By the VEKTOR team · 9 min read
Desk chat gets the Agent tab’s tools
The biggest structural change in this release is that the Desk chat can now read files, write files, run code, and lint, using the exact same tool definitions and dispatch logic the Agent tab already runs on.
Before this, any request that touched real files got a one-line “this needs the Agent tab” and a context switch. Now Desk just does it, in the same reply, with a 15-round tool budget instead of the old 6.
Every one of those tool calls now shows up as a live, point-form checklist above the answer as it streams: “Reading main.py,” “Writing tests/test_main.py,” “Running python code,” each item flipping from a pending dot to a checkmark the moment that specific call actually finishes.
A multi-round tool-calling turn used to give you nothing but a blank wait until the whole thing landed. Close the tab and reopen a saved session, and that same checklist rebuilds itself from what’s now persisted alongside each turn. Tool name and label only, never the raw arguments or output, since those can carry file contents or command output that shouldn’t sit in chat history indefinitely.
Two things the Agent tab already had and Desk didn’t: a running dollar cost for the turn’s actual LLM calls, and task-level rollback. Both are ported now, reusing the exact pricing table and rollback function the Agent tab already relies on, so the two surfaces can’t quietly drift out of sync on either. Ask Desk to undo the last file it touched and it will, restoring from the backup its own write already took.
Faraday learns to reason about who it’s watching
Faraday, VEKTOR’s security layer, already moved from watching to enforcing earlier this cycle: a pre-flight scan now runs inside the actual request loop across Desk, JOT, and the Agent tab, catching a prompt injection or a leaked credential in single-digit milliseconds, before the request ever reaches a provider.
That part shipped as a real architectural shift, a gate in front of the request instead of a log entry after it.
This release adds the layer on top of that: three components that let Faraday reason about actors over time, not just judge one request in isolation.
Actor Profiles: this gives every connected MCP server or tool a durable, cross-session behavioral fingerprint: call counts, decision outcomes, tool frequency, a weighted risk score, and surfaced riskiest first.
Intent & Motivation: classifies an actor’s likely purpose from that profile into a fixed taxonomy, reconnaissance, data exfiltration, financial gain, disruption, privilege escalation, persistence, testing, or ordinary benign use.
Predictive Modeling: goes a step further, forecasting which stage of a real attack kill chain an actor’s behavior is heading toward next, with an escalation-risk flag, scoped from actual published attack-prediction research rather than invented from scratch.
All three ran through real tests against the actual configured model rather than mocked, and Intent and Predictive Modeling share a single LLM call instead of costing two separate round-trips.
Two new ways to ask for more than one answer
Council mode has always run independent analyses in parallel and blended them into one synthesized answer.
That’s useful, but it’s a different job from picking a single best attempt, which turns out to be its own pattern that VEKTOR never actually exposed as a general capability. It does now. run_parallel_best takes any task, runs it independently across several providers, and has an impartial judge pick the single strongest result with a stated reason. No blending.
The second new pattern is a real evaluator-optimizer loop.
refine_until_good generates an attempt, hands it to a separate model acting as a strict evaluator against whatever criteria you give it, and revises against that specific feedback until it passes or hits a round cap.
We tested it against a deliberately impossible bar, an evaluator instructed to reject every attempt with “needs more sparkle” no matter what, and watched it run four real rounds: generate, fail, revise, fail, revise, then stop cleanly at the cap instead of looping forever. That’s the actual mechanism working, not a demo dressed up to look good.
Narration improvements
During tests we kept asking Desk to check something on the VPS, uptime, disk space, whether a process was running and kept getting back a paragraph explaining what it was about to do. Never the real answer.
The root cause turned out to be narrower than it looked. Forcing a genuine tool call, instead of leaving it up to the model’s own judgment, only ever applied to one code path, for two specific providers, and only when the question looked like a web search.
Desk’s actual chat interface runs through a different path entirely, one that never forced a real tool call under any circumstance. An infrastructure question could get narrated indefinitely on any provider, and nothing downstream would ever correct it.
We fixed the forcing logic properly, broadened it to recognize infrastructure and SSH phrasing specifically, and dropped the narrow two-provider carve-out, since forcing a real tool call costs nothing when a model already calls tools reliably, and fixes exactly this when it doesn’t.
Then we tested it live against the same failing scenario. It worked as the model reached for a real tool instead of describing one.
With a real tool call now actually happening, the model fetched a stored SSH credential directly, and the raw key came back as that tool’s output, flowing straight into the chat response in plaintext.
The credential vault tool it called was built for a trusted caller to fetch a secret and consume it immediately inside the same operation, never to hand raw key material back through a conversation where it could be echoed, summarized, or persisted to history.
Desk’s own model isn’t that kind of trusted caller. Fixing the narration bug had made the leak possible to trigger in the first place, because before that fix the model was never getting far enough to actually call the tool.
The fix is a hard block. Desk chat can no longer read an existing credential back through its own tool-calling loop, on either the streaming or non-streaming path. Storing a new one still works. Reading one back returns a clear explanation instead of the secret.
While we were in that code, we also found that the anti-fabrication guardrail we’d shipped a few days earlier, built to catch exactly the kind of fake uptime report that started this whole chain, missed a fabricated disk-usage table completely.
It had been tuned to the specific wording of one incident rather than the general shape of fabricated command output. That’s fixed too. It now recognizes device paths, standard command-output column headers, and the kind of “this reflects the actual state of the system” language a model reaches for when it’s trying to sell you on invented data, regardless of which command it’s pretending to have run.
Smaller things worth knowing about
Exporting a document from Desk or JOT used to trigger a silent download the moment generation finished. No filename, no confirmation, just a file appearing wherever your browser puts downloads. It now shows a small popup first: file icon, filename, one download button, so you see what’s ready before it lands anywhere.
Gemini 3.6 Flash, Google’s successor to 3.5 Flash, was already selectable in the model dropdown but missing from the internal registry Collab’s conductor uses to actually pick models. Added.
Changelog updates in v1.9.4
Real streaming on every provider. Desk answers now stream token by token over each provider’s own wire format, Claude, OpenAI, Groq, Gemini, Mistral, Cerebras, xAI, OpenRouter, and Ollama alike, with automatic fallback to a full-response reply if a stream can’t be established.
30–60 second replies fixed. A chain of independent causes, hidden chain-of-thought leaking from the local model, a recall channel silently failing every call, and streaming itself quietly falling back to non-streaming, all traced and fixed. Typical latency dropped to single-digit seconds.
SSH approval hangs fixed. A full protocol trace found every SSH write silently defaulting to the wrong port. 75–95 second hangs are now 1.4 seconds.
Provider fallback is health-aware everywhere. A provider that just failed gets a real cooldown scaled to the actual error, instead of every caller retrying a known-dead provider cold.
Ollama gained native tool-calling on the streaming Desk path, including the full MCP tool catalog, with loop- and narration-detection for models that can’t reliably call tools.
One unified Desk/Agent tool registry, replacing two separate, driftable lists of which tools actually exist and are connected.
A guided, resumable GUI activation wizard for first-run setup: licence validation, provider setup, security defaults, connections, and live diagnostics.
JOT exports to real PDF, Word, or PowerPoint, generated server-side from the note’s actual Markdown, not a plain-text dump.
15 stale hardcoded model defaults corrected across the SDK, plus a systemic JSON-parsing bug fixed across every “ask the LLM for structured data” feature.
JOT’s side panel got a resizable, persisted chat history list and usage-based sorting for templates and notes.
Upgrading
Drop-in from any prior version, same as always. Your memory database stays untouched.
npm install -g ./vektor-slipstream-1.9.4.tgz
Full changelog with everything not covered here is at vektormemory.com/docs/changelog. Questions or feedback, the forum’s the fastest way to reach us.
VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads at vektormemory.com.
Top comments (0)