---
title: Changelog
order: 4
description: Notable changes to BxLens.
icon: lucide:list
---

# Changelog

This project follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The source file is `changelog.md` in the repository.

## Unreleased

### Added

- [Lensy sets up notifications](../console/notifications.md#set-it-up-with-lensy) in plain words: two read tools (`alertRules`, `notifications`) and five tools that change something and wait for Approve (`alertRuleSet`, `recipientSet`, `recipientRemove`, `reportSchedule`, `notificationsSet`). It cannot change the SMTP server or password.


- [Email reports](../console/email-reports.md) (BoxLang+): a daily, weekly and monthly report for admins, built from what every server saved (traffic, failures, mail, capacity, alerts, top errors, outgoing HTTP), set against the period before. A schedule with a time and zone, a preview in a locked frame and Send now. One server sends, once. Each server now saves one small `daily` document per day.


- [Notifications](../console/notifications.md) (BoxLang+): email alerts for 15 critical conditions on every server (server down, deadlock, heap pressure, disk space, error spike, failed requests, slow site, datasource pool, executors, tasks, outgoing HTTP, mail, AI, security, log errors), all off until switched on. A Settings tab for the SMTP server (Lens sends the mail itself, Jakarta Mail is bundled, the password stays in an environment variable or a `bxsecret:`), the recipients with their severity and categories, and every limit. One server sends for the cluster (the lowest id that is alive), mails are firing, reminder and resolved, grouped per person, limited per hour, with a pause.

- Volumes on the [System page](../console/system-and-threads.md) (Free): every mounted volume with size, used, free, a read only flag and a status (`volumes.warnPct`, `volumes.critPct`), and the folders BoxLang and Lens use with the volume of each, who uses it and whether Lens writes there.
- The Mail, ORM and Queries pages can show another server (BoxLang+), read only, from its health snapshot.
- A health snapshot every server saves each minute, and a **Servers** table on the Overview. With BoxLang+ the System, Executors, Tasks, Datasources, Caches, Requests and In flight pages can show another server, read only, with a banner and the time it was saved. See [The server selector](../console/servers.md).

- The [Mail](../console/mail.md) page (BoxLang+, three counters and ten messages on Free): messages sent through bx-mail with a locked preview, delivery steps, servers, the spool with send again and discard, and the settings. Opt in with `collectors.mail.enabled`; it needs a bx-mail that announces the `onMail` events.

- [Lensy](../console/ai.md#servers-lensy-can-ask-mcp) can ask MCP servers: the eleven Ortus documentation servers (all off) and servers the admin adds, with a per server list of allowed tools, an approval for custom servers and addresses checked on the server. See the [threat model](../security.md#mcp-servers).
- The assistant is now called Lensy, with a mascot, in the drawer, the AI page and the bar.
- The [Lensy](../console/ai.md) (BoxLang+): a chat with 32 [tools](../reference/ai-tools.md) over the data of the console, JVM introspection (threads, deadlocks, GC pressure, executor recommendations, a health sweep) and the bundled docs, on a local Ollama by default. Actions need an Approve click. New AI page, bar Ask link and live `ai.*` settings. See the [threat model](../security.md#lensy-threat-model) and [Set up Ollama](../guides/ollama.md).
- Server identity on every record: host, address and an instance id on requests, errors, reports, query statistics, in flight entries, the audit log and the disk store files, plus `lensServer()`. See [`server`](../configuration.md#server) and [Server identity](../features.md#server-identity).
- Five BIFs that return the console data as plain structs and arrays, in any request: `lensReport`, `lensErrors`, `lensQueries`, `lensInflight` and `lensLicense`. See [Data functions](../guides/bifs.md#data-functions).
- The [BIFs panel](../panels/bifs.md) and the `collectors.bifs` collector: time per built-in function, from `postBIFInvocation`. It is heavy and off by default. It needs a BoxLang build with core pull request 657.
- The [Modules page](../console/modules.md) in the console: every loaded module, nested ones too, with version, state, path and what it provides.
- `/~bxlens/` with a trailing slash opens the console. On MiniServer it also needs a pass predicate, see [The console URL](../guides/production.md#the-console-url).
- Live settings: the console Settings page is editable. Changes apply at once, are saved to `config/bxlens-settings.json` (or `console.overridesFile`), survive restarts and win over `boxlang.json`, with a reset per setting. `console.readOnly` refuses every change from the console. See [Console settings](../console/settings.md) and [Live settings](../configuration.md#live-settings).
- Roles and access: `console.viewerPassword` for a view-only role, proxy header trust (`access.trustProxyHeader`, `access.proxyHeader`, `access.proxyPeers`), `console.requireHttps` with a warning banner for plain HTTP, and an audit log, `bxlens-audit.log`. See [Security](../security.md).
- Console pages: [Datasources](../console/datasources.md), [Caches](../console/caches.md), [Logs](../console/logs.md), [Environment](../console/environment.md) with a diagnostic bundle (BoxLang+), [In flight and Queries](../console/in-flight-and-queries.md), [Errors and Reports](../console/errors-and-reports.md) and [Ask Lens](../console/ask-lens-and-ai.md).
- System page: Run GC, heap dump (BoxLang+, `console.allowHeapDump`, admin only, off by default) and a deadlock banner that shows the cycle. See [System and Threads](../console/system-and-threads.md).
- Free and BoxLang+ split. Free keeps the bar and most of the console. BoxLang+ or a trial adds request cost and the slow request sample, task actions (Run now, pause, resume, reload), cache value, evict, reap and clear, log download, the diagnostic bundle, heap dumps, saving or resetting a bar layout, AI calls from the server, the disk store (errors and reports saved, totals since first install, a longer minute series) and a request history longer than 25. A locked item shows a "BoxLang+" note and the server answers 403 (AI answers 409). The split is the current state and may change. See [Licensing](../licensing.md#free-and-boxlang).
- Optional AI help (`ai.*`): copy a redacted prompt, open ChatGPT or Claude, and Explain with AI and Ask Lens through the `bx-ai` module. `bx-ai` 3.4.0 ships inside the module, in `modules/bxai`, so there is nothing to install. Lens still loads if it is removed. The server calls need BoxLang+ or a trial.
- New settings under `console`, `access`, `store`, `ai` and `collectors`. `checks.*` and `dev.*` are now declared in the schema. See [Configuration](../configuration.md).
- A standalone console at `/~bxlens/index.bxm` with a password login, per-address lockout, CSRF protection, a strict Content-Security-Policy and no external requests. Pages: Overview, Requests, Executors, Tasks, System, Threads, Bar designer and Settings. See [Console](../console/index.md).
- Live executor health from BoxLang's own health reports, and scheduled tasks with status and metrics. Run now, pause, resume and reload need BoxLang+.
- A Server-Sent Events stream for live data, with polling as the fallback.
- Bar designer: choose and order the bar's tabs. Saving a layout needs BoxLang+. The layout is saved in `config/bxlens-layout.json`.
- Bar: Open console button and a More menu (open in console, copy request JSON, copy id, detach).
- Request cost (BoxLang+: CPU time and bytes allocated by the request thread), response headers in the Request panel, a slow request sample (BoxLang+) that names the template and line, and security Notes for missing headers and cookie flags.
- `collect.level` (`off`, `light`, `full`) and `tabs.hide`.
- License detection through `bx-plus`, with Plus, Trial, Expired and Free states. See [Licensing](../licensing.md) for what Free and BoxLang+ include.
- Phosphor icons, vendored (MIT).
- Request-level debug bar for BoxLang web apps. It is off by default and limited to local and private callers.
- Panels: Issues, Timeline, Queries, Templates, HTTP, Exceptions, Messages, Timers, Cache, Modules, Request, Scopes, Runtime and History.
- Issues engine for N+1, slow queries, slow templates and functions, slow requests, HTTP 4xx and 5xx, and exceptions.
- BIFs: `lensMessage`, `lensDump`, `lensStart`, `lensStop`, `lensMeasure`, `lensAddMeasure`, `lensException`, `lensEnable`, `lensDisable`, `lensIsEnabled`, `lensRender` and `lensPanel`.
- Extension points `onLensRegister`, `onLensRequestStart`, `onLensCollect` and `onLensRequestFinish`, with built-in renderers.
- In-memory History of the last 50 requests, including JSON and SSE.
- Floating detach window, resizing, keyboard shortcuts, light and dark themes, and persisted UI state.
- Server-side redaction and size limits.
- Demo harness, Playwright end to end tests and generated documentation screenshots.
- Documentation site built with bx-sites.

### Changed

- The bar and the console are switched independently, and both are off by default. `enabled` became `bar.enabled`, and `access.allowedIPs` and `access.allowPrivateNetworks` became `bar.access`. The default `bar.access` is loopback only. See [Moving from older settings](../configuration.md#moving-from-older-settings).
- BxLens is a product of Ortus Solutions under the BoxLang+ proprietary license (freeware with limits) and is no longer described as open source. See [Licensing](../licensing.md).
- The queries collector id and the console Queries page share `collectors.queries.enabled`. The `logs` collector (per request) is separate from `logfiles` (the console Logs page).
- `X-Forwarded-Proto` is believed only from a trusted proxy peer.

### Not in v1

- `lensDumpHeap` and the `bx:lens` component. Thread dumps and heap dumps are in the console.
- Java collectors and custom UI extensions.
- Comparing requests, and loading the detail of an earlier request from History.
- SOAP events. They need core changes.