Niro v0.1.61

Summary

This release improves pentest reliability and diagnostics, simplifies duplicate test-case handling, prevents long report evidence from being clipped, and makes discovered credential registration consistent with credentials.yaml.

Changes

• Claude, Codex, and Copilot sessions now always preserve their provider-native session files so failed agent runs leave diagnostic evidence.
• Marking a test case as a duplicate now deletes that duplicate row. Ephemeral test-case history and duplicate metadata are no longer retained.
• Long commands, tokens, and minified JSON now wrap within PDF report code blocks instead of extending past the page boundary.
• register_credentials now accepts the standard credential fields and applies the same type-specific validation used for credentials.yaml.
• Credential metadata consistently uses description; legacy permission, internal value maps, caller-supplied source labels, and unknown fields are rejected.
• Discovered mTLS credentials expire at the earlier of the supplied session expiry and certificate expiry.

Security

Credential registration now has a narrower trust boundary: the attacker agent cannot claim a customer source, malformed type/material combinations fail before storage, and an explicit shorter mTLS session lifetime cannot be extended to the certificate lifetime.

Persisted provider-native session files improve incident diagnosis but can contain prompts, tool activity, and other run context. Protect them with the same host access controls and retention policy used for other Niro diagnostics.

Compatibility and upgrade

No CLI flags or customer configuration keys changed. Existing credentials.yaml files remain compatible.

The attacker agent credential MCP surface changed: registration uses description, type, and type-specific material fields; listing emits description; and legacy permission, value, and files registration payloads are rejected. The ephemeral test-case-history tool was removed. Niro supplies this internal surface to newly started attacker agent sessions, so no customer migration is required.

Upgrade normally with niro upgrade or rerun the installer.

Known issues

• Provider-native session files persist on the host and may consume disk until removed by the provider's or operator's retention process.
• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.