chore: release main

[nimbus-release-bot]

🤖 I have created a release beep boop

10.0.0

10.0.0 (2026-10-17)

⚠ BREAKING CHANGES

• llm: make LlmRegistryOptions.db required so an unledgered non-local route is a compile error (#1372)
• llm: remove the inert remote_model key and document the vendor tables (#1368)
• llm: ledger the ask intent classifier, and three defects found on a live install (#1366)
• llm: the Mastra engine agent no longer falls back to a vendor API key found in the environment. An install that today relies on ANTHROPIC_API_KEY alone, with no [llm.remote.*] configuration, will stop constructing the agent — nimbus ask then answers from the local router if one is configured, and workflows refuse with a message naming the fix. To restore the previous behaviour, add [llm.remote.anthropic] enabled = true with a model, and store anthropic.api_key in the Vault. This is the point of the change rather than a side effect: a capability that turns itself on because a credential happens to exist is the air-gap defect's shape, one level up.
• llm: route the LLM by (provider, model) instead of provider kind (#1352)
• connectors: delete packages/mcp-connectors — it ships from npm now (#1347)
• egress: remove the EgressCompleteness.tier compat shim (#1156)

Features

• agents: a browser-viable why — agents.why answers about a pull request (#1260) (55715b7)
• agents: attribute Sentry error issues to people (#1182) (ffa54b3)
• agents: give every interleaved brief disclosure one definition and a guard (#1245) (5b9c115)
• agents: never let synthesis drop a brief's disclosures (#1237) (f27b416)
• agents: nimbus changelog — the fifteenth built-in agent (#1496) (bc1139b)
• agents: nimbus negotiate — a cited contribution brief (#1166) (fa807e3)
• agents: nimbus oncall — the seventeenth built-in agent (#1509) (27c4211)
• agents: nimbus pre-mortem, with a service-scoped incident watcher condition (#1146) (58e93fd)
• agents: nimbus standup — the sixteenth built-in agent (#1502) (3101702)
• agents: publish the gateway version on the roster response (#1428) (d3ba71d)
• agents: resolve a forge file coordinate to the reader's checkout (#1424) (4770bdf)
• agents: why, expert and ownership answer about an indexed item (#1421) (b5fabb2)
• audit: index lane census (report-only) (#1561) (863f621)
• automation: add incident_opened and deploy_failed watcher conditions (#1138) (34601b2)
• briefs: research briefs draw on the whole index, not only clips (#1253) (80c21df)
• build: prove the connector registry can import from a package, before anything moves (#1340) (3a1e813)
• captures: batch accept proposed decisions, terms and links (#1668) (64ab982)
• captures: purge a finished action's stored input; prune executed/failed after 90 days (#1667) (e35e346)
• chatops: invoke the built-in read-only agents from a Slack or Teams channel (#1412) (a6a052e)
• ci: gate on connector version skew between the gateway and npm (#1346) (1a2d38a)
• ci: gate on native dependencies reaching the gateway binary (#1350) (b3ff071)
• cli: add nimbus tool run to invoke a saved generated tool (#1521) (a89bd27)
• cli: nimbus demo — a seeded synthetic org and a three-brief tour (#1547) (b238a13)
• cli: nimbus explain last — an X-ray of the most recent nimbus ask (#1514) (755c2b6)
• cli: nimbus index health — index quality, not index size (#1483) (93ac016)
• cli: nimbus init and nimbus demo end on the guided tour (#1570) (fc8ce7c)
• cli: nimbus tail — follow the gateway's operational event stream (#1511) (9f70962)
• cli: nimbus wow — a guided tour of your own index, ending on a locality proof (#1565) (8c78849)
• clips: a web clip can say who wrote it — optional source metadata on POST /v1/clips (2.5 S2) (#1285) (1c7e818)
• clips: related answers about the resolved item, and its snippets come from the body (#1232) (9f75fa3)
• computer-use: I35 gate + D26 confinement for local computer-use actuation (browser lane, driver not yet wired) (#1415) (461cebd)
• computer-use: raw-CDP browser lane driver; the browser egress class goes live (#1418) (0c52e96)
• computer-use: the terminal lane — a confined shell where nothing runs before the owner approves the whole line (#1426) (9ad2be9)
• connectors: attribute PagerDuty incidents to people (#1177) (20b51f6)
• connectors: consent-gated standalone connectors, so writes cannot run ungated off-gateway (#1318) (e4d948a)
• connectors: consume @nimbus-dev/connectors from npm (#1343) (0b6ff53)
• connectors: gcloud login mode for the GCP connectors, detected and adopted (#1557) (d01e198)
• connectors: index GitHub PR reviews and size statistics (#1159) (fb8a0c7)
• connectors: index Sentry issues, and make the published installers able to install (#1172) (ea37e0d)
• connectors: nimbus connector detect — reuse existing gh, aws and kubectl logins (#1554) (44a57ad)
• connectors: per-connector write action types across all 94 connectors (#1321) (072b1fa)
• doctor: report embedding runtime state (#1397) (9b3ed09)
• doctor: warn when the on-call push cannot reach ChatOps (#1618) (f560d92)
• egress: a targeted fetch names the client that asked for it (U2a) (#1322) (8611b5c)
• egress: ledger every non-local LLM route at the provider chokepoint (#1357) (278e6b2)
• egress: ledger every outbound ChatOps post (#1403) (fcef76f)
• egress: ledger remote embeddings and add per-task model routing (#1384) (33273b2)
• egress: make the I29 completeness claim true — coverage vector, boot marker, required sink (#1038) (a1169d9)
• egress: record how a targeted fetch ended (U3a) (#1325) (68db7d6)
• engine: [persona] gives Nimbus a configurable voice (#1248) (10b3175)
• engine: disclose step-budget exhaustion, emit agent.gasLimitReached, make [llm] loop-guard keys live (#1640) (57d9f25)
• engine: negation predicates reach nimbus ask and MCP clients, refusing rather than guessing (W6-B.2) (#1281) (5ce7505)
• engine: nimbus ask --devil argues against the plan (#1246) (becc386)
• exec: sandboxed code execution behind the I33 owner gate (S2 slice 1) (#1313) (25e2c3b)
• expose the read-only agents as MCP tools, recorded in the egress ledger (#1059) (dcc7bd7)
• extensions: run grants - approve an installed extension to run (S3 extension runtime PR 2) (#1665) (37e2044)
• fleet: add the overnight-fleet change digest (PR 2a) (#1467) (4c54be8)
• fleet: overnight sub-agent fleets on local compute — S2 PR 1 of 2 (#1458) (d47d52e)
• fleet: subject enumeration — sweep a corpus instead of naming one subject (#1541) (c1bab10)
• gateway: index Jira/Linear ticket depth and recover it via rebody --since (#1128) (bdbecd1)
• gateway: invoke read-only agents over the HTTP API, recorded in the egress ledger (#1063) (4b4bedb)
• gateway: ownership graph derived from already-indexed blame data (#1064) (82c03d2)
• gateway: pre-mortem theme extraction pass (V53, PR A of 2) (#1134) (cd1d9c2)
• gateway: read the ownership graph through the agents.ownership brief (#1067) (e898a1e)
• gateway: resolve an indexed item by URL (V52 resolve_key) (#1070) (0a32751)
• gateway: scope the HTTP API bearer tokens (#1062) (826b76a)
• gateway: targeted fetch-on-miss behind a derived host boundary (#1072) (369f9af)
• http: GET /v1/items/resolve-ids — an item id back to its reference (#1465) (8531752)
• http: GET /v1/metrics/stats — the bucketed DORA series, plus the change-failure-rate attribution fix (#1493) (f6e852a)
• http: GET /v1/services/resolve — repo-URN-to-service resolution (#1491) (7da3b84)
• http: read the egress ledger over HTTP, under its own scope (U1) (#1319) (e42d66b)
• http: resolve a forge file coordinate to a path in the reader's checkout (#1447) (b472f67)
• index: canonical ci_run / pr / git_commit metadata contract (index lane A1) (#1632) (232b778)
• index: readers answer from the contract and disclose what they cannot (index lane A2) (#1634) (3515729)
• index: the lane census is an enforced gate (index lane A3) (#1635) (672ef16)
• ipc: tag agent.chunk with a client-supplied streamId and add workflow.cancel (#1165) (5779488)
• isolated demo root for nimbus --demo (invariant I41) (#1545) (8791c19)
• llm: register four cloud vendors behind a default-off per-vendor opt-in (#1359) (1a59735)
• llm: route the LLM by (provider, model) instead of provider kind (#1352) (5ac042c)
• mcp: act door — agent-proposed connector actions, owner-accepted (S3, I28) (#1660) (2714c57)
• mcp: capture sink — agent notes over MCP (S3, I28) (#1653) (486aa79)
• mcp: capture sink proposals — decisions, terms and links over MCP (S3, I28) (#1657) (9b7ac3d)
• metrics: nimbus stats charts a metric over time (#1249) (ba316d4)
• multimodal: cloud byte-fetch for Photos, Drive and OneDrive (S2 PR 3 of 4) (#1448) (3f7e7b6)
• multimodal: image understanding and sampled frame captions (S2 PR 2 of 4) (#1438) (a24300a)
• multimodal: local audio/video understanding, indexed and searchable (S2 PR 1 of 4) (#1429) (b995a96)
• multimodal: remote vision arm with per-artifact grants, I37 and D27 — S2 PR 4 of 4 (#1454) (580e893)
• negotiate: stop crediting agent-caused issues, messages and pages to the owner (#1669) (6a7c84c)
• notifications: deliver OS notifications on Windows, macOS and Linux (pre-S3 E) (#1646) (d0d7a61)
• oncall: post the pushed brief's headline to ChatOps (PR 2 of 3) (#1600) (84a335e)
• oncall: push the on-call brief when a P1 is assigned to you (#1592) (7a4feb5)
• prfiles: index PR changed-file paths behind an explicit coverage record (#1258) (926fb80)
• query: first-class negation queries that refuse rather than answer from an empty index (W6-B.1) (#1277) (10c20cb)
• sandbox: a real Windows sandbox leg, and a policy-shaped runner interface (#1294) (54c20c9)
• search: disclose keyword-only and mid-backfill results; typed embedding query timeout (#1535) (c6c7e27)
• security: I32 — clip source metadata is whitelist-constructed, so a page cannot deny ingestion of its own clip (#1288) (5587c84)
• sync: connectors reach credentials and the index only through scoped capabilities (#1333) (23233d5)
• telemetry: measure agent invocation latency p50/p95 (#1641) (082311b)
• toolgen: draft a tool body and its input schema, and bind credentials at create time (#1481) (ecd1a04)
• toolgen: runtime tool generation PR 1 of 3 — the sandboxed substrate (#1475) (4719bfb)
• toolgen: runtime tool generation PR 3 of 3 — persistence + signing (#1487) (52644ce)
• tooling: close the gap between local gates and CI (#1050) (0efd781)
• ui: On-call page for pushed briefs (PR 3 of 3) (#1604) (88e161a)
• ui: read-only desktop Captures page (#1672) (69d5e9d)
• updater: refuse apply without an installer, audit apply phases, cache last check (#1639) (749656c)
• user-mcp: let the model call opted-in user MCP tools for the local owner (#1628) (fee3b25)
• user-mcp: org-policy lock-off and I11 wrapping for model-offered tools; prove I38 end to end (#1637) (0cf3df0)
• user-mcp: run user MCP servers confined, with owner-approved grants (#1623) (7797aa1)

Bug Fixes

• nimbus config set on a fresh machine, and an unactionable brief footer (#1212) (c6824c7)
• admin-console: escape policy.version before it reaches innerHTML (#1201) (f62fd85)
• agents: strip a fabricated reserved section at any level, and in its non-heading form (#1302) (6742411)
• bitbucket: 🧹 correct itemsUpserted overcount (#1086) (9657921)
• build: bundle the gateway workers so they exist in a compiled binary (#1299) (934779b)
• chatops: escape every Slack-bound post at the wire (#1617) (2e76680)
• ci: accept repo as satisfying public_repo on WINGET_PAT, and add a scope-check script (#1131) (ba54754)
• ci: close the pre-push gaps behind most red PR checks (#1303) (0407fb0)
• ci: make the sandbox spawn suite report why it failed, and gate it on the platforms it is about (#1298) (344e217)
• ci: retry a status-less transport failure in the dependency audit (#1441) (4b1948b)
• ci: stop the AuditPanel vitest flake, clear the Sonar board, and make docs/README.md the only README (#1252) (70f15ca)
• ci: the sdk release-train tagPattern never matched a real tag, and that only warned (#1445) (19a371c)
• clear the SonarCloud backlog, reduce duplication and raise test coverage (#1603) (4663fbb)
• cli: a Gateway connection can always answer a HITL prompt (#1305) (576ba6e)
• cli: make --format plain's underscore-italic pass linear (#1608) (475735e)
• cli: nimbus start waits for the gateway state file, not only the socket (#1549) (4267055)
• clips: embed web clips locally and stop advertising discarded text (#1151) (0e3b183)
• cli: refuse a nested-table key in nimbus config set/get (#1387) (1a4338c)
• cli: stop blocking gateway RPCs dying on the 30s client timeout (#1203) (3fc2132)
• close three documented gaps in completed phases (I16 reasons, connector.startAuth, redaction fixtures) (#1480) (da5d239)
• connectors: align the aws sync interval with its AWS-CLI siblings (#1377) (61173ae)
• connectors: gcloud spawns authenticate as the configured GCP service-account key (#1553) (e1d16b1)
• connectors: index a Confluence page under its browser URL (#1364) (c7a9e1a)
• connectors: let Jira, Confluence, GitLab, dbt and the Teams bot reach their configured host from the sandbox (#1536) (d4465f9)
• connectors: make connector auth refuse vault-key services with the exact vault set commands (#1537) (02011df)
• connectors: report only what was actually verified in connector auth and targeted fetch (#1141) (902cd42)
• connectors: stop connector CLI spawns flashing console windows on Windows (#1370) (184dc42)
• coverage: gate four runtime-bearing types files and give the sandbox harness a way to run (#1230) (326493d)
• demo: retry the demo-root delete for real on Windows; size the PAL boot test for CI (#1673) (a264732)
• deps: bump the bundled connectors to 0.2.2 and drop the nodemailer override (#1606) (58ad04f)
• deps: bump the devalue override to 5.9.4 for three new high advisories (#1593) (693f62b)
• deps: bundle connectors 0.2.4, and name the right Workday task in the auth help (#1614) (d25fbea)
• deps: override @modelcontextprotocol client/core/server to the patched 2.2 line (#1624) (a00d70d)
• deps: override past five new moderate advisories (ip-address, nodemailer, undici, markdown-it) (#1577) (beec826)
• deps: override past new brace-expansion and fast-uri advisories (#1586) (19327c5)
• deps: unbreak main — move the override pins #1469 outgrew, and restore the docs build (#1474) (2cc6fcf)
• docs: correct the standalone connector install path, and measure client support (#1323) (bdc6abf)
• docs: derive four drifted invariant claims instead of hand-maintaining them (#1221) (6fc59e5)
• egress: count the whole prove window, not the first page of it (#1189) (1743437)
• embedding: cancel timed-out query embedding work, not just abandon it (#1542) (35b0aa8)
• embedding: embed the onnx addon so the compiled binary can load it (#1402) (7ca8379)
• embedding: embed the onnxruntime runtime library, not just the addon (#1405) (7d38e79)
• embedding: report the backfill pass from the hybrid and openai runtimes (#1538) (5d31dab)
• embedding: ship the onnx binding and stub sharp so the worker can start (#1399) (2356e6a)
• extensions: read the registry's entryHash as the entry file's hash everywhere (#1662) (42102e0)
• fleet: close the five follow-ups from the overnight-fleet merge (#1462) (bf0559b)
• gateway: 🔒 Prevent command injection in tar extraction (#1091) (575e2aa)
• gateway: enforce the connector allowlist at the federated invoke gate, and route ChatOps writes through the write transport (#1615) (1c578cb)
• gateway: log why the process exits instead of dying silently (#1140) (322ea68)
• gateway: make connectors spawnable from a compiled binary (#1055) (b3a6f15)
• gateway: refuse connector writes and code-executing connector tools at the federated invoke gate (I26) (#1607) (eeb5245)
• gateway: resolve bare connector tool ids on the caller's own MCP server (#1610) (3e41d5b)
• gateway: resolve WAL mode race in http-api-test-server (#1093) (1323567)
• gateway: serve the admin console and OpenAPI doc from a compiled binary (#1058) (36abf19)
• gateway: stop console windows flashing on every Windows sync (#1451) (2042740)
• index: extract export default symbols in the code indexer (#1391) (78751d2)
• index: one pre-migration backup per upgrade, none on a fresh install (#1671) (9eb42b1)
• init: --no-sync no longer ends by naming two commands that cannot work (#1341) (829db8c)
• install: stop Windows PowerShell 5.1 native stderr from aborting gpg signature verification (#1179) (6c991ea)
• install: verify the release signature on Windows with a Git-for-Windows gpg (#1175) (a68945e)
• jenkins: build headers with Headers so a hostile crumb cannot reach a prototype (#1336) (8edb94f)
• lan: never drop the tail of a large federation frame (#1630) (814f470)
• llm: a provider named proto vanished from the availability map (#1442) (c16855a)
• llm: enforce_air_gap now refuses the remote classifier instead of doing nothing (#1334) (be9841c)
• llm: ledger the ask intent classifier, and three defects found on a live install (#1366) (8202ec6)
• llm: make llm.setDefault write the store the router actually reads (#1410) (9f69790)
• llm: remove the inert remote_model key and document the vendor tables (#1368) (0ca8232)
• llm: stop Ollama reasoning tokens truncating answers and costing ~16s per ask (#1376) (abdbbdc)
• logging: stop logging every Error as {} (#1393) (7734ab1)
• media: show real sizes in the allow-remote consent preview (#1534) (c6f927e)
• metrics: stop requiring a resolved status to attribute a change failure (#1494) (011cbf7)
• ownership: stop the symbol sync wiping owner counts from the graph (#1255) (34a08e3)
• perf: drift-check must use each surface own noise floor, not a hardcoded 10% (#1374) (8607743)
• platform: bundle a full SQLite with the macOS build so semantic search works without Homebrew (#1507) (a3703cc)
• platform: load a full SQLite on macOS so sqlite-vec can load (#1503) (107bf08)
• preflight: an unknown service must not pass the deploy gate (#1297) (6ae5a53)
• prove the installed binary's claims in install-smoke and retract the dark ones from the docs (#1627) (d40fbcd)
• quality: clear 9 Sonar issues, two of them real security bugs (#1327) (6d828c5)
• quality: clear the SonarCloud board, prune the delivered plans and specs, and fix what that exposed (#1497) (63bbdd9)
• quality: close two ReDoS regexes and clear 25 SonarCloud findings (#1152) (1f89379)
• quality: fix all 29 open Sonar findings in code, cut duplication 420 to 400 clones, and correct five stale doc facts (#1439) (62a6a20)
• refuse index.regraph over LAN, retire the merge queue and Dependabot, and refresh the contributor docs (#1596) (6f6f025)
• release: gate the release PR at PR time, and reject a body release-please cannot parse (#1227) (074daab)
• release: parse the squash message GitHub actually creates (#1235) (044c16b)
• resolve macos-15 CI test failures and consolidate open connector PRs (#1082) (9f9215b)
• resolve the brief timeout from one definition, and make the ask context budget configurable (#1354) (30c1ce6)
• sandbox: stop concurrent sandbox users from deleting each other's profiles, and a macOS test hang (#1680) (a7eca57)
• sandbox: stop the Windows helper leaking an ACE per run; tool run follow-ups (#1524) (52fb7cf)
• search: stop the vector KNN re-running once per chunk row (#1500) (1ac89f6)
• security: three allowlisted methods had no reachable handler; add the test I7 promised (#1225) (f7d8c75)
• security: wire the two I22/I18 defenses that were resolved but never read (#1220) (84d3e62)
• sonar: clear 23 findings, and document five that should not be applied (#1434) (64d50af)
• sonar: raw path literals, media flag validators, and the two findings the last pass added (#1437) (6fe5240)
• sonar: resolve the six minor findings and annotate the S8786 false positive (#1206) (fa65d95)
• sonar: specific matchers and named decisions, minus two arity assertions (#1436) (d1900c6)
• test: re-home the F11 Google-spawn isolation tests off a process-global mock (#1311) (f9c6f92)
• test: stop the Windows deploy.preflight hook timeout and clear the Sonar backlog (#1316) (139aa40)
• the remaining 24 findings from the local-LLM audit (#1307) (1f9ae09)
• tui: render the watcher pane, and stop claiming OS notifications work (#1204) (78cb49b)
• user-mcp: per-server dispatch listing, no sync.run egress rows, bounded Windows boot revoke (#1629) (e1850af)

Performance Improvements

• connectors: ⚡ batch fetch message metadata in Gmail sync (#1099) (cf1dfe1)
• filesystem: index only what changed since the last sync tick (#1453) (ec284d1)
• gateway: ⚡ batch API calls in SonarQube Sync to resolve N+1 issue (#1089) (892e96b)
• index: build a fresh database without a flush per migration step (#1675) (9a0330f)
• jenkins: ⚡ batch jenkins job builds sync (#1087) (d94d632)
• test: a migrated-once schema template and a deadline-bounded poll, for the Windows hot path (#1291) (6e5fbfd)

Code Refactoring

• connectors: delete packages/mcp-connectors — it ships from npm now (#1347) (2118cdd)
• egress: remove the EgressCompleteness.tier compat shim (#1156) (7b530dc)
• llm: make LlmRegistryOptions.db required so an unledgered non-local route is a compile error (#1372) (97ce904)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: nimbus-agent/Nimbus/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 347fcc50-de9a-42df-bf5a-d1f996a46ef8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}