v0.4.0

Changes

• Merge pull request #579 from ChronoAIProject/chore/bump-components-0-4-0 (143ee44)
• chore: rebuild wizard bundle for v0.4.0 (59fb45a)
• chore: regenerate lockfiles for v0.4.0 bump (0971be3)
• chore: bump components to v0.4.0 (90ea056)
• docs(readme): split Connecting AI Services into hub + per-path docs (#571) (d620c4b)
• Merge pull request #578 from ChronoAIProject/fix-issue-576-public-client-broker (aec50d7)
• Merge pull request #577 from ChronoAIProject/feat/ssh-org-sharing (10c02e3)
• refactor(oauth): clean up DCR field annotations and cover get_binding (d327244)
• test(cli): assert full body shape in add-ssh no-org test (9a8d7ae)
• fix(oauth): allow DCR-issued public clients to use broker capability (#576) (516abda)
• feat(cli): support org-owned SSH services (a72d96f)
• Merge pull request #572 from ChronoAIProject/feat/issue-560-cli-org-resolver (cdfef0a)
• test(backend): derive unique slug per org test fixture (3dd4939)
• feat(frontend): surface auto-generated org slug and allow editing in settings (2558d24)
• refactor(cli): tighten --org resolver and api_key call site (c2d97be)
• docs: document --org resolution + slug field across CLAUDE.md and skills/nyxid (b7d135d)
• test(backend, cli): cover slug backfill, lookup, and CLI resolver (4484e59)
• refactor(cli): route all --org flags through shared org resolver (acdaf6c)
• feat(cli): add shared org resolver for --org arguments (b2356ee)
• feat(backend): expose org slug in /orgs and accept slug as lookup key (3f80b64)
• feat(backend): add auto-generated slug to org users (a641111)
• feat(landing): replace waitlist with Discord beta-invite CTA + dev proxy CSRF fix (#569) (874dd89)
• Merge pull request #568 from ChronoAIProject/feat/issue-553-org-multi-admin-nodes (5da211d)
• feat(cli): poll pending credentials with multi-instance fallback (e119892)
• refactor(backend): tighten pending credential push validations (9c340b8)
• fix(backend): reverse node transfer ordering to prevent cross-tenant routing window (77f75b2)
• chore(cli): regenerate wizard bundle for credential push UI (a250441)
• docs(skills): remote credential provisioning flow (3343e22)
• test(backend): pending credential lifecycle integration tests (4af03cf)
• feat(frontend): credential push UI on node detail page (f235d11)
• feat(cli): nyxid node credentials pending/accept/decline (VM) (10ca68a)
• feat(cli): nyxid node-credential push/list/cancel (laptop) (3a8b0a9)
• feat(backend): node-agent endpoints for pending credentials (f89bc2d)
• feat(backend): node pending credentials model + push endpoint (d77e523)
• docs(skills): document org-owned nodes operational playbook (8e9dc60)
• feat(frontend): transfer-to-org action on node detail (93ee771)
• feat(cli): nyxid node transfer command (2b52493)
• feat(backend): transfer node ownership between users and orgs (761b4ba)
• docs(skills): document org-owned nodes (fc860e9)
• docs: note registration-token TTL bounds revoked-admin window (1ef440b)
• refactor(frontend): use snake_case owner_user_id in node schema (c5f88d6)
• refactor(cli): align node --org with existing convention (56697ee)
• fix(backend): allow direct owner to mint registration tokens; propagate owner audit to WS events (4428f48)
• feat(frontend): owner column, owner picker, shared-with section (a105197)
• feat(cli): org-owned node management (485a9a8)
• docs: document polymorphic Node.user_id convention (5b1615b)
• feat(backend): include owner_user_id in node-routed proxy audit + e2e test (f4979ca)
• feat(backend): list nodes returns owner metadata + admins endpoint (082e9f0)
• feat(backend): owner-scoped node registration tokens (0b686a3)
• refactor(backend): route node access through resolve_owner_access (7b5f6c9)
• Merge pull request #556 from ChronoAIProject/debug/slow-mtls-binding-test (e21cc45)
• test(api_docs): serialize SPEC_CACHE access via RAII guard (34b7ba8)
• perf(tests): cache JWT keypair and opt-level rsa in dev profile (bd28089)
• Merge pull request #555 from ChronoAIProject/feat/issue-549-broker-capability-enabled (0d0dd22)
• docs(env): document MTLS_CLIENT_CERT_HEADER in docs/ENV.md (b086b6f)
• docs(env): document MTLS_CLIENT_CERT_HEADER in .env.example (a8b8113)
• docs(skills): note V2 broker capabilities in skills/nyxid (25d5999)
• fix(oauth): post-V2 review fixes (clippy, PAR TTL, CAE secret zeroize) (f195bc0)
• feat(oauth): Continuous Access Evaluation webhook on broker binding revocation (b1b4d22)
• feat(oauth): RFC 8705 certificate-bound access tokens (proxy-forwarded mTLS) (32e9a34)
• feat(oauth): RFC 9449 DPoP sender-constrained access tokens (4e5c5d0)
• feat(oauth): RFC 9126 Pushed Authorization Requests (PAR) (b3c4adb)
• feat(oauth): RFC 7662 introspection support for broker binding handles (3d1ee50)
• feat(oauth): chain-follow retry on broker rotation conflicts (8a084c2)
• feat(crypto): AAD-bound encryption for broker refresh tokens (4bc6951)
• fix(oauth): silence unused-variable warning in /oauth/bindings auth (e1872bc)
• fix(oauth): broker token-exchange gate must honor scope trigger too (d41c61e)
• feat(oauth): urn:nyxid:scope:broker_binding as broker-mode trigger (8a87fd1)
• feat(oauth): DELETE /oauth/bindings/{binding_id} client-revoke alias (cf3756b)
• refactor(oauth): align broker subject_token_type URN with #549 contract (0c6c1a5)
• docs(skills): document OAuth broker bindings in nyxid skill (ce037f3)
• feat(oauth): GET /oauth/bindings reverse lookup by external_subject (91cf781)
• feat(oauth): GET /oauth/bindings/{binding_id} introspection (5a43bd5)
• fix(cli): relax wizard heartbeat watchdog (#554) (5169b62)
• feat(cli): nyxid oauth bindings {list, show, revoke} (47692dd)
• feat(oauth): broker discovery metadata, audit events, and integration tests (62c2ed5)
• feat(account): authorizations page (list/revoke broker bindings) (f31e355)
• feat(oauth): revoke broker bindings via /oauth/revoke and user account API (1072569)
• feat(oauth): token-exchange path for urn:nyxid:token-type:binding_id (02b0115)
• feat(oauth): broker path on /oauth/token returns binding_id (facb4a6)
• feat(oauth): oauth_broker_binding model + indexes (d271f22)
• feat(oauth): persist optional external_subject ref on AuthorizationCode (13b915b)
• fix(oauth): include broker_capability_enabled on OidcCredentialsResponse (108182f)
• feat(oauth): broker_capability_enabled flag on OauthClient (c7f8e63)
• feat: surface viewer node routing on /services and /keys (#416) (#551) (af0d8b8)
• Merge pull request #550 from ChronoAIProject/chore/update-skills-spec (e3f8e89)
• feat(cli): self-heal partial nyxid skill installs after spec migration (e4a84eb)
• chore(skills): drop legacy proxy.sh and services.sh helper wrappers (86bc1db)
• refactor: migrate nyxid skill to Anthropic Agent Skills spec (95f4ea3)
• fix(cli): drain pending placeholder keys on wizard watchdog/timeout/ctrl_c (#448) (#548) (aaa4cfb)
• Merge pull request #547 from ChronoAIProject/fix/issue-545 (3dc5ac7)
• fix(keys): show org avatar for shared org sources on AI Services (#545) (7af20a8)
• Merge pull request #544 from ChronoAIProject/fix/issue-539-org-last-admin-remove-disabled (f9cb1d1)
• feat(cli): wizard for service add --custom --via-node (#414) (#543) (05babf6)
• fix(keys): persist user label on UserEndpoint for no-auth catalog flows (#541) (3013364)
• test(frontend): assert last-admin tooltip text + drop redundant disabled (#539) (09232a3)
• fix(frontend): use radix tooltip for last admin lock (#539) (386b34b)
• fix(frontend): disable remove and role change on last active admin (#539) (2d36f26)
• Merge pull request #540 from ChronoAIProject/chore/bump-tokio-tungstenite-nix (b16e175)
• chore: bump tokio-tungstenite to 0.29.0 and nix to 0.31.2 (67c1b99)
• Merge pull request #538 from ChronoAIProject/docs/issue-537-nyxid-via-403-vs-404 (0e7fcff)
• Merge pull request #535 from ChronoAIProject/fix/issue-534-org-device-code-pending-auth (bb1ef9a)
• docs: clarify _nyxid_via 403 vs 404 contract (#537) (9387298)
• docs(skill): document org-aware provider disconnect and cascade cleanup (#534) (662f9fc)
• feat(frontend): org-aware provider disconnect on Providers page (#534, closes #536) (8ef0cf2)
• fix(backend): list my-tokens accepts target_org_id (#534) (9c857a5)
• fix(backend): exclude node-managed keys from provider token cascade (#534) (6aa71cc)
• fix(backend): rename audit on_behalf_of for device-code completion (#534) (4a8f8b7)
• feat(cli): add --org to provider disconnect for org-owned tokens (#534) (a84e286)
• fix(backend): cascade-revoke provider token when last service is deleted (#534) (f194d75)
• fix(backend): pass effective user_id through device-code completion (#534) (aeebd09)
• Merge pull request #533 from ChronoAIProject/fix/issue-530-cli-delete-json-output (af83d87)
• fix(cli): honor --output json on delete commands (3f262ae)
• Merge pull request #531 from ChronoAIProject/fix/issue-528-org-member-add-json-output (f622129)
• fix(cli): honor --output json on org member add (5a3b8ae)
• Merge pull request #529 from ChronoAIProject/feat/issue-497-org-admin-sa-dev-apps (2325593)
• refactor(frontend): clean up org-owned resource detail APIs (9fd6ef9)
• test(frontend): cover org owned resource flows (d2d8c53)
• feat(frontend): add org owned resource tabs (a796dc7)
• feat(frontend): add org scoped detail routes (82dd46a)
• feat(frontend): support org scoped app hooks (bdf10ed)
• refactor(frontend): extract reusable app detail components (27a8e45)
• Merge pull request #523 from ChronoAIProject/fix/issue-513-non-ascii-identity-headers (30ce85c)
• chore(frontend): update landing footer Discord invite link (#527) (73ed591)
• docs(readme): update Discord invite link (#526) (3a39f58)
• Merge pull request #522 from ChronoAIProject/fix/issue-514-default-proxy-user-agent (6466b88)
• Merge pull request #521 from ChronoAIProject/docs/issue-512-api-key-scope-precondition (fd06ed9)
• docs(identity): broaden sanitize_header_value contract and tighten test (6184fe4)
• fix(proxy): inject default User-Agent when ca...

v0.3.0

Changes

• chore: bump all components to 0.3.0 (#492) (40483f9)
• feat(telemetry): Part 2 emission sweep (closes #442) (#494) (c1c858e)
• chore: refresh CLI wizard bundle (#495) (c45ed18)
• feat: ship telemetry consent withdrawal toggle (web + CLI) (#485) (8b87f23)
• Merge pull request #438 from ChronoAIProject/feat/cli-remote-pairing (4b2c90b)
• Merge remote-tracking branch 'origin/main' into feat/cli-remote-pairing (95079ad)
• fix(config): thread CLI_PAIRING_HMAC_KEY through AppConfig + document TRUSTED_PROXY_IPS (8196689)
• Merge pull request #489 from ChronoAIProject/fix/issue-415-service-slug-ux (0f39935)
• feat(cli): honor --slug in OAuth and device-code service add flows (#415) (e9eead2)
• docs(skill): document --slug flag and per-user slug/SSH scoping (#415) (e74789f)
• fix: clean service slugs + per-user SSH scoping (#415) (02a4ab0)
• Merge pull request #488 from ChronoAIProject/fix/backend-test-mongo-probe (1b7e11a)
• Merge branch 'main' into feat/cli-remote-pairing (9084fa5)
• fix(ci): run backend tests against MongoDB service container (3e586df)
• fix(ci): unblock Rust pipeline on feat/cli-remote-pairing (#486) (8dde61f)
• Merge pull request #483 from ChronoAIProject/feat/issue-480-channel-relay-edit (7e78494)
• docs(env): document channel-relay edit rate-limit env vars (c566b91)
• Fix merge conflict in user_api_key_service.rs (2aa9599)
• Merge branch 'main' into feat/cli-remote-pairing (c01a703)
• docs(skill): document channel-relay edit-message endpoint (ac1db8e)
• refactor(channel-relay): document Lark edit-error taxonomy and rate-limit ordering (dacf8da)
• feat(channel-relay): add edit-message endpoint for progressive replies (7d3ea8c)
• chore(ci): add fast wizard bundle touch-check sentinel (#482) (63fc236)
• feat(cli): wizard v4 UX polish — unified UI + heartbeat + catalog fixes (#481) (fede5dc)
• docs: fix quickstart onboarding issues (#479) (1e8cd22)
• Merge pull request #478 from ChronoAIProject/feat/issue-167-lark-permissions (de5a77c)
• feat(lark): auto-generate permission setup link for bots and AI services (#167) (ace0d80)
• Merge pull request #310 from ChronoAIProject/feat/identity-assertion-rbac (bbde405)
• Merge pull request #477 from ChronoAIProject/feat/csrf-trusted-origins (b0e9993)
• style: apply rustfmt to identity assertion call sites (6c9863e)
• feat(csrf): add CSRF_TRUSTED_ORIGINS env var separate from CORS list (e0041bd)
• Merge pull request #476 from ChronoAIProject/fix/issue-434-mcp-oauth-default-scopes (873b0fc)
• Merge pull request #475 from ChronoAIProject/audit/pr-472-cli-skill-md (3ec54ec)
• fix(oauth): grant roles and groups scopes to MCP clients (#434) (52b8858)
• chore(cli): drop duplicate cfg(test) attribute on test_support module (ec24d3b)
• docs(skill): inline reply_token semantics instead of external link (30100a8)
• docs(skill): document reply_token in channel relay callback (0b2fa53)
• Merge pull request #472 from ChronoAIProject/jaded-lynx (ecf29c5)
• Address review feedback on relay reply token (72f55cf)
• feat(telemetry): M1 usage analytics + error-tracking framework (#442) (#461) (5375a93)
• Implement channel relay reply tokens (a433846)
• Merge pull request #471 from ChronoAIProject/plan/issue-424-fix (97f26ca)
• test(auth): assert org users get generic anti-enumeration response on public auth paths (4fff837)
• Merge pull request #468 from ChronoAIProject/plan/issue-446-fix (183247c)
• refactor(docs): serialize cached openapi spec without deep-cloning the Value (55fe800)
• fix(discovery): surface custom UserService specs in catalog/proxy endpoints (#446) (2fb6961)
• Merge pull request #467 from ChronoAIProject/fix/user-service-auth-method-snapshot (38ac48e)
• Merge pull request #466 from ChronoAIProject/fix/llm-gateway-user-service-lookup (e339141)
• fix(keys): snapshot SPR-derived auth_method onto UserService, backfill stale rows (4c97031)
• fix(llm-gateway): look up UserService by catalog_service_id, not provider_slug (3d1fb3c)
• Merge pull request #465 from ChronoAIProject/fix/proxy-skip-delegation-for-user-service (5cbb97e)
• fix(proxy): skip delegated-credential resolve when new UserService path resolved the target (e9166a3)
• Merge pull request #464 from ChronoAIProject/fix/issues-457-459-462 (1f20e0b)
• feat(cli): add nyxid cleanup-orphans subcommand for pre-fix orphan rows (6ccf557)
• refactor(test): extract shared MongoDB and encryption-key helpers into test_utils (024417f)
• fix(keys): validate node before creating backing resources (#459) (05ed981)
• fix(keys): hard-delete endpoint and api-key when revoking a service (#457) (db6d526)
• fix(proxy): use service owner for delegated credential lookup on org-routed services (#462) (f24af7f)
• Merge pull request #463 from ChronoAIProject/fix/458 (cb87ad8)
• fix(cli): resolve node names for service --via-node / --node / --node-id (#458) (8485b81)
• feat(approvals): org-aware presentation in mobile app and notifications (#451) (05bcf3c)
• Merge pull request #456 from ChronoAIProject/fix/455-lark-webhook-verification (633d189)
• docs(cli): document encrypt_key three-state semantics (611dcd2)
• test(channel-webhooks): use local mock callback server (ae81adc)
• feat(channel-bots): expose verification material configured flags (301670e)
• fix(channel-bots): redact secrets in request struct Debug/Display (cd25a2b)
• fix(channel-bots): reject /verify for lark bots missing verification token (c17a949)
• fix(lark): verify signature before decrypting encrypted webhook bodies (366b3a5)
• fix(channel-bots): rewrite composite bot_token on PATCH for lark/feishu (3d93311)
• docs(skill): sync nyxid skill with lark verification fix (040b832)
• docs(channel-bots): document lark verification inputs (755eaed)
• feat(cli): support lark verification updates (b3daa0e)
• feat(frontend): support lark verification updates (905f10e)
• fix(channel-bots): correct lark webhook verification (81e5084)
• Merge pull request #454 from ChronoAIProject/fix/anthropic-api-credentials (2e2c1a0)
• fix(catalog): heal seeded Anthropic API setup on restart (2aac797)
• Merge pull request #450 from ChronoAIProject/feat/github-pat-catalog-seed (323ddf9)
• feat(catalog): seed GitHub PAT provider and api-github-pat service (985dfd5)
• Merge pull request #447 from ChronoAIProject/feat/445-lark-card-action-trigger (ea9ab0a)
• feat(cli): wizard v3.2 — full scope set + Access Scope card (82b0952)
• feat(channel/lark): relay card.action.trigger inbound events (ecbbff1)
• Merge pull request #444 from ChronoAIProject/fix/417-cli-none-prompts (c14d691)
• fix(cli): skip prompts for auth_method=none (a4a4cbc)
• Merge pull request #437 from ChronoAIProject/fix/keys-credential-upgrade-and-node-delivery (89e6f7f)
• fix(keys): pre-validate label so PUT stays atomic on invalid input (1a6d028)
• fix(cli-pair): trusted-proxy-aware rate limit + cross-shell resume cmd (1c929a9)
• fix(keys): classify node credential_missing + atomic no-auth downgrade (2b78c6c)
• docs(skill): clarify wizard v4 two-predicate layering (1dc389a)
• feat(cli): route headless callers through remote pairing + refresh skill docs (15ba9ea)
• feat(cli): wizard v4 — remote pairing (Mode B) for agents and split-device handoff (f36d314)
• feat(keys): server-held credential delivery + no-auth upgrade fix (3109011)
• docs(readme): make demo GIF expandable (#431) (d950090)
• docs(readme): add end-to-end demo GIF (#428) (64bb84a)
• Merge pull request #427 from ChronoAIProject/fix/org-model-polish-423-426 (5504e9c)
• feat(cli): add service-account and developer-app commands (#426) (e94fd89)
• feat(orgs): expose and edit contact_email after creation (#425) (4c3699d)
• docs(orgs): clarify OrgCannotAuthenticate vs anti-enumeration (#424) (9bb9ab2)
• fix(audit): record routed_via=personal for personal proxy calls (#423) (a6333d7)
• feat(cli): wizard v3.1 — DisplayOnce for node register-token + api-key create (#421) (dfbe8fd)
• Merge pull request #420 from ChronoAIProject/fix/org-invite-history-and-timeline (d7f4a7d)
• fix(orgs): retain org invite history and surface redeemer identity + timeline (107c5b1)
• feat(cli): wizard v3 — DisplayOnce flow for nyxid api-key rotate and node rotate-token (#412) (a3bf501)
• Merge pull request #413 from ChronoAIProject/feat/first-class-device-channels (b80d9c9)
• feat(channel): make device channels first-class (no bot required) (1a2f57a)
• Merge pull request #410 from ChronoAIProject/claude/jovial-archimedes-97ff87 (1ea42c6)
• feat(catalog): seed api-slack-bot for direct xoxb- bot token access (c2ca6c7)
• docs(skill): document Slack channel platform (6cabff4)
• feat(channels/slack): detect 429 and ratelimited responses on chat.postMessage (898bcdf)
• feat(channels): add Slack as a channel platform (#403) (4702823)
• feat(cli): add --terminal flag and document wizard v2 in NyxID skill (#404) (e83f301)
• Merge pull request #401 from ChronoAIProject/fix/rust-msrv-1.93 (14aa476)
• fix(cli): restore Rust 1.93 support for nyxid update (8ef9245)
• Merge pull request #400 from ChronoAIProject/claude/nervous-elbakyan-d030c8 (542cd74)
• fix(proxy): hard-fail UserService node-pinned requests when no viable node (#328) (7c881f8)
• feat(cli): wizard v2 — browser-based nyxid service add flow (#396) (2c10ccd)
• Merge pull request #395 from ChronoAIProject/fix/custom-service-approval-165 (f0bd71f)
• docs(approvals): clarify SERVICE_ID accepts UserService id (#165) (856d6c5)
• fix(approvals): support UserService IDs in per-service config (#165) (ebb0085)
• Merge pull request #393 from ChronoAIProject/fix/sign-in-method-display (1319156)
• fix: expose social_provider in user profile response (#215) (2015c14)
• Merge pull request #392 from ChronoAIProject/fix/auth-store-mixed-import (42f916b)
• fix(frontend): resolve auth-store mixed-import warning (6f95cd0)
• fix(ui): smooth modal motion and align api-key scope picker with AI Services (#391) (1cffb20)
• Merge pull request #390 from ChronoAIProject/fix/backend-docker-git-hash (8a64f8a)
• fix(backend): copy build.rs into Docker...

v0.2.0

Changes

• chore: bump version to 0.2.0 + fix MCP setup copy in README (#279) (6eb316a)
• Merge pull request #274 from ChronoAIProject/fix/path-auth-method-validation (c253d98)
• fix: remove stale node-agent references from UI, CLI error message, and docs (56d7fe0)
• chore: remove node-agent references from Dockerfiles and docs (83f950f)
• fix: support path_prefix in credential push and remove deprecated node-agent crate (8962481)
• fix: support path auth in node proxy, WS passthrough, and server-side node routing (d2be3b8)
• fix: migrate Telegram Bot catalog to direct path auth and handle path injection in proxy (d35edaf)
• fix: add path to auth_method validators for path-injection catalog services (d94d0aa)
• Merge pull request #272 from ChronoAIProject/fix/stale-grant-approvals-after-mode-switch (3434328)
• fix: invalidate stale grant-mode approvals on mode switch to per_request (de25e4a)
• docs: restore Step 1/2/3 quickstart and fix auto-verify regression (#269) (70192d1)
• Merge pull request #270 from ChronoAIProject/fix/registration-existing-email-message (d8b8718)
• fix: use neutral messaging for registration to avoid misleading success toast (51fbe4b)
• docs: tighten self-host quickstart — prereqs, disk estimates, optional CLI install (#268) (f3381a2)
• Merge pull request #260 from ChronoAIProject/feat/per-service-user-agent (b3c133f)
• feat: per-service custom User-Agent override for proxy requests (507ce02)
• Merge pull request #259 from ChronoAIProject/fix/workflow-hardening (8875539)
• fix: restore thread_sandbox for Codex git access (fd470d2)
• feat: add mempalace agent instructions and wake-up context to workflow (695fa92)
• fix: remove string sandbox policies rejected by Codex v0.118.0 (274719e)
• fix: increase read_timeout_ms to 60s and add timeouts to claude agent (7cff58c)
• fix: add explicit review boundaries to prevent code implementation (62700dc)
• fix: add explicit triage boundaries to prevent code implementation (5990323)
• fix: make after_create build steps non-fatal (7279a46)
• fix: use subshells for cd in hooks and increase timeout to 600s (2c57a37)
• fix: use fullstack label for implementer stage to pass scope validation (a599ba3)
• fix: add scope to fullstack implementer stage for parallel validation (b106f14)
• fix: harden WORKFLOW.md with symphony patterns and mempalace integration (843484a)
• Merge pull request #219 from ChronoAIProject/feat/org-model (8f1303a)
• feat: one-shot dev quickstart with auto-verify and invite gate toggle (#253) (0c74d7e)
• fix: remove stale DM Serif Text font preload causing 404 (#254) (7fd30f6)
• fix: resolve mobile UI issues — theme, layout, light mode contrast (#251) (3c15e75)
• docs: document _nyxid_via route constraint in SKILL.md + ORG_MODEL.md (fd61fbd)
• fix(proxy): constrain _nyxid_via to the route's service identity (9d6f957)
• refactor(proxy): rename via_service param to _nyxid_via (ebe33db)
• fix(proxy): strip via_service from downstream query + CLI flag + docs (fad8e9b)
• feat(proxy): explicit credential selection via ?via_service= (3422b95)
• docs: single copy-pasteable quickstart block (#247) (48da02d)
• fix(services): cascade-deactivate OIDC OAuth client on delete_service (651bddf)
• fix(orgs): cascade consents alongside refresh_tokens by org-owned client_ids (167d014)
• fix(orgs): live OAuth client check on auth-code exchange + refresh, cascade refresh tokens (7bb9666)
• fix(orgs): block + cascade custom downstream_services in delete_org_user (aa7dcb9)
• fix(orgs): close in-flight oauth race + cascade SA-owned provider tokens (1a6c10d)
• fix(orgs): block + cascade nodes / registration tokens / bindings + user_provider_credentials in delete_org_user (e9cc32c)
• fix(orgs): cascade agent_service_bindings + service_account_tokens in delete_org_user (ae79230)
• fix(orgs): block legacy user_service_connections, cascade notification_channels in delete_org_user (e1feea8)
• fix(orgs): cascade openclaw_channel_mappings in delete_org_user (d5fdeb4)
• fix(orgs): block + cascade channel relay state in delete_org_user (66010f2)
• fix(orgs): live-state filters on org delete blockers + symmetric orphan handling (816be4b)
• fix(orgs): tighten authorization on approval policies, member churn, invite TTL, org creation (1813a31)
• Merge main into feat/org-model (47e030a)
• docs(orgs): record node-ownership design rationale + follow-up (25bd21c)
• feat(orgs): shared credentials via Org=User model (67cda7c)

Container images

Multi-arch (linux/amd64, linux/arm64) images for this release are
published to GitHub Container Registry by the Publish Images
workflow:

• ghcr.io/chronoaiproject/nyxid/backend:v0.2.0
• ghcr.io/chronoaiproject/nyxid/frontend:v0.2.0
• ghcr.io/chronoaiproject/nyxid/node-agent:v0.2.0

What's Changed

• docs: single copy-pasteable quickstart block by @ctkm-aelf in #247
• fix: resolve mobile UI issues — theme, layout, light mode contrast by @ctkm-aelf in #251
• fix: remove stale DM Serif Text font preload causing 404 by @ctkm-aelf in #254
• feat: one-shot dev quickstart with auto-verify and invite gate toggle by @ctkm-aelf in #253
• feat(orgs): shared credentials via Org=User model by @kaiweijw in #219
• fix: harden WORKFLOW.md with symphony patterns and mempalace by @kaiweijw in #259
• feat: per-service custom User-Agent override for proxy by @kaiweijw in #260
• docs: tighten self-host quickstart — prereqs, disk estimates, optional CLI install by @ctkm-aelf in #268
• fix: neutral messaging for existing-email registration by @kaiweijw in #270
• docs: restore Step 1/2/3 quickstart and fix auto-verify regression by @ctkm-aelf in #269
• fix: invalidate stale grant-mode approvals on mode switch (#153) by @kaiweijw in #272
• fix: add path to auth_method validators (#273) by @kaiweijw in #274
• chore: bump version to 0.2.0 + fix MCP setup copy in README by @ctkm-aelf in #279

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Changes

• docs: rewrite self-host quickstart for launch readiness (#236) (5f1a29a)
• Merge pull request #241 from ChronoAIProject/feat/issue-221-http-event-gateway (a3c0e9d)
• feat: HTTP Event Gateway for device push events (#221) (3f4e4e6)
• chore(deps): bump frontend and mobile dependencies, remove unused packages (#235) (e03acb9)
• Merge pull request #237 from ChronoAIProject/fix/llm-gateway-user-service-resolution (6de9273)
• fix: reuse existing UserApiKey when provider token already has one (fa280ec)
• fix: llm gateway_request resolves user-level credentials from UserService (d2fe003)
• fix: llm gateway now resolves user-level credentials from UserService (207e94b)
• Merge pull request #234 from ChronoAIProject/ci/native-arm64-runners (1e57edc)
• ci: build images on native arm64 runners instead of QEMU (a54b9c3)
• Merge pull request #225 from ChronoAIProject/docs/launch-prep (2491cd7)
• Merge pull request #230 from ChronoAIProject/refactor/compose-override-pattern (ab50423)
• Merge pull request #231 from ChronoAIProject/feat/landing-page-update (e9beca0)
• feat(frontend): align landing page with new product positioning, enhance LCP, and add login flow (1848667)
• refactor: split compose into base + dev override + prod override (5f541cd)
• Merge pull request #228 from ChronoAIProject/fix/ci-workflow-call-trigger (a0946f4)
• ci: de-duplicate CI runs and bump action versions (39dbf76)
• ci: add workflow_call trigger to ci.yml (0eea07d)
• Merge pull request #227 from ChronoAIProject/feat/issue-174-ghcr-publish (cc20f42)
• ci: publish multi-arch images to GHCR on main + tags (805d88c)
• Merge pull request #222 from ChronoAIProject/feat/issue-220-token-exchange (55a74f0)
• fix: reject malformed token_exchange credentials at /keys registration (61ccf74)
• test: regression coverage for old body-auth HTTP flow (6967221)
• Merge pull request #224 from ChronoAIProject/feat/sso-invite-code (9ce36b6)
• docs: add raw HTTP / API usage section to SKILL.md (ce1fdb8)
• fix(auth): update closed beta copy to link waitlist page (13c6999)
• docs: clarify old vs new Lark token exchange privacy guarantee in SKILL.md (53da809)
• docs: update invite link to waitlist page (9807d7f)
• docs: update hosted URL to nyx.chrono-ai.fun, mark closed beta (ba21da6)
• docs: add banner, update tagline, honest localhost-to-MCP flow (217debf)
• fix(auth): release invite reservation on session creation failure (fc824ed)
• docs: add troubleshooting section for stale Lark/Feishu bot bindings (81806be)
• docs: update SKILL.md for transparent Lark/Feishu token exchange (5f64ee2)
• fix: token_exchange provisioning + resolution paths (fc26d5d)
• refactor: generalize lark_token_exchange into declarative token_exchange (6d7d789)
• feat: server-side Lark tenant token exchange with single-flight cache (e7f1d14)
• feat(frontend): fade transition, invite gate, unified SSO buttons (38f0e9c)
• fix(frontend): always show SSO buttons, stable panel heights (892e683)
• fix(frontend): gradient text rendering and dynamic panel height (8874f50)
• feat(frontend): unified sliding auth flow for login and register (37a5e6a)
• docs: restructure README as Show HN front door, extract env vars (e78b05e)
• feat(frontend): redesign register page with two-panel sliding layout (90759a5)
• feat(auth): carry invite code through SSO OAuth flow (9cc5e07)
• Merge pull request #211 from ChronoAIProject/feat/chatbot-intergration (2991fbd)
• revert: remove backend chat stub and social_provider changes (00b57ab)
• feat: smart offline retry, reduced polling frequency, and history polling (d0d08a5)
• feat: card chip layout, offline-aware queries, and avatar image support (247b4d5)
• Merge pull request #210 from ChronoAIProject/feat/admin-invite-codes-ui (843bfa0)
• feat(frontend): admin UI for invite code management (ed6e4b9)
• Merge pull request #180 from ChronoAIProject/feat/invite-code-registration (f154ac2)
• feat(auth): INVITE_CODE_REQUIRED env var to toggle registration gate (7299603)
• feat(cli): hint that browser shows login errors (65967f7)
• feat(frontend): human-readable message for social_auth_registration_closed (e66b2dc)
• docs(skill): document invite-code registration and admin CLI (e9fdff6)
• fix(invite-code): address review feedback on #180 (aaccee2)
• Merge remote-tracking branch 'origin/main' into feat/invite-code-registration (9cb3868)
• Merge pull request #208 from ChronoAIProject/docs/telegram-bot-proxy-path (ca67287)
• docs: clarify Telegram bot proxy path expects bare method name (e65c175)
• Merge pull request #206 from ChronoAIProject/fix/add-key-dialog-dynamic-auth-labels (a0935fe)
• fix(cli): dynamic credential prompts for body/bot_bearer auth (d0d7656)
• fix(frontend): dynamic credential labels in Add AI Service dialog (6f79270)
• Merge pull request #205 from ChronoAIProject/feat/body-auth-deprecate-channel-mode (03fd6f2)
• feat: body/bot_bearer auth methods and bot-as-service catalog seeds (622631b)
• Merge pull request #202 from ChronoAIProject/fix/node-ws-silent-disconnect (ee2424f)
• fix: detect silent WebSocket disconnects in node agent (24d41a5)
• Merge pull request #201 from ChronoAIProject/fix/chatgpt-translator-input-shape (bdfbeca)
• fix: backfill call_id on Responses API function_call input items (db79d8a)
• fix: convert Chat Completions input items to Responses API shape (c111215)
• Merge pull request #199 from ChronoAIProject/fix/chatgpt-translator-tools-shape (d9009ef)
• fix: convert Chat Completions tools to Responses API shape in ChatGPT translator (0423e85)
• Merge pull request #197 from ChronoAIProject/fix/mcp-dcr-proxy-scope (c006f7f)
• fix: grant proxy scope to dynamic OAuth clients for MCP access (7fd20c2)
• Merge pull request #195 from ChronoAIProject/feat/additional-oauth-scopes (867abef)
• feat: support user-supplied additional OAuth scopes on service connect (1aaf747)
• Merge pull request #193 from ChronoAIProject/fix/relay-token-inherit-agent-scope (46a6af5)
• fix: relay token inherits agent key scope, respects approval flow (5abdedf)
• Merge pull request #190 from ChronoAIProject/chore/apache-2.0-license (95fce79)
• chore: switch license from MIT to Apache 2.0 (d2de254)
• fix: cargo fmt + add inviteCode to register schema test data (b54a7f3)
• feat: invite code registration — require invite code to register, each code allows up to 10 uses (f69bce6)
• Merge pull request #173 from ChronoAIProject/fix/llm-gateway-user-service-resolution (3b9cfe5)
• fix: LLM gateway resolves via UserService path before legacy fallback (d77c295)
• Merge pull request #171 from ChronoAIProject/fix/relay-token-proxy-access (9f3bf50)
• fix: bypass LLM gateway approval for relay tokens (3c7599d)
• fix: relay callback token bypasses approval enforcement (58c1401)
• Merge pull request #169 from ChronoAIProject/fix/relay-token-scope (16fe3e0)
• fix: expand relay callback token scope to include LLM gateway (ecb41c0)
• feat: add light/dark theme system, infinite scroll pagination, and post-decision actionable toasts (59c6cae)
• Merge pull request #162 from ChronoAIProject/feat/landing-page (818b7b2)
• Merge pull request #155 from ChronoAIProject/feat/channel-bot-relay (bc1f1ab)
• docs: add group/per-user routing examples to SKILL.md (6d72598)
• fix: address Codex round 6 findings (92e6851)
• feat: make --credential optional on api-key bind, auto-resolve from service (0212035)
• docs: update SKILL.md and playbook for simplified service bindings (d44ca9e)
• feat: add --callback-url flag to api-key create and update CLI commands (b736258)
• fix: sync allowed_service_ids with bindings when scope is restricted (21fff15)
• feat: add allow-all-services toggle to bindings card (7a96cb4)
• fix: revert scope auto-sync, keep bindings as credential overrides (95cf4b0)
• refactor: auto-sync service scope from bindings, remove scope UI (f4c96a9)
• refactor: simplify credential bindings UI to single service picker (32aabbd)
• Merge pull request #163 from ChronoAIProject/docs/update-skill-nyxid-update-command (b9cbeee)
• docs: update SKILL.md to reference nyxid update command (5c7646a)
• fix: updated Frontend with landing page (1013240)
• docs: add channel relay env vars to .env.example (31427a4)
• feat: include bot owner's access token in relay callback header (2ab5205)
• docs: add architecture decision on platform adapters vs generic passthrough (85b61b6)
• feat: include raw_platform_data in channel relay callback payload (602330e)
• refactor: remove dedicated tool-requests polling endpoint (e6a4761)
• refactor: rename "NyxID API Keys" to "Agent Keys" in frontend (fdb3ee0)
• feat: implement Channel Bot Relay and Tool Approval API (8a8b4de)
• docs: add Channel Bot Relay design document (5759e1d)
• Merge pull request #159 from ChronoAIProject/feat/forward-access-token-and-identity-propagation (f4a4d74)
• feat: add forward_access_token, catalog identity propagation, and CLI update command (a8d5bd9)
• feat: deep-link challenge routing, in-sheet approve/deny, and push polling (08afcac)
• Merge pull request #150 from ChronoAIProject/feat/catalog-metadata-enrichment (28a9e97)
• fix: enforce visibility on catalog discovery and fix SSH hints (284b988)
• feat: iOS updated everything except chat (2a4c362)
• feat: add frontend UI, skills/examples fields, legacy migration, and docs (1dae921)
• fix: update chatbot intergration v2 (98ecdbe)
• fix: handle legacy services missing service_category in catalog filters (883f3cd)
• fix: use hardened spec fetch and align endpoint discovery filter (536e73c)
• feat: enrich catalog metadata for AI agent discovery (5e947de)
• Merge pull request #151 from ChronoAIProject/fix/proxy-binary-upload-and-identity-propagation (fbb540b)
• Merge branch 'main' into feat/chatbot-intergration (4cb1e20)
• feat: added mobile layout v1 (3ad733c)
• fix: support binary proxy uploads and fix identity propagation defaults (3d3d6b2)
• Merge pull request #149 from ChronoAIProject/fix/approval-grant-mode-switch-cleanup (d4afc28)
• fix: revoke stale approval grants when sw...