Release notes

What’s new (2026-10-26)

Area	Change
X posts written from your own documents	Name up to three text files in Settings → X → Reference documents for post drafting (for posts about Kazma, the page What Kazma is) and every X post Kazma drafts is written from them and fact-checked against them — from X Studio’s Generate, or by asking in chat (“write two posts about Kazma”), which now drafts the same way and saves to X Studio’s Drafts. Nothing is sent to X until you approve a post.
Posts have their own length	Settings → X → Post length: short, standard or full (the default: as many sentences as the post needs, within X’s limit). Posts used the reply length before, and a three-sentence post was rejected for it.
X checks that judge	With DeepSeek, an X draft’s evidence check spent its whole reply on hidden reasoning and came back empty (“invalid JSON”), and quotes from a wrapped page were refused. X’s model calls now turn the reasoning off, a quote counts by its words, and the evidence check marks each fact supported with its source.
Diagnose keeps the card	Pressing Ask Kazma to diagnose on an incident card no longer removes its other buttons on Telegram and Discord: the diagnosis arrives below the card, and you retry or dismiss from the same card. Run and incident ids now read correctly on Telegram, and a failure you already retried or dismissed no longer counts in /runs as needing attention.
Swarm time limits you ask for	“Use the swarm … with a 5-second timeout” now reaches the task: dispatch_swarm takes a limit from 5 seconds to 30 minutes (5 minutes by default). It is also the quickest way to see an incident card (Running work).

What’s new (2026-10-25)

Area	Change
Kazma watches every task it runs	Chat turns, swarm tasks, scheduled jobs, document jobs, research sessions and crawls, X posts, memory tasks and maintenance sweeps are watched in one place. When one stalls, gets stuck or fails, a card arrives in the chat it started from (Telegram, Discord, Slack), else your ops channels, with Retry, Cancel, Close the turn, Dismiss or Ask Kazma to diagnose. The first decision wins everywhere; acting is admin-only. See it all with /runs in any chat or the Dashboard’s Running work card (Running work).
Automatic first steps, off until you switch them on	Kazma can take one step before asking you: retry a failed swarm task that changed nothing outside Kazma, a document job or memory task out of attempts, or close an abandoned chat turn. At most one a day per piece of work, never when its effects are unknown.

What’s new (2026-10-24)

Area	Change
X videos, downloaded and sent	Ask Kazma to download a video, GIF or photos from a public X post and it fetches them through the official X API (one read from the X read budget) and sends them in the chat, a video at the best quality under 50 MB. Before, it said it could not and went looking through your folders. See X Publisher.

What’s new (2026-10-23)

Area	Change
Chat apps no longer go silent	A rare race could leave Telegram showing “typing…” for good while every later message, on every chat app, waited without an answer or an error: the typing indicator’s stop waited forever on a request whose cancel had been lost. Every such wait in Kazma is now bounded and says when it gives up.
Kazma knows who it is, and today’s date	The base system prompt (Kazma’s identity, what it can do, the Kuwaiti dialect, today’s date) was left out of every web and chat-app turn; it is sent on every call now, with the date in your time zone, refreshed each day. Before, Kazma guessed the date from old messages.
Files keep their place in the chat	A file or image sent from Telegram, Discord or Slack now shows as your message when the chat is opened on the web, and the next answer no longer replaces the one before it.
No page for a short database restart	The research/crawl monitor alerts only after 5 minutes without a check, names the cause and how long, and says when monitoring is back; a Docker or database restart of a few seconds no longer pages (Troubleshooting).

What’s new (2026-10-22)

Area	Change
Dashboard charts show what was spent	“Tokens Over Time” and “Cost Over Time” read the per-call LLM ledger: each bar is one slot’s tokens or cost (5 minutes for 1H, an hour for 24H, 6 hours for 7D), kept across restarts and reloads. They drew running totals the open page had sampled, lost on a reload (Web UI).
Whole tool outputs	A model no longer loses most of a long tool result between steps: a fixed 30,000-token cap that cut every tool output to 2,000 characters is gone, so the context budget is the model’s window, as decided on 2026-10-18.
Long scanned documents	A scan attached in chat is no longer OCR’d before the model sees it; read_document and ocr_document read as many scanned pages as fit in the call and say how to continue, and document_import reads the whole file in the background a few pages at a time, with progress in document_status; document_convert to Word then exports the OCR text, a section a page. A call that is stopped now stops its OCR worker too (Document Intelligence).
Converted files can be sent	document_convert and document_redact now save their file and name its path, so the agent sends it straight away; before, they gave only an id no tool could use, and the agent searched the disk for the file and made a new one (Document Intelligence).
Word files keep the house font	Every Word file Kazma makes now carries IBM Plex Sans Arabic inside it, so it looks the same on a phone or a computer that does not have the font; before, Word drew another face there. An Arabic scan’s Word export is headed “صفحة 1”, “صفحة 2”… (Document rendering).
Fewer false “stale” notices	A single lost request no longer shows “Alerts could not be refreshed” or empties the Dashboard’s answer-quality block: the alerts are read again after 5 s, the block keeps its last reading, and either says so only when a second read fails too.

What’s new (2026-10-21)

Area	Change
X posts wait for you	An X card offers one approval and Deny and names what it does (“Post now”); a draft the agent saves is posted only after you’ve seen it, in a later message (X publisher). x_status reads post counts on request, and save_proposal gives each draft’s X length.
Approvals that can’t help, and approvals that expire	A shell command or browser call the host would refuse gets no card; a refusal before anything ran is an ordinary error and the turn goes on. An unanswered card expires as “expired”, not “denied”, and in Telegram, Discord and Slack the chat is told and gets the rest of the turn.
/abort and /stop	/stop is /abort. The aborted request is answered “cancelled”, the turn closes with its own reply, and the next message is not taken as asking for it again.
The web chat stays live	A turn you leave and return to stays live after a server restart, and an open tab tells you when Kazma was updated (Refresh).
Forgetting	Asking in chat to forget a fact forgets the turn it came from; “forget everything that mentions X” reaches every memory, fact and lesson holding it (Memory).
Documents	One house style for generated documents and HTML converted to PDF; each table in its own language; Kazma reads its own bilingual PDFs back as they are (Document rendering).
Tools	Read-only git_log and git_diff; check_swarm_task waits for the result; Gmail listings show sender, date and subject.
Knowledge	Chroma replays a library’s write log on one thread, after a race in its parallel replay crashed the process (Knowledge Library).
Endurance	The Documents 48-hour soak passed (2026-10-19); the Memory and Time Travel 72-hour soaks passed (2026-10-20).

What’s new (2026-10-10)

Telegram, Discord and Slack preserve finalized answer text and save one reply per turn. English/Arabic literal-JSON copies and one-paragraph prose requests have conservative formatting safeguards; ambiguous tool-argument fragments receive one bounded recheck without executing text. Web/Telegram code delimiters and saved terminal history preserve their contents. Structural answer-quality signals are available to administrators, separately from accuracy grades.

Native command registration and private reply delivery, IDE draft protection, durable retry receipts and Windows-service Docker execution were also updated. The owner’s 60 development and 24 fresh bilingual responses are fully reviewed; approved replacements remain separate from the original failed responses. The operational pilot closed on 2026-10-17: 40 turns in 20 chats, no failed turn, one argument recheck. Neither these small review sets nor live smoke checks establish a production accuracy or uptime SLO. See Recent features, Native chat commands and Known gaps.

What’s new (2026-10-04)

Settings now require durable storage: boot stops if settings cannot initialize, and operational save failures return HTTP 503. Restore storage, reload and review values before retrying; a lost acknowledgement may follow a committed write. See Configuration and Troubleshooting.

Real-model evaluations now pin a provider/model and use isolated stores with fixture tools. Mechanical results are separate from human-reviewed bilingual holdout accuracy, which remains unmeasured without reviewed cases. The default prompt separates source facts from inferences; this is not accuracy certification. See Recent features, the evaluation workflow and X Studio dataset collection.

What’s new (2026-10-03)

Area	Change
The Memory page’s numbers match what memory holds	The page’s “empty” count included merge redirects, which no clean-up removes, so it stayed above zero after a purge that left nothing to take. It now counts what the Hygiene purge takes, and a redirect is listed as “merged into” its target. A merge also refreshes the counts of the entities linked to both names, and a maintenance pass fixes any stored count that disagrees with memory: 11 of 377 entities on the live install showed wrong counts (Memory & RAG).
Kazma learns who its owner is from memory, not from its code	Five places decided which memory entities may not be deleted or merged away, and four of them named Kazma’s author: every install protected that name and none its own owner’s other names. The owner’s names now come from the memory hub, on any install. Both purges (the Memory page’s and the agent’s) also deleted merge redirects, the rows that send a merged name to its target; they now remove only empty shells. The Entities search finds an entity by its own ID (Memory & RAG).
The memory graph shows what memory holds	Most nodes the Memory graph drew alone were made by the drawing. The links joining a concept to you were the first dropped when the graph had too many facts, a cut by node left a fact’s subject alone, and values such as true disappeared. The graph now keeps connected groups whole, starting from you, and draws each value on its own fact. On the data side, an automatic merge of two names for one thing failed on every install and left a duplicate; it now works. Work items such as phase names, tickets and versions no longer become entities (their facts are kept), an entity whose last fact is removed goes with it if it holds nothing else, and memory health lists the remaining clutter with examples (Memory & RAG).
A chat opened from another page shows its turn live	Going to Chat through the sidebar from another page left the chat unable to draw a turn. A task you sent ran, and even paused for your approval, while the chat showed nothing until a refresh. The sidebar swaps pages without reloading them, and it skipped the folder of scripts Chat draws turns with. Those scripts now load the first time a page needs them, and a test checks that every page gets every script it includes (Web UI).
The daily digest counts the whole day	The morning digest on Telegram said “Turns completed: 0” over a day with four turns, and listed two maintenance pauses that had ended under “Needs attention”. It read only the newest log file (the log starts a new file at midnight) and counted web turns alone. It now reads every log file of its 24 hours and counts the turns of every chat app (“Turns completed: 4 (web 3, telegram 1)”). Approvals come from the approval registry, one per question. Alerts are counted over the whole day, not only since the last restart. Reloads and maintenance pauses are listed as planned work, with the longest pause. A digest no channel took is sent again an hour later; it used to be marked as sent.
Slack says when its app is full	Slack lets one app hold ten connections at once. When all ten are taken, Slack refuses Kazma’s until one frees, and meanwhile a message can go to whichever program holds a slot. Kazma now says so at the first refusal, as a warning and as the connection’s problem in the Slack Test (Settings → Providers & Connectors → Platform Connectors). The Test shows the count and checks whether your latest messages reached Kazma (Gateways & Platforms).

What’s new (2026-10-02)

Area	Change
MCP servers: the buttons work, Settings tells the truth, a failed server comes back	On the MCP page, Start, Stop, Test and OAuth login did nothing when clicked. They work now, Remove asks first, and the page’s messages follow its language. In Settings → MCP the switch starts or stops the server at once and can show a server as off (it could not before); the dot shows whether the server runs (it was always red); and Test is the MCP page’s Test (Settings’ own copy failed for the filesystem server). /config tools toggle applies at once too. A server that fails to start at boot is retried in the background; only the last server’s failure used to be remembered. Changes made on a page are kept in Kazma’s settings and no longer rewrite kazma.yaml, a tracked file whose changes made git pull refuse to update; and an error message never shows a key (Skills, MCP & Tools).
Every count reads right, in English and Arabic	About seventy labels in the web interface had a number beside a word in one form: “1 msgs”, “Plan locked (1 steps)”, “N worker(s)”, and in Arabic “1 أدوات”, “2 أدوات” or “11 معتقدات”. Every count in the chat, the Dashboard, the memory pages, Research, Time Travel, Documents, Knowledge, Settings, the Swarm page and the MCP pages now uses English’s two forms and Arabic’s six. The terminal, the CLI and the chat apps, which speak English only, said “(1 msgs)” or “1 new chunks” in 39 places; they now say “1 message”. A new count written in one form, in either language, fails the build.
Text follows its own language, in either UI	English runs left to right and Arabic right to left whatever the UI’s language: replies, quotes, tool output, tables, cards, menus and fields. An Arabic paragraph in a mostly English reply runs right to left again (it ran left to right in both UIs), and a reply looks the same in both UIs. Arabic installs no longer show parts of the Dashboard, the packages and tools lists and the Skills page in English (Arabic & Cultural Features).
Send a test alert	Settings → Adapters & Routes → Send a test alert sends one message along the saved alert routes, the way a real alert travels, and the page names each route that took it (Deployment).
A chat kept out of memory stays out from its first message	“Don’t remember this chat” set before the first message now holds: the memory writer checks every id the chat has. On the live install such a chat had reached memory through the catch-up sweep.
Small fixes	The SQL tools’ refusal of one of Kazma’s own databases names the SQL tools, and the Skills page no longer shows “v—” for a skill without a version.
Updating packages: one command, and it works on Windows	kazma update stops and restarts a supervised Kazma itself. It waits until no chat is mid-turn, has the guard stop the server and keep it stopped while the packages install, then starts Kazma again. A failed install keeps Kazma stopped, and the same command is the repair. It no longer replaces packages under a running server (on Windows that fails half way and leaves a mix of old and new packages). On Windows the update runs with the install’s Python (.venv\Scripts\python.exe -m kazma_cli update): a reinstall must replace kazma.exe, which Windows does not allow while it runs, so an update started from kazma.exe refuses before installing anything and names the command. It used to fail on its own launcher and leave Kazma half installed. The “packages are behind” alert names the command (Kazma update).
File tools no longer hold up every chat	Looking up the workspace and your granted folders is a database read, and the agent’s file tools did it on the server loop that serves every chat; so did the research pipeline, the MCP path check and the chat apps’ sidebar sync. All of it now runs beside the loop. The SQL tools now open a relative path such as app.db in the workspace, like every other file tool.
A message Kazma could not send is reported as not sent	Reminders, files and scheduled-post notices were reported as delivered whatever Telegram, Discord or Slack answered. A refused reminder is now logged as failed, a refused post notice falls back to your other chat apps, and the agent is told when a file was not sent. send_file works again from reminders and the command line.
Ops alerts from background work arrive	Alerts raised by backups and boot checks were sent on the wrong event loop and reached nobody; one was the alert that your packages were behind. They are delivered on the server’s own loop now, and an alert no chat app took falls back to a direct Telegram message.
Agent skills show what activation will do	Every list of agent skills (the model’s catalog, list_agent_skills, kazma agent-skills list, the Skills page) shows whether a skill is verified, unsigned or refused, with the reason. A refused skill is no longer offered to the model as verified, and the Skills page no longer shows an invented “100/100” score. kazma agent-skills sign takes several folders (CLI reference). Only an attempt to use a refused skill is logged; listing them used to fill the log on every turn.
Packages with known advisories are upgraded	Fourteen packages with published advisories have new minimums, the lock file matches the project again, and the server says at boot when an install’s packages are older than the build requires (Security & Safety).
An Approve click is never lost	A turn shows its approval card, then finishes its own bookkeeping. An Approve clicked in that moment was refused as “no longer pending” over a card that was pending, so the button did nothing. The approval now waits for that bookkeeping and goes through.
The Swarm page settles finished tasks	A finished task’s live view ends with its result even after a restart (before, it reconnected ten times and its timer kept counting), and a cancelled task’s view ends too. The Workflow Editor and the Playground show the task’s answer, which they never found. Running tasks the page did not start (another tab, a chat) appear in Active Tasks again; a hidden script error kept them out.
Commands keep their files out of your repository	A command the agent runs got your workspace as its home and temp folder, so tool caches and temp files landed in the repository (143 MB of uv cache in the live install). Each workspace now gets a private home outside it.
Sending a task to the swarm from the IDE doesn’t freeze chats	It described the workspace (two git probes of up to 4 seconds each) on the loop that serves every chat; it now does that beside it.
Searches skip what your repository ignores	The agent’s file search and the code index read the files your repository keeps: tracked files, plus untracked ones .gitignore does not exclude. In the live install a 4.7 GB clone, ignored by .gitignore, made one search take 13.9 seconds and return its matches; searches there now take about a second. A folder you name is still searched (IDE).
The security report tells the truth; sign-in stays on behind a proxy	The hardening report (GET /api/security/hardening) now measures what each check names: credentials written in the install’s own files, MCP secrets outside the vault, who can reach the API, advisories for the package versions actually installed, skills that would be refused, TLS, the record of approvals, and calls that run a shell or evaluate code. It had reported critical failures that were not true, and passed checks on a keyword. KAZMA_AUTH_DISABLED behind a tunnel used to start with every API route open; it is now refused at startup when a proxy is declared, and a request that came through a proxy gets a 503 while it is set (Security & Safety).

What’s new (2026-10-01)

Area	Change
The docs say what the code does	The security guide no longer describes signed, encrypted delegation between agents — that code was archived, never wired in, and deleted; nothing signs work between agents (Security & Safety §6.2). The Arabic & Cultural Features guide now matches the tokenizers, Arabic search and Majlis as built, and every file the docs name exists. Section links land on their section, and Arabic pages link to Arabic pages.
The TUI in Arabic	Ctrl+L switches the terminal UI between English and Arabic and keeps the choice; the tabs and the navigation rail follow it, in the web UI’s words. The tabs’ Arabic labels had never been applied, and nothing could switch the language (TUI).
Chat commands report what they measured	In Telegram, Discord and Slack, /status lists each chat app’s connection, the queue and the messages in progress; /cost sums this chat’s model calls; /context measures the saved conversation against the model’s window — all three showed fixed numbers before. /config changes one setting at a time and never reports a failure as a success, and every change a chat makes to Kazma for everyone is admin-only (Slash Commands).
Every Arabic page in Arabic	Eight Arabic pages were the English page, copied — among them Slash Commands and Document Intelligence. All are translated, and the docs sync check now catches a copied page.
Switching the model no longer holds up other chats	Switching the model or provider, testing a provider and first-run setup write settings and secrets and rebuild the agent; they now run beside the server’s event loop instead of on it, so open chats keep streaming while it happens.
Restore your settings, keep your keys	Settings → System → Restore settings backup… shows what will change before it writes anything, keeps every key you have, brings a lost key back from this install’s vault without typing it, and can be undone. The backup file holds settings only (no sessions, password hash or approval grants), and every way of saving a setting checks the value the same way (Configuration).
The chat stream’s events, as sent	The SSE event contract lists all eighteen frames POST /api/chat/stream sends, when, and their fields as the code builds them, the reconnect and approval frames included; a test holds the table to the code (API & Extension Points).
A chat app’s token takes effect when you save it	A Telegram, Discord or Slack token, on/off switch or swarm channel applies within a second of saving it, wherever it was saved, with no Refresh: that platform reconnects and the others stay connected. The Test checks the connection made with what you saved, and Refresh Gateway now builds exactly what boot builds (Gateways & Platforms).
Slack no longer holds you to one message a minute	The flood guard shipped the platforms’ own send limits as messages per person per minute (Slack 1, Discord 5); every platform now allows 30, and an install on the old values follows. A message the guard leaves is logged and shows in the Test, and Slack’s connection count no longer blames a second program when every message arrives (Configuration).
Kazma’s names are held on PyPI	kazma, kazma-core and six more names are reserved: version 0.0.1 of each, with no code, only a page pointing at the GitHub releases, so no one else can publish under them. A hand-run workflow uploaded all eight through PyPI Trusted Publishing, with no token; Kazma still installs only from GitHub (Supply chain).
Pull-request titles shown as text	Workspace → GitHub’s pull-request viewer put a PR’s title and its reviewers’ names into the page as HTML, so a title written as markup could run in your browser when you opened the PR. Every value from GitHub is now shown as text, and the viewer’s own words follow the page language.
Settings → Skills works, and pages speak your language	The skill switch and Uninstall on Settings → Skills now do what the Skills page does (they wrote a setting nothing read); built-in skills offer only the switch. 57 messages that scripts show after a click (toasts, dialogs, button titles) were English on Arabic pages; all come from the translation catalog now, and a check keeps it that way. A route that could delete any setting by name is gone.
A database outage no longer freezes every chat	Saving a reply, approving a tool call and delivering a reminder read or wrote the chat on the loop that serves every open chat; with Postgres away each waited up to 5 seconds. They now run beside it, and a check keeps new code from doing it again. Six API routes nothing used are gone.
More of each page follows your language	19 more phrases that scripts write straight into the page were English on Arabic pages. They include the chat’s clarification card and its states, the “Loading messages” screen, the model picker’s default, the swarm’s background-task line, the memory graph’s hover tips, and a research result’s cost, tokens and duration. All now come from the translation catalog, and the check that keeps them there now also reads the HTML that scripts build.
Research reads only reports	The paper export read any file the server could reach, and the download route then served it; the report scorer measured any file on disk. A report a request names must now lie inside a research/reports folder. The research and time-travel APIs are now mounted when the app is built, so the route checks see them at last. Swarm → Task History has Export CSV, and on the Memory graph Group under→ moves a node that already has a parent and Tier… sets its tier.
The IDE’s reject writes only checkpoint files	Rejecting a hunk in the IDE’s patch review wrote any path the request named, and turned LF files into CRLF on Windows. It now restores only a file the checkpoint holds, keeping its line endings, and the review lists files created after the checkpoint. The swarm’s worker registry moved into the data dir, so backups include it, and 45 more request handlers left the event loop, among them the backup archive, which zipped a whole backup there.
No page waits on the database	Every page and every read in the API now does its database work beside the loop that serves every open chat, and a check calls each one twice and fails on any that does not. Among those it found: the Scheduled list, the Documents API, and the IDE’s file reads and listings. A settings write no longer empties the read cache of every other setting, and the security hardening report takes about 5 seconds instead of freezing the server for 50.
A migration carries the whole data dir	kazma migrate export carried five folders. The swarm’s workers and templates, the default workspace and any file you kept in the data dir stayed behind. A bundle now carries everything except what belongs to the machine (its identity, backups and logs) or is rebuilt. An import keeps any file of yours that it replaces in its pre-import backup, and a file that cannot be read stops the bundle from verifying instead of going missing (Migration).

What’s new (2026-09-30)

Area	Change
Updates only from Kazma’s own releases	On an install made from a release wheel, kazma update installs the newest GitHub release’s wheel only after checking its checksum — never whatever is called “kazma” on PyPI, where the name is free for anyone to take. Settings → Check for Updates shows your real version, links the release notes and says when it could not check. Install tips point to Settings → Packages or pip install -e ".[web]" in the Kazma folder, and kazma update --reinstall or --force repairs such an install from its own release. See Supply chain.
MCP servers: keys in the vault, presets that exist	Testing an MCP server no longer hands it Kazma’s secrets (the Test button started it with Kazma’s whole environment). A key you give a server is kept in the vault — kazma.yaml and the settings keep a pointer, the pages show **** — and keys saved earlier move there by themselves. The “Add Server” list is 13 real, maintained servers checked against npm and PyPI; 78 of the 81 it offered before did not exist. See Skills, MCP & tools.
Every JavaScript test runs	24 of the 45 JavaScript test files ran nowhere; every one now runs in CI and in the local suite.
A reply cannot send your data elsewhere	External images in a reply are links you choose to open, and every page carries a Content-Security-Policy, so a prompt injection can no longer make the browser send the conversation to another server.
Safer sign-in and sessions	The page opened after login is checked as a real address, the login throttle is per address and per username (no global lockout), a WebSocket accepts your login cookie only from Kazma’s own pages, and scripts no longer create login sessions.
One way to run a chat turn	The chat’s WebSocket only shows what happens in a turn; turns, approvals, stop, steer and abort all go one way. Turn-complete push notifications work now, and a turn that runs out of time still pages you.
A chat app keeps its new token	Slack, Discord and Telegram tokens saved in Settings are stored for the whole install, so they survive a restart.
Normal priority, an honest restart card	Kazma raises itself to a normal program’s priority as it starts (it had been starting below normal and freezing when something heavy ran beside it); the restart card counts only the downtime; Slack says why it reconnects. On Windows, install_service.py --status checks the service task setting by setting, and running --install again can no longer weaken it (Deployment §6).
A database outage is not a restart	A short Postgres outage no longer makes the guard restart Kazma: nothing waits on the database on the event loop, readiness answers in seconds, the connection pools recover, and the guard rides it out and pages you. A crash leaves its last lines in .kazma/server.stderr.log.
Errors that were swallowed now say so	Switching the model really drops the old failover connections, database columns are added one way with failures reported, and quiet failures (a search index rebuild, a cleanup) leave a trace.
A full audit of the code	Every product and script file was audited (report) and its findings fixed with tests — among them the removed semantic response cache, the Swarm page crash on quotes, Safari voice transcription, disk work that blocked the server, dead code and unused dependencies — and every /api route now has a caller or a written reason.

What’s new (2026-09-29)

Area	Change
More than one mail account	Settings → Email → Other accounts adds any number of mailboxes: a Google or Microsoft sign-in under a short name you choose, or an app password / IMAP-POP with the login tried before it is kept. In chat, name the account or its address (“check my work inbox”); every email and calendar tool takes account=, and each account keeps and refreshes its own tokens. See Email integration.
Every page reads in Arabic	Pages that show your data, and the login page, read in Arabic too — your words, the model’s replies, names and server diagnostics are shown as written.
Every control does what it says	A pass over the live install, each fix with tests: switches that switched nothing, background jobs that never ran on a busy install, the owner’s reminders showing “done”, connecting Outlook Calendar opening Google, mail/calendar/X flows tested end to end.
Chat apps you can diagnose	Each chat app’s Test (Settings → Providers & Connectors → Platform Connectors) checks the token, the chat or channel Kazma delivers to, direct messages, allowed users, and what became of the last message a person sent. Every message a chat app receives is answered or logged with the reason it was not. See Gateways.
One card per restart	A restart sends one status card instead of three messages: how long Kazma was down, and each chat app ✅ or ❌ with the reason. Start and stop messages are optional. See Deployment.
Discord keeps its session	The reconnects Discord asks for resume the same session instead of starting a new one.
Tables on a phone	Tables in an answer are rewritten as lines for Telegram, Discord and Slack, so they read on a phone.
Each turn gets fresh context	The notes Kazma gives the model for one turn — the workspace, the language, what memory recalled, the task — are replaced every turn instead of piling up. A workspace switch now reaches a chat already in progress, and the file the IDE has open is context for the model, never saved as your words.
Arabic chat steps	A chat step’s tool and thoughts are named in Arabic on Arabic pages, and approval and memory lines that mix Arabic with code, ids or dates read in the right order.

What’s new (2026-09-28) — the memory program

Area	Change
Who Kazma is for, said plainly	One operator per install. Whoever runs an install has full control, can switch any safeguard off, and answers for what its agent does; anyone they let in — a web login or an allowlisted chat account — acts with their authority. The safeguards protect the operator from the agent and the untrusted content it reads, not an install from its operator. Now the first section of the Threat model, pointed to from the README and the feature list.
An old “skip approvals” flag no longer lasts forever	A YOLO flag set before windows had an end time was honoured for good — one chat of the live install had skipped approvals under one since July. Such a flag now counts as ended and is removed, and the 15-minute maintenance removes every ended window (90 had piled up). A running window is never cut short.
kazma project init no longer over-promises	The .kazma/ templates said their rules were “applied to every agent session”; nothing in Kazma reads them yet — init creates them, show/validate check them. Each template now says so and links issue #20; a test keeps the wording honest.
Recall by evidence, memory made visible	A memory is used only when it matches the question well enough — nothing is injected when nothing does. A turn that used memory shows a Memory used row in its activity: how many facts, conversation memories, weekly summaries and library passages the model was shown, stored with the turn so a reload shows it again. See Memory & RAG.
“About me”	Settings → Memory → About me is a short text you write about yourself; Kazma reads it at the start of every reply, in every chat, and never fills it in itself. What you say in a conversation wins over it.
Weekly summaries, “where are we with…”	Once a week ends Kazma writes a short summary of each topic (what it was about, what was decided or done, what stayed open), on the Memory page and in the export. Ask where a long-running topic stands and those summaries are brought back — at most two, after the matching turns.
You decide what Kazma remembers	The Memory page lists what Kazma remembers of your conversations, each with Forget; a chat’s menu can keep it out of memory (or /memory off on Telegram, Discord, Slack); deleting a chat can also forget what it learned; Export downloads everything. Kazma keeps one version of a fact — a new value replaces the old.
Isolation and quiet	Each tenant’s memory stays its own; memory work no longer holds up other chats; removed memories can no longer come back through the Postgres mirror; compaction no longer keeps a copy of the conversation outside both controls.
Databases that stay writable	A failed write (lock timeout, full disk) no longer leaves its database locked — fourteen connections had the fault, now covered by tests that fail each write on purpose and a check on the source. Chat step history is bounded on Postgres too (newest 200 steps a chat, a setting — 0 keeps everything), and a model switch no longer leaks a checkpointer connection.
Backups prove they restore, by default	The weekly check restores the newest Postgres dump into a scratch database, verifies and drops it (KAZMA_PG_RESTORE_REHEARSAL=0 opts out). Local + offsite snapshots run every 6 hours. See Disaster recovery.
The guard	The supervisor’s guard restarts Kazma itself, can no longer die unnoticed, and pages you over Telegram; deploy kills are not treated as crashes; a restart no longer runs out of time shutting down.
Secrets and tunnels	A password inside a provider or connector URL is treated as a secret and masked on every screen and API; web chat over Cloudflare Tunnel loses no approval cards and merges no turns; no more false “undeclared proxy” alarms behind a tunnel.
Every environment variable described	The environment variables page now covers every KAZMA_* name with where the code reads it — and a check keeps the page complete.
Every known gap closed or accepted	docs/KNOWN_GAPS.md opens with where things stand: no open defects known, two owner decisions, and the accepted limits with their reasons. See Known gaps.
kazma.ai back in step	The site’s numbers arrive daily again through one open pull request (and count six packages, not seven — kazma-memory was retired long ago), and a standing procedure now lists exactly what the site must add, update and translate.

Earlier changes

Everything before 2026-09-28 — the 0.11 “Hands” release, the prompt-injection measurements, the document platform, the 0.10.0 and 0.6.x summaries — is in the Recent features guide and the changelog.