Niro v0.1.64

Summary

This release makes customer-facing pentest summaries structurally consistent across find, fix, and clean runs. Niro now renders the summary from canonical pentest state while leaving deployment-specific ranking and concise customer prose to the developer agent. It also records both the developer agent and attacker agent across all supported agent CLI implementations and replaces the previous operational logs with lower-noise files split by execution boundary.

Changes

• Find and fix runs now publish a tool-rendered Markdown summary with stable headings, tables, empty-run text, and omission rules. Finding facts come from canonical state; the developer agent supplies the reconciled finding order, fix outcomes, and the customer-facing paragraphs for accepted behavior, coverage gaps, and residual risk.
• Fix summaries retain findings removed after successful verification when the developer agent includes them in the reconciled finding order, even when a fix outcome is omitted. Snapshots excluded from that order, including accepted behavior, stay excluded. Missing or incomplete outcomes are surfaced as warnings instead of silently dropping the finding.
• Niro now owns the summary and PDF destinations. The PDF tool no longer accepts an output directory from the developer agent, report paths stay outside the Markdown summary, and direct sessions still return the generated PDF location to the user.
• niro init now installs the lifecycle hooks that feed the run ledger without a separate opt-in. The ledger distinguishes completed turns from session termination and records developer agent and attacker agent activity when their agent CLI implementation is Claude, Codex, or Copilot, including per-agent streams.
• Ledger reads now skip an isolated corrupt JSONL record and retain the rest of the run instead of making the complete ledger unreadable.
• Operational logs are written separately to niro-activity.host.jsonl and niro-activity.sandbox.jsonl, with origin: host|sandbox preserving the execution boundary. Merge the files at read time for a unified view. Successful instrumented and agent-driven tool calls are omitted because the ledger already records them; successful host-issued sandbox calls remain as orchestrator_tool_call audit records. Failures and panics remain, and MCP request tracing moves to debug level.

Security

The internal summary staging file uses private permissions and is atomically replaced. Generic/local runs and GitLab CI publish a separate niro-summary.md copy with mode 0644; GitHub Actions publishes through its job-summary service. The renderer selects reportable canonical findings, excludes development-only findings, escapes Markdown table and link delimiters, and never includes its internal destination or the PDF path.

Attacker agent sessions implemented by the Codex agent CLI keep the model sandbox read-only. Niro executes lifecycle hooks outside that sandbox and uses a stable Niro-owned OS-cache directory for the attacker agent working directory and isolated CODEX_HOME. That cache can retain copied Codex configuration, authentication, trust, and session data across runs and should be handled as sensitive local state.

The run ledger and debug-log archive may contain tool arguments, tool outputs, prompts, target details, and other sensitive diagnostic data. Continue treating niro-debug-logs.tar as an unsafe support artifact and share it only through an approved channel.

Compatibility and upgrade

• niro init --hooks has been removed; hooks are installed automatically. niro must be discoverable on PATH before niro init runs, even when the current invocation uses an absolute executable path. After updating PATH, re-run niro init to update existing Claude, Codex, and Copilot integrations with the current lifecycle hooks.
• Previous activity and security log filenames have been replaced by niro-activity.host.jsonl, niro-activity.sandbox.jsonl, niro-security.host.jsonl, and niro-security.sandbox.jsonl. Update collectors to read both files for each stream; merge niro-activity.*.jsonl at read time and, when needed, filter on the origin field.
• The developer agent MCP surface adds generate_pentest_summary. generate_pentest_report now has an empty input object because Niro owns its destination. Custom MCP callers that supplied output_dir must stop sending it.
• No customer configuration keys changed.

Upgrade normally with niro upgrade or rerun the installer.

Known issues

• If a requested PDF fails after the Markdown summary is generated, the run fails and the reason is written to the job log, but the published job summary may not include that failure explanation.
• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.