What's new in Kayon.

The model finds an attached file even when it truncates the name, instead of guessing and inventing a summary.

• read_file now resolves a truncated or approximate name to the right file. It looks for a unique case-insensitive basename match: exact first, then a suffix, then a substring. So "Timeline.pdf" opens "Project Roadmap – Timeline.pdf". The match still runs through the workspace scope guard, so a symlink can't escape.
• On a real miss, read_file lists the actual filenames, so the model retries with the correct one instead of making something up.
• The attach note now quotes the exact filenames and tells the model to read them.
• With the PDF text extraction from v1.3.1, attaching a PDF and asking it to read and summarize now works end to end.

Attaching a PDF and asking the model to read or summarize it now works. read_file extracts the text instead of feeding the model raw bytes.

• read_file extracts a PDF's text with pdf-extract, so an attached PDF is actually readable and summarizable. PDFs over 25 MB, and scanned or image-only PDFs with no text layer, return a clear message rather than garbage. OCR is out of scope for v1.
• Non-PDF binaries such as images, office documents, and archives are refused with an explanatory error, rather than fed to the model as replacement-character noise.

Tool-capable models can now call tools locally in an agentic loop, with a session workspace, built-in tools, and opt-in web access.

• Tool-capable models are detected from the GGUF chat template, never guessed. Their tool calls run locally, the results feed back, and the loop repeats until a final answer. Every step shows inline and is saved, so the history stays auditable.
• The built-in tools cover a calculator (no eval), read_file, list_dir, write_file, read_selection, a Python code interpreter, and web search and fetch_url.
• Each session gets a workspace. Attach a folder, or let Kayon create ~/.kayon/workspace/<session>/ for you; attached and model-created files land there. Every path is canonicalized, so .., absolute paths, and symlink escapes are all refused.
• Web access stays off until you turn it on, once per session, and every request is logged. Search goes through DuckDuckGo. fetch_url is SSRF-guarded: it refuses loopback and private addresses, pins the IP, and re-checks redirects.
• The code tool always asks before it runs; write_file asks only when writing into a folder you attached. Code runs isolated but, honestly, not sandboxed. A WASM or OS jail is post-v1, so for now the confirmation is the boundary.
• The best pick only crowns a model that actually runs. When nothing fits, an honest "no model fits this machine" notice replaces the old, misleading recommendation.
• A weak model that gets stuck looping on a tool now returns a real answer instead of an error, and a repeated call never fires the same side effect twice.
• Pressing Enter commits a chat-title rename.

Starting a model no longer pops a console window on Windows.

• Loading a model used to flash a console window. The llama.cpp llama-server sidecar and the nvidia-smi NVML fallback are console-subsystem executables, so Windows opened a console when it spawned them.
• Both now start with CREATE_NO_WINDOW. Their output is still captured, so sidecar logs and the health-wait are unaffected; the window just never appears.
• Upgrade in place over any earlier version. Library entries and partial downloads are preserved.

Fixes a CSRF guard that silently blocked every write in the installed desktop app (supersedes v1.2.0).

• In the installed app, the loopback-API CSRF guard rejected every mutating request from the desktop window: loading a model, downloads (stuck on "Starting…"), pause, resume, cancel, Ollama adopt, delete, and settings. Reads still worked, so the app looked alive.
• The guard now treats the unspoofable Origin allow-list as authoritative: a Kayon origin passes, a foreign origin is still rejected, and Sec-Fetch-Site is the fallback only when no Origin is present. Defense against real malicious pages is unchanged.
• The UI's API client no longer throws on a non-JSON or non-2xx response, so a rejected call surfaces as a visible error instead of a silent freeze.
• Upgrade in place; existing library entries and partial downloads are preserved.

Live install progress on each catalog card, with pause, resume, and cancel controls.

• Each catalog card shows its install progress inline: percent, bytes, speed, and ETA.
• Pause, resume, or cancel any download in flight. Pause keeps the partial file, resume picks up from where it left off with an HTTP Range request, and cancel restores the Install button.
• Progress survives navigation. Leave the model browser and come back, and the download is still running, with its current progress shown right away.
• The "in library" state is read from the actual library, so a deleted model is immediately re-installable.
• While catalog discovery runs in the background, the browser shows a "finding the best models…" note and reloads on its own once the fresh catalog lands.

Conversations persist as named local sessions you can reopen and continue, plus a round of fixes since 1.0.0.

• Start a new chat or reopen any prior one and continue it; conversations are stored in local SQLite. Each session keeps its own system prompt and sampling params, auto-titles from the first message, can be renamed, and deletes with a two-step confirm. Nothing leaves your disk.
• The app now fills the OS window instead of drawing a fake floating window inside it.
• The benchmark forces a real generation and reports tok/s truthfully, instead of the nonsensical rate it used to show for models that stop early.
• The model list no longer stalls, because it stopped re-scanning the Ollama store on every poll tick.
• The browser and settings now name the real catalog source, "live from Hugging Face, checksum-pinned," instead of implying a signature the discovered catalog doesn't carry.
• The signed catalog bytes are pinned, so line-ending normalization can no longer break verification.

The first build: honest fit, a live catalog, verified downloads, Ollama adoption, local chat, and privacy by construction.

• On launch, Kayon builds its catalog live from Hugging Face. It takes the most-downloaded GGUFs from trusted quantizers and pins each quant's real SHA-256 and size from the HF metadata. A signed catalog ships inside the app as the offline anchor.
• Fit verdicts come from a real memory model (weights + KV + buffers + headroom), never a naive file_size < VRAM check.
• The llama.cpp CUDA sidecar is bundled in, so chat works out of the box with no env vars to set.
• Adopt-in-place from Ollama, a two-step delete, a network log, and no account or telemetry by default.
• v1 non-goals: Windows and NVIDIA only, a single active model, and no multimodal.