One platform. For everyone.

Conversation Assist, and ratings that ask about the agent

Catch up, Suggested reply and Sources sit in a collapsible rail beside the transcript. Each account and site chooses Off, Manual or Prepare; with Prepare, opening a conversation prepares suggestions in the background, but only where both approved the current policy, so earlier choices start as Manual. Reply drafts can cite passages from the account's published articles, and an invalid citation withholds the whole draft. An agent can ask Assist to clarify, shorten, change the tone of or translate their own unsent draft. Assist never sends: an agent reviews every insertion and sends it with the ordinary Send.

Ratings can ask how the one agent who helped did, separately from the overall score, and a site can write, version and publish its own rating questions in English, German and Italian. Each published version is reported on its own. The dashboard gains one contextual sidebar and a tighter type scale.

No operator action required; pull and restart. Every migration is additive and runs through the normal migration path. Forge sites that deploy in place pick up the shared-storage fix after re-pasting the deploy script; nothing breaks without it. Application updates preserve the installed host helper. Choosing helper 0.11.0 requires a separate, explicit root-only helper upgrade on an idle installation. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Published 1.4.4 and 1.4.5 provide a source and newer target for fresh qualification runs; no managed scenario is qualified yet. Read the release notes.

Account AI controls and private password-reset links

Account administrators can test and activate their own AI connection, discover models and review bounded usage. Account and site policies govern availability, tasks and permitted context; guarded requests recheck current authority and reserve usage. Existing installation-level manual copilot settings remain available. Every suggestion still belongs to an agent to edit, use or discard.

New password-reset links carry their credentials in a browser fragment, keeping them out of HTTP request URLs. The landing clears the fragment and submits through the existing protected reset flow. Expiry, single use and session revocation remain in force. These new links require JavaScript; earlier links and custom notification URL callbacks remain supported.

Shared work identities and cache classifications are a foundation for later AI preparation. Automatic preparation, the unified Assist rail, grounded answers and draft refinement remain future work; opening a workspace does not generate them.

No operator action required; pull and restart. The seven additive migrations run through the normal migration path. Application updates preserve the installed host helper. Choosing helper 0.11.0 requires a separate, explicit root-only helper upgrade on an idle installation. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Published 1.4.4 and 1.4.5 provide a source and newer target for fresh qualification runs; no managed scenario is qualified yet. The protected owner-bootstrap v1 claim is unchanged; integrations must validate it before deriving a fragment link for a compatible destination. Read the release notes.

A protected owner setup path for fresh installations

An optional headless bootstrap creates a fresh account, ordinary Owner and first site without granting platform operator access. Its expiring, single-use setup claim goes exclusively into a protected file. Exact committed retries retain the original receipt; partial or uncertain outcomes hold for operator reconciliation.

Read-only status separates the original completed receipt from current owner and site bindings. Recognizing a completed bootstrap after a legitimate ownership transfer does not establish a completed password handoff or grant management authority.

No operator action required; the new request table is additive. Existing installations keep their normal bootstrap and recovery behavior. Host helper 0.11.0 remains a separate administrator upgrade. Managed updates and protective-archive recovery remain unqualified, with no managed scenario qualified yet.

Let transient Docker checks settle before protecting data

Host helper 0.11.0 gives existing Docker execs up to ten seconds to settle before fencing writers. Transient health checks can finish normally; persistent execs, malformed metadata, Docker errors and hidden upgrade-window processes still refuse protection. No command is exempted. Origin trust is checked before taking maintenance ownership or stopping writers. TLS and hostname verification stay enabled.

No operator action required for the application; pull and restart. Application updates preserve the installed host helper. Choosing helper 0.11.0 requires a separate, explicit root-only helper upgrade on an idle installation. The helper CLI admits the complete, unchanged published 0.10.0 bundle; interrupted helper transactions must finish with their original distribution and transaction UUID. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Published 1.4.4 and 1.4.5 provide a source and newer target for fresh qualification runs. Read the helper upgrade procedure. Read the helper 0.11 contract. Read the qualification boundary.

Verify the serving origin before maintenance

Host helper 0.10.0 checks the serving installation's configured HTTPS origin and fresh proof tied to the release and installation key before taking maintenance ownership or stopping writers. An untrusted certificate issuer or invalid proof refuses the update while the source keeps serving. Early recovery repeats that check; existing protected recovery keeps its ownership safeguards. TLS and hostname verification stay enabled.

No operator action required for the application; pull and restart. This release adds no release requirements. Application updates preserve the installed host helper. Choosing helper 0.10.0 requires a separate, explicit root-only helper upgrade on an idle installation. Interrupted helper transactions must finish with their original distribution and transaction UUID. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Published 1.4.3 and 1.4.4 provide a source and newer target for fresh qualification runs. Read the helper upgrade procedure. Read the origin trust prerequisite. Read the qualification boundary.

Compare Compose commands with Docker's actual runtime

Helper 0.9.0 decodes one layer of Compose JSON dollar escaping when checking runtime commands, preserving exact inspected commands and inherited image defaults. Its separate upgrade path admits the exact published 0.8.0 helper on idle installations and retains historical executor journals.

No operator action required for the application; pull and restart. Application updates preserve the installed helper. Helper replacement remains a separate root-only upgrade; interrupted transactions retain their original distribution and UUID. Source tests and saved-output replay do not establish a completed managed application upgrade or restore.

Preserve image defaults during managed runtime checks

Helper 0.8.0 treats omitted or null Compose commands and entrypoints as inherited image defaults while keeping explicit empty overrides distinct. Its separate upgrade path admits the exact published 0.7.0 helper on idle installations, preserving historical journals and interrupted transaction ownership.

No operator action required for the application; pull and restart. Application updates preserve the installed helper. Helper replacement remains a separate root-only upgrade. The source correction does not recover an existing held operation or establish managed-update qualification.

Inspect stopped replacements before starting them

Helper 0.7.0 creates managed replacements with Compose's supported no-start command, with builds and pulls disabled, then inspects each stopped replacement before starting it. Failed commands and actual timeouts remain distinct, and uncertain creation intents are never automatically replayed.

No operator action required for the application; pull and restart. Application updates preserve the installed helper. Helper replacement remains a separate root-only upgrade from exact published bundles on idle installations. Interrupted transactions keep their original distribution and UUID.

A corrected helper, with explicit replacement and recovery

Host helper 0.6.0 supports separate upgrades from the published 0.4.0 and 0.5.0 helpers, corrects Docker process checks, and verifies the new helper is running and ready before completing replacement. Interrupted helper upgrades retain their original transaction for explicit recovery. A separate, narrowly scoped bridge preserves one supported failed application update during helper replacement; application recovery remains an explicit operator step.

No operator action required for the application; pull and restart. This release adds no migrations. Application updates preserve the installed host helper. Choosing helper 0.6.0 requires a separate, explicit root-only helper upgrade from a reviewed public source distribution. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Read the separate recovery bridge contract.

Docker 29 support, with a separate host helper upgrade

Optional host helper 0.5.0 verifies release images on Docker 29 with either the classic or containerd image store, including the selected platform and image configuration. Enrolled hosts can replace the published 0.4.0 helper through an explicit upgrade that preserves enrollment and recovery state, with explicit recovery if the helper replacement is interrupted.

No operator action required for the application; pull and restart. This release adds no migrations. Application updates preserve the installed host helper. Choosing helper 0.5.0 requires a separate, explicit root-only helper upgrade. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. Published 1.2.0 and 1.3.0 now provide a compatible source and newer target for those qualification runs. Read the helper upgrade procedure. Read the qualification boundary.

Review an upgrade before it touches your installation

Operator → Updates shows the running and proposed releases, required actions across skipped versions, prerequisites, backup policy and recovery limits. Docker, source and hosted installs receive guidance for their deployment owner. Terminal upgrades verify the target before activation and preserve recovery state when an outcome is uncertain.

No operator action required; pull and restart. One additive audit-event migration runs automatically. Optional managed updates require separate enrollment and remain under disposable VM qualification, not yet qualified for production use. This is the first compatible source release; managed source-to-target qualification needs a later compatible published release too. Read the qualification boundary.

A clearer desk, easier to use on a phone

The dashboard uses consistent type, spacing and pagination, with clearer visitor history, ticket context and grouped site settings. Phone ticket queues keep the essentials in view. Reports wrap long comments and open long charts on recent activity. Sign-in and recovery forms make help and errors clearer; keyboard tab choices survive a refresh, and removing a focused attachment returns you to Attach.

Widget forms have readable editing text and roomier phone controls. No operator action required; pull and restart. This patch adds no migrations.

Forgotten when they ask, shown everything when they ask

The two data requests a support desk meets most now have an answer on every contact's profile. Erasure removes everything Wayfindr holds about a person and keeps their tickets as work items with the personal content stripped out. Export downloads one archive of everything held about them. Both need a new permission, and both leave an audit entry that records how much, never what.

Erasures also survive a restore from backup: an archive that brings an erased person back has them erased again before the desk serves anyone. No operator action required; pull and restart.

The version number makes a promise

The application is the same as 0.11.0's. What changed is what the number tells you: from here, only a new major version can ask an operator to do anything beyond pulling and restarting. A minor adds features and migrates itself; a patch only fixes things.

It also marks the bar the project set for itself: somebody who has never worked on Wayfindr installed it on a clean Ubuntu machine using only the public documentation, and it ran.

An account area for the person running it

The people on an account got a Team page of their own, API tokens and webhooks became two tabs, and each integration folds its settings under its own row. Nothing about who may do what changed. A provider connection form that failed validation also stopped keeping its API token and webhook secret in the session.

Email replies that actually arrive

Until this release, no agent reply to an email conversation was ever delivered, while the agent was told it had been sent. 0.10.0 fixed that, and sent every reply 0.9.0 had held back, threaded into the visitor's original email. A visitor who left an address while the desk was away now gets the reply by email too.

Also in the release: a widget less than half the size, an account sidebar, phone-width dashboard pages that no longer scroll sideways, and a visitor's message that always reaches an agent who can be alerted.

A desk that can share the load

Accounts gained two-factor sign-in, OpenID Connect, and custom roles. The desk gained service-level targets, automatic routing, automation rules and macros, bulk queue work, and a command palette. Agents can see disclosed, declinable live visitor presence, send bounded proactive invitations, receive Web Push alerts, and ask an optional copilot for suggestions they review before using. An AI that replies to visitors on its own remains deferred.

Also in the release: direct Mailgun and Postmark inbound mail, outbound webhooks and narrow API writes, richer visitor contact records, per-agent timezones, and wider German and Italian dashboard coverage. Upgrading an existing host-managed PHP install requires checking its PHP and cURL requirements and acknowledging the release action. Wayfindr's image already includes those requirements; read the release notes for the exact steps before upgrading.

Prepared as 0.8.0 and renumbered before it was tagged, so there is no 0.8.0.

Reachable by email, and measurable at last

0.6.0 changed how Wayfindr looks; 0.7.0 changed what it can do. A desk that could only be reached through the chat widget can now be reached by email, answer questions before they are asked from a help centre inside the widget, and say when nobody is home. Reporting and satisfaction ratings arrived with it, so there is finally a way to know whether any of it is working.

Also in the release: a pre-chat form, password recovery an agent can run without a shell, per-site widget appearance, a widget that speaks the visitor's language, a visitor directory, and a read-only public API.

The interface renovation

The dashboard was rebuilt around a permanent sidebar, a colour per site, queues about four times denser, and a dark mode the widget follows too. Same application wearing a different face: data, URLs, and the install snippet on your pages are untouched.

Sites get a lifecycle

A site can now be renamed, archived when you stop supporting it, or permanently deleted. Archiving destroys nothing and is reversible; deletion has to be archived first, done by an owner, and confirmed by typing the site's name.

Install anywhere, not just on a public domain

localhost, bare IP addresses, and internal hostnames became supported install targets, with a certificate issued locally instead of an ACME challenge that could only fail.

Followed by 0.4.1 – 0.4.4, which fixed the TLS handshake for installs at an IP address and moved the widget's last third-party dependency in-tree, so a self-hosted install now serves every byte it runs.

Advice that does not block the upgrade

Releases can carry advisory notices — worth telling an operator, not worth stopping for — and they disappear on their own once the thing is done. Where the install genuinely cannot check, it says so rather than guessing.

Followed by 0.3.1 and 0.3.2, which cleared Composer advisories and fixed a first-boot race on empty storage volumes.

The upgrade guard, exercised

The first release you could upgrade to across a release boundary with a manifest on both sides. It deliberately demands nothing: the point was to prove the mechanism on a release where being wrong cost nothing.

The first stable release

Mail, attachment storage, malware scanning and backups became things you configure in a browser rather than in a file, behind a guided first-run checklist. Backup and restore shipped with an optional offsite mirror, and a release learned how to state what an operator must do before it will migrate or serve.

Preceded by the 0.1.0-alpha.1 – alpha.3 prereleases on 21 and 22 July 2026, the first Wayfindr builds published as installable artifacts.