Skip to content

Lens Agents release notes#

Versions of the Lens Agents platform Helm chart, newest first.

helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reuse-values --wait

Database migrations run at startup. Sandboxes keep running across an upgrade and reconnect when the new server process is ready.

0.22.0 — 11 August 2026#

Sandboxes record what they were given. Each sandbox now keeps a record of the policies, credentials, and configuration it was provisioned with, so an investigation can answer "what did this agent actually have" without reconstructing it from history.

Model pricing refreshed. Cost calculations use current published model pricing, so usage costs and spending limits reflect what you are really being billed.

Admin UI. The sandbox list answers common questions inline, and breadcrumbs are built from the URL rather than guessed from name fragments — so deep links and names containing slashes behave.

0.21.0 — 10 August 2026#

The largest release in this series. Two themes: sandboxes that carry their own governance, and a much faster PII engine.

Sandbox-owned policies and credentials. A sandbox can now carry its own embedded policy and its own credentials, created atomically with the sandbox and deleted with it. Use it for the one domain a single agent needs, without adding a policy to the shared catalog that every other team then has to reason about.

Author sandboxes as YAML. nexusctl sandbox create -f sandbox.yaml drives the whole sandbox from a spec file, and the admin UI gained YAML authoring for sandboxes and policies. This is what makes an agent's configuration reviewable in git.

See the effective policy. A read-only effective-policy view shows what a sandbox's merged, ceiling-clipped policy actually resolves to. This is the fastest answer to "why can my agent not reach X".

Header injection for embedded credentials. Sandbox-owned credentials support the same header injection as project credentials.

PII masking is substantially faster. Named-entity recognition now runs in a pool of child processes with per-project result caching and batched cache-miss detection. Long-running agents that send similar prompts repeatedly see the largest improvement.

Connector credential handling hardened. A long series of fixes around storing, renaming, and reconciling connector header secrets. Header reconciliation is now non-destructive, connector secrets are stored as proper credential values, and a header format that would embed a secret inline is masked rather than displayed.

If you use connectors with header credentials

Header formats that contained a secret inline are backfilled into templates on upgrade. Review your connector credentials afterwards and confirm each one still reads the way you expect.

0.20.1 — 31 July 2026#

Org ceilings intersect HTTP rules. Where an org policy and a project policy both carry HTTP method and path rules, the effective rules are now the intersection rather than the union. This is a correctness fix with real consequences: a project can no longer widen the org ceiling's HTTP rules by adding its own.

Review policy-binding list-drift after upgrading. Projects that were unintentionally relying on the previous behaviour will show as clipped.

Masked PII is restored in tool-call arguments, so an agent receives usable values back from a masked round trip.

Database sessions are pinned to UTC, which fixes charts and time-bucketed queries drifting for installs in non-UTC regions.

0.20.0 — 30 July 2026#

PII masking fails closed, properly. A dead masking worker now returns 503 rather than forwarding unmasked content, and it does so even when the policy sets failOpen. An infrastructure failure is not a licence to leak.

Exec across replicas. Sandbox exec and terminal sessions route correctly on multi-replica installs, so interactive sessions no longer depend on reaching the right pod.

0.19.1 – 0.19.3 — 27–29 July 2026#

Stability and isolation fixes.

  • Credential domains no longer grant egress. Attaching a credential for a domain no longer implicitly allows the sandbox to reach it. A policy must allow the domain explicitly. Check your policies after upgrading — an agent that relied on the implicit grant will start being denied.
  • Sandbox principals get a real Kubernetes impersonation identity, so cluster-side audit names the agent.
  • Idle-connection and job-queue errors no longer crash the process.
  • The cluster relay forwards real upstream 101 headers, fixing protocol upgrades over the tunnel.

0.19.0 — 22 July 2026#

Agents can read their own spend. A sandbox identity can query its own spending status and usage over MCP, scoped to itself. A well-behaved agent can wind down before it hits its cap rather than being cut off mid-task.

Sandbox cost and limit reads are force-scoped to the calling sandbox, and a malformed sandbox context is denied instead of falling back to an org-wide read.

0.18.0 — 22 July 2026#

Per-sandbox CPU and memory, with a ceiling. Every sandbox declares its own resources, bounded by an install-wide ceiling. A request above the ceiling is rejected rather than silently clipped, and the ceiling is validated at startup.

Breaking change

cpu and memory are now required on sandbox creation. Update any automation that creates sandboxes without them. Set the install ceilings with sandbox.k8s.cpu and sandbox.k8s.memory. See Install on Kubernetes.

Project admins can manage project-scoped resources, and API tokens with project admin get the full sandbox tool set over MCP.

Connector credentials are selectable inline on a policy's connector row in the admin UI.

0.17.0 — 17 July 2026#

Chiefly a PII masking release, and a substantial one.

Masking covers far more of a request. The top-level system prompt, tool-call arguments in chat history, document title and context, refusal and JSON tool-result content, and array-shaped function-call output are all masked now. Structural metadata is deliberately left alone, so masking no longer breaks request shapes.

Long inputs are handled honestly. Named-entity recognition runs over a sliding window with a bounded budget, and coverage truncation is reported per call rather than passing silently. Over-budget fields are truncated to keep masking complete.

Signed thinking content is never rehydrated on the response side.

Sandbox tokens are pinned to their project, closing a cross-project access path.

0.16.0 – 0.16.1 — 10–13 July 2026#

Bedrock Mantle is available as a managed-inference backend, serving both Claude and GPT off the same Bedrock key. It appears automatically when a Bedrock token is configured.

PII propagation is faster and safer. The propagation sweep is a single-pass Aho-Corasick scan with bounded memory, deterministic results, and fail-closed behaviour on long text.

0.15.0 — 9 July 2026#

Response-streaming correctness for exposed ports and the cluster tunnel: chunked responses are dechunked correctly, hop-by-hop framing headers are stripped, stale Content-Length headers are dropped, and ingress streaming has backpressure and an idle deadline.

If an agent's web UI behaved oddly behind the sandbox ingress before, this release is the fix.

0.14.0 — 8 July 2026#

Microsoft Foundry managed inference. Claude on the Anthropic Messages API and GPT on both Chat Completions and the Responses API, from one Foundry resource and key. Streaming usage is metered, so spending limits apply to streamed responses too.

The proxy enforces the policy's provider selection at the boundary: a policy naming a provider the install has not configured is refused rather than quietly falling back. See Inference providers.

0.13.0 — 7 July 2026#

The symmetric org and project policy model. This is the release that introduced org policies as a ceiling rather than a default, with a sandbox policy-clip report and an effective-policy readout so clipping is visible instead of mysterious.

Connector tools inside agent sandboxes. A project's connectors are exposed as MCP tools within agent sandboxes, so an agent reaches them the same way whether it runs inside the platform or connects from outside.

The audit trail resolves sandbox names and surfaces PII masking status, so entries read as something other than a wall of identifiers.

0.12.0 — 2 July 2026#

On-prem activation. The device-flow activation shipped in the chart, along with air-gapped license-file activation for installs that must never reach Lens Cloud. activation.apiUrl defaults to production Lens Cloud.

Sandbox templates for well-known agents, and egress policy templates for common domains, so a first agent does not start from an empty form.

Per-sandbox spend and spending limits are visible in the admin UI.

Earlier releases#

Versions 0.7.0 through 0.11.0 (May and June 2026) built out identity, RBAC, the audit trail, connectors, and the sandbox runtime ahead of the on-prem chart.

Upgrading#

  1. Read the notes for every version between yours and the target, not only the newest — the breaking changes above are cumulative.
  2. Back up the database.
  3. helm upgrade lens-agents oci://ghcr.io/lensapp/lens-agents --reuse-values --wait
  4. Run nexusctl policy-binding list-drift --org <org> afterwards. Policy-resolution fixes are the changes most likely to alter what your agents can reach.

Planning an upgrade across several versions, or running an air-gapped install? Talk to us.