code, and a native install that wants Codex needs npm install -g @openai/codex.
v2026.9.7112900 — 7 September 2026#
The runtime now listens on this machine only. PRISM_HOST names the interface it binds and defaults to 127.0.0.1, so an install other machines reached over the network needs PRISM_HOST=0.0.0.0 to keep answering them, while ::1 serves clients that arrive over IPv6 loopback; the Docker image already sets 0.0.0.0, so a published port works as before. Every request and the /api/ws handshake are also checked against the address the browser used, which closes the path where a page on another site opened the chat socket and talked to the agent as you. A request arriving through a proxy in front is recognised by its X-Forwarded-Host header and still passes.
A new Activity page shows what the agent spent and what it ran. It sits after Profile in the web UI sidebar: token totals for the last 24 hours — input, output and cache reads, with the cache hit percentage — and every tool call the agent has recorded, newest first, across chat, Slack, heartbeat and scheduled runs. Expand a call to read the parameters it was given.
An explicit endpoint override now outranks the Lens Agents gateway. OPENAI_BASE_URL, OPENROUTER_BASE_URL, AZURE_FOUNDRY_BASE_URL and BEDROCK_MANTLE_BASE_URL were read and then ignored whenever NEXUS_API_URL was set; each now wins over the gateway mount, for chat, classification and embeddings alike. An endpoint that is not on the gateway host needs a real vendor key, because the gateway holds the credential only for its own host. The [Startup] LLM provider log line reports the resolved endpoint and whether it came from an override, the gateway or a direct vendor host.
v2026.9.3101535 — 3 September 2026#
Native installs update themselves. A packaged install under ~/.prism, run by launchd, systemd or a scheduled task, checks for a new release every hour, applies it between turns and restarts the background service; prism update and the /update command in the web and terminal UIs do it on demand. DISABLE_UPDATER=1 turns off the checks, the automatic install and the command. Docker and dev runs are unaffected — they still update by pulling a new image tag.
A meeting agent can share its screen and use a browser. In a call you can ask it to open a page, present it to the room, stop presenting, and describe what is on screen. Two limits apply: the capture is the whole screen rather than one window, so what you want shown has to be the tab in front, and that browser is signed in to nothing and anyone in the call can drive it.
A meeting agent can turn its own microphone on and off. Ask it in a call to mute and it mutes and stays muted, and asking whether the room can hear it gets an answer — including the case where it could not read the microphone control at all. If something else mutes it mid-call it is told, stops talking into a dead microphone, and turns the microphone back on unless the room asked for quiet.
Non-Claude models on Bedrock work again. Every turn on a model that routes through the Converse API failed, because the runtime sent a prompt-cache breakpoint those models reject; they now run without prompt caching, while Claude on Bedrock keeps its breakpoint and its cache hits. The startup log line reports promptCache: on or promptCache: off for the configured model.
v2026.9.2134556 — 2 September 2026#
A meeting agent can post to chat. It can put a short plain-text message into the chat panel of the call it is in — a link or a command someone needs to copy. The agent cannot read the chat yet, so a line typed there never reaches it. Posting works from inside the call, from a chat session, and from a scheduled run reporting on work the call started.
Long conversations cost less per turn. Recalled memories no longer change the stable part of the prompt on every turn, so a multi-turn conversation reuses the provider's prompt cache instead of paying for the whole thread again.
v2026.9.1111648 — 1 September 2026#
A meeting agent can schedule a task during a call. Ask it in a call for something the room has no time for and it sets up a one-off scheduled task, says when that runs, and the answer arrives in your chat with the agent afterwards.
Meeting progress is no longer posted into your conversation. Asking the bot to join gets one reply saying the request is in, and meeting_status is how you find out whether it got in.
Large tool results are capped for MCP tools too, and the cut middle is saved. MCP tools used to replay at full size on every turn; the cap now covers every tool, and the full output is saved to disk for the agent to read with the shell.
Enter accepts the highlighted slash command instead of sending it as chat. In the terminal UI and the web composer, Enter completes the highlighted row while the command popup is open and a second Enter runs it.
Also in this release: the runtime appears as prism-agent in ps and top instead of /usr/local/bin/node dist/index.js, so an operator matching on the old string has to update it, and startup no longer leaves a zombie process behind; the prism-server binary now runs the memory-embedding backfill it had always skipped; and the bundled documentation uses the Prism Agent name throughout.
v2026.8.28075349 — 28 August 2026#
A meeting agent knows who is speaking. Speaker attribution, the roster and the participant count now come from Meet's participants panel instead of the captions, so attribution no longer lags the speaker or depends on the language spoken in the room. The agent can be asked who last spoke and who it is currently answering, and reports overlapping or shared-microphone speech as unknown rather than guessing.
Your Agent Guide is now the risk gate's policy. With TOOL_RISK_GATE_MODE set to observe or enforce, rules you write in the Agent Guide decide what the classifier permits, and they outrank the built-in rules in both directions — a rule you write can permit a call the built-ins refuse, including broad deletion, secret exposure and permission changes. A guide you have not edited is not read as policy, so an agent still holding the stock template gets exactly the checks that shipped before. Run observe first to see which rules would block work before any work is blocked.
A shared file is now the version the agent just wrote. share_file could read the file while the write that produced it was still running and attach the older content; it now waits for writes to its own path, reports the stored byte count with a sha256 digest, and returns an error pointing to the write tools when no write landed. Sharing a file from a thread with its own workspace no longer fails with File not found.
Adds support for the first-party Anthropic API. LLM_PROVIDER=anthropic puts chat and the classification gate on api.anthropic.com; it is direct-only, so ANTHROPIC_API_KEY is always required. ANTHROPIC_MODEL_ID defaults to claude-opus-5 and ANTHROPIC_CLASSIFICATION_MODEL_ID to claude-haiku-4-5, and ANTHROPIC_BASE_URL repoints the endpoint.
Memory embeddings are configured separately from chat. EMBEDDING_PROVIDER takes bedrock, azure-openai, openai, openrouter or none, so the vendor that embeds memory no longer has to be the vendor that serves chat. Unset keeps each chat provider's existing embedding vendor, so a running deployment is unchanged; an unrecognized value falls back to that same default and logs a warning at startup. Anthropic publishes no embedding model, so on anthropic embeddings run on OpenAI when OPENAI_API_KEY is set or the gateway can hold the key, and otherwise memory entries are stored without vectors and vector search returns nothing.
Also in this release: the license and third-party notices ship inside the container image, the release archive and the installed tree; the web UI's design system moved to the public @k8slens/lds package, so building the project no longer needs a GitHub registry token; one high-severity advisory in a transitive Prisma dependency is closed; and the end-to-end suite stopped asserting the same runtime behavior from two clients.
v2026.8.27074014 — 27 August 2026#
Prompt caching reaches the non-Claude models on Bedrock. Every Bedrock model was sent Anthropic's cache_control breakpoint, which is the namespace the Anthropic Messages API reads. The models Bedrock serves over Converse — Grok, Nova, Llama, Mistral, Kimi — read their breakpoint from a different namespace and discarded it without an error, so the whole prompt prefix was re-read at full input price on each turn. The breakpoint now follows the protocol the model is served over.
v2026.8.26145030 — 26 August 2026#
Improved claude_code tool performance by appending instead of replacing the system prompt. The runtime passed --system-prompt, which replaces the CLI's default prompt, so a sub-agent ran without Claude Code's tool-selection, todo, search and output conventions; instructions are now appended in every mode and the tool's field is renamed appendSystemPrompt.
v2026.8.25125905 — 25 August 2026#
A meeting agent is better at telling when it is being spoken to. It now works that out from the meeting audio, so it answers when you address it and stays quiet when you are talking to someone else.
An optional risk gate can refuse a sensitive tool call before it runs. TOOL_RISK_GATE_MODE is off by default. observe records a verdict and still executes the call. enforce blocks a call the classifier rejects, and an unavailable classifier fails closed. A typo in the value resolves to off, so it cannot turn enforcement on by accident. A model refusal is now surfaced as an answer instead of leaving the turn hanging on every surface.
You can now edit the Agent Guide. The operating manual used to be a read-only box with no way to change it. Edit it on the Agent tab of the Profile page and press Save, or run /agent-guide in the terminal to open it in your editor. The agent still has no tool for it, so it cannot rewrite its own operating manual.
Bedrock chat and classification default to the global. inference profile. Unset BEDROCK_MODEL_ID and BEDROCK_CLASSIFICATION_MODEL_ID now resolve to global.anthropic.claude-opus-5 and global.anthropic.claude-haiku-4-5-20251001-v1:0. An explicit us. or eu. value is unchanged. Mantle still needs a bare id.
Also in this release: Chromium in the container trusts the sandbox's TLS-interception CAs, so a browser-backed meeting works behind a TLS-inspecting proxy; a platform MCP tool that reuses a built-in name is dropped instead of replacing the built-in.
v2026.8.24083158 — 24 August 2026#
Prism Agent runs on OpenRouter. LLM_PROVIDER=openrouter puts chat and the DELIVER/SUPPRESS classification gate on OpenRouter, either direct with OPENROUTER_API_KEY or through the Lens Agents gateway, which holds the key itself. The defaults are the OpenAI tiers and the parameter handling is written for GPT-5.x, so a model id from another vendor may not hold those assumptions, and prompt caching is left to the model. Memory embeddings stay off until OPENROUTER_EMBEDDING_MODEL_ID names a model that can deliver the 1024 dimensions the index expects. Voice meetings are unaffected and still need an OpenAI key.
Locked-in mode now freezes searchable memory too. Locked-in mode previously froze only the identity documents, leaving vector memory writable. memory_write and memory_delete are now refused while the lock is on, including a lock turned on mid-turn. memory_search still works, so a locked agent can read what it already knows but cannot add to it.
v2026.8.21064958 — 21 August 2026#
Connectors reached through Nexus MCP work again on Bedrock. Bedrock caps tool names at 64 characters, and some Nexus-namespaced connector names ran longer, which failed the whole request. Model-facing tool names are now truncated to fit, while each call still goes out to the server under its original name.
Grok on Bedrock works again. Turns from Grok on Bedrock failed with an error after a successful response; they now complete normally.
v2026.8.19081228 — 19 August 2026#
An agent can be locked so it cannot rewrite its own identity. A new optional per-agent setting freezes the workspace markdown fields — soul, memory, user, vision, heartbeat, and bootstrap — so the agent's own tools cannot overwrite them, while vector memory and behavioral settings stay editable. An agent cannot unlock itself: the switch lives on the profile page and the Management API, never in the agent's own settings.
A meeting agent answers to its name without a round trip to a classifier. Deciding whether the agent was addressed by name in a group call used to cost a model call on every utterance. A local grammar check now handles the clear cases instantly; anything it does not recognize still reaches the model, so it can only speed things up, never make the agent answer wrongly.
You can steer a running turn from the web chat composer. Sending a message mid-turn so the agent changes course already worked in Slack and the terminal, but the web UI blocked it. Stop now sits next to send, so a mid-turn message reaches the running turn, and send is disabled while the connection is down.
v2026.8.17092438 — 17 August 2026#
Message attachments are saved to the file system instead of being inlined into conversation history. An attachment now reaches the agent as a metadata stub — filename, type, size — and two tools pull in the content on demand: view_attachment returns an image or PDF for the agent to read directly, and hydrate_attachment writes any attachment to the workspace so the agent can inspect it with shell tools such as file, pdftotext, or hexdump.
Attachment content is stored as files under the data directory and expires automatically 7 days after upload. Set ATTACHMENT_TTL_HOURS to change the window; the metadata stub survives expiry, so conversation history stays intact.
A stuck attachment can no longer crash-loop the container. Boot-time storage reconciliation is hardened so a bad row or missing file is skipped instead of taking down startup, and the media store, expiry janitor, and PDF handling were tightened against races.
Also in this release: the agent can stop a running Claude Code task it started, and the Docker image forces a precompiled Python at build time so a fresh CPython patch release can't break the build.
v2026.08.14080709 — 14 August 2026#
A meeting agent no longer goes deaf in a room full of people. Server-side noise reduction over the meeting audio is now off by default, controlled by a new setting, OPENAI_NOISE_REDUCTION (off, near_field, or far_field). The audio the agent receives is Google Meet's finished mix — already noise-suppressed, echo-cancelled, and levelled for each participant — so reducing it a second time was a second pass over a cleaned signal, sitting in front of turn detection and transcription. Its adaptive floor rose with the loudest thing in the call, and a quieter person in the room was suppressed as noise: agents were observed answering another agent's louder synthesized voice instantly while ignoring a human for minutes. Off by default restores that audio to the turn detector. The trade is deliberate — with less reduction, more noise reaches the detector, so a noisy room commits more utterances, and in addressed mode each one costs a classification call. Turn reduction on only if a room proves too noisy, and try near_field before far_field.
Also in this release: in concise mode the agent may now quote its own hidden intermediate narration when a user explicitly asks for it — for example, to repeat an earlier message or show a step it ran during the turn. The default is unchanged: a final message a user did not ask about still stands on its own.
v2026.8.13125224 — 13 August 2026#
The agent can gain capabilities from a plugin, with no code change. Prism Agent now loads Agent Plugins alongside its skills: drop a plugin directory under the data directory and, on the next turn, its skills and any MCP servers it declares become available; delete the directory and they are gone. A plugin can bundle skills, MCP servers, or both. Plugin-supplied skills rank after ones you installed directly, so a plugin can add a capability but never overrides yours. If a plugin is malformed, only the broken part is skipped — a bad MCP server does not stop that plugin's skills from loading, and one failed server does not stop the others.
Also in this release: a meeting fix so the agent's decision about whether it was addressed is judged against what was actually said.
v2026.8.13104825 — 13 August 2026#
A non-Claude inference provider. Setting LLM_PROVIDER=openai runs the agent on OpenAI models — the first provider that does not serve Claude. Chat, the DELIVER/SUPPRESS classification gate, and memory embeddings all run on OpenAI through one surface, direct to api.openai.com or through the Nexus gateway. It uses the same OPENAI_API_KEY voice meetings already use. The context-fullness indicator and automatic compaction work with no extra setup.
Slack status falls back to a reaction only when it has to. When the agent works on a Slack message, it shows a live thread status; the 👀 reaction is now used only when that status can't be posted, rather than in addition to it.
Also in this release: the agent unmutes itself when Google Meet auto-mutes it on join and says so if it can't, and the model in a call is given room to think before it reaches for a tool.
v2026.8.12151416 — 12 August 2026#
Three voice meeting reliability fixes. A call now sees as much of a tool's result as a chat turn does, rather than a truncated view. The loopback browser-control handshake no longer goes through a configured proxy, which broke it in proxied deployments. And a sign-in failure now leaves the page still, so the error points at the real cause instead of blaming the meeting link.
v2026.8.12100230 — 12 August 2026#
The agent can join a Google Meet call and take part by voice. Prism Agent can now join a Google Meet call as a live voice participant — listening, speaking, and using its real tools in the room. It carries the same system prompt and tools it uses in chat. In a one-to-one call it answers everything said; in a group call it responds only when addressed by name. The tools appear only when OPENAI_API_KEY is set and the container has the browser and audio toolchain, which ships in the image. See Voice meetings.
Scheduled tasks no longer post their own output twice. A scheduled task is now told that its final message is delivered for it, so it won't go looking for a Slack tool to post the result itself — which either sent the message twice or sent the agent hunting for a posting tool it shouldn't use. A conditional task's withheld all-clear stays withheld.
v2026.8.10130628 — 10 August 2026#
Scheduled tasks stay quiet when there's nothing to report. A conditional scheduled task — one told to check something and report only if a condition is met — now passes through the same DELIVER/SUPPRESS gate the heartbeat uses, so a run that finds nothing to say sends nothing. A task with unconditional instructions (a daily summary, a fixed reminder) always delivers, even when its text repeats. A run that ends in an error always delivers, so a failure is never swallowed as "nothing to report."
v2026.8.7080521 — 7 August 2026#
Long conversations no longer forget their beginning. A thread previously fed the model only its most recent messages, so older context silently dropped away. Conversations now compact instead: when a turn fills most of the model's context window, the agent summarizes the older history and keeps the most recent messages verbatim. It also happens on demand with /compact in the web UI and the terminal UI.
Start a fresh conversation from the web sidebar. A new-conversation button next to Recents in the web UI opens a clean thread. Repeated clicks reuse the newest empty thread rather than stacking up unused ones.
v2026.8.4071841 — 4 August 2026#
Slack shows when the agent is working. While the agent processes a message you sent it in Slack, it reacts to your message with 👀 and, in a thread, shows a live status — "is thinking…" while it reasons, or the tool it's running — then clears both when it replies. The live status needs Slack's Agents & AI Apps feature and the assistant:write scope; without them the reaction is the cue.
v2026.8.3134735 — 4 August 2026#
See how full the context window is. The web UI composer and the terminal UI status bar now show how much of the model's context window a conversation has consumed, so you can see when compaction is near.
A third inference provider. Bedrock Mantle joins Bedrock and Microsoft Foundry as a provider the runtime can talk to. It is AWS's newer inference endpoint, recommended by AWS for new applications.
v2026.7.31065332 — 31 July 2026#
Messages sent mid-turn reach the running turn. A message that arrives while the agent is already working is now handed to the live turn instead of waiting in a queue, so a mid-thought correction or addition is picked up in the same reply. This release also reorganized the inference-provider code internally, with no change in behavior.
v2026.7.30060034 — 31 July 2026#
Replies are concise by default. In a multi-step turn, only the agent's final message is delivered; the intermediate steps are kept but flagged as internal. Turn on verbose delivery to stream every step. Because every step is still stored, the model's context is unchanged either way — this only affects what you see.
v2026.7.28084404 — 28 July 2026#
The default model is now Opus 5. New agents run on Claude Opus 5 as their main model unless you set a different one. This release also added a boot census and an internal refactor of the provider type, neither of which changes how the agent behaves.
v2026.7.23135032 — 23 July 2026#
The image carries a document toolchain. The agent's container image bakes in Python and the tools the Anthropic document skills need — pandoc, poppler, tesseract, and the Python libraries for PDF, Word, Excel, and PowerPoint — so those skills work out of the box without installing a toolchain at runtime.
v2026.7.15062202 — 15 July 2026#
A cleaner shell environment for the agent. NODE_ENV and Husky variables are stripped from the environment the agent's shell runs in, so commands it runs don't inherit build-time settings that could change their behavior.
v2026.7.10110818 — 10 July 2026#
Claude on Microsoft Foundry. Microsoft Foundry (Azure) joins Bedrock as a selectable inference provider, running Claude through the Anthropic Messages API from a Foundry resource. On Foundry, memory embeddings come from an Azure OpenAI text-embedding-3 deployment.