Release notes
0.5.0 adds bots and webhooks, server-wide search, persistent notifications, a new composer, and desktop apps. Read the upgrade notes before you upgrade: review permissions, update configuration, and plan downtime.
The rise of the machines is finally upon us! Create bot accounts that post, reply, and react through the same API as members: ConnectRPC, realtime websocket protocol, inbound and outbound webhooks, and even a built-in MCP server make it easy to supercharge your Chatto server with integrations, chatbots, and more, while keeping things transparent and safe for your human users.
Find that old conversation from last year/month/week! Chatto now ships with search built-in. Find stuff within a single room, a server, or even across all your connected servers.
We now have a desktop app! It’s available for macOS, Windows, and Linux, and features auto-updates, native notifications and screen sharing on all platforms.
An all-new notifications feed that shows you everything that’s happened until you dismiss it, with an equally all-new configuration matrix that lets you choose just how much Chatto can bug you when someone posts in that one channel.
Chatto now ships with not just one, but two composers; the Visual Composer gives you the same WYSIWYG editing experience you know from previous versions, but the new Markdown Composer gives you the true Markdown source editing experience with some extra syntax highlighting niceties on top. Both editors feature a useful formatting toolbar, and we’ve also added support for Markdown tables and footnotes.
Some rooms are better with threads, others… maybe not. Rooms can now be configured for one of four different threading modes, ranging from “we don’t have threads in this house” to “threads everywhere or else”.
That one private room not everyone is supposed to freely join? You can now lock it down and manually invite users to it. You’re welcome.
Chatto 0.5 features an all-new attachment upload UI that will show you upload progress as it goes. Isn’t technology incredible? To top it off, it also ships with an all new attachment viewer that lets you zoom and pan around images and will even render HTML attachments (yes, h4x0rs, it’s sandboxed.)
Voice boosting, an optional noise gate, and per-participant volume make voices easier to hear. Calls now also auto-highlight the current speaker and let you manually pin a video tile if that’s what you prefer.
You can now embed Mermaid diagrams, SVG images, and even ANSI art in code blocks.
Chatto is now available in 22 languages. More will be added over time.
Choose an accent color, a flat or 3D style, and a contrast level from soft to pure black and white. Make the entire damn thing look the way that feels good to you. It’s fine.
On top of giving a room a description, you can now also publish room notices and pin messages for every memember to see.
# to find and link a room. Use the emoji picker or shortcodes to add
emoji, including skin-tone variants.<https://example.com>, to send it without a preview.message.manage can edit their own messages after the edit
window.Administrative and moderation permissions stay off during normal use. Enable privileged mode for 15 minutes when you need them. The event log records each activation.
A new server opens a setup wizard for the server name and the owner account. You do not need a command line or email delivery for the first login.
Want to control who’s joining your server? Set the whole thing to invite only and hand out invite codes to the people who you actually want on there. Invite codes will work with any registration method (email/password, SSO, …) you’ve configured.
Members can add several verified email addresses. Operators can turn off password login for SSO-only servers, and send email through JMAP.
Restrict OIDC sign-in by group and map groups to Chatto roles. Login providers can also manage usernames and prevent members from disconnecting their account link.
Recommend other Chatto servers in a public directory. Members find them in the Server Directory.
Servers with a long history replay faster and use less memory. Optional encrypted snapshots shorten restarts further.
Administrators can deactivate an account to stop access and keep its data, reactivate it, or delete it.
Show online and registered member counts on your website with Shields.io badges.
chatto init for guided configuration, and chatto config check to find
unknown or deprecated settings before deployment.docker compose run. See
Backup and restore./.well-known/change-password. Make sure that your reverse proxy
forwards this path.nats.embedded.sync_interval to control how often
embedded NATS writes to disk.Bots use the same ConnectRPC API and realtime connection as the Chatto client. Direct messages, mentions, and replies activate a bot through normal notifications.
Post into rooms with incoming webhooks, including Grafana alerts without a custom template. Outbound webhooks send signed requests when someone mentions a bot or sends it a direct message.
Use @chatto/client
for requests, live state, reconnects, and bot message handling. The npm
package has no required UI framework and includes TypeScript declarations.
The realtime connection starts from an exact snapshot, sends semantic events, and resumes after a short disconnection without a full reload.
Connect AI assistants to Chatto through MCP. They read and post messages with the permissions of the member or bot that authorized them. This feature is experimental.
These notes cover the upgrade from 0.4.26, the last stable 0.4 release.
Version 0.5 adds new permissions. When a 0.4 server starts with 0.5 for the first time, Chatto adds these grants one time, so that existing access does not change:
message.read for everyone at server scope. Members can read messages as
in 0.4.room.remove-member for each role and user that had room.ban-member, at
the same scope. room.ban-member has no effect in 0.5. Active bans continue
as suspensions.call.* permission for everyone.Chatto does not add these grants again. If you remove or deny one later, it does not return.
Do these steps on every upgraded server:
user.manage-invites and bot.manage to the admin role if
administrators must manage all invitation codes and bots. Grant user.invite
to members who need to create and manage their own codes.bot.create to the roles that can create bots. A new server grants
it only to admin.room.manage to delegated room managers. Room group management
used role.manage in 0.4.message.post for admin and owner in the announcements room
if they must post there without privileged mode. A new server has these
grants, but an upgraded server keeps its current settings.message.post now also allows thread replies. A
0.4 setup that allowed message.post and denied message.post-in-thread now
allows replies.everyone denies. An allow for a named role or a user now
overrides an everyone deny at the same or a narrower scope.Administrators, moderators, and the owner must now enable privileged mode before
they use their administrative permissions. This also applies to custom
room.create grants. Owners also need privileged mode to see, join, or read
rooms that deny these actions to everyone when no explicit grant allows
access. Give the owner role a room-level allow if owners need this access
during normal use.
See Permissions for the complete list.
video.ffmpeg_path,
video.ffprobe_path, video.max_concurrent, and video.temp_dir to
asset_processing.ffmpeg_path, asset_processing.ffprobe_path,
asset_processing.max_concurrent_jobs, and asset_processing.temp_dir. Set
asset_processing.enabled = true, or new videos stay in processing. Chatto
ignores the old keys without an error. New videos use HLS; existing MP4 videos
continue to play. See Video processing.core.assets.max_upload_size for all
attachments, including GIFs and videos. Remove video.max_upload_size; until
you do, the larger limit applies to all files. The default is now 25 MB for
every file. Set 100MB explicitly if you need to keep the old default video
allowance. See Upload limits.[core.assets.cache], CHATTO_CORE_ASSETS_CACHE_ENABLED, and
CHATTO_CORE_ASSETS_CACHE_TTL. The asset cache is always enabled and keeps
entries for seven days. See Asset cache upgrades.webserver.oauth_redirect_origins. Clients on other origins no longer
need configuration. Use webserver.allowed_origins only for additional
origins of the bundled client behind your reverse proxy. Chatto does not
start if an origin has a path, or if one host has both an HTTP and an HTTPS
origin.[search] and
[search_provider]. See Search.--passphrase. Use --passphrase-file or
--passphrase-stdin in scripts.chatto_service_info metric is removed. Use chatto_model_info.Regenerate every custom client from the 0.5 protobufs. The public API and the realtime protocol have breaking changes, and 0.5 servers accept only realtime protocol 4. See API compatibility.
The generated GitHub release lists every PR and commit: github.com/chattocorp/chatto/releases/tag/v0.5.0