What's Changed

• fix(toasts): extract the Insights resource DLL at build time by @mfuntowicz in #134
• Fix/gguf scan 135 by @mfuntowicz in #136
• Fix/runtime update 133 by @mfuntowicz in #138
• Ensure the app can update llama managed installation at launch by @mfuntowicz in #143
• More .gguf scan hygiene by @mfuntowicz in #144
• fix(locator): find hub-cache GGUFs in snapshot subfolders by @ultrathinker in #141
• fix(context): preselect nothing when a model has no saved context length by @mfuntowicz in #150
• Install models via llama://install?repo= deep links by @mfuntowicz in #152
• Improve deeplink install feedback by @mfuntowicz in #153
• Flyout: defer startup network/process fan-out until first show by @mfuntowicz in #154

New Contributors

• @ultrathinker made their first contribution in #141

Full Changelog: v0.13.0...v0.14.0

Highlights

• Speculative decoding, wired automatically — models that ship a draft head (mtp / dflash / dspark) now run up to ~2× faster with identical output. The app detects the head from Hub repos and imported files, configures the server, and offers a one-click reload for models that are already loaded.
• Your own model folders join the app — point Settings at any folder where you keep GGUF models and they appear — loadable, with metadata and fit verdicts — right next to the Hugging Face cache.
• Honest "will it fit?" verdicts — three-level fit badges (fits / might fit / won't) computed from real memory estimates (GGUF headers) against this machine's devices and free memory, with the reasoning one hover away.
• Share to Llama — send images and text from any app straight into the chat composer through the Windows share sheet, and open chats/models with llama:// deep links.
• Installs are ~60% smaller — 235 MB → 86 MB. The app was carrying an entire Windows-ML runtime and 40 language packs it never used; it now ships only what it needs (of which the app itself is ~2.5 MB).
• A quieter, faster app — the always-on model poller costs nothing when nothing changes, the model list rebuilds in batches, and JSON round-trips are compiled instead of reflected: less CPU, battery and UI stutter while the app sits in your tray.
• Safer installs and settings — the installer script now runs in memory (it never touches disk), the server API key is stored encrypted like your Hugging Face token, and every URL the app fetches or opens is validated first.
• Coming to the Microsoft Store — releases are now submitted to the Store automatically; the listing goes live once Partner Center certification completes.

New features

Speculative decoding (#105)

• Models with a draft head (-mtp, -dflash, -dspark in the repo's files) are detected automatically — from the Hub at download time and for models already in your cache — and the server is configured to use them.
• The details view shows the detected head; a loaded model that missed its head gets a one-click reload to engage it.

Enrolled model folders (#106)

• Settings → General → Model folders: add places you already keep GGUF models (another drive, a private stash). They're scanned recursively and listed as first-class models, with the same metadata, fit and download-less loading.
• The Hugging Face cache stays the primary storage; enrolled folders are additive and never duplicated.

Fit verdicts (#111)

• Every model now answers "will it run here?" before you download: memory estimates read from the GGUF header, compared against your RAM/VRAM and devices, rendered as three badges — fits, might fit, won't.
• The reason is spelled out (what the model needs vs. what the machine has), matching the wording of the pre-download check.

Share to Llama and llama:// deep links (#98, #99)

• Share images and text from other apps into the chat composer via the Windows share sheet — images ride straight into the multimodal pipeline.
• llama:// links open the chat overlay with a prompt or load a model — the model id is validated against what the server actually has.

Microsoft Store distribution (#125)

• Each version release is now submitted to the Microsoft Store automatically (Partner Center submission behind a human approval gate), so the app can be installed and updated from the Store once the listing passes certification.

Performance

• Much smaller installs and updates (#122, #123): trimming is enabled and validated (a build-time check now fails on any unsafe reflection usage), and the unused Windows-ML/Search/Widgets runtime is gone from the package — 235 MB → 86 MB for self-contained builds.
• The /models poller is change-gated: while nothing changes it publishes nothing, drops to a slower cadence, and stops waking the UI thread — a large cut in idle CPU/battery for an app that runs all day (#114).
• The model list rebuilds once per change instead of per row: opening the flyout with a large cache no longer staggers rows in over multiple frames (#116).
• JSON serialization is source-generated across the board and settings load in a single parse: faster startup paths and settings round-trips (#120).

Fixes

• A dead llama server is detected again: a failing GET /models is confirmed against /health, so the app reports "the server stopped responding" instead of showing a phantom "running" forever (#115).
• Fixed a rare cross-thread race on the shared settings collections that could wedge the background model watcher (#119).
• Server reads and writes stay outside the MSIX virtualization sandbox, fixing settings/models that could split across real and virtual paths (#108, fixes #107).
• Removing a managed installation deletes only Llama's own files from the shared install directory (#95).
• Correct architecture detection on ARM64 machines (#101).
• Providers without a bundled brand mark show the org's Hub avatar instead of an empty tile (#112).
• The stale Windows Phone identity is gone from the package manifest (#124).

Security

• The installer script runs in memory — install.ps1 travels from the validated response into PowerShell without ever being written to disk (#113).
• The server API key is protected like your HF token — DPAPI-encrypted at rest, managed from the same Settings door, never logged (#109).
• URLs are treated as untrusted — avatar fetches are restricted to HTTPS Hugging Face hosts with a size cap (including after redirects), and the update banner only ever opens an https github.com release page (#119).
• Supply-chain hardening (#117) — release tag names are no longer interpolated into CI scripts, every third-party action is pinned to a commit, NuGet dependency locks are enforced at restore time (drift fails the build), and preset INI section names are validated against injection.
• Trim-safety enforced (#122) — the release build now fails if reflection or dynamic code re-enters the app, keeping the trimmed artifacts trustworthy.

Misc

• Dependency updates (#92), Microsoft Store publisher identity (#102), version bump to 0.13.0.

What's Changed

• update dependencies to latest version by @mfuntowicz in #92
• fix(app): remove only Llama's files from the shared install dir by @mfuntowicz in #95
• Add ability to share images and text to the llama server by @mfuntowicz in #98
• Add llama:// protocol deep links (chat prompt, model load) by @mfuntowicz in #99
• Fix/arch detection by @mfuntowicz in #101
• misc: update publisher for the windows store by @mfuntowicz in #102
• Add speculative decoding support by @mfuntowicz in #105
• Enroll local model folders for discovery by @mfuntowicz in #106
• fix(server): keep every server-read path out of the MSIX virtualization sandbox by @mfuntowicz in #108
• Put the server API key behind the same door as the HF token by @mfuntowicz in #109
• Ability to heuristically determine if a model would fit the underlying hardware by @mfuntowicz in #111
• fix(logo): unknown providers show the org's Hub avatar instead of an empty tile by @mfuntowicz in #112
• security(install): run install.ps1 in memory — never written to disk by @mfuntowicz in #113
• perf(poll): fingerprint-gate the /models poll; settle to 2s when idle by @mfuntowicz in #114
• fix(supervisor): make server-death detection reachable by @mfuntowicz in #115
• perf(model list): coalesce per-row rebuilds; diff-gate the browse tail by @mfuntowicz in #116
• Security, CI and ini hardening by @mfuntowicz in #117
• fix(publish): stop shipping trimmed zip builds by @mfuntowicz in #118
• Fix/dict race and uri validation by @mfuntowicz in #119
• perf(json): source-generate every DTO serializer; single-pass settings load by @mfuntowicz in #120
• perf(publish): trim the zip builds — blockers fixed, IL gate enforced by @mfuntowicz in #122
• perf(deps): drop the WinAppSDK metapackage — 52 MB of unused shell/ML runtime by @mfuntowicz in #123
• chore(manifest): drop the stale mp:PhoneIdentity element by @mfuntowicz in #124
• feat(store): publish to the Microsoft Store from GitHub Releases by @mfuntowicz in #125
• Improve model loading error surface by @mfuntowicz in #127
• Enrolled folder live updates by @mfuntowicz in #129
• fix(zombies): delete leftover import artifacts — the source of undeletable rows by @mfuntowicz in https://githu...

Highlights

• Search Hugging Face from the app — browse and download any of the Hub's GGUF models straight from the model list, with suggestions as you type, download progress,
  failure reasons that name the actual problem, and private/gated repo support via your HF token.
• New llama server settings — choose which network interface the server listens on, cap how many models run in parallel, quantize the KV cache, and pass arbitrary
  extra llama serve flags.
• Security hardening across the board — an API key now protects the server whenever it's reachable beyond this machine, your Hugging Face token is stored encrypted,
  the installer download is verified and bounded, and the embedded chat overlay can no longer be navigated off the local server.
• Weekly llama.cpp runtime updates now actually work — a JSON-parsing bug had silently disabled them since launch.

New features

Hugging Face search (#65, #69)

• Type in the model list to search the Hugging Face Hub, or paste a repo id (owner/model); suggestions appear as you type.
• Download any GGUF variant directly, with live progress, disk-space preflight, cancel support, and clear failure messages (rate limits, auth, disk space, and more).
• Sign in with a Hugging Face token (Settings → General) to download private and gated repos; the token is optional and never logged.

Settings → Llama (#79, #73, #74, #76)

• Listen On — bind the llama server to a specific network interface's address, all interfaces (0.0.0.0), or localhost (the default). All user-facing links and the
  chat overlay follow the selected address.
• Max Loaded Models — cap how many models the server runs simultaneously (0 = unlimited).
• KV Cache Quantization — independently choose K/V cache precision (f32, f16, bf16, q8_0, q4_0, q4_1, iq4_nl, q5_0, q5_1) to fit larger contexts in GPU memory.
  Defaults match llama.cpp (f16).
• Custom Serve Arguments — a free-form box for extra llama serve flags, appended after the built-in ones (e.g. --threads 4 --flash-attn). A bad flag is reported as
  the server's failure reason on the status dot.

Misc

• Dev builds are now labeled in the footer (#80).
• The project is now MIT-licensed (#78).

Security

This release implements the fixes from a full security audit of the app.

The server is no longer an open API on your network (#85, #79)

The llama server has no authentication of its own, so previously, choosing "All interfaces" exposed its full control API — load, download, run and delete your models
— to everyone on your network. Now:

• Any bind beyond localhost automatically gets an app-generated 256-bit API key, passed to the server via a key file and sent on every request Llama makes.
• Switching away from localhost requires an explicit confirmation dialog.
• The key is shown (with a copy button) in Settings → Llama whenever the server is exposed, for tools that ask for it. The chat overlay authenticates automatically.

Custom serve arguments can no longer override security flags (#85)

llama.cpp honors the last occurrence of a repeated flag, so a pasted --host 0.0.0.0 could silently re-expose the server while Settings still showed "Localhost". The
app-owned flags — --host, --port, --api-key, --api-key-file, --models-preset, --ssl* — are now rejected in custom arguments, at save time and again at launch.
Secret-bearing flags are redacted from the log.

Your Hugging Face token is encrypted at rest (#86)

The token is now stored DPAPI-encrypted (bound to your Windows account on this machine) instead of plaintext in settings.json. Existing plaintext tokens migrate
automatically the first time the app runs. Note: a settings file copied from another machine/user will read as "no token configured" — re-enter it there.

A stale "Listen On" address can't send your traffic elsewhere (#84)

If the configured interface address is no longer assigned to this machine (DHCP change, different network), the app now falls back to loopback and warns you, instead
of pointing every request and link at whatever foreign host now owns that address.

Hardened installer download (#83)

install.ps1 is now fetched with redirects refused, from the exact expected HTTPS URL, size-capped, and its SHA-256 is logged. The interpreter runs from its absolute
System32 path so a planted powershell.exe can't hijack it. Behavior change: unattended (weekly) runtime updates now require a pinned script hash; until the project
pins one, automatic updates are skipped rather than executed unverified — the first-launch install still works as before. The update check itself was also fixed (#81,
below).

Chat overlay confinement (#86)

The overlay is a borderless window with no address bar, so anything it renders carries the app's visual authority. The embedded WebUI can now only ever display pages
from your local llama server: top-level and iframe navigations off the server's origin are cancelled, new windows go to the system browser (plain http/https only),
and DevTools are disabled in release builds.

Model-id and input validation (#82)

Model ids come from remote data and were previously trusted too far: they're now validated before being used as cache paths (closing a path-traversal that could probe
files outside the cache) and JSON-escaped in every request body. The copyable sample curl command is now safely serialized and shell-quoted.

Supply chain (#87)

• NuGet dependencies are pinned to exact versions (no more floating 1.* ranges) and every project commits a restore lock file, making dependency drift visible in
  review.
• Every GitHub Actions workflow — including the Trusted Signing steps — is pinned to a commit SHA instead of a mutable tag.

Fixes

• Runtime updates actually install now (#81) — the weekly llama.cpp update check never bound GitHub's tag_name field, so it silently always reported "no update". This
  also re-enables the (now safely gated) auto-update path.
• Per-model context length is honored (#62) — the chosen context size was being ignored when loading a model.
• Installed-version tracking (#61) — the installed list no longer loses track of which version/quant of a model you have.
• Vision tag height and other small UI polish.

What's Changed

• fix(ui): improve tracking of installed version of a model by @mfuntowicz in #61
• fix(llama): honor the context length by @mfuntowicz in #62
• Feat/hf search by @mfuntowicz in #65
• Add huggingface search by @mfuntowicz in #69
• docs: rewrite build-from-source instructions with verified commands by @larroy in #64
• Add some basic info export by @mfuntowicz in #70
• feat(llama): add max number of concurrent models loaded by @mfuntowicz in #73
• feat(llama): add KV cache K/V quantization settings by @mfuntowicz in #74
• feat(llama): add custom serve arguments setting by @mfuntowicz in #76
• Add ability to define listening interfaces by @mfuntowicz in #79
• Add License to the project by @mfuntowicz in #78
• feat(ui): label dev builds in the footer by @erusev in #80
• [1/7] fix(runtime): bind GitHub tag_name so runtime updates actually install by @mfuntowicz in #81
• [2/7] fix: validate model ids at filesystem and JSON sinks by @mfuntowicz in #82
• [3/7] fix(llama): verify and bound the downloaded installer before running it by @mfuntowicz in #83
• [4/7] fix: fall back to loopback when the saved listen address is gone by @mfuntowicz in #84
• [5/7] feat: API key for non-loopback binds + reserved serve flags by @mfuntowicz in #85
• [6/7] fix: DPAPI token at rest, pinned interpreter, fail-closed overlay webview by @mfuntowicz in #86
• [7/7] build: pin NuGet versions, lock files, SHA-pinned CI actions by @mfuntowicz in #87

New Contributors

• @larroy made their first contribution in #64
• @erusev made their first contribution in #80

Full Changelog: v0.11.0...v0.12.0

What's Changed

• feat(ui): add update banner when a new version is available by @mfuntowicz in #60

Full Changelog: v0.10.0...v0.11.0

What's Changed

• Feat/UI fluent rounded corners by @mfuntowicz in #31
• Feat/UI fluent text fill tokens by @mfuntowicz in #33
• Feat/UI fluent semibold footer by @mfuntowicz in #29
• Feat/UI fluent control corner radius by @mfuntowicz in #32
• Feat/UI fluent settings card fill by @mfuntowicz in #30
• Improve README for going public by @mfuntowicz in #44
• Fix dark theme icon by @mfuntowicz in #45
• [CATALOG] Show only featured models by @mfuntowicz in #46
• Idle models unloading by @mfuntowicz in #47
• Rename the app "just llama" by @mfuntowicz in #49
• [UI] ability to pause download by @mfuntowicz in #50
• Model fit check: dim and block models that don't fit this machine by @mfuntowicz in #52
• UI model details by @mfuntowicz in #51
• Improve fittable models heuristic by @mfuntowicz in #53
• feat(ui): click on on the logo opens llama.app website by @mfuntowicz in #55
• feat(ui): update download progress presentation to remove duplicate b… by @mfuntowicz in #56
• feat(ui): improve accelerator display by @mfuntowicz in #57
• Fix/cancel download by @mfuntowicz in #58

Full Changelog: v0.9.0...v0.10.0

What's Changed

• [UI] add model size on disk in GB by @mfuntowicz in #17
• fix(ui): wire the download cancel button into the row action cell by @mfuntowicz in #18
• fix(ui): surface model load failures instead of failing silently by @mfuntowicz in #19
• fix(ui): make the empty-state text honest in every server state by @mfuntowicz in #20
• fix(ui): dismiss the tray flyout with Esc by @mfuntowicz in #21
• feat(ui): show bytes, speed and ETA while a model downloads by @mfuntowicz in #22
• feat(ui): preflight disk space and show sizes on Recommended rows by @mfuntowicz in #23
• fix(ui): make Recommended rows keyboard- and screen-reader-reachable by @mfuntowicz in #24
• fix(ui): surface LlamaManager.FailureMessage instead of dropping it by @mfuntowicz in #25
• feat(ui): first-run guidance — install indication and hotkey discovery by @mfuntowicz in #26
• fix(ui): smaller UX items — wording, glyphs, featured order, descriptions, logs by @mfuntowicz in #27

Full Changelog: v0.8.2...v0.9.0

Full Changelog: v0.8.1...v0.8.2

What's Changed

• [UI] take screen DPI into account by @mfuntowicz in #14
• [TESTS] improve dependency workflows by @mfuntowicz in #15
• [UI] handle dark theme to turn model icons blank by @mfuntowicz in #16

Full Changelog: v0.7.2...v0.8.1

Full Changelog: v0.7.1...v0.7.2

Full Changelog: v0.7.1...v0.7.2

What's Changed

• [UI] probe the status of the taskbar before adding trayicon by @mfuntowicz in #13

Full Changelog: v0.7.0...v0.7.1

What's Changed

• [UI] probe the status of the taskbar before adding trayicon by @mfuntowicz in #13

Full Changelog: v0.7.0...v0.7.1