Changelog

Changelog

• 4177db8340e01539f3c89bc1fceb6232cb9b59ec fix(terminal): support cross-platform terminal polling on POSIX and Windows
• b79ba47f29c719f675ea7486851ba8cc225ca82f ci: ensure test binary is built before race tests in CI pipelines
• 991104a5ff1b43171bb6132c870e57045670de28 docs: rewrite README into marketing showcase and add install.sh
• 177fd607bd2cb9c92e06f1ec4a149fb7eb80defe feat: complete NIKI skeleton, live TUI & safety, extensibility & reliability, and performance hardening
• 0f9a5a3213608cdcc78675ab8d4d3784a3377daa Phases 5-7: readiness matrix, MCP manager, TUI lifecycle, perf contract
• 659b95f5c96e2e08fa9ae04245350fe516bc24da B1/B2/B6 probes pass, session persistence wiring, benchmark flatness
• 24ed1471179f02060c1b284f5864594b4f3d3fbf Usage events, sanitize hardening, extended pass ledger
• 5f70e201fa7aaf7dbd160c4f12710eaa05e5ac43 S2/L6: env-scrubbed sandbox fallback, terminal sanitization, frame dumps, doctor, CI/release workflows
• 9dcf488b4df2aecee664575d70fd7c3c12cfde5c P4/P6/P7/QA: errcheck clean, schema validation, bounded output, shell AST, MCP catalog cache, breaker, snapshots, doctor, CI+release
• 5bc1df3679bd5807ae71d0df693192c21afd1986 docs: ledger + conformance for P1/P4 progress
• e7ac4a47136cb1ba2515ee65071b298904133e71 P4b: fail-closed tool Base, Batch concurrency gate, read-only opt-in
• 8fa8d2a2eace427b99f13b38a98568a9fe9bea9d P4a: fail-closed shell AST allowlist (mvdan syntax), permissions tests
• 59138e4ecef6fa93a8c97cdcd1ffc9d31e8a65b1 P1 progress: lint tests, coalesced frames, PTY restore tests, config sources, strict skills, bounded instructions
• 115f64373dc9e33f2e0d09c02e3d4dccc9b6bc1f docs: viewport decision recorded (fullscreen default)
• bcdaddd4e689b14dd31559df4f17b08fe6665cc5 docs: NIKI v2 design note, decisions, conformance checklist, progress ledger
• d82b534e2ba8fa860339987ae0094089c7751e17 docs: rewrite README
• 24a84e13c28c49ba4fdec7e14430778681afb181 Update plan ledger: Phases 0-9 complete
• 87910162a74b837450356b97b5abfad69ca3d397 Phase 2-9: hooks, subagents, sandbox, safety redaction, boot phases, profile flag
• 857cd2d33ff4da5162a801183aa38c7cc3a31667 Phase 0+1: destructive reset, Go foundation with engine, tools, providers, TUI, config, sessions
• d6f9ee29209c7cf41d0adb36a6e0096c01ea6afb fix(shell): auto-discover engine binary and reject pending requests on error
• 516f04cba92fc01092cdc12d14db49b20d06a936 docs(ship): rebuild DOCTOR.md with clean diagnostic verification
• dbaa785e927e0f20faf11e1431c33c5b1c276316 style(claims): format subcommands_for closure
• c6de8b485caa3ecee8a01a227b71d9a163468be5 docs(ship): add launch kit, owner execution steps, and leaderboard protocol (P6, DoD-6)
• c0842a22349fc878ef55b588ef7a5f9959aba2b4 feat(agent): wire harness levers L0-L10 into headless agent CLI (P3)
• 353d02444d0a53f3c78558d1a3bf6890a055c3d5 feat(docker): configure static headless engine Dockerfile for GHCR and Harbor (R9)
• 47978b551afe4db189003190d00a73526ea48938 feat(npm): add thin launcher package setup for npm distribution (R7)
• ec7a618b12eff1c04be1613976f63d509c9aad7e ci(release): add release rehearsal workflow with draft mode and installer tests (R12, P4)
• ac4f4249d45c888649c21d315f61750a1a01c77b feat(release): add conventional commit changelog generator script (R1)
• fc02541933f1d106873e3345d3e5a814b329928a docs(ship): add release channel rollback and yank procedures (R13)
• 8044c752b6d18379e6e5d8949828ae484f6754dd fix(shell): add oxlint linter, fix unused imports/vars, and add npm audit to CI (R2)
• 92b3782fd51814c5bac560ff4f69882df6d93da1 feat(install): add PowerShell installer and uninstaller for Windows (R5)
• bdf5984b62b82932dc315e3ccc35173b0341aeae docs(legal): add Apache-2.0 NOTICE file (R4)
• 997372de5bc1253e0c9a38bafcca2582171e8703 feat(bench): rig with Harbor adapter, budget gate, ATIF validation, split, and contamination suite (P2)
• 24fa4c44163c302b00997e04b5c913f8145673a7 docs(platform): document unsupported combinations and stable install URLs for W16/R6
• f04965683d9dea2b6725a2c9cb6d470b1d29a08e fix(claims): resolve subcommands from Commands enum instead of first pub enum
• 6b2aca0f640603a6db75fba0b81ce60f5ce9e35c feat(config): safe migration between config versions
• b821c79d134edb6eb8d4f20c3931646a03c72756 feat(config): explain covers every setting, derived from the schema
• e2b2df6cdb43f6858833ea5570315524f075e09e docs(ship): W1 owner steps, and the checklist’s last states
• 331a997d6c49089eb74e9888b9ccb0aaa8bcc704 feat(permissions): bypass requires an explicit acknowledgement
• 1c5a02d369affd5823b07d26a9fd5648484667f1 feat(config): validate niki.toml against the schema the engine generates
• e8cbfce44d05345e4a1d50f5aed210d30af09ae1 feat(wiring): close the P0/P1 wiring rows, with a gate for each
• 8cd81ce7e42b77673a819213e5abaa331a727982 feat(ui): make the interface reachable from an ordinary install
• 87d6e665c3da82a6e6b1c25cfea3e03c0376b11c fix(shell): the interface could not actually be started, and booted half-dead
• 6c71a7baa800533aa21f9dcb45fae264b2e7ff41 docs(scoreboard): the baselines are closed by decision, and the partial run found something
• 04989d0480cd588b927408d1c55709982a747fdd fix(d2): a resume repainted a stale screen, because there was no SIGCONT handler
• d844ff35d85ddceda1993bcae36e998d7f501cfd fix(scoreboard): flush results per case, not at the end
• a298b6de03d5fa743684c55e8130d73eb0646f6c test(colour): the same text at truecolor, 256, 16 and NO_COLOR
• 633dc5fe86b681472e4366293ba89b89cab7034a feat(f,g,h): command surfaces, diff view, rendered docs, and the scoreboard harness
• 1ef4b1554c6cf75e8b887941a4319b8b76655c52 perf: anchor the composer without measuring the whole screen
• ad4d036e3e46e8e9eac19608cd2c93779972ba29 perf: one measurement method, re-baselined
• c1201a4591f12cfc2106347af5222b1c8891f152 fix(test): a silently rebuilt binary was hanging the fixture suite for eight minutes
• 9b4d6713443670c614441822cdf99c64f457d574 test(fixture): give the PTY loop integration-scale budgets
• 4d1c62a7bed0ccce81d106fb92ce9380ff51ee20 feat(s6,s7): pipeline, verifier, chat loop, and the PTY driver that checks them
• efd2a210bf6a673ecaf59ae5c31ef92872a974bb test(pty): drive the real shell through a real pseudo-terminal
• 64150eb6cbff0b9cc765fd4ee2b8d9d767f0d4a8 feat(foundation): the seam, the server, and the TypeScript shell
• 18f9ed3b52ec36d28381c98b048e80756abdcd7c test(assets): skip the logo render honestly where there is no renderer
• 6069f533b09db61b1231de86fbc8771523d689b5 feat(assets): an SVG logo drawn from the product’s own palette
• 203bd93433493af7890ad595815641625a437456 docs: release report header for v0.10.0
• eb1d218393fce1601efa8bc28863241f6b836106 chore(release): repin homebrew, scoop and winget to v0.10.0

Install niki 0.10.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/RavaniRoshan/niki/releases/download/v0.10.0/niki-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/RavaniRoshan/niki/releases/download/v0.10.0/niki-installer.ps1 | iex"

Download niki 0.10.0

Release Notes

Breaking. A run’s verdict now carries its provenance, and a verdict that nobody produced is no longer reported as an approval. See Upgrade notes below — if you gate CI on verdict, read that section first.

The release is the engine half of a larger correctness pass. Every item below was found by looking at what the code actually did, not by asserting what it should do, and several were defects the existing suite was passing over.

Fixed

• A verdict is no longer a pass nobody granted. Verdict defaulted to Approved, and two paths produced one: the SingleAgent fast path ran no Reviewer and still reported Approved, and the MultiAgent arm set verdict without ever setting verdict_source, so a genuine reviewer’s approval arrived with no provenance. RunOutcome (reviewed/revision_requested/self_verified/not_evaluated/blocked/ cancelled/failed) is now derived at the single PipelineResult build point, and verdict is a projection of it.
• The security audit ran after the review. With [security] enabled, the reviewing agent finished before the auditor produced anything, so the audit could never reach the agent it exists to inform. The auditor is now injected ahead of the Reviewer on both the config and risk-tier paths.
• A SecurityAuditor Rejected had no effect on a run that had a Reviewer — the normal configuration. It was computed, recorded, and rendered into the report, and then ignored. A rejection now forces a revision and a later Reviewer approval cannot overturn it.
• Network egress was allowed unconditionally. web_fetch and web_search declare PermissionRequirement::Allow, and the rule that forbade it lived in permissions::resolve_tool, which no product code calls. Egress is now denied fail-closed outside an explicit bypass/dontask opt-out.
• A patch that failed to apply warned and continued. The Tester then verified a tree that did not contain the change, the Reviewer judged a verdict about code that was never written, and a branch was cut anyway. On the solo fast path, a repair that also failed fell through to verdict = Approved and completed the run with no change in the working tree. All of these now stop the run with an error naming what failed.
• State writes could vanish. save_task_record discarded its write error at all ten call sites, the closing record write warned, context.json went through two discarded let _ =s, and the session init and after_planner checkpoint were discarded — so /undo and /rewind could silently not work for a whole run. All propagate now.
• write_atomic derived its temp name with with_extension, which replaces the extension rather than appending: task.json and a sibling task both became task.tmp-niki-atomic. Two writers would clobber each other’s partial write and rename a truncated file into place.
• Cancelling was read once per revision round — four sequential LLM calls — and never at all on the solo path, which has no loop. A user who pressed Esc watched the rest of the round play out.
• A repair retry’s tokens were billed to nobody. run_agent assembled its usage total before the repair loop, so a stage that needed two rounds to produce a valid artifact under-reported its own cost to the user and to the spend cap — precisely on the most expensive runs.
• The container backend was unreachable on Windows. connect_container_runtime was #[cfg(unix)] and the non-Unix arm bound docker to None, so Docker Desktop being installed and running changed nothing. Ctrl-C cleanup was Unix-gated too, so cancelled Windows runs leaked their containers.
• The error modal was fully tested and completely unreachable. Modal::Error had a renderer, a hit-test, key handling and three passing tests that constructed the variant by hand; nothing in the product ever did. A failed stage now opens it. That made live a Box::leak in its render path, which leaked on every redraw.
• The embedded-asset manifest was stale on master: the ratchet guarding the prompts and schemas compiled into the binary had been red since an earlier commit.

Added

• outcome and independently_reviewed in the --output-format json envelope, and an Outcome: line in the markdown report naming who produced the verdict.
• reconcile_result_record_manifest cross-checks the pipeline result, task.json and manifest.json before a run is considered finished. A disagreement is a hard error, not a warning: by then the artefacts are on disk, so warning would mean shipping a self-contradictory run.
• Regression tests for each of the above, each verified to fail against the pre-fix code — including two (tests/cancellation.rs) that had to be rewritten because their first drafts passed against the bug they were written to catch.

Changed

• finish_stage and record_isolation are now the only implementations of per-stage bookkeeping. Seven copies of the tail existed in two orders and two had dropped enforce_spend_cap, enforcing it one stage late. Six hand-copies of provider_cache_key collapsed into the one function.
• body_stages_for is actually called. The SingleAgent collapse was satisfied only because that arm looks the Coder up by hand.
• permissions::resolve_tool and its three tests are removed; the rule that made it worth keeping now lives in the path that runs.
• ModalAction::Skip is removed — no code path ever produced it.

Fixed

• Three gates reported success without measuring anything. The acceptance suite printed pass_test 'Git/worktree integrity' with no assertion near it — the product’s headline promise, unchecked. The same script skipped the whole product E2E and exited 0 when mock_llm.py was missing, so the gate could vanish from CI and still read as a pass. The Manifest parity job called a dead release URL PENDING, so seven manifest URLs pointed at an unpublished v0.9.0 while brew install niki — the README’s primary install command — returned 404, with the job green.
• The setup wizard wrote a config the machine could not run. It recorded a provider and a model and no backend, so on a machine with no container runtime — the machine the README opens by describing — the wizard reported success and the next command could not start. niki doctor then failed that same machine for a missing container runtime, having no notion that a second backend needs none, and niki smoke inherited the bug while its own help text called the worktree path the zero-setup route.
• The goal loop forgot everything it had learned. It accumulated context_summary and negative_knowledge, persisted them, and handed the pipeline a task built from the description alone — so iteration 2 could repeat iteration 1’s mistake, the specific thing a multi-iteration runner exists to prevent.
• Promoted skills were invisible to the agents that load them. Promotion wrote to the configured output_dir; the runtime skill_list/skill_load tools read a hardcoded .niki/skills. Under a custom output dir a skill was promoted with a success message and never loaded.
• An expired key defeated the fallback chain. Any non-5xx error returned immediately, so a 401 from a stale primary — the most common reason anyone configures a fallback — killed the run before the fallback was reached.
• A test asserted the wrong value for the bash-timeout clamp, which is what made main red. The production arithmetic was always correct; the assertion claimed the ceiling where the floor was right, and the property it was written to protect was not the one it checked.

Added

• niki-starter/ — a small project with a real failing test and one command, plus the setup guide, a troubleshooting guide, an honesty page, and a guide to reading report.md. Solving its task is a regression, and a test says so.
• tests/docs_consistency.rs — a document may not state a version the crate does not have, a stated MSRV must be the one Cargo pins, and the README’s numbers are re-derived rather than trusted.
• Journeys J20–J25: the wizard, doctor, smoke and the first run, verified on a keyless machine with no container runtime — including one that forces the worktree backend so that path is exercised even where containers exist.
• sandbox::detect_container_runtime — one probe, so the wizard, doctor and the runner can no longer disagree about what a machine can run.

Changed

• tests/claims.rs covers the documentation site, niki.example.toml, the root documents and the handover starter, by walking declared roots rather than listing three filenames. It is what stopped docs/launch-audit.md describing version 0.4.0 for six weeks and five releases.
• docs/launch-audit.md rewritten against the current tree, with its version-shaped facts re-derived on every build.
• The documentation site’s quickstart leads with the no-key, no-container path the README already described, instead of requiring Rust, Podman and an API key for a product that needs none of the three.

Upgrade notes

If you gate CI on verdict, this is the change that matters. A run that produces no independent review no longer reports verdict: "Approved". If your script is:

niki run "..." --output-format json | jq -e '.verdict == "Approved"'

it will now correctly fail for runs that were never reviewed, and pass for runs that were. To keep the old effective behaviour of “did the run produce an approved artifact”, gate on the outcome instead:

niki run "..." --output-format json | jq -e '.independently_reviewed'

task.json gains an outcome object with the same shape ({"outcome": "...", "by": "...", "verdict": "..."}). It is optional when reading old records. verdict_source remains a plain string and is now populated on the multi-agent path, where it was previously always None.

Config. No new keys. [security] enabled = true changes behaviour: the auditor now runs before the Reviewer and a Rejected verdict from it gates the run. [permissions] mode gates network egress in the tool loop; use dontask to keep the previous permissive behaviour.

Platform. Windows can now use the container backend. The new path is unverified by compilation here — cross-checking to x86_64-pc-windows-msvc needs MSVC tooling this machine does not have. Each bollard API was checked against the vendored 0.18.1 source, but a Windows CI job is the real gate and should be added.

Install niki 0.9.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/RavaniRoshan/niki/releases/download/v0.9.0/niki-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/RavaniRoshan/niki/releases/download/v0.9.0/niki-installer.ps1 | iex"

Download niki 0.9.0

Release Notes

Agent-harness + runtime release (36 commits since 0.7.0): repo intelligence, risk-gated Critic pipeline, provenance/KB/history/structural index, agent runtime rework with sessions/checkpoints/resume, converged store + project skills, unified run budget, TUI performance/search/input hardening, five ready gateways, reliability/honesty fixes, and CI/visual gate repairs. Claims below are backed by tests, mock-LLM e2e, or the VHS visual gate unless noted as docs/launch material.

Added

• Repository intelligence ([repo_intel], niki inspect [--json]): deterministic RepoManifest (languages, entry points, tests, build files, vendor exclusion, risk cues). Fail-soft; indexing can no longer abort a run unless on_failure = "fail".
• Run provenance ([snapshot], manifest.json per task, niki status [id] --with-provenance): repo HEAD/branch/remote, config content hash, toolchain versions, result branch + costs.
• Project KB (niki architecture build, .niki/kb/): snapshot-stamped Markdown + provenance-wrapped JSON sidecars, rebuilt from scratch.
• History miner (.niki/history/, cache-as-truth with rewrite detection): keyword-classified commit learnings rebuilt from cache every run.
• Structural index (niki index build|query, .niki/kb/structural_index/): content-addressed per-file units, AST→regex→coverage backend ladder (tree-sitter behind the default-on ast Cargo feature; --no-default-features keeps the regex baseline). Advisory only — grep stays authoritative.
• Bounded Planner context ([general] max_context_chars, default 48000): manifest + KB + symbol excerpts + learnings, priority-ordered with an explicit truncation marker.
• Risk-based pipeline ([risk], [critic]): deterministic TaskSpec classifier (low/normal/high/security) injects the Critic after the Reviewer on Normal+ and forces a SecurityAuditor on High/Security. Explicit [pipeline].stages topologies are never rewritten.
• Critic stage: narrow verdict-grounding checker (prompts/critic.md, schemas/critique.schema.json); a Reject forces exactly one Reviewer retry, then a closing judgment. Recorded, never a gate of its own.
• Post-run reflection (src/orchestrator/reflect.rs): verification_failure, review_correction, and security_fix learnings into .niki/learnings.jsonl, flowing back to the Planner via the KB.
• Reviewer test-evidence gate: failures/skips (or zero executed tests) on business-logic tests must yield revision_needed, never approved.
• Agent runtime rework (src/runtime/): AgentSession / AgentTurn / AgentStep execution loop, bounded priority-sorted ContextStore with compaction, typed AgentEvent stream, ToolPolicy + tool registry split (tools.rs), cancellation tokens, and session checkpoints under .niki/sessions/.
• niki resume <session-id>: resume an interrupted agent session from a checkpoint (role/turn/step, artifacts, context fragments, active branch).
• niki skills (list|candidates|promote|retire|show|diff): two-step distillation — Approved green run stages a candidate, human promotes to a versioned skill (SKILL.md + metadata.json + skills-lock.json). Nothing auto-activates; stale source snapshots are flagged, never served as fresh. Served via skill_list / skill_load alongside ~/.agents/skills/.
• Converged store (src/store/, ADR-002): rebuildable hybrid index over learnings + role/user memory + run records — keyword (0.45) + trigram vector cosine (0.35) + recency (0.10) + authority (0.10). File-backed, zero new deps; index size honors [repo_intel] disk_budget_mb; deleting <output_dir>/store/ is always safe (live-scan fallback).
• Unified run hysteresis budget ([budget] / RunBudget): one step/cost/wallclock ceiling across retries, repairs, revisions, tool-loop steps, and goal iterations. Exhaustion → typed BudgetExhausted recorded in task.json. CLI overrides: niki run --max-steps --max-usd --max-wallclock-secs. max_usd falls back to spend_cap_usd when unset.
• Optional executable tool loop ([tools] experimental_tool_loop, default off): one bounded research step through run_tool_loop before the Planner; inherits [permissions] mode (Ask tools fail closed headless).
• MCP end-to-end path: from_config loads [[mcp.servers]] + governance; live connections retained for call_tool; annotations.readOnlyHint → read_only (unmarked tools denied under default read-only governance); domain allowlist applies to web-fetch-shaped tools.
• Failover structured-output routing: FailoverProvider now propagates supports_structured_output and routes request_structured through the chain (structured output no longer silently degrades on failover).
• Hook timeouts: [hooks] timeout_seconds (default 30); overlong hooks are killed and treated as Noop with a warning (0 = wait forever).
• TUI (goal c81d04): central keybinding table with [ui.keybindings] overrides + conflict report; transcript search (Ctrl+F); fuzzy @files ranking with Tab apply; shared ScrollState (fixes stuck auto-scroll, wires tool-detail modal); NIKI_TUI_DEBUG per-frame log; headless tests/tui_perf.rs render budgets; stage-markdown + processed-diff memos; fleet refresh throttle (500ms); mouse motion/SGR always-on with Ctrl+E toggle; width-aware markdown tables; OSC-8 hyperlinks gated by terminal caps / NIKI_HYPERLINKS. Optional [ui], [ui.tips], [ui.transcript] tables.
• Providers / onboarding: five ready gateways — Ollama first-class keyless (wizard option 0, live /api/tags probe, auth/doctor reachability) plus Zen / Kimi / Kilo (OpenAI-compatible, named constructors, OPENCODE/KIMI/KILO_API_KEY env wiring); single-pick init wizard that rewrites all four [agents.*] provider lines and preselects an installed Ollama model; headless chat --message plain-text reply (was silent TUI teardown).
• niki smoke --backend: local smoke path selectable without a container runtime (Path A quick-start: Ollama + worktree, no key/container).
• Cinematic README demo: deterministic frame-rendered 80s TUI walkthrough (scripts/render_demo_cinematic.py); theme sand() fixed to warm SAND_500 (was cyan), theme::cyan() for INFO_BLUE.
• Launch material: PH kit (docs/launch/ checklist, maker first-comment, gallery), social assets (assets/social/ph-thumbnail.png, ph-gallery-run.gif), launch playbook (plans/noctty-launch-playbook.md) with trust-boundary-aligned copy; TUI extraction plan status (docs/tui/pi-extraction-plan.md).
• Eval grades: four seeded defect cases graded (100% maintainer agreement).
• CI gates: MSRV (1.85) + --no-default-features jobs; clippy -D warnings; artifact-contract + run-lifecycle tests required before the full suite; STATE_LAYOUT.md file contract; agent-harness plan docs (plans/niki-agent-harness-plan.md, ADRs 001/002).

Fixed

• Hooks: payload write ignores EPIPE so a fast hook that exits without reading stdin can no longer mask Block as Noop/Allow (exit-code interpretation always runs); 100× stress regression test.
• [general] max_diff_lines from niki.toml is now honored (it was parsed but never merged into the active config).
• TUI: multi-byte cursor panics/caret corruption (char-boundary clamp + byte↔char click mapping); 1-column click offset; fleet refresh no longer block_ons Tokio locks every frame; long-transcript auto-scroll stuck at top (write-only auto_scroll / bottom-anchored selection math); tool detail modal state existed but never painted; permission-modal option rows off-by-2+ and clipped (content-driven height); command-menu hit-test drift vs filtered count; byte-slice panics on tool cards, stage error headers, and chat input echo; long commands truncated to modal width.
• Empty-diff runs no longer leave HEAD on an empty niki/<id> branch; worktree teardown no longer leaks git fatal() noise to stderr.
• Version/logo strings use CARGO_PKG_VERSION (showed stale v0.4.0).
• providers check: all OpenAI-compatible slugs use named constructors (groq/together/deepepseek previously reported OPENAI_API_KEY); Ollama health check resolves an installed model (was permanent 400 + empty model).
• Init wizard rewrites all four [agents.*] provider lines to the picked provider (template Anthropic defaults no longer survive and break fresh machines); Ollama pick preselects an installed coding model (was hardcoded qwen2.5-coder, which 404s when only tagged variants exist).
• Solo coder gets one bounded repair attempt on patch-apply failure (exact error + verbatim-SEARCH rules; same spend-cap/hooks/metrics accounting as the first attempt); code_diff search/replace schema bans regex/anchors/paraphrase (propagates to all coder prompts).
• Artifacts writer keeps every attempt (coder.json, coder-2.json, …) instead of overwriting — failed attempts stay inspectable.
• Failover no longer reports supports_structured_output = false (trait default); structured output routed through the chain with circuit breakers.
• VHS/visual CI: onboarding tapes force the modal via NIKI_FORCE_ONBOARDING (CI auto-suppress broke references); ttyd + ffmpeg installed for tape rendering; render engine tests headless (TestBackend — no TTY on runners).
• Release/CI plumbing: package manifests (Homebrew/Scoop/Winget) pinned to v0.7.0 with real sha256 (v0.4.0 Windows zip never existed / 404); artifact actions aligned to v7 (v8 tag does not exist); cargo dist allow-dirty for hand-maintained artifact pins; @niki review workflow needs-keys gate moved off job-level if: (workflow failed to load); audit job restored after being swallowed into a comment; VHS/pillow install order fixed for runners.
• Mock-pipeline e2e (kb_pipeline / critic path) drops the nodejs binary alias from the sandbox tool check (CI has node only).

Changed

• README / trust copy: sequential stages intentionally share one execution sandbox so the diff persists Coder → Tester → Reviewer; independence is at the LLM-session layer. Committed branches are never repointed or rewritten; the host working tree receives the finished diff for review. readonly_rootfs documented as optional and off by default; sandbox claim narrowed to CapDrop ALL + network disabled + optional read-only rootfs.
• extra_packages clarified: despite the name, nothing is installed — entries extend the startup command -v checklist against the pre-baked image.
• network_allowlist honesty: per-domain filtering is NOT implemented — container egress is all-or-nothing; only "*" opens egress; a non-empty domain list warns at startup and behaves as block-all.
• Init wizard rewritten as a single-pick menu (was 11 sequential prompts).
• Config examples: [ui] tips/transcript nested tables; [compaction] default threshold 80% + auto_compact; pipeline topology values lowercased (auto/multiagent/singleagent).
• Launch copy aligned with trust boundaries (docs/launch-audit.md, first-comment).

Security

• Deny-list always wins over overlapping allow entries (coder rm still cannot rm -rf /; git diff allow no longer bypasses a git deny).
• Diffs scoped to agent-produced changes: pre-existing dirty/untracked host files stay out of changes.patch and the commit; new agent files appear via scoped intent-to-add (both backends); edit-format application is all-or-nothing per stage.
• Same-task worktree collision fails loudly instead of deleting a concurrent run’s directory; Drop/panic paths still tear down worktrees and containers (best-effort); stale prune never removes a live worktree.
• Failed runs create no niki/* branch and leave task.json Failed with the error; conflict markers abort branch creation instead of committing.
• MCP: unmarked tools denied under default read-only governance (deny-by- default, never assumed safe); web-fetch tools gated by domain allowlist; untrusted servers error instead of connecting implicitly.
• Hooks timeout kills overlong processes so a hung hook cannot stall or mask a Block decision forever.

Install niki 0.8.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/RavaniRoshan/niki/releases/download/v0.8.0/niki-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/RavaniRoshan/niki/releases/download/v0.8.0/niki-installer.ps1 | iex"

Download niki 0.8.0

Release Notes

Mega-plan execution (30 commits): plan-mode approval gates, oracle integrity, honest cost metering, independence hardening, session control plane, headless CI contract, trust posture, automation, and TUI unification. All user-facing claims below are covered by tests, mock-LLM end-to-end runs, or the VHS visual gate (tests/visual/, 12 reference frames at 0.00% self-diff).

Added

• Plan mode: niki plan researches without executing and writes reviewable plan.md; niki run --plan <id> executes the approved spec, skipping the Planner LLM call. Dry runs no longer create empty branch refs.
• Session CLI: niki session list/show/checkpoints/undo/rewind with code+conversation/both restore modes and a dirty-tree guard.
• User slash commands: .niki/commands/*.md (filename → /name) with description:/aliases: frontmatter, [commands] extra_dirs sharing, and niki commands list/show/expand.
• Headless contract: niki run --bare (no memory/MCP/knowledge-URLs), --output-format json stable envelope (incl. error path), stdout pipe-purity (display mute + captured git stdio), OTLP trace export (--otel-endpoint, no new dependencies).
• Oracle integrity: oracle_source (spec/derived/property) on every test case, reviewer oracle-check rule, no-healing rule, opt-in [agents.tester] mutation_command gate; red-suite/mutation failures block the branch unless --force (recorded as NOT verified).
• Independence hardening: Red receives evidence-only diffs, isolation records match wiring, topology selection reason recorded and reported, shared-model review warnings.
• Honest meter: cached-input/reasoning token splits, unpriced-model warnings (unpriced* in reports), price-table freshness test, failover cache-bust warnings, history-driven niki recommend --project.
• Trust posture: [permissions] mode + --permission-mode, disable_worktree kill-switch, fail_closed_headless flag, loud headless Ask fallback.
• Lifecycle hooks: [hooks.commands] wired to PreTaskStart/PreAgentStart/ PostAgentStop/PostTaskStop, fail-closed block semantics.
• GitHub automation: keyless nightly eval gate, human-gated @niki review workflow (injection-safe, loop-guarded).
• Eval credibility: per-case costs, disclosure manifest on every run, niki eval grade maintainer judgments with agreement metric, ablation protocol doc.
• Observability: trace.jsonl spans per run (honestly derived timeline), niki audit compliance bundles.
• MCP Streamable-HTTP remote transport (JSON + SSE, session affinity).
• Onboarding: niki init alias, init --scan AGENTS.md drafter, .niki/rules/ binding conventions, per-provider model aliases, per-agent effort presets, actionable key errors, guided empty states.
• TUI unification: one status grammar, 100% theme-token production code, normalized headers, global page jumps in both event loops, palette fleet/session rows, empty-state triads.
• TUI motion system: primitives + caret blink, Done slide-in, notice slide-in, progress shimmer, modal pulse, verdict pulse — all reduced-motion gated (frames pixel-identical with the flag on).

Fixed

• GEMINI_API_KEY vs GOOGLE_API_KEY chat fallback miss.
• smoke/doctor pointed at nonexistent niki init (now a real alias).
• Unwired schemas/review_feedback.schema.json removed.
• backend = "podman" doc strings corrected (docker|worktree only).
• safety_proof.json scope documented as git-only (was overclaimed).
• Approval tool auto-approved everything; ask tool invented answers.
• [permissions] table silently dropped by config merge.
• MCP JsonRpcResponse never parsed (jsonrpc field rename bug).
• Dry-run empty branch refs; planner-skip metrics crash.
• Global key h/s/l dead-ends; blank session screen; $-0.00.

Changed

• safety_proof.json, spend-cap, and deny-list copy narrowed to match code.
• niki recommend static-pairings truth in docs (history-driven per-project observed spend added to the command itself).

Install niki 0.7.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/RavaniRoshan/niki/releases/download/v0.7.0/niki-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/RavaniRoshan/niki/releases/download/v0.7.0/niki-installer.ps1 | iex"

Download niki 0.7.0

v0.6.0 — Claude Code parity: interaction, trust & ecosystem

Interaction, trust, and ecosystem surface on top of the v0.5.0 render/permission base.

Added

• Visible, draggable scrollbar in the chat viewport (ratatui Scrollbar; click/drag-to-jump)
• Mouse hover system across all surfaces (stage headers, messages, status bar, tab bar, modals, help, fleet) + click flash + double-click word select
• Scroll-wheel routing on every page with auto-follow pause
• Kill ring + yank: Ctrl+Y yanks the most recent kill, Alt+Y cycles (yank-pop); Ctrl+W/U/K delete into the ring
• Input undo/redo: Ctrl+Z / Ctrl+_ undo, Ctrl+Y yank; every edit snapshot-able
• Multi-line composer: input area grows to ~1/3 of the screen (render_input_box_multiline now live)
• Protected paths & destructive-command enforcement (.git, .ssh, /etc, rm -rf, sudo, curl, git push always prompt)
• Shared skills portability: reads ~/.agents/skills/ (override via knowledge.skills_dir)
• Kitty keyboard protocol (I4): enable/disable around the session + CSI-u decoding for Shift+Enter disambiguation
• Expanded slash-command set: /status, /permissions, /plan, /version, /rename, /fork, /branch, /usage, /effort, /mcp, /skills, /copy, /export-md, /btw, /code-review, /security-review, /add-dir, /loop, /voice

Ecosystem (launch baseline)

• ACP server (niki acp): JSON-RPC 2.0 over stdio — initialize, prompt/send, session/status, session/cancel, with live stage.start/stage.token/stage.done/stage.failed/task.completed notifications. Drives Zed, Claude Code, and any ACP client.
• Voice input (niki voice): records via ffmpeg and transcribes through your provider’s STT endpoint (LlmProvider::transcribe, OpenAI-compatible).
• MCP trust gate: servers must be explicitly allowed (fingerprinted, persisted to .niki/mcp_trust.json) before connecting — behavior-preserving default.
• Headless TUI harness (tests/headless_tui.py, tuiwright): drives the real binary under a real PTY with mouse scroll/click/drag.

Changed

• Chat render virtualizes to the visible window and renders a live scrollbar
• Permission modal detail panel (Ctrl+D) + scope selector (Tab) wired to the live flow

Verification

• cargo test --all-targets: 417 lib + 5 ACP integration, 0 failed
• cargo clippy --all-targets: warning-free
• cargo build --release: clean
• pytest -c pytest_headless.ini: 11 passed, 2 documented skips (Shift+Enter and bulk-message scrollbar need a live terminal/LLM)

Binary artifacts (macOS/Windows/Linux tarballs + installers) are produced by the cargo dist release workflow in CI.

What’s Changed

• fix(homebrew): fill v0.4.0 SHA256 for 3 Unix targets by @RavaniRoshan in https://github.com/RavaniRoshan/niki/pull/14
• Bump tokio-stream from 0.1.18 to 0.1.19 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/5
• Bump async-trait from 0.1.89 to 0.1.92 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/6
• Bump libc from 0.2.186 to 0.2.189 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/7
• Bump glob from 0.3.3 to 0.3.4 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/8
• Bump globset from 0.4.18 to 0.4.19 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/9
• Bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/10
• Bump actions/cache from 4 to 6 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/11
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/12
• Bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in https://github.com/RavaniRoshan/niki/pull/13
• demo: v0.4.0 pipeline demo (gif+mp4) on landing page by @RavaniRoshan in https://github.com/RavaniRoshan/niki/pull/15

New Contributors

• @dependabot[bot] made their first contribution in https://github.com/RavaniRoshan/niki/pull/5

Full Changelog: https://github.com/RavaniRoshan/niki/compare/v0.3.3...v0.4.0

Full Changelog: https://github.com/RavaniRoshan/niki/compare/v0.3.2...v0.3.3

Full Changelog: https://github.com/RavaniRoshan/niki/compare/v0.3.1...v0.3.2

Release v0.3.1 — Truth-Checked Pre-Launch

Truth fixes:

• README: removed false claims (auto-pull image, niki init), hero image uses committed logo.svg, corrected ‘verified PR’ terminology
• SECURITY.md: egress policy now accurate
• sandbox: Rust toolchain (cargo 1.97.1) included; network_allowlist = ["*"] re-opens egress correctly
• theme/glyph collision fixed (Planner: ◈, Reviewer: ◆)
• version bump to 0.3.1 across all installers (homebrew/scoop/winget) and site (Install/Downloads)

New feature:

• Tester agent now executes the project test suite in-sandbox and records results as test_execution.json audit artifact

Verification:

• cargo build green · cargo test green (445 + 4 new) · site npm run build green

Assets (Linux x86_64 only):

• niki-x86_64-unknown-linux-gnu.tar.xz — sha256: 7700e44ba8c2c29c49bd5d60b5f7c014d58ad9daecf3008fa80b6a10abf07ee7

Note: This release ships the Linux x86_64 binary manually. macOS (aarch64/x86_64) and Windows binaries are normally generated by cargo-dist CI on tag push. CI workflows are currently failing with 0 jobs / instant failure (GitHub Actions infrastructure issue). workflow_dispatch has been added to allow manual re-trigger when the infra issue resolves. A maintainer can run cargo build --release + tar -cJf for each target to attach remaining assets.

Install niki 0.2.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/RavaniRoshan/niki/releases/download/v0.2.0/niki-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/RavaniRoshan/niki/releases/download/v0.2.0/niki-installer.ps1 | iex"

Download niki 0.2.0