Research and build,
from one place.
You ask a question. It searches the web, opens and reads the sources, runs commands and Python on your machine, writes real files — Word, PowerPoint, PDF, spreadsheets, charts — and shows you every source it used and whether it actually read it.
That last part is the reason this exists. A report citing twenty-six sources it never opened looks exactly like a report citing twenty-six sources it read. This app can tell you which one you have.
Install
Windows 10 or 11, 64-bit. The installer is about 167 MB and covers both Intel/AMD and ARM machines. macOS and Linux builds exist in the build configuration but are not published yet.
Download the installer
Get LumiChats-Setup-1.0.0.exe from the downloads page.
Get past the SmartScreen warning
Windows will say it protected your PC. Choose More info, then Run anyway. This happens because the build is not code-signed yet — see below.
Choose where it goes
The installer asks. It installs for the current user, so it needs no administrator password.
Sign in
First launch opens your browser to lumichats.com and returns a token to a local port. The same account works in the Lumi CLI — signing in here signs you in there.
Why Windows warns about it
A code-signing certificate has to be bought from a certificate authority, and this one is not funded yet. Without it Windows has no publisher name to check, so SmartScreen shows an unrecognised-app screen and hides the Run button behind More info.
We would rather say that plainly than let you meet it unwarned. The warning is about who vouched for the file, not about what the file does — but you have no way to know that from the dialog, which is precisely the problem with shipping unsigned. If you want to check the download yourself, every release publishes a SHA-256 hash:
certutil -hashfile LumiChats-Setup-1.0.0.exe SHA256 # Compare the result with SHA256SUMS.txt on the release page.
Your first question
Type a question and press Enter. There is nothing to configure first. A good opening question is one with a deliverable in it, because that exercises the part of the app that is unusual:
Research the current state of solid-state batteries and write it up as a paper with citations
What happens next, in order:
It searches, several phrasings at a time, and opens the results that look primary rather than summarised.
Each page it opens is recorded — the query that found it, the quote it used, and whether it was read or only appeared in a result list.
It writes and runs Python locally to build the document, then re-opens the file to check it is valid.
The finished file appears in the thread and in Documents. Charts are drawn inline; you do not have to open another application to see them.
The Lumi tiers
You choose how much power to spend on a question, not which model answers it. The control sits on the composer bar; the tier applies to the next run.
Quick answers and small edits.
Short questions, quick lookups, a paragraph rewritten, a small file changed. Fastest to respond and the right default when you already know what you want.
Balanced
Thinks things through. Good for most work.
The tier to reach for unless you have a reason not to. Multi-step research, a document with structure, code that has to fit an existing project. Slower than Normal and markedly better at anything with more than one part to it.
Hardest problems, longest tasks. Slower.
Long autonomous runs, research that has to cross-check itself, problems where being right matters more than being quick. Worth the wait when the alternative is checking the answer by hand.
Tuned for reading and writing code.
Reading an unfamiliar codebase, writing changes that match its conventions, working through a failing test. Point it at a project folder and it can read, edit and run.
What it makes
Every one of these is produced by running Python on your machine, not by templating a string and renaming it. Each has a skill telling the model how to build that format properly and to re-open the file afterwards to confirm it is valid — the check that catches a .docx no word processor will open.
Word, with real heading styles
A genuine .docx with a proper style tree — not a text file renamed. It re-opens the file afterwards to confirm Word will accept it.
PowerPoint at 16:9
A .pptx at 16:9, one point per slide, and the slide count verified after saving.
Typeset, with page numbers
A typeset report rather than a printed web page. Page count checked afterwards.
Computed exactly, not sketched
A matplotlib figure with both axes labelled and units given, drawn from the real numbers and titled with the finding rather than the variable.
Spreadsheet and CSV analysis
Inspects the file's shape before computing anything, states n alongside every aggregate, and never overwrites your source file.
Cross-checked, with citations
Searches several phrasings, opens the primary sources, cross-checks every number against a second source, and finishes with numbered references and a confidence section.
Long report with references
Outline first, then figures, then body, then abstract and conclusion, then references — in that order, because the alternative is an abstract that promises what the body does not deliver.
A second pass over the last answer
Re-reads what was just produced and checks it against the sources gathered. The single most useful button on a long piece of work.
Sources, and whether they were read
Every page fetched is recorded with the query that found it, the quote used, and whether it was actually opened or only appeared in a result list. The Sources sheet shows all of it, filters by title, site, quote or query, and exports to CSV.
Each conversation keeps its own ledger in its own file, so the sheet is never a mix of two threads' research. It survives closing and reopening the conversation.
Permission modes
The app runs programs on your machine on purpose — that is how it produces real files. These three modes decide how much it may do without asking, and the control is on the composer bar next to the tier.
You approve every file change and every command before it happens. The preview shows exactly what will be written or run.
File edits apply straight away so a long task does not stop for each one. Commands still ask, because a command can do things an edit cannot.
It can look and search and never change or run anything. This means it — which is what makes it safe to point at a real project you care about.
The window
Sidebar
Conversations and Documents, as two tabs. Deleting a conversation deletes its transcript, its recall index and its source ledger too — all of it, not just the row.
Composer
The tier, the permission mode, the working folder, and a Sources button that appears once the conversation has actually gathered something. A permanent “Sources 0” is a control that teaches you to ignore it.
Document viewer
Markdown, text and CSV open in a panel that takes width from the thread rather than covering it, so the answer and the file it produced are on screen together.
Working folder
Where files are read and written. Point it at a project and the agent can read, edit and run inside it — and nowhere else.
Keyboard
Where your data lives
Everything is on your machine, under %USERPROFILE%\.lumichat — the folder you would back up, and the folder to delete if you want to remove every trace of the app after uninstalling.
Security
The window displays text the app did not write — model output, fetched pages, file contents — and the agent runs programs on your machine deliberately. So the model is containment, visibility and reversibility, not a sandbox. The claims below are each held down by a test.
Your files
Every file tool resolves through one guard that canonicalises both sides of the containment check, so a symlink or an NTFS junction cannot walk out of the working folder.
Secrets are refused by name, by shape and by directory — .env files, any private key, .ssh, .aws, .gnupg, and the app's own data folder. That last one matters more than it sounds: the working folder is chosen freely, and picking a home directory used to make the sign-in token readable.
The agent cannot write its own permission rules or hook commands. A page that talked it into writing one file could otherwise have removed the permission system and installed a command that runs every turn.
The window
Context isolation on, Node integration off, sandbox on, no webview. The developer tools and the test injector are absent from packaged builds.
HTML documents are shown as source, never rendered. The content policy blocks iframes, so there is no sandbox to put them in, and injecting web-derived markup into the app's own privileged origin is exactly what that policy exists to prevent. A browser is on every machine; a markdown viewer is not.
Inline images accept base64 raster only. SVG is excluded, because it can carry script.
The network, and code that comes with a folder
Private, loopback and cloud-metadata addresses are refused, and every redirect hop is re-checked.
A project can carry its own hooks and tool servers. They do not run until you have seen the exact commands and agreed, per folder. Editing the file asks again. With no one to ask, none of it loads.
Updates
Installed copies keep themselves current without interrupting anything. The design is shaped by one fact about this app: a run can be twenty minutes of searching, downloading and reading, and it lives in memory. An updater that restarts the app to be helpful destroys work that cannot be recovered.
Extensions
All of these load per working folder, so a project can carry its own setup and a different project is unaffected.
Troubleshooting
Ask it something that needs a document.
That is the shortest way to see what is different about it — a real file, built by running code on your machine, with every source it used listed and marked read or unread.