HomeDesktop Documentation
LumiChats Desktop
v1.0.0Windows

Research and build,
from one place.

You ask a question. It searches the web, opens and reads the sources, runs commands and Python on your machine, writes real files — Word, PowerPoint, PDF, spreadsheets, charts — and shows you every source it used and whether it actually read it.

That last part is the reason this exists. A report citing twenty-six sources it never opened looks exactly like a report citing twenty-six sources it read. This app can tell you which one you have.

Install

Windows 10 or 11, 64-bit. The installer is about 167 MB and covers both Intel/AMD and ARM machines. macOS and Linux builds exist in the build configuration but are not published yet.

1

Download the installer

Get LumiChats-Setup-1.0.0.exe from the downloads page.

2

Get past the SmartScreen warning

Windows will say it protected your PC. Choose More info, then Run anyway. This happens because the build is not code-signed yet — see below.

3

Choose where it goes

The installer asks. It installs for the current user, so it needs no administrator password.

4

Sign in

First launch opens your browser to lumichats.com and returns a token to a local port. The same account works in the Lumi CLI — signing in here signs you in there.

Why Windows warns about it

A code-signing certificate has to be bought from a certificate authority, and this one is not funded yet. Without it Windows has no publisher name to check, so SmartScreen shows an unrecognised-app screen and hides the Run button behind More info.

We would rather say that plainly than let you meet it unwarned. The warning is about who vouched for the file, not about what the file does — but you have no way to know that from the dialog, which is precisely the problem with shipping unsigned. If you want to check the download yourself, every release publishes a SHA-256 hash:

PowerShell
certutil -hashfile LumiChats-Setup-1.0.0.exe SHA256

# Compare the result with SHA256SUMS.txt on the release page.
Because the build is unsigned, Windows reputation is tracked per file hash and never accumulates across releases — so this warning will not “wear off” over time. It goes away when there is a certificate, and not before.

Your first question

Type a question and press Enter. There is nothing to configure first. A good opening question is one with a deliverable in it, because that exercises the part of the app that is unusual:

Ask
Research the current state of solid-state batteries
and write it up as a paper with citations

What happens next, in order:

It searches, several phrasings at a time, and opens the results that look primary rather than summarised.

Each page it opens is recorded — the query that found it, the quote it used, and whether it was read or only appeared in a result list.

It writes and runs Python locally to build the document, then re-opens the file to check it is valid.

The finished file appears in the thread and in Documents. Charts are drawn inline; you do not have to open another application to see them.

Press + to see everything the app can do, grouped by what you are trying to produce, or / to filter the same list by typing. Both are faster than describing the format you want in prose.

The Lumi tiers

You choose how much power to spend on a question, not which model answers it. The control sits on the composer bar; the tier applies to the next run.

Lumi NormalEveryday

Quick answers and small edits.

Short questions, quick lookups, a paragraph rewritten, a small file changed. Fastest to respond and the right default when you already know what you want.

Lumi UltraMost capable

Hardest problems, longest tasks. Slower.

Long autonomous runs, research that has to cross-check itself, problems where being right matters more than being quick. Worth the wait when the alternative is checking the answer by hand.

Lumi CodeCoding

Tuned for reading and writing code.

Reading an unfamiliar codebase, writing changes that match its conventions, working through a failing test. Point it at a project folder and it can read, edit and run.

Why the tiers are not named after models. A tier is a promise about how much capability you get, and keeping that promise means changing what runs underneath as better models appear. If the tiers were named after specific models, every such improvement would be a rename, a documentation change and a support conversation — and the product would be frozen to whatever was true the day it shipped. Choose the tier that matches the work; the routing gets better without you doing anything.

What it makes

Every one of these is produced by running Python on your machine, not by templating a string and renaming it. Each has a skill telling the model how to build that format properly and to re-open the file afterwards to confirm it is valid — the check that catches a .docx no word processor will open.

Document

Word, with real heading styles

A genuine .docx with a proper style tree — not a text file renamed. It re-opens the file afterwards to confirm Word will accept it.

Slides

PowerPoint at 16:9

A .pptx at 16:9, one point per slide, and the slide count verified after saving.

PDF

Typeset, with page numbers

A typeset report rather than a printed web page. Page count checked afterwards.

Chart

Computed exactly, not sketched

A matplotlib figure with both axes labelled and units given, drawn from the real numbers and titled with the finding rather than the variable.

Data

Spreadsheet and CSV analysis

Inspects the file's shape before computing anything, states n alongside every aggregate, and never overwrites your source file.

Research

Cross-checked, with citations

Searches several phrasings, opens the primary sources, cross-checks every number against a second source, and finishes with numbered references and a confidence section.

Paper

Long report with references

Outline first, then figures, then body, then abstract and conclusion, then references — in that order, because the alternative is an abstract that promises what the body does not deliver.

Verify

A second pass over the last answer

Re-reads what was just produced and checks it against the sources gathered. The single most useful button on a long piece of work.

A command that exits 0, prints nothing and changes no file is reported as exactly that — never as a success. Silent failure is how a task “finishes” having produced nothing.
These need Python, and the app installs it for you. All of them are built by running Python, and a new Windows machine does not have it. LumiChats checks — properly, by running it, not by looking for a file — and offers to install it in one click. It shows you the exact command first, installs for your user only so there is no administrator prompt, and picks the new installation up without a restart. If you decline, everything else still works and it never asks again; Help → Install Python… is there when you want it.

Sources, and whether they were read

Every page fetched is recorded with the query that found it, the quote used, and whether it was actually opened or only appeared in a result list. The Sources sheet shows all of it, filters by title, site, quote or query, and exports to CSV.

Each conversation keeps its own ledger in its own file, so the sheet is never a mix of two threads' research. It survives closing and reopening the conversation.

ReadThe page was opened and its text used. A quote is attached.
UnverifiedIt appeared in a result list and was never opened. Counting these as sources is the failure the ledger exists to prevent.
ConflictedAnother source contradicts it. Flagged rather than silently resolved.
Used inWhich produced file the source ended up supporting.
A percentage or citation written into a document must trace to something the system actually read, fetched, or watched a command print. If it cannot, the write is refused and the figures are named. This catches invention. It does not catch a real figure attached to the wrong year — read the sources for anything that matters.

Permission modes

The app runs programs on your machine on purpose — that is how it produces real files. These three modes decide how much it may do without asking, and the control is on the composer bar next to the tier.

Ask before changesDefault

You approve every file change and every command before it happens. The preview shows exactly what will be written or run.

Auto-apply edits

File edits apply straight away so a long task does not stop for each one. Commands still ask, because a command can do things an edit cannot.

Read-only

It can look and search and never change or run anything. This means it — which is what makes it safe to point at a real project you care about.

The first request to a website in a conversation asks; later ones do not. So reading twenty pages from one site costs one prompt, and an unfamiliar name costs one prompt. Any URL past 512 characters asks regardless, because that is the shape of an address carrying a payload.

The window

Sidebar

Conversations and Documents, as two tabs. Deleting a conversation deletes its transcript, its recall index and its source ledger too — all of it, not just the row.

Composer

The tier, the permission mode, the working folder, and a Sources button that appears once the conversation has actually gathered something. A permanent “Sources 0” is a control that teaches you to ignore it.

Document viewer

Markdown, text and CSV open in a panel that takes width from the thread rather than covering it, so the answer and the file it produced are on screen together.

Working folder

Where files are read and written. Point it at a project and the agent can read, edit and run inside it — and nowhere else.

Keyboard

EnterSend
Shift + EnterNew line without sending
/Slash menu — filter every command by typing
+Everything the app can do, grouped
EscStop the current run; close a menu, the viewer or a dialog
Ctrl + NNew conversation
Ctrl + [Collapse or expand the sidebar
TabIn the slash menu, complete the highlighted command
↑ / ↓Move through the slash menu

Where your data lives

Everything is on your machine, under %USERPROFILE%\.lumichat — the folder you would back up, and the folder to delete if you want to remove every trace of the app after uninstalling.

library/chats.jsonThe conversation index
library/documents.jsonFiles the agent produced
sessions/<project>/<id>.jsonlFull transcripts, append-only
recall/<id>.jsonlMessage chunks and their embeddings, for recall across a long thread
evidence/<id>.jsonEvery source, with quotes and read or unread status
skills/The bundled skills, unpacked on first run
config.jsonYour sign-in token and tier choice — and nothing else
LUMI_DATA_DIR moves the research — transcripts, documents, the source ledger — somewhere else. It does not move config.json, which stays put because it is shared with the Lumi CLI: one login, one place to revoke it. Worth knowing before pointing the data directory at a drive you share or sync.
There is no analytics service, no crash reporter, and no background upload of your files. Your questions go to the model that answers them and pages the agent fetches are requested from the sites hosting them. That is the complete list — see the privacy policy.

Security

The window displays text the app did not write — model output, fetched pages, file contents — and the agent runs programs on your machine deliberately. So the model is containment, visibility and reversibility, not a sandbox. The claims below are each held down by a test.

Your files

Every file tool resolves through one guard that canonicalises both sides of the containment check, so a symlink or an NTFS junction cannot walk out of the working folder.

Secrets are refused by name, by shape and by directory — .env files, any private key, .ssh, .aws, .gnupg, and the app's own data folder. That last one matters more than it sounds: the working folder is chosen freely, and picking a home directory used to make the sign-in token readable.

The agent cannot write its own permission rules or hook commands. A page that talked it into writing one file could otherwise have removed the permission system and installed a command that runs every turn.

The window

Context isolation on, Node integration off, sandbox on, no webview. The developer tools and the test injector are absent from packaged builds.

HTML documents are shown as source, never rendered. The content policy blocks iframes, so there is no sandbox to put them in, and injecting web-derived markup into the app's own privileged origin is exactly what that policy exists to prevent. A browser is on every machine; a markdown viewer is not.

Inline images accept base64 raster only. SVG is excluded, because it can carry script.

The network, and code that comes with a folder

Private, loopback and cloud-metadata addresses are refused, and every redirect hop is re-checked.

A project can carry its own hooks and tool servers. They do not run until you have seen the exact commands and agreed, per folder. Editing the file asks again. With no one to ask, none of it loads.

Reporting a vulnerability: security@lumichats.com. The full statements are on the security page and inside the app under Help.

Updates

Installed copies keep themselves current without interrupting anything. The design is shaped by one fact about this app: a run can be twenty minutes of searching, downloading and reading, and it lives in memory. An updater that restarts the app to be helpful destroys work that cannot be recovered.

ChecksOnce a day, starting about 45 seconds after launch — never competing with the first paint or your first question.
DownloadsIn the background, silently. Bandwidth is cheap; interruption is not.
InstallsThe next time you quit. You close the app when you are finished, which is by definition the moment nothing is in flight — and the next launch is already up to date.
Offers restartOnly when nothing is running, and only once per download. Enter does not restart.
On demandHelp → Check for updates… — and unlike the daily check it tells you the outcome either way, because an explicit check that says nothing looks broken.
From sourceNever checks. There is no feed to read from an unpackaged tree.
Releases are published as public files on GitHub, so the daily check reaches GitHub rather than us — we get no record of who checked or who updated. Every download must match the SHA-512 recorded in the release manifest before it is allowed to install, so a tampered or truncated file is discarded rather than run.

Extensions

All of these load per working folder, so a project can carry its own setup and a different project is unaffected.

MCP serversDeclared in mcp.json. Their tools appear alongside the built-in ones.
Custom agentsSub-agents with their own instructions and tool sets, for work you do repeatedly.
HooksCommands that run at defined points in a turn. Shown to you in full and approved per folder before any of them run.
SkillsProse instructions telling the model how to do something properly. The bundled ones cover each document format; a project can add its own.
.lumi/settings.json and .lumi/mcp.json are not writable by the agent, and that is deliberate. They supply the permission rules and the hook commands — so a single file the agent could write would be enough to remove the permission system and install a command that runs every turn.

Troubleshooting

Still stuck? support@lumichats.com — include the version from Help, and what you were doing.

Ask it something that needs a document.

That is the shortest way to see what is different about it — a real file, built by running code on your machine, with every source it used listed and marked read or unread.