What’s new in Kayon.

1.5.1 measured the fit reserve against a different llama.cpp than Kayon ships. This one measures the exact build in the box, which is now pinned and checksummed.

• 1.5.1 read each model's vocabulary and reserved VRAM from that. It turned out that was measured against an older llama.cpp than the one Kayon bundles. The build it ships keeps no such reserve in your GPU memory: it moved the output buffer to system RAM, so vocabulary now costs no VRAM at all.
• What is left grows with your context length, and the old model had no term for that. So it reserved too much at short context, and at long context it could reserve too little and tell you a model fits when it does not. This release measures the runtime Kayon actually runs and reserves what it really uses: the model's width plus the context. Checked against llama.cpp's own numbers across six models and two context lengths, the prediction now matches what it allocates to within a rounding error.
• Mixture-of-experts models allocate memory the width formula does not describe; on the one measured, the real figure was about double the estimate. Rather than guess from a single data point, Kayon reserves a deliberately generous fixed amount for any expert model until there is enough data to model it properly. This can only make Kayon more cautious about whether an expert model fits, never less.
• The bundled runtime is now pinned and checksummed. Kayon records the exact llama.cpp build it ships, verifies the checksum before staging it, and refuses to build against anything that does not match. Before this the runtime was an unlabeled local build that reported its version as “1”. Releases are now built by GitHub Actions from that pinned runtime rather than by hand.

The fit engine held back 1.5 GB of VRAM that nothing needed. The real figure is around 256 MB, and it is now read from each model rather than assumed.

• The fit engine reserved 1.5 GB of your VRAM beyond the weights and the KV cache. The real figure is about 256 MB. On an 8 GB card that is 16% of your VRAM held back for nothing, so Kayon has been calling models a split or a no when they fit comfortably. If a quant you wanted was refused, check it again.
• The 1.5 GB was never measured. It was a figure carried over from a CUDA build that Kayon does not actually ship. This release measures the runtime that really runs.
• The reserve turns out to have almost nothing to do with model size. It is the output buffer, so it scales with the model's vocabulary: a 70B model needs the same as a 3B one with the same tokenizer. Kayon now reads each model's vocabulary out of its own file and computes the figure, which lands close to what llama.cpp actually allocates: 96.0 MB predicted against 97.1 observed at one vocabulary, 250.5 against 254.5 at another. Every model in the catalog gets its own number, from 250 MB for Llama up to 512 MB for Gemma 4.
• The bundled runtime is Vulkan, not CUDA. The README, the settings screen, and the documentation all claimed otherwise, and every one of those claims is corrected. Vulkan is the deliberate choice: the CUDA build and its runtime come to about 600 MB against Vulkan's 20 MB, and a 30x download is too much to pay for faster prompt processing. It is slower than CUDA on NVIDIA, and that is the trade. The CUDA version shown in your GPU details is your driver's, read from NVIDIA's own library, which is true and stays.
• If Kayon cannot compute an honest verdict for a model, it now refuses to load it rather than falling back to putting every layer on the GPU. That fallback was most likely to fire on exactly the small cards it would then run out of memory on.

Kayon tells you when a new version exists and updates itself on your click. Already have Kayon? Uninstall it first: this one installs to your user account and will not replace it.

• Read this first if you already have Kayon. This version installs to your user account instead of Program Files, so it will not replace an existing install. Uninstall the current one (Settings, Apps, Kayon), then run this installer. Your models, chats, and settings live in your profile and survive either way.
• Kayon checks on launch whether a newer version exists and tells you. It does not download it. Click Download when you want it, and when the download finishes you get Relaunch to update, which applies it. Because the install is now per-user rather than machine-wide, updating no longer raises a Windows administrator prompt, which is the reason the location changed.
• The update check plays by the same rules as everything else. It asks GitHub for a version file, and sends no identifiers, no telemetry, and nothing about you or your machine beyond the request itself. It is written to the network log exactly like model downloads and catalog lookups: an update path that skipped the log would make the log a lie. Settings has a switch to turn it off, and with it off Kayon makes no update request at all, though a Check for updates button is still there for when you want one.
• Every update is signed with a key that never leaves the developer's machine, and Kayon verifies that signature against a key built into the app before it runs a single byte. An installer that fails the check is refused rather than executed, which was tested by feeding it a forged artifact and confirming the rejection. An updater is the one feature that downloads and runs code, so this matters more than the convenience does.
• Nothing is downloaded without your click, which is the rule models already follow.

A delete that looked final was not. A chat's workspace and every file in it now go when the chat goes.

• Deleting a chat used to remove two database rows and nothing else. The chat's workspace folder, and every file in it, stayed on disk permanently. That included documents you attached, so a chat you deleted precisely because it held something sensitive kept the PDF you gave it.
• The leftovers were also unreachable. Kayon's file routes require a live chat, so those folders were invisible inside the app while sitting in plain view in Explorer. A delete that looks final should be final, and now is.
• Only the workspace Kayon created for a chat, at ~/.kayon/workspace/<chat>/, is removed. A folder you attached is yours: deleting the chat leaves it and everything in it alone, the same way Kayon never writes to Ollama's model store. Kayon deletes only what Kayon created.
• Every version up to 1.4.0 left a folder behind for each chat you deleted, so an existing install is probably carrying a pile of them. On first launch, 1.4.1 removes the workspaces of chats that no longer exist. Directories Kayon did not create are left alone, even if you parked them in the workspace folder.

A Files panel in Chat shows the session workspace, and documents open in place: markdown, code, images, HTML, and real PDF pages.

• A Files panel in Chat lists the session workspace, putting the documents you attached and the files the model wrote in one place. Click one to open it without leaving the app: markdown, text and code, images, HTML, and PDFs with paging and zoom.
• PDFs render page for page rather than as extracted text. The engine and every asset it needs ship inside the installer, so opening a document never sends it anywhere. That is what takes the installer from 16.3 MB to 18.6 MB.
• The viewer is read-only. Saving a copy takes an explicit click, and nothing is written for you.
• An artifact's JavaScript does not run, and that is deliberate rather than unfinished. A content policy can stop a page fetching, but nothing stops a script navigating itself to a remote URL with your data in the query string, and a navigation is not a fetch. This was tested rather than assumed: with scripts enabled, a test artifact really did reach a live external site. Running artifact scripts and promising that nothing leaves your machine cannot both be true, so the promise wins.
• A chart or React artifact therefore shows as static markup. The viewer says so on the artifact itself and names the remote URLs it refused to load. Save a copy to run it in a browser you trust.
• Two file-access bugs are fixed, both present in earlier versions. A crafted request could read your whole chat database through the session file route, because session ids were joined into a folder path and an id of .. walked up to Kayon's own data directory. Another could read any file your account can read, so /C:/Windows/win.ini returned the file, because joining a request path onto the asset folder throws the base away when that path is absolute on Windows. Both are pinned by tests. Neither needed a model, a tool call, or your permission, so this update is worth taking even if you never open an artifact.
• Tool calls start collapsed now, with the name, the status, and a one-line result in the header, so a short answer is not buried under its own plumbing. A call waiting on your approval stays open, because its arguments are the thing you are approving. Models also answer the question instead of describing the calculator: asked what 1024 * 768 is, a 3B model used to explain the function and its JSON shape, and now replies 786432.
• A turn that breaks mid-stream keeps its tool trace. Code may have run and files may have been written before the failure, and that record used to be the one thing that vanished on reload. Calls cut off by a broken stream are marked interrupted, so reopened history never shows an Approve button that does nothing, and reopening Kayon returns to the chat you had open instead of a blank composer.

The model finds an attached file even when it truncates the name, instead of guessing and inventing a summary.

• read_file now resolves a truncated or approximate name to the right file. It looks for a unique case-insensitive basename match: exact first, then a suffix, then a substring. So "Timeline.pdf" opens "Project Roadmap – Timeline.pdf". The match still runs through the workspace scope guard, so a symlink can't escape.
• On a real miss, read_file lists the actual filenames, so the model retries with the correct one instead of making something up.
• The attach note now quotes the exact filenames and tells the model to read them.
• With the PDF text extraction from v1.3.1, attaching a PDF and asking it to read and summarize now works end to end.

Attaching a PDF and asking the model to read or summarize it now works. read_file extracts the text instead of feeding the model raw bytes.

• read_file extracts a PDF's text with pdf-extract, so an attached PDF is actually readable and summarizable. PDFs over 25 MB, and scanned or image-only PDFs with no text layer, return a clear message rather than garbage. OCR is out of scope for v1.
• Non-PDF binaries such as images, office documents, and archives are refused with an explanatory error, rather than fed to the model as replacement-character noise.

Tool-capable models can now call tools locally in an agentic loop, with a session workspace, built-in tools, and opt-in web access.

• Tool-capable models are detected from the GGUF chat template, never guessed. Their tool calls run locally, the results feed back, and the loop repeats until a final answer. Every step shows inline and is saved, so the history stays auditable.
• The built-in tools cover a calculator (no eval), read_file, list_dir, write_file, read_selection, a Python code interpreter, and web search and fetch_url.
• Each session gets a workspace. Attach a folder, or let Kayon create ~/.kayon/workspace/<session>/ for you; attached and model-created files land there. Every path is canonicalized, so .., absolute paths, and symlink escapes are all refused.
• Web access stays off until you turn it on, once per session, and every request is logged. Search goes through DuckDuckGo. fetch_url is SSRF-guarded: it refuses loopback and private addresses, pins the IP, and re-checks redirects.
• The code tool always asks before it runs; write_file asks only when writing into a folder you attached. Code runs isolated but, honestly, not sandboxed. A WASM or OS jail is post-v1, so for now the confirmation is the boundary.
• The best pick only crowns a model that actually runs. When nothing fits, an honest "no model fits this machine" notice replaces the old, misleading recommendation.
• A weak model that gets stuck looping on a tool now returns a real answer instead of an error, and a repeated call never fires the same side effect twice.
• Pressing Enter commits a chat-title rename.

Starting a model no longer pops a console window on Windows.

• Loading a model used to flash a console window. The llama.cpp llama-server sidecar and the nvidia-smi NVML fallback are console-subsystem executables, so Windows opened a console when it spawned them.
• Both now start with CREATE_NO_WINDOW. Their output is still captured, so sidecar logs and the health-wait are unaffected; the window just never appears.
• Upgrade in place over any earlier version. Library entries and partial downloads are preserved.

Fixes a CSRF guard that silently blocked every write in the installed desktop app (supersedes v1.2.0).

• In the installed app, the loopback-API CSRF guard rejected every mutating request from the desktop window: loading a model, downloads (stuck on "Starting…"), pause, resume, cancel, Ollama adopt, delete, and settings. Reads still worked, so the app looked alive.
• The guard now treats the unspoofable Origin allow-list as authoritative: a Kayon origin passes, a foreign origin is still rejected, and Sec-Fetch-Site is the fallback only when no Origin is present. Defense against real malicious pages is unchanged.
• The UI's API client no longer throws on a non-JSON or non-2xx response, so a rejected call surfaces as a visible error instead of a silent freeze.
• Upgrade in place; existing library entries and partial downloads are preserved.

Live install progress on each catalog card, with pause, resume, and cancel controls.

• Each catalog card shows its install progress inline: percent, bytes, speed, and ETA.
• Pause, resume, or cancel any download in flight. Pause keeps the partial file, resume picks up from where it left off with an HTTP Range request, and cancel restores the Install button.
• Progress survives navigation. Leave the model browser and come back, and the download is still running, with its current progress shown right away.
• The "in library" state is read from the actual library, so a deleted model is immediately re-installable.
• While catalog discovery runs in the background, the browser shows a "finding the best models…" note and reloads on its own once the fresh catalog lands.

Conversations persist as named local sessions you can reopen and continue, plus a round of fixes since 1.0.0.

• Start a new chat or reopen any prior one and continue it; conversations are stored in local SQLite. Each session keeps its own system prompt and sampling params, auto-titles from the first message, can be renamed, and deletes with a two-step confirm. Nothing leaves your disk.
• The app now fills the OS window instead of drawing a fake floating window inside it.
• The benchmark forces a real generation and reports tok/s truthfully, instead of the nonsensical rate it used to show for models that stop early.
• The model list no longer stalls, because it stopped re-scanning the Ollama store on every poll tick.
• The browser and settings now name the real catalog source, "live from Hugging Face, checksum-pinned," instead of implying a signature the discovered catalog doesn't carry.
• The signed catalog bytes are pinned, so line-ending normalization can no longer break verification.

The first build: honest fit, a live catalog, verified downloads, Ollama adoption, local chat, and privacy by construction.

• On launch, Kayon builds its catalog live from Hugging Face. It takes the most-downloaded GGUFs from trusted quantizers and pins each quant's real SHA-256 and size from the HF metadata. A signed catalog ships inside the app as the offline anchor.
• Fit verdicts come from a real memory model (weights + KV + buffers + headroom), never a naive file_size < VRAM check.
• The llama.cpp sidecar is bundled in, so chat works out of the box with no env vars to set.
• Adopt-in-place from Ollama, a two-step delete, a network log, and no account or telemetry by default.
• v1 non-goals: Windows and NVIDIA only, a single active model, and no multimodal.