Changelog
- 9faea151e7922fca4ffca7f1f48a98cb02d71b3d 1-CLI-1-pentest model, OS-cache logs, drop .niro/ and dotenv
- 982419701559fe6c92a3d0e2bf117c59e4e3914e Aggregate PR-comment snapshot, verify_finding posts, drop report tool
- d14e49619bbb0bf522c04e220e92bdef1218f68a Build out CLI, brain, claudecode, and tool surface
- 4a42e8bf898105e04689625bde79b15e828ec67f Canonical edit-in-place PR comment + transition bubble; Niro Gate proposal
- c4a51f8236e60abe551ff50144e476c532405f05 Casdoor demo fixes: state machine, preflight checks, prompts
- b04cadc25331d778251bde7a79d5046d4caba100 Coding-agent UX cleanup: cred schema, post-verdict ctx fix, sentinel race fix, hook + reflection sharpening
- ddcaecfcb97bd5d0c7ed7e242f69202c62e12239 Coding-agent integration: hook scaffolding, MCP server instructions, drop CLAUDE.md
- b47c97b62531ac9e8f7c113173c77e44b0feab72 Cred pipeline, integration tests, validation sweep
- f851bb454f7489c9bd1ea2f89032c043e57ba1e2 Disable preview_finding tool + merge rerun phases into single pool
- 704b6512c6f2ce432734949d1a3e1a1dc70a93fc Hook prose: name start_pentest by tool name; preview_finding by name
- 821ce473f828d5c2b26b017f5bae8924cd87cb35 Initial scaffold: CLI, agent, shared packages
- f538f0a12d0bea1069e7a86042e28b8c55303935 Kill niro/docs scaffolding; demote subprocess_stderr to INFO (#20)
- 809fca702882a62c74d6f799da83cbb23915451b Merge pull request #1 from apxlabs-ai/test/notify-and-pr-mode
- 7a9ff9368dc69c2b7857db99204c59bc9cdf8276 Merge pull request #11 from apxlabs-ai/feat/canonical-pr-comment-and-gate-proposal
- 39772b24fc4984745a384d3316772728d94168a0 Merge pull request #12 from apxlabs-ai/feat/rename-verify-to-preview
- d5991d5fc0b96894eb9b8c0d06efba4094102073 Merge pull request #13 from apxlabs-ai/feat/preview-dry-run
- 5f98a2c2b36f748c75fb78f99b78a552fc3b6bf8 Merge pull request #14 from apxlabs-ai/feat/start-pentest-auto-rerun
- 288c86866a3fb76a35d37afe4a44da82b02bf7f3 Merge pull request #15 from apxlabs-ai/chore/serve-robustness-bundle
- 7080dd07893b69b4ffa6177d5fe3339c0b5aeaa3 Merge pull request #16 from apxlabs-ai/chore/disable-preview-finding
- 39fb4e8b2388e6e6e75cc5e07ab225b956f4edd9 Merge pull request #17 from apxlabs-ai/test/rerun-prior-verdicts-coverage
- 38401212c18976dd29a78b47aa25b16a41b088c5 Merge pull request #18 from apxlabs-ai/fix/parser-fires-session-start-once
- 67b773f60d3a7f7ac1e09807d92d26b1a25add9f Merge pull request #19 from apxlabs-ai/feat/log-enrichment-context-tokens-and-pentest-id
- d916ff83cd67d028eac76fa7cc42dd47650c4b3f Merge pull request #2 from apxlabs-ai/feat/sort-findings-by-severity
- 6b955e0c5365b4c593682e5bc7aa77b9c19c4dcc Merge pull request #26 from apxlabs-ai/fix/niro-gate-security
- e5542760a8858c0237d1cf9737527034b65ec99d Merge pull request #3 from apxlabs-ai/fix/post-verdict-context-deadline
- d2af907c7ae44ded2132718fe66723cc67fd29b5 Merge pull request #4 from apxlabs-ai/fix/casdoor-demo-feedback
- c3a364758cabe525cf422f9355ddd80ca873ee37 Merge pull request #5 from apxlabs-ai/chore/simplify-start-pentest-api
- 1bc11190947a13c0010b34141d03113feb92e791 Merge pull request #6 from apxlabs-ai/feat/tactician-pr-continuity
- ee1a8f184e40cc4bd8164ce21ee86770c5e835fb Merge pull request #7 from apxlabs-ai/feat/verify-nextsteps-and-always-post-pr-comment
- 51d6d1075f8ade651e97173e14e99e9f2db86562 Merge pull request #8 from apxlabs-ai/feat/aggregate-pr-comments-verify-publishes
- e688e1e0628bd25717408e60752bf03a6ad20872 Merge pull request #9 from apxlabs-ai/feat/pentest-status-heading-and-niro-attribution
- d93de9f99ba560999be9e59f5178dff961f0feb0 PR-mode continuity: delta in pr.patch + inline prior test cases
- a2ccb678dc0b171e33bfce74abcafa0d1d8be7d6 Plugin-based reasoner dispatch: claude code + GitHub Copilot drivers (#45)
- 49e6e2df2b933e3842604c2ec7dd9fc619aab744 Reflection: add docs-empty concern (block-tier, once-per-session)
- e4fb716d44af06b0702062f95043fd405fdddd11 Rename verify_finding tool to preview_finding (pure refactor)
- 9d174dfbde547baa591906ef058714c7ac205498 Simplify start_pentest: drop diff/base_ref/artifacts, session-key gate
- 8a04359edc539ef2387778e65eec503cfd02c9cd Snapshot draft4: PR mode, notify fan-out + GitHub PR publisher, dev UX proposal, reasoning logs
- 031a19325bca05abddf53f4a6dd4106f6395d095 Sort findings by severity in PR comment; consolidate severity rank into pkg/notify
- c69fbdce2b2e041d02f108466880de287961de12 Task-oriented SessionRunner interface + Tier abstraction
- 36bb397c8b4c81aa095beecea09fe1966c78c047 Test stability: drain workers + atomic flags to remove races
- 5bcc70a0f4312652b6bf6c369c4576ec24a20463 Tests: pin rerunPriorVerdicts merge invariants
- 7d5fa1275b436407d65b64bf36d6fff7e1b7bb94 Unit tests for notify fan-out, GitHub publisher, and PR mode
- 3cfffb039c640c4d24a353bc0c61e90daf47cdd3 Verdict-in-h2 heading; drop pentest id from visible title; Niro attribution
- e845fe14aa08d9c361fad3312632d8f96267caea copilot hook: clear pending-pentest marker on start_pentest postToolUse + vector prompt: adapt fixtures instead of MARK_BLOCKED (#54)
- 862c36e0a515ccd686392c9e8cca5451985e0edf copilot: four follow-ups from live Copilot pentest validation (#52)
- 3022b4fa44f60cda1790726b743c2eb72bba3f6d docs(init): rewrite project README template (#56)
- a2104c88a2f88520879af1142eff2bd893457578 draft4 snapshot: claudecode integration, brain runner, scope rename, init CLAUDE.md guidance
- c1da91ddd1820fc777caf89087ce87bd5bde929a feat: niro-gate v0.2 — comment-driven CI security gate (#24)
- de642c804a1709248b4e9803eee1cc17f915186a fix(copilot): AvailableTools needs niro-prefixed names, not empty (#51)
- de7fc74ea52597d5cda9fd46228d4abc90a8c12d fix(niro-gate): add concurrency group to workflow example; note stalled pentest in v1.0 roadmap
- 9a488297e42aa8ab84f6089edb54696ae9b4af33 fix(niro-gate): security and reliability fixes
- 24ab7350493168131d0ada9365599ad89c1b927e forge: cross-host PR-publish abstraction + pentest package decomposition (#55)
- e9cd089705b19a7d65f42267be6be1e1e2af84a7 gate: drop sticky comment + check-run API call, lean to single check (#35)
- dd363920fac2404f7b1e4a0088390966d897913e gate: niro-agent posts the gate verdict directly (v0.2 — no CI workflow) (#40)
- e4502c78c2e44f9bea0751826c8df54a775a4c06 gate: post pending "Pentest in progress" status at pentest start (#41)
- 3706defb1dec2ab211bdd0a3e05b16a662521a14 gate: rename context "Niro Gate" → "Security / Niro" (#42)
- 79fb81f8e12ea944bbebd46767e2dda7572309bf gate: v0.1.3 singleton check_run with state-machine UX (#37)
- b69d89ed87d3ddc207c5ce89ad29cc3a186c3d02 gate: v0.1.4 — event-aware single-row state machine with spinner UX (#38)
- 2df397ba8f7d17f90084cb3de83d44860ba23c8f gate: v0.1.5 — always-POST check_runs, rely on UI name-coalescing (#39)
- cd46bea746812c1dbad6e1fe364a76baa7e01b37 init + cred: scope self-docs; credentials are dev-produced + gitignored (#30)
- fcf1adcd09f31d4bcd92ef73c1b9ef1fbdc04ba4 init: --agent flag + copilot hook templates; add codex driver; drop niro-gate (#46)
- 9d86514a35190d759854d35670d7548aba2ed2d7 init: scaffold .github/workflows/niro-gate.yml (#34)
- 847fe556769eed7dd6b6fb3de375747ffd62911e logs: consolidate to 3 canonical files with rotation + cross-process flock
- 3fc994019b557053df74d3238b3dac49c9185b9c logs: final_context_tokens + pentest_id on Vector/Tactician events
- eca970979e03c2d83a02c9219ff27c72afa903ab manage_finding: unified accept/revoke/dispute tool (#27)
- 7d8e34a16d1be2b71908f2bc82e887ee8391b8fc niro init: point Next steps at credentials.yaml.example (#31)
- a1b8ace54f67a43503a826d06513959a166bcaba niro serve: fall back to common claude install paths + boost PATH
- f9da26afe0d5b252480ef8d8fb1e9cb239b6a095 notify/github: drop transition bubble comment (#44)
- 9d3103a3e86ab69e8de0a4d1d729dca21cf1f721 notify: align comment verdict with gate — exclude acknowledged findings (#43)
- 7ae5034059341709c2da9a5b4584c40a1bac178a notify: emit gate-data sidecar + acknowledge in PR comment (#28)
- 4c61b3d5bdc13f59b5f7517aeda4536532a09c40 parentenv: adopt provider env from parent agent process at startup (#49)
- 94c2a55cdcd29536ee276b7a5169cbdf98413612 parsers: dedupe fireSessionStart by session_id
- 58850250acf0a4406bd0ce5504bc7a11a4b55527 pr.go: add multi-VCS extension-point design comment (#25)
- 734c16e104ea520abaafa10f125c726f31bc25bd preview_finding: true dry-run via PreviewTestCase + preview_verdict tool
- f92b365aaa64490e66be0503aabf733d61b4d6e4 reasoner observability + session-init binary check + fail-hard dispatch (#47)
- 35ed9203a80c50867c77fae625db4979675430ec refactor: extract gate-data wire shape into shared package (#32)
- c0095139468e6d38b5bedd2515b4187154b2c3a0 refactor: move niro-gate binary to cmd/niro-gate (#29)
- a812053091b5a61f62fa92c4092171cf751a1f31 release(dist): v1 binary distribution pipeline (darwin/linux/windows) (#57)
- cadc534d54b3344cfa59b3865fdeb5f6b5965c13 release(dist): version-independent asset names for stable URLs (#58)
- 3371e9baacef00a94a17f8bc2d4189007eaa2900 release(image): publish niro-agent to ghcr.io on tag + stamp registry in CLI (#59)
- 1a0962a016e7e35ebf1e9d0cad480207ff3ae20e release: publish niro-gate binary to public apxlabs-ai/niro-gate (#33)
- 337976c33b291b845b960a1ef88694adb269cdba runOneExecuteSession: silent close is success for regression-check phase
- 198cd777c1adee5e3a4c7481bd7c7ad091b1e7a2 same-SHA start_pentest re-verifies existing tests, skips Tactician (#48)
- d66a73ea54dbbc9cdc82d73154caa3bcc28b0d58 serve: omit reason key from serve_stopped when nil (#22)
- adf88e7971198797dfdd8947e1b7485b511e6f0a start_pentest: auto-rerun prior verdicts; preview description tweak
- 2adcf360e6e4346d72d405a770cc33022f704267 start_pentest: require url_serves_latest_code attestation (#21)
- 722835d796eb21c3597dd26b871de77bd4eb163e tools: centralize per-reasoner wire projection + reasoner_log_pointer parity (#50)
- 2bc95783549032b648027df01e42d96b3e9ebbc5 verify_finding NextSteps; always-post PR comments; passed tests block