Niro v0.1.57

Summary

This release makes attended local execution interactive by default and requires
an explicit autonomous grant for unattended runs. It also adds on-demand,
customer-facing PDF penetration-test reports, first-class GitLab shared-runner
support, and stable descriptive credential IDs in place of opaque generated
handles.

Changes

• Local niro find and niro fix runs now open the selected agent CLI in its
  native interactive interface by default. CI and other non-terminal runs must
  pass --autonomous explicitly.
• Niro resolves the selected claude, codex, or copilot executable from its
  inherited PATH, validates the installed version against the selected native
  models before work begins, and uses updated default model tiers. Complete
  Copilot external-provider configurations remain outside native-model version
  floors.
• Completed pentests can now generate a private, versioned PDF on demand. The
  report uses canonical finding facts, a narrowly generated business-risk
  summary, distinct finding titles, Markdown-formatted reproduction and
  remediation content, customer-runnable target names, and deterministic Niro
  Community Edition rendering.
• GitLab CI now supports the standard shared-runner docker:dind topology,
  including fail-closed topology detection, job-scoped Niro state, authenticated
  control traffic, cleanup, and updated ready-to-copy pipeline examples.
• Every customer credential now requires a stable, unique uppercase
  credential_id. Customer and dynamically discovered credentials use
  descriptive IDs in credential listings, reports, and Bash variable names;
  attacker agent registrations must supply their own unique ID.
• Credential listings continue to expose useful non-secret identifiers while
  withholding scalar authentication material and private-key contents.

Security

Interactive mode delegates host-command approval to the selected agent CLI.
--autonomous is an explicit grant of the full filesystem, process, credential,
and network authority of the user running Niro; it should be used only on an
ephemeral, least-privilege runner with a reviewed revision. The supplied PR and
merge-request workflows require a human start, bind execution to immutable
base/head commits, and reject stale revisions.

GitLab docker:dind control traffic now uses a per-run bearer token and avoids
ambient proxies, while Niro-owned state is stored outside the customer checkout
with restrictive permissions and removed after the run. Credential registration
rejects duplicate IDs, ambiguous synthesized Bash names, and reserved
process-control names. The report-writing model receives only reportable finding
facts through a bearer-authenticated, loopback-only, single-tool endpoint;
target-derived text remains data rather than executable Typst source.

Compatibility and upgrade

This release has two required migration actions:

• Add a unique credential_id matching ^[A-Z][A-Z0-9_]{0,63}$ to every entry
  in credentials.yaml. Update scripts to use <CREDENTIAL_ID>_<FIELD> instead
  of generated CR_NNN names. HMAC values now use _SECRET instead of
  _SIGNING_KEY; PEM variables retain their field name and add _FILE, such as
  _KEY_PEM_FILE, _CERT_PEM_FILE, and _CA_PEM_FILE.
• Add --autonomous to every unattended or CI invocation of niro find and
  niro fix. Without it, Niro exits before orchestration when no interactive
  terminal is available.

Ensure the selected agent CLI is available through Niro's inherited PATH and
upgrade it if the compatibility preflight reports that the selected native
model requires a newer version. The developer agent MCP surface adds the
zero-input generate_pentest_report tool; existing clients that discover tools
dynamically require no configuration change.

Known issues

• checksums.txt covers the platform archives but does not yet include
  niro.mcpb.
• Release artifacts do not yet include detached signatures, a public binary
  provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC, and Windows users must
  rerun the installer to change versions.