ORG-2 Files

Key changes

• Chat & images: generated model images survive provider replay and collapsed activity, rendering in one per-turn gallery after the response text; chat images gain native right-click and keyboard actions — Add to chat, Copy image, Reveal in Finder or the file manager, and Download copy — with the five-image draft limit enforced at the attachment write; the feature's privacy and memory-isolation boundaries are documented (#2057, #2061, #2058).
• Spotlight: the hover detail card can be switched off from the Spotlight settings menu, and a row's pin toggle moved to the end of its label line so it no longer splits an agent name from its transport label; that settings menu now opens with room between it and the hint pill (#2047, #2049).
• Key Vault & credentials: scan-imported OAuth credentials are compared by generation at the Vault write boundary, with guarded recovery and best-effort writeback to the proven source; ORG2-managed Codex and Kiro profiles keep their refreshed tokens across launches and explicit reconnects; auto-detect no longer writes an account name that collides with an existing one, and a duplicate name now explains why Done is disabled; account rows show the exact provider balance instead of a negative quota meter (#2015, #2016, #2050, #2051).
• Market: a signed-in desktop discovers website-managed packages without a website jump, sharing one catalog cache and a single pending read per identity so model pickers cannot stay stale; a Market Claude Desktop profile prepares its installation identity and local Gateway catalog before Desktop starts, so imported Code sessions are there on the first open (#2017, #2056).
• Settings & models: settings tables can render their rows as a responsive card grid, with a keyboard-reachable search field, provider marks in the filter menus and a clear-all control — adopted first by the Key Vault models list; Cursor's routing tiers are named for what the server picks instead of surfacing the raw "default" id as a model, and only when the owning agent is Cursor (#2064, #2063).
• Security & platform: the in-process IDE server requires a loopback host, an allowed app origin and the per-launch token on every protected route; the remaining git commands reject caller-supplied values that git would read as options, with reset modes mapped through an allowlist; the unused git-api task-stream route, which spawned a shell from its request body, is removed (#2054, #2052, #2053).
• Performance: main chat, side chat and the simulator load the transcript renderer on demand behind the existing loading placeholder, cutting boot modules from 2,992 to 2,822 and boot JavaScript by about 295 KB (#2048).
• Dead code & cleanup: leftover lineage session-impact and search-language RPCs, their registered IPC wrappers and unused constants are removed (#1993).

Contributors

@Neonforge98, @Lando801, @beruro, @Harry19081, @TsomgoLake

Full Changelog: https://github.com/org2AI/ORG2/compare/v2.0.6...v2.0.7