# DisPatch 3.0: Family Profiles, a Setup Wizard and Agents That Ask First

URL: https://www.laserlloyd.com/projects/dispatch-3-family-profiles/
Published: 2026-10-19
Description: What's new in DisPatch 3.0: Owner, Admin, Member and Restricted profiles, quiet hours for kids, a setup wizard, encrypted backups, agent tasks and a safe upgrade from 2.x.
Reuse: free for personal use — full policy at https://www.laserlloyd.com/llms.txt

DisPatch 3.0 is the biggest change since I started the project. Until now the whole access model was one PIN: you either had it and saw everything, or you got Safe Mode. That worked for me. It didn't work for a household where an adult, a teenager and a small child share one install. Version 3.0 replaces it with real profiles, each with its own sign-in and limits, and the server checks every request against the permission it needs. A setup wizard, encrypted backups and agent tasks came with it.

Every screenshot below comes from a fresh scratch install with invented people (Ada, Jo, Max, Mia) and invented chats, using the characters DisPatch ships with. If you have never seen DisPatch, the main DisPatch article covers what it is and how replies reach your phone. This page covers what is new.

TL;DR

Profiles: one Owner, any number of Admins, Members and Restricted profiles. Kids get Restricted: only the characters made for them, a daily time limit, quiet hours, and no settings.
Setup: a six-step wizard creates the owner, connects an AI, adds the family and asks who may reach the app. A new install refuses the network until the owner exists.
AI: one connection per model server, keys kept out of the config file, a Test button, and Atlas as the default character.
Also new: starter packs (Animal Friends for kids, Assistants for adults), voice for Members, every setting in one searchable page, encrypted backups, and agent tasks with budgets and approvals.
Upgrading: 3.0 migrates your 2.x data when it starts, takes a backup first, keeps your PIN working, and has a one-command undo. I tested that path.
Status: 3.0 is on the main branch of the public repo as of 2026-10-19, and it runs my own household. There is no tagged release or zip for it yet. MIT licence, free.

Atlas, the default character, on a MiniMax connection. The three chats below the new one are the guides a fresh install starts with.

What changed for you

Everyone gets their own profile. Tap your name on the lock screen and enter your PIN or password. Each person's limits follow them, not the device or the Wi-Fi address.
Children get a safe corner of the app. A Restricted profile sees only the characters you made for children, cannot change anything, and stops working outside the hours you allow.
The first five minutes are guided. The wizard asks for an owner account, an AI, the family and the network, in that order.
Connecting an AI is a form, not a file edit. Pick the provider, paste the key, press Test.
Ready-made characters. Two starter packs install with one click.
Voice for the whole family. With the voice add-on, Members (and Restricted profiles, on their own characters) can talk instead of type.
Backups you can take elsewhere. One button writes an encrypted archive of chats, characters, settings and keys.
Agents that ask first. Hand a job to an agent from any chat, watch it work, approve risky steps, and cap what it may spend.
Docker. docker compose up -d in a clone runs it, on Linux, a Pi or Windows. The Docker article has the full walkthrough.

Profiles for the whole household

There are four roles. In plain terms:

RoleForWhat it can do
OwnerYou. Exactly one.Everything, including host control, backups and the machine API key.
AdminA trusted adultEverything the Owner can, except act on the Owner's own profile or change the install PIN, so nobody can lock the owner out. Signs in with a password.
MemberAn adult or teenChat, voice, pictures, the tools you enabled, notifications, and tidying their conversations. No settings, and no agents unless you grant it. Signs in with a PIN.
RestrictedA child or a guestChat and voice with the characters meant for them. No tools, no agents, no settings, no files. Daily limits and quiet hours apply.

Settings → People & Profiles. "This device" binds a browser to a Member or Restricted profile, so the kitchen tablet opens as Mia with nobody signing in. The line under "People" is older than the 2026-10-19 change: Admins now manage other Admins too.

The Owner can also hand one person an extra permission or take one away. For example, give one Member the right to run agents, or switch voice off for one profile. A Restricted profile can never be given a management permission, and host control can't go to a Member at all.

Limits for children

Each profile can have a daily allowance of minutes, messages, new chats, ratings and upload megabytes, plus quiet hours. Mia's quiet hours here are 20:00-07:00, with 45 minutes and 100 messages a day. Active time is counted from her actual use, so a tab left open overnight doesn't burn her minutes.

Daily limits on a Restricted profile. An empty box falls back to the install default.

Here is what Mia sees. Only the Animal Friends and Atlas are on her rail, because Atlas's audience is "everyone" by default (you can change that). The banner at the top tells her what the owner can see: counts of chats and uploads, never what was said.

A Restricted profile chatting with Otto the Otter from the Animal Friends pack. No tools, no settings, a Sign in button for a grown-up.

Locking the screen is not a way around the limits. The first time a Restricted profile signs in on a device nobody had bound, the device is bound to that profile. So if Mia locks the screen or her session times out, the device opens as Mia again, with the same quiet hours and the same minutes already used that day. That fix landed on 2026-10-19; before it, locking the screen gave a child a fresh guest budget. An unbound device with nobody signed in is a guest on default Restricted limits, and anonymous_access: none hides even that behind the sign-in page.

One thing to know before you rely on it: conversations are one shared household space in this version. Roles control which characters and actions a person can use, not who can read which thread. In my test, Max (a Member) opened the dinner chat Ada had started. If two adults need private threads, 3.0 doesn't give them that.

If you forget the PIN

DisPatch writes a recovery code to RECOVERY-CODE.txt in its data folder when the Owner's PIN is set. On a one-person install, using the code on the lock screen removes the PIN. Once other people have profiles, it asks for a new PIN at the same time and replaces the old one, so the household is never left without a working Owner. An owner with a password can always sign in with that instead.

The setup wizard

A fresh install opens a six-step wizard: your account, a model, voice (optional), family (optional), network, done. You can put it off with "Set up later", and it goes away for good when you press Finish.

Step 1 creates the Owner. A password needs 8 characters, a PIN 4 digits, and at least one of the two is required.

The step that matters for security happens before you see it. A new install is closed to the network until the owner exists. From the computer DisPatch runs on, the wizard asks for nothing. From any other device it asks for a one-time setup token that the server prints in its log (docker compose logs app in Docker). In 2.x, whoever reached a fresh install first could set the PIN and own it. Now they can't.

Step 4 adds the family. Children get a Restricted profile, and Animal Friends is ticked by default.

The network step records whether DisPatch should be reachable from this computer only (the default) or from your home network. It tells you how to start the server to match. The address it listens on is still set by how you launch it, and the wizard warns when the two disagree. Phones need HTTPS for install-to-home-screen, push and the microphone. The repo's docs/remote-access.md covers a reverse proxy or Tailscale Serve.

Connecting an AI

Step 2 of the wizard looks for StudioForge, LM Studio and Ollama on the same computer. If it finds nothing, it takes a type, an address, a key and a model by hand: OpenAI-compatible, StudioForge, LM Studio, Ollama, OpenAI, Anthropic, DeepSeek or OpenRouter. Test and save checks the connection, makes it the default, and points Atlas at it. Settings → Connections offers thirteen types, MiniMax and xAI among them. That's where I added the MiniMax connection Atlas uses in these screenshots.

One connection serves every character that uses it. The card's own model count still read 0 after a successful test (the green box is the real result), a display bug I still have to fix.

Each server is one record now, not a copy pasted into every character. The key goes into the operating system's keyring, or a file only your user can read, and no screen or API ever shows it again. A connection can also read its key from an environment variable you name. Find servers probes the usual ports for StudioForge, LM Studio, Ollama and OpenAI-style servers. It never probes cloud-metadata or link-local addresses, so a mistyped address can't be used to reach internal services.

If you run StudioForge 2.x, it needs an API key whenever DisPatch reaches it from another machine or container. Create an inference key in StudioForge's Users & Keys page and paste it into the connection. Find servers spots a key-protected StudioForge and marks it as needing one.

Starter packs

Settings → Bots → Starter packs. Installing again never overwrites a character you already have.

Animal Friends is six gentle characters for Restricted profiles. They never ask for personal details, they point a worried child to a grown-up, and they have built-in voices with no lookups, quick actions or reactions. Assistants is four helpers for Members: explain, write, code and plan. Each character also has an audience (everyone, members, or restricted) and an optional list of the profiles allowed to see it. The server applies that rule to every list and every live update, not just the sidebar.

Voice for Members

Voice chat is still a separate add-on, DisPatch Voice. Its current release, 1.5.0, works with 3.0, and that's what these screenshots use. They ran the speech models on the CPU of the same machine, with no GPU server. What changed on the DisPatch side on 2026-10-19: Members can now open the call screen, see Settings → Voice, and browse the voice list and samples. Cloning voices, the GPU speech server and the on/off switch stay with the Owner and Admins.

A Member on a phone: the chat, then the call screen after tapping the microphone.

A Restricted profile can use voice too, with its own characters. The voice connection follows the same rules as text: quiet hours are checked when the call starts and again while it runs, and the call's minutes count toward the child's daily limit. Voice 1.6, which moves every voice setting into one Settings page, is on the add-on's main branch but not released yet.

Every setting in one place

Settings → All settings: search, Basic and Advanced views, and a badge on anything an environment variable sets.

Every setting is now described once: its type, default, range, whether it needs a restart, and which environment variable can override it. The All settings page is drawn from that description, and the repo's docs/settings.md is generated from the same source. The older tabs are still there for what hasn't moved over yet. When you upgrade, a setting DisPatch doesn't recognise is kept and listed, not dropped.

Encrypted backups

All settings → System. The three kinds of backup side by side: an encrypted archive, the six-hourly database snapshot, and the copy taken before the 3.0 migration.

Back up now writes one encrypted file with everything you need on a new computer: the database, characters and settings, avatars and the connection keys, plus pictures and files if you tick the box. It is encrypted with AES-256-GCM, and the key comes from your passphrase. If you give no passphrase, DisPatch makes a recovery key and shows it once. I made an archive on the scratch install and ran Verify on it, and it checked out.

The honest catch: the passphrase is saved on the install so scheduled backups can run without you. That means the encryption protects a copy you move off the machine, not the machine itself. Anyone holding the data folder and its keyring already holds the key. Keep the recovery key or passphrase somewhere else, like a password manager or paper. Without it, an archive copied elsewhere is useless. Scheduled backups are off until you turn them on (every 24 hours, the newest 7 kept, by default). A restore checks the archive first and applies at the next start, after copying the current state aside.

Also new: a support bundle for bug reports that removes keys, tokens, PINs and passwords and leaves out conversations, plus an export or erase of one person's profile data.

Agents and tasks

An agent is a configured worker: a backend, a model, instructions, the tools it may use, a budget and an approval policy. A task is one job you hand it, from the Tasks page, an Assign task button in any chat, or an @agent mention. Each task shows a live timeline, any subagents it starts, its files, an estimated cost and its state. Owners and Admins see every task. A Member sees only agents published to them and only their own tasks, and only after you grant that permission. Restricted profiles get none of it.

Settings → Agents. Costs anywhere in DisPatch are labelled estimates, never billing figures.

There are two backends. OpenClaw runs on the same machine and keeps its own tool policy. The Claude Agent runs on the Claude Agent SDK with an Anthropic API key, or Amazon Bedrock, Google Cloud or Microsoft Foundry credentials. A Claude subscription sign-in is not supported, and it needs the optional extra (uv sync --extra agents-claude). On the Claude Agent, anything destructive asks every time and offers only "allow once": a shell command, a file write, anything that sends, posts, deletes or creates. You get a push ping with no content, a line in the chat, and a badge on the rail. Budgets can stop a task by dollars, turns, minutes or tokens, and cap each agent and each person per day.

The limits are real, and the Known limits section below lists them. The short version: I have only run the Claude Agent against recorded and scripted streams, because I had no API key during the build. And approved shell commands are not sandboxed. Routing ordinary OpenClaw chats through the task model (agents.unified_dispatch) is off by default, so if you never open the Tasks page, chat works exactly as it did.

Installing 3.0

If you want the easy route, use Docker. The Docker article walks through it with screenshots, and the repo README has install blocks for Windows and Linux, a Raspberry Pi 4 or 5 included. Without Docker, it's a normal uv project:

git clone https://github.com/LaserLloyd/DisPatch_Chat.git
cd DisPatch_Chat/backend
uv sync
uv run uvicorn app.main:app --port 8765

Open http://localhost:8765 on the same machine and the wizard needs no token. Add --host 0.0.0.0 only once you want other devices in, and read the setup token from that terminal. The README puts the Docker image at about 840 MB, or about 1.7 GB with voice built in. The backend runs natively on Windows too, but the full test suite runs on Linux, so treat native Windows as experimental.

Upgrading from 2.x

You start 3.0 the way you started 2.x. It migrates your data folder before it serves anything:

Look first if you like. From backend/: uv run python -m app.migrate --dry-run --data-dir <your data folder> prints each step and writes nothing.
Start 3.0. When there is something to migrate, it first copies chats.db, config.yaml, security.yaml and trusted-devices.yaml to <data>/backups/3.0.0-<time>/, keeping the newest five.
Your PIN becomes the Owner. The PIN is unchanged and unlocks as before, and remembered devices stay remembered. The Owner has no password yet. DisPatch asks you to set one the first time you do something that needs it, such as creating an Admin.
Your bots become characters. Each gets an audience computed from the old flags: safe plus hide_unlocked becomes Restricted, safe alone becomes everyone, and the rest becomes members. API keys move out of config.yaml into the secret store, and DisPatch reads each key back before removing it.
To undo: stop the server and run uv run python -m app.migrate --restore <data>/backups/3.0.0-<time>, then start your 2.x copy again.

I ran that whole path on a scratch copy. I started DisPatch 2.2.0 on an empty folder, set a PIN and posted a message, then started 3.0 on the same folder. It wrote the backup, ran the migration, and the old PIN signed in as the Owner and asked for a password. Then I stopped it, ran the restore, and 2.2.0 started cleanly on the restored folder.

Three things can bite after an upgrade:

Reverse proxies must keep the Host header. Cookies are now SameSite=Strict, and any request that changes something must come from DisPatch's own origin. Caddy and Tailscale Serve keep Host by default. A proxy that rewrites it gets refused.
Scripts on the same machine still work without a key while machine_loopback_trust is true, which is the default after an upgrade. Give your cron jobs the API key, then turn that off.
Going back to 2.x after the keys moved means restoring the backup. 2.x can't read keys from the secret store.

Fixed since the 3.0 merge

I run 3.0 at home, and a day of real use found problems the test suite didn't. These are all on main:

Live replies from OpenClaw 2026.10 stream again. That release sends only the new text after the first chunk. DisPatch read the full message each time, so a reply showed its first words, froze, then appeared all at once.
Messages no longer fail under load. With several devices sending at once while a background job wrote to the database, some sends failed with "database is locked". In my repro, 7 of 24 sends failed before the fix and 0 of 48 after.
A tablet that stays connected for days picks up new limits. Quiet hours you set, or a profile you disable, now reach an open connection on its next action.
Admins got full permissions, Members got voice, and locking stopped resetting a child's limits (all covered above).
The recovery code asks for a new PIN on a household install, instead of removing the only Owner credential.

Known limits

Conversations are shared by the whole household. Roles gate characters and actions, not individual threads.
Behind a TLS proxy that rewrites Host, every change is refused. Fix the proxy.
The Claude Agent has only run against recorded and scripted streams, so its first real run may hit something the fakes don't model. Hosted Claude sessions and a generic CLI agent are not built. Tasks can't recur on a schedule yet. Approved shell commands are not sandboxed.
There is no tagged 3.0.0 release or download zip yet. Install from main.
Native Windows is experimental. Use Docker Desktop there.

Related: DisPatch: a self-hosted chat app for local AI agents · every module in Docker · StudioForge · my local AI agent stack on OpenClaw