Changelog

Upgrade with npm install -g buildwithnexus@latest or cargo install buildwithnexus --locked.

0.15.1 2026-10-02

This patch release fixes colours in the Windows console window, drops "hilariously fast" from the setup banner, and carries the npm publish fix that 0.15.0 needed.

Fixed

• Colours show in a cmd or PowerShell console window. In the console window that cmd and Windows PowerShell open, the first-run setup and anything else printed before the full-screen UI showed colour codes as text, such as ←[38;2;187;154;247m. It happened on every launch of a cargo-installed or release binary, and through npm on every launch after the one that downloaded the binary. bwn now turns on virtual-terminal processing for the console before it prints anything. A console that refuses it (the "Use legacy console" setting) gets plain text without colour. Windows Terminal was not affected.

Changed

• Setup banner. It reads "an agentic AI coding CLI for remote or local models". README and the crate descriptions give the measured 2 ms startup instead of "hilariously fast".

Release process

• npm publishing works with npm 12. The publish step passes the package tarball as ./dist/…. npm 12 read the old path as GitHub shorthand and refused it, so 0.15.0's first publish run failed after its GitHub release was out.

0.15.0 2026-10-01

0.15.0 is a minor release. It adds allow, ask and deny permission rules and an accept-edits mode. The trust prompt is one screen with one question. An approval for rm and similar commands covers only that exact command, and provider keys stay out of the agent's commands. Setup finishes only after the chosen model answers. Sessions belong to a folder, and /rewind goes back to an earlier prompt. Read-only helpers and isolated helpers started in the same reply run at the same time, up to max_parallel_helpers at once. The setting defaults to 3. On a local model server it defaults to the number of requests the server reports it answers at once, up to 3, or to 1 when the server reports none. bwn can sign in to MCP servers that use OAuth, editors connect through bwn acp, and there is a GitHub Action. The model can read pictures, PDFs and screenshots, and a headless run's exit code says how it ended. Some defaults changed. Each change has a setting that restores the old behavior, unless the old behavior was a defect or lost data. See What's new in 0.15 and the full changelog.

0.14.10 2026-09-30

This release fixes security problems found on 0.14.9. The first run says why the binary can't start, and release checks now install the published package on clean machines.

Security

• Broken hooks block instead of allowing. A PreToolUse hook that times out, can't start or is killed now blocks the tool call and says which hook failed and why.
• Old "always allow" entries for interpreters no longer run code. 0.14.3–0.14.8 saved "always allow" approvals for bare interpreter names such as python3, node, bash or awk. bwn now ignores those approvals and lists them in /permissions. New approvals cover one exact command.
• Read-only mode closes more bypasses. It now catches abbreviated options (sort --o), quoted flags, globs that expand into flags, programs run by path (./cat) and rg --hostname-bin. On Windows it also catches cmd.exe's ^ escapes, %VAR% expansion and sort /O.
• Escape codes from repos, models and MCP servers show as visible markers in more places, including /rules, /skills, prompts, menus, mcp, sessions and doctor.
• The knowledge base never writes through a symlink.
• Don't install 0.12.1–0.14.2. They list buildwithnexus-<os>-<cpu> packages that were never published, so a stranger could register those names. Update to @latest.

Install

• The first run says "ready" only after the binary starts. On glibc older than 2.34, on musl systems such as Alpine, or when endpoint protection blocks the binary, the launcher says why. For a blocked binary it also prints the path and SHA-256 for IT. It no longer downloads the binary again on every run.
• A failed download shows the real error, with proxy (NODE_USE_ENV_PROXY=1) and CA (NODE_EXTRA_CA_CERTS) hints.
• bwn doctor finds tools on stock Windows. The supported glibc floor is 2.34, which adds RHEL 9, Rocky 9, Alma 9 and Amazon Linux 2023.

Release process

• A release runs the full CI on its own commit first. CI also scans for committed secrets.
• An install matrix installs each release on clean Linux, Windows Server 2022 and macOS machines after publishing and again every day. A scheduled check catches releases that never reached npm.

0.14.9 2026-09-29

This release fixes the findings of a full security audit of the CLI, the npm launcher and the release pipeline.

Security

• A cloned repo can no longer leak secrets through its instruction files. bwn reads AGENTS.md, CLAUDE.md, system.md and project skills only when they are real files inside the project. It skips a symlink to your environment or key store.
• The permission prompt shows the whole command, with line breaks marked, and names what "allow this session" and "always allow" would cover. For shells and interpreters that is one exact command.
• Web fetches ask once per host outside auto, since a fetch can send data out or reach services on your network.
• Terminal escape sequences from repo files, MCP servers and command output show as visible markers, and so do characters that reverse text direction.
• Read-only command checks close bypasses through case-insensitive file systems and git -C. Git commands ask again when a repo's own config can run programs.
• bwn honours an MCP server's readOnlyHint only when you set "trust_read_only_hints": true on that server.
• A project settings file can't change your model until you trust it. /verify and /audit go through the permission gate. The Linux sandbox protects .git even before the folder exists.

Supply chain

• The first-run download checks the binary against checksums shipped in the npm package. The publish workflow records those checksums only after it verifies each release binary's build attestation.
• The launcher ignores a copy of the binary planted in a parent folder and a relative BWN_BIN. Release build jobs no longer hold write access while compiling.

0.14.8 2026-09-29

Added

• Easier to approve on managed Windows machines. The Windows .exe now names its product, publisher and version, and its manifest runs it with your own rights and never asks for elevation.
• Every release ships an SBOM in CycloneDX format (buildwithnexus.cdx.json).
• Code signing is ready to switch on through the SignPath Foundation. Releases stay unsigned until the project sets up its SignPath account.
• A guide for IT and security teams covers what bwn runs, where it connects, what it writes, and how to allowlist it. See Install.

0.14.7 2026-09-29

Added

• Sixel image previews. bwn draws an attached image with its real pixels instead of coloured blocks, so text in a screenshot is readable. This works in Windows Terminal 1.22 or later on native Windows and WSL, and in WezTerm, foot, mlterm and xterm started with -ti vt340. bwn detects Sixel support and the cell size at startup, and BWN_IMAGES=sixel forces Sixel on. Sixel previews need ffmpeg, as half-block previews do.

Changed

• Image previews follow the window size. Resizing the window re-fits every image in the transcript, and bwn crops an image that is partly scrolled out of view.
• Dependencies: crossterm 0.29, serde 1.0.229, serde_json 1.0.151, libc 0.2.189.

0.14.6 2026-09-29

Changed

• Image previews are thumbnails. An attached image used to fill nearly the whole terminal. Previews now take at most half the width and a third of the height and keep their proportions. The model still gets the full-size image.

0.14.5 2026-09-29

Fixed

• Esc and Ctrl+C stop the agent while it waits on the model. An interrupt used to take effect only when the server sent something, and on Ollama only when the reply finished. A local model that was loading or reading an image ignored Esc for minutes. An interrupt now returns to the prompt within about 50 ms.

0.14.4 2026-09-29

These fixes came from running a small local vision model on Ollama in WSL.

Fixed

• Images work in every mode. Chat answers, PLAN and BRAINSTORM used to drop an attached image with "only BUILD mode tasks take images". Every mode now sends it, including headless bwn plan and bwn brainstorm.
• Ollama vision models without tool support work. gemma3 failed every task with HTTP 400: … does not support tools. bwn now describes the tools in the prompt and reads the calls from the reply.
• The same fallback on llama.cpp, LM Studio and other OpenAI-compatible servers keeps the image instead of stripping it.
• what is in @shot.png? attaches the file. bwn used to read the trailing ? as part of the name.
• The Linux binaries run on Ubuntu 22.04, Debian 12 and WSL's default Ubuntu. They needed glibc 2.39 and failed with "GLIBC_2.39 not found".

0.14.3 2026-09-29

This release has security and reliability fixes from a full review of the codebase. You should upgrade.

Security

• Project settings need your trust. A cloned repo's .buildwithnexus/settings.json could send your API key to its own base_url, switch to permission: auto, or start an MCP server. Now a project's settings file can only tighten permissions or change harmless keys such as the model, effort and instruction files. bwn ignores every other key until you answer one prompt that lists the keys the project wants. Headless runs ignore those keys and print a warning.
• Hook trust covers the scripts hooks run. Editing a settings file or any project script its hooks call asks again.
• Ask mode no longer auto-approves compound commands. An allowed binary chained with another command (cat x; rm -rf ~) now asks. bwn stores "always allow" per binary and subcommand (git status, npm test).
• Access to secrets always asks. More credential paths count as sensitive (.kube, .docker/config.json, .netrc, .npmrc, .git-credentials and others). The check follows symlinks and covers shell arguments, so cat ~/.aws/credentials always asks.
• Model text can't drive your terminal. Escape sequences in replies and tool output show as a visible ␛ instead of moving the cursor, faking a prompt or writing the clipboard.
• Read-only commands with write or exec flags (find -exec, rg --pre, sort -o and similar flags) no longer count as read-only. Hooks can't approve writes in PLAN or BRAINSTORM. Fetch tools refuse cloud metadata and link-local addresses. The sandbox keeps .git and .buildwithnexus read-only and no longer passes API keys to commands.

Fixed

• Long replies no longer stop at three minutes. The idle read timeout is 300 seconds, and BWN_READ_TIMEOUT_SECS changes it. After a read timeout bwn reports the error and does not send the request again. bwn retries a request only when the connection or DNS lookup failed, or when the server answered 429, 500, 502, 503, 504 or 529.
• API keys never go to a redirect target. A 3xx reply is an error that names where the server tried to send the request.
• bwn init keeps your existing settings, and "always allow", /model and /permissions no longer copy project settings into your global file.
• /undo restores everything or nothing and names what blocked it. /undo git no longer deletes untracked files.
• A truncated stream is now an error instead of a partial reply. An image in the first prompt no longer drops the system prompt. bwn no longer loses keystrokes you type while the agent streams. After a crash, bwn restores the terminal fully. link/../file can't escape the workspace.

0.14.2 2026-09-29

These fixes came from walking through the first run, the TUI and headless runs the way a new user would.

Fixed

• Headless first run. With no saved setup and no terminal, bwn run printed the setup menu into the log and exited with "setup cancelled", even with an API key set. It now uses --provider or the first API key in the environment, and names the fix when there is neither.
• Commands after a BRAINSTORM answer run. /exit, /help, /model, /undo and !cmd typed after an answer went to the model as questions. They now run, and the footer stops saying "working" while it waits for you.
• Enter runs a command typed in full. /mode build no longer needs a second Enter when the autocomplete popup is open.
• A request to a stopped local model server fails in about a second and says how to start the server, instead of retrying for about two minutes.
• Setup lists a local server's models for LM Studio, llama.cpp and other OpenAI-compatible servers.
• Headless runs that could not apply changes exit with code 3 instead of printing "done" and exiting 0, and warn before they start. Piped output is plain text unless you set FORCE_COLOR.
• PLAN and BRAINSTORM say which mode is read-only when they skip an edit. help opens /help, and bwn sessions explains an empty list. On a narrow terminal the footer drops the context gauge instead of cutting it off. The npm launcher's missing-binary message leads with bwn --bootstrap.

0.14.1 2026-09-24

Security

• rustls 0.23.45 and rustls-webpki 0.103.15 fix RUSTSEC-2026-0285, where rustls accepted TLS 1.3 handshake messages across encryption level boundaries. Every remote-model request goes over this TLS stack, so this ships as a patch release with no other changes.

0.14.0 2026-09-24

0.14.0 is the "see it" release. The terminal shows the real pixels of what you attach, code blocks get syntax highlighting, Markdown tables line up in columns, and the footer shows what the agent is doing. None of this slowed the streaming path, which still renders a chunk in 3.6 µs.

Added

• Inline images in real pixels. On kitty, Ghostty and WezTerm builds with Unicode-placeholder support, bwn uploads an attached screenshot once through the kitty graphics protocol and draws it inside the transcript with its real pixels. On this path a PNG needs no ffmpeg. The image rows are placeholder cells, so they scroll, wrap and repaint like text and work through tmux with allow-passthrough on. bwn frees the images on exit. Other truecolor terminals get half-block art sized to the terminal, up to 160×48 cells, instead of a 64×36 thumbnail. Half-block art needs ffmpeg for every format. The settings key is images, and BWN_IMAGES overrides it.
• Preview on paste. Ctrl+V draws the screenshot above the composer when you paste it, and bwn does not draw it again on submit.
• Drop a file onto the terminal. A pasted or dragged path to an image or video becomes an @attachment token and previews at once. Quoted, file://, ~/ and shell-escaped paths all work, and bwn quotes a path that has spaces.
• Syntax highlighting. bwn highlights fenced code blocks in Rust, C/C++, JS/TS, Python, Go, Java/Kotlin/Swift, shell, Ruby/PHP/Lua, SQL, JSON, YAML, TOML, CSS, HTML and diffs. It makes one pass per block, when the closing fence arrives.
• Markdown tables. bwn collects a table while it streams and draws it aligned, with a header rule, column alignment, and columns that shrink with … instead of wrapping. It also renders --- rules, #### headings, task lists and ~~strikethrough~~.
• Live footer. The footer always shows the model name. While the agent works it adds a spinner, elapsed time, tokens per second and a reminder that Esc interrupts.
• Desktop notifications. When a turn of 8 seconds or more ends while the window is unfocused, bwn sends OSC 99, OSC 777 and OSC 9 notifications plus a bell. It tracks focus with CSI ?1004. The settings key is notify. Windows Terminal, Ghostty and ConEmu also show taskbar progress through OSC 9;4.

Fixed

• Scrolling back no longer jumps while output streams. The row you were reading stays where it is.
• Colour no longer drops on wrapped rows. bwn replays the active SGR state on each continuation row.
• The escape scanner handles APC, DCS, PM and SOS strings, so graphics payloads and tmux passthroughs never count as visible width. Copying a selection across an image row gives spaces, not placeholder bytes.
• On Windows, bwn quotes the Ctrl+V attachment token when the temp path contains spaces.

0.13.0 2026-09-08

0.13.0 is the audit release. It came from checking every claim on this site against the code. Where it could, it adds features that other terminal agents already had. It also fixes twelve bugs the audit found.

Added

• Full MCP client. bwn connects to stdio and Streamable HTTP servers, completes the initialize handshake, and discovers tools with tools/list. The model sees those tools as mcp__<server>__<tool>, and each call goes through the permission gate. bwn keeps the connection to each server open. /mcp add|remove|reload manages servers, and bwn mcp … does the same from scripts.
• Project instructions. bwn reads AGENTS.md or CLAUDE.md files from the git root down to your directory, plus a global one. It injects them into every mode, helper agent and headless run. /init offers a starter.
• Agent Skills. SKILL.md folders from the .buildwithnexus, .claude and .agents skill roots load unchanged. Flat skills still work.
• Tokens and cost. bwn reads server-reported usage from all three wire protocols. /cost shows tokens and, for known models, an estimated price. /context uses measured prompt sizes, and --max-budget-usd stops the agent once the estimate passes the limit.
• Reasoning depth. /effort, --effort and reasoning_effort map to each API's native control.
• Opt-in OS sandbox. Every shell command can run under bwrap on Linux or sandbox-exec on macOS. Turn it on with /sandbox or --sandbox.
• Headless plan. plan --yes auto-approves the plan, and --json emits a plan event. Without a TTY, a plan no longer hangs.
• BUILD mode enforces check_work. A BUILD turn that changed files runs the project's build, tests and linter before it can finish. The verifier now also checks --json runs and emits a verify event.
• Hooks. Matchers take globs, and payloads carry the real session id and transcript path. PrePrompt and SubagentStop are new events, and Stop fires in every mode.
• Workflows. Background workflows run while you are idle, two at a time by default, and their logs survive restarts.
• Windows support. Clipboard image paste, key-file permissions, background-server control, terminal restore on Ctrl+Break, and PowerShell and cmd hook scripts now work on Windows.

Changed

• BRAINSTORM is read-only, as this site always said. Action requests still switch you to BUILD.
• "Always allow" is per project. /permissions reset forgets it.
• Local OpenAI-compatible servers get native tool schemas (llama.cpp, LM Studio, vLLM, Ollama /v1). If a server's 400 error names tools or says the chat template rejects the message roles, bwn retries once without tools and remembers that for the session.
• auto_update: "install" applies to npm installs only. Text attachments cap at 256 KiB with a visible marker. bwn ignores the retired effort key in favour of reasoning_effort.

Fixed

• Readonly mode could execute an approved destructive command. Ctrl+Q and Ctrl+X edited the wrong queued message. Ctrl+G flattened newlines. /model <url> <model> went to OpenRouter. Unknown --options launched the TUI. /rules promised YAML. Copy confirmation ignored OSC 52 support. The slash popup showed blank descriptions for skills.

0.12.15 2026-09-08

Fixed

• Shift+Tab keeps your draft. Cycling modes used to discard the composer, including the cursor position and any continuation lines entered with a trailing \. The draft, its lines, and the cursor now survive the mode change. Inside ordinary y/N and question prompts, Shift+Tab now does nothing instead of cancelling them.
• Autocomplete replaces the whole token. Accepting a completion with the cursor mid-token, as in /he|lp, produced /helplp. Tab and Enter completion now replace the whole token and reuse an existing separator instead of adding a second space.
• Mouse selection around wide characters. Drag and double-click selection now map terminal columns to characters. Text after CJK characters or emoji highlights and copies the right span, and combining marks stay attached to their base character.
• The npm launcher consumes --bootstrap whether or not a binary is installed. With a binary already installed, the flag used to reach the native CLI, which could read it as task text. The launcher now strips it in every case and preserves a literal --bootstrap after --.
• CLI argument parsing. --provider, --model, --permission-mode, and --prompt fail with exit code 2 when their value is missing or empty, instead of silently consuming the next argument. -- ends option parsing, so a task can contain literal option names such as --json. --help lists the global options.

Added

• Regression coverage for the fixes above: Rust unit tests for the parser, completion, and selection helpers; a Node test for the npm launcher; and a PTY test that drives the real TUI. All three run in CI.

0.12.14 2026-07-30

Fixed

• PLAN mode approval menu. The approval popup renders in place above the composer instead of duplicating when you press Up or Down. Esc or closing the menu cancels the plan instead of executing it, and the exit_plan log noise is gone. PLAN switches to BUILD once the plan completes.
• PLAN prompt quality. PLAN rejects raw tool lists as plan steps and accepts every valid step. The PLAN prompt requires a tech stack and file specs, and asks about design choices and edge cases up front.
• Composer. Full editing keys, cursor movement, key repeat, and paste work in the queued composer again. Flicker and missing repaints are gone, and the composer stays interactive at all times. Keystrokes typed during questions and menus are no longer delayed, duplicated, or lost.
• The /model menu no longer duplicates entries, and the local server probe timeout is longer. Streamed code blocks no longer auto-copy to the clipboard. A full TUI audit pass closed 35 rendering, cursor, and input-handling findings.

0.12.13 2026-07-29

Fixed

• Trailing whitespace in slash commands. Typing /model with trailing spaces opens the interactive model dialog instead of doing nothing. /mode and /permissions work the same way.

0.12.12 2026-07-29

Fixed

• In-place menu rendering. The /model, /mode, and /permissions menus redraw in place by moving the cursor, so Up and Down no longer duplicate the list. When you pick an entry, the menu clears to a single confirmation line.
• Automatic llama-server launch. Selecting a local GGUF model checks ports 8080, 1234, 11434 and 8000. If nothing is listening, bwn finds llama-server on the host and starts it in the background.
• Switching between cloud providers resets base_url to the target provider's default endpoint.

0.12.11 2026-07-29

Added

• Interactive slash-command dialogs. /model, /mode, and /permissions open TUI dialogs. Move with ↑ and ↓ or j and k, and pick with Enter.
• Context and token usage (ctx: 25% 32k/128k) move out of the chat to the footer below the composer.

Fixed

• Strict slash-command handling. An unknown command such as /unknown shows an error instead of going to the model as a prompt.
• Immediate cancellation. Esc and Ctrl+C abort HTTP stream reads and running child processes. Esc keeps the message queue for the next task, and Ctrl+C clears it for a full stop.

0.12.10 2026-07-29

Changed

• First-run binary download is automatic in interactive sessions. When the platform package is missing, bwn downloads the checksum-verified binary from the GitHub release without prompting [y/N]. Running npm install -g buildwithnexus already counts as opting in. Non-TTY environments such as CI, scripts and pipes still require --bootstrap or BWN_ALLOW_BOOTSTRAP=1.

0.12.9 2026-07-29

Fixed

• Brainstorm no longer auto-switches to Build on greetings. A short "hi" in Brainstorm could let the model emit a mode-switch suggestion. The lightweight chat loop now handles conversational inputs in every mode.
• Sessions start in Brainstorm. Launching bwn and typing a casual message no longer starts a build run.

0.12.8 2026-07-21

Changed

• bwn has one voice in every mode. A shared prompt now comes before the build, plan, brainstorm and chat prompts. It describes bwn as a plain-spoken, dry coding partner that builds on its own, or brainstorms and plans with you. The prompts no longer call bwn a "planning engineer" or "senior software engineer". A casual aside like "know any jokes?" gets an answer instead of an "I am a planning engineer…" refusal. Error messages stay plain.
• PLAN mode no longer forces a plan onto non-tasks. Greetings, jokes, identity questions, and creative asides get a short reply. PLAN breaks only concrete workspace tasks into steps.

Added

• check_work answers "does my change work?" in one call. It detects the project type (Cargo, npm, pnpm, yarn, Python, Go), runs its build, tests, and linter, and returns a short pass/fail report. It reports a missing linter as skipped, never as a failure. BUILD mode now checks its work before finishing.

Fixed

• A long BUILD turn ends with a summary instead of an error. Reaching the per-turn step budget used to show a raw "reached the step limit" error. The budget is larger now. One step before it runs out, bwn tells the model to wrap up. The turn then ends with a summary of what got done and the next step.

0.12.7 2026-07-21

Changed

• The thinking stream renders Markdown as formatted text. Headings, **bold**, `code`, bullets, and quotes in the model's reasoning used to show their raw markers. They now show as formatting, in the muted thinking palette.

Fixed

• The screen no longer flashes, and the queued-prompt bar always shows. bwn now re-applies the terminal's scroll region whenever you queue a prompt mid-stream, so streaming output can't scroll over the queued bar or flash the screen. On Ghostty in particular, the bar used to disappear.

0.12.6 2026-07-19

Added

• A killed TUI restores your terminal. SIGTERM, SIGHUP, SIGINT and SIGQUIT now run a signal-safe handler that leaves the alternate screen, shows the cursor, and restores your terminal settings. You no longer need reset after an external kill.
• doctor probes your configured provider live. It runs the same one-token validation /model uses, so a rejected key, wrong model name, or dead server shows up in doctor instead of on your next prompt.

Changed

• Higher-contrast dim text. Secondary text moved from 2.76:1 contrast, below the WCAG AA minimum, to 4.93:1, and stays in the Tokyo Night comment-color family. Status meaning never relies on color alone.
• /undo git and /undo all confirm before destroying work. Both say exactly what they are about to do and require [y/N].
• "Write a poem" stays in the chat. When the model explains instead of acting, bwn tells it to act. It now does that only when the task names something in the workspace, such as a path, file, project or bug. bwn answers creative requests in the transcript instead of writing them to files.

Fixed

• The binary writes every file atomically. That covers tool edits, settings, the API-key store, memory, history and checkpoints. A crash mid-write can't truncate anything, an edited script keeps its executable bit, and .env.keys is never visible with open permissions, even for an instant.

0.12.5 2026-07-19

Added

• Any OpenAI-compatible endpoint as a provider. /model <url> <model>, or a guided walk-through, points bwn at vLLM, TGI, LiteLLM or a gateway. The API key is optional, and bwn never sends a configured key over plain HTTP to a non-loopback host. Typing an org/model name selects any OpenRouter model.
• The letsbeheroes skill collection. bwn bundles eight process skills: /hero-brainstorm, /hero-plan, /hero-execute, /hero-debug, /hero-ship, /hero-wait, /hero-subagents and the /letsbeheroes charter.
• Startup tips. One rotating line under the banner shows a real tip half the time and a joke the other half. Error messages contain no jokes.
• BENCHMARKS.md and RECOVERY.md. BENCHMARKS.md lists every performance claim with the command that regenerates it. RECOVERY.md describes how bwn fails and recovers, including what it deliberately does not protect.

Fixed

• /model now swaps the provider along with the model. Every pick maps to the provider that serves it, and you can set up a missing API key on the spot. Ollama gets reachability and installed-model checks. "✓ hot-swapped" prints only after a live one-token probe validates the key, model, and server.
• Bare /undo reverts the whole last agent turn, so you can recover from a partial multi-file edit. Checkpoint ids created in the same millisecond used to collide, and fast multi-file batches silently lost recovery snapshots. Ids now carry a sequence number.
• Pending /schedule and /loop workflows survive restarts. bwn saves them on every change and restores them at the next launch with a visible notice.
• Startup diagnoses broken settings files and never silently drops them. It warns with the exact line and column for each unusable file, doctor shows each file's status, and onboarding can no longer overwrite a mistyped config.
• A malformed tagged tool call gets one corrective retry instead of becoming the final answer. If the retry also fails, the agent stops.

0.12.4 2026-07-16

Fixed

• The first-run [y/N] consent prompt now waits for your answer on macOS. Node keeps a TTY stdin non-blocking, so the prompt used to fail with an error before you could answer. It now reads from a blocking /dev/tty handle.

0.12.3 2026-07-14

Changed

• Auto-update now defaults to notify-only. The new auto_update setting takes "off", "notify" or "install". The default, "notify", checks daily, prints a startup notice and never installs. "install" keeps the previous silent behavior. BWN_NO_AUTO_UPDATE=1 still works.
• First-run binary download requires explicit consent. On a TTY the launcher asks [y/N]. Non-interactive runs need bwn --bootstrap or BWN_ALLOW_BOOTSTRAP=1.

0.12.2 2026-07-14

Fixed

• Bundle analyzers can build the package. A browser field points at a dependency-free stub entry, so tools that webpack-bundle the npm package no longer fail on Node built-ins and platform binaries.
• The publish workflow's crates.io "already published" check now queries the registry index instead of resolving workspace crates locally.

0.12.1 2026-07-14

Changed

• Script-free npm install. The main package has no install scripts and no eval. Its optionalDependencies list five per-platform binary packages. Those packages were never published, so the npm launcher downloads the binary from the GitHub release on first run. The launcher checks the binary's SHA-256, and the release workflow attests each binary's build provenance.
• Auto-update moved into the binary. It checks daily in the background, and BWN_NO_AUTO_UPDATE=1 opts out.
• buildwithnexus is on crates.io. Install it with cargo install buildwithnexus or cargo install bwn.
• Pasted screenshots and sampled video frames preview inline in the transcript, and clicking a .docx path opens it in Word.

0.12.0 2026-07-14

Added

• Live slash-command autocomplete shows one-line descriptions and also completes @path and sub-arguments. Commands that autocomplete offered but nothing implemented are gone.
• Multimodal input. Ctrl+V pastes clipboard images, and ffmpeg samples frames from a video and reads its metadata. Both depend on a per-model vision check, and you get an explicit notice when the model is text-only.
• Clickable files and links. Markdown links and edit headers are OSC 8 hyperlinks, and clicking an edit header opens the file in your default app.
• npm auto-update. bwn updates itself silently in the background once a day, and BWN_NO_AUTO_UPDATE=1 opts out.
• Esc interrupts the agent, and queued prompts send on the next turn. History filters by prefix and keeps your in-progress draft. Double-click selects a word and triple-click a line, with a copy confirmation. The cursor shape follows the mode.

Changed

• One diff renderer. Previews and applied changes share one renderer with line-number gutters, tinted rows and word-level change emphasis.
• Bordered composer. The spinner inside the box shows elapsed time and an interrupt hint. The banner, once a boxed header full of emoji, is now a gradient wordmark with aligned model, working directory and mode rows. /help is grouped and aligned, and /verify, rule violations, /agents and /memory render Markdown. The fabricated cost and tokens-per-second figures are gone.

Fixed

• Denials and failed workflows now show in red. HTTP retries now print a ⟳ retrying line instead of running silently. /resume no longer corrupts the alternate screen, and bwn caps tool previews at 80 columns.

Performance

• Streaming renders are about 215× faster. Each line wraps once through an incremental cache, and bwn coalesces repaints to 60fps and applies each as an atomic frame. Startup no longer waits on dependency probes, and the screen never shows a black frame.

0.11.4 2026-07-07

These fixes came from a gemma-2-2b-it session on llama.cpp.

Added

• Gemma's tool_code calls run. Gemma writes a tool call as a Python call in a tool_code fence, sometimes inside print(...). bwn used to read it as prose. The recovery parser now reads that syntax and maps keyword and positional arguments to each tool's parameters.

Fixed

• Gemma no longer stops after one step. Gemma's llama.cpp chat template rejects the system and tool roles and needs user and assistant turns to alternate, so every turn with a tool result failed with a 400. On that error bwn retries once with a flattened message list that alternates.

0.11.3 2026-07-07

These fixes came from a qwen2.5-coder-1.5b session that looped instead of building a page.

Fixed

• Small models no longer stall on clarifying questions. The compact tool set for local models drops the question tool. Larger models and PLAN keep it.
• Question answers echo what you type. The question prints on its own line, and bwn reads the answer from a one-line prompt.
• bwn rejects an HTML artifact that links a local stylesheet and asks for one self-contained file.

0.11.2 2026-07-07

Added

• Formatted Word documents. create_docx turns **bold**, *italic* and `code` into Word formatting, and Markdown tables into bordered Word tables with a bold header row.
• Structured web search. web_search returns numbered results with a title, URL and snippet, and takes the real URL out of DuckDuckGo's redirect link.

Fixed

• Fetched pages and search snippets decode numeric HTML entities such as ’.
• An unmatched `, ** or *, as in 5 * 3, no longer styles the rest of the line.
• Reasoning models that put <think>…</think> in their reply no longer leak it into the answer or into written files, even when a tag splits across streamed chunks.

0.11.1 2026-07-07

Fixed

• Qwen2.5-Coder tool calls work on llama.cpp and Ollama. Small local coder models write tool calls as <tools> or <tool_call> text instead of native tool calls, and bwn read them as prose. The parser now strips those tags and reads the JSON inside, even when a content field holds CSS braces. It also finds a JSON call that follows a sentence.

0.11.0 2026-07-06

0.11.0 fixes reliability problems, adds support for small open-weight models and reworks the TUI. It came from a review of the whole codebase and from what opencode, vtcode, aider and cline do for weak models.

Added

• Native Ollama protocol. bwn talks to Ollama's /api/chat, reads the model's context window from /api/show and sets num_ctx, so Ollama no longer cuts off the start of a long prompt. Base URLs that end in /v1 stay on the OpenAI-compatible path.
• Live diffs. The TUI shows a coloured diff with added and removed line counts as the agent writes and edits files.
• Markdown on every output path. Headings, bold, italic, inline code, lists and fenced code blocks render, streaming included.
• Mode switching. A build or plan request in BRAINSTORM switches to the matching mode.
• A nudge to use tools. When the model answers an imperative task with instructions only, bwn tells it to use its tools.
• Lenient edits. An edit whose text differs from the file only in whitespace or indentation still applies. A match by similarity alone only produces a diagnostic.
• New temperature, max_tokens and context_tokens settings. CI runs cargo fmt --check and cargo audit.

Changed

• A reply cut off at max_tokens gets a bounded continuation. bwn no longer treats it as complete.
• Retries follow the status code, cover HTTP 529 and honour Retry-After.
• The loop guard counts only repeated errors and empty results. After three identical ones it nudges the model once, and it stops the run if the call repeats again. Re-reading a file no longer ends a session.
• Compaction keeps each tool call with its result, the original task and the most recent turns. A context-overflow error forces a compaction and a retry.
• When bwn cuts command output, it keeps the start and the end, so test summaries and exit codes survive. run_command and python_tool time out after 120 seconds.
• By default, ask mode auto-allows 15 read-only commands instead of 43.

Fixed

• A streamed tool call with cut-off JSON no longer runs with empty input. The model gets an invalid-arguments error.
• bwn no longer overwrites correct model output with text from the task or turns shell commands into file writes. The hardcoded fallback canvas game is gone, and a rejected artifact names the rule it broke.
• The queued-message TUI no longer deadlocks while a reply streams. /undo no longer truncates binary or oversized files.
• The read-only command check catches ;, | and redirection, sed -i, find -delete and git clean. File tools that change files work only inside the working directory.

All releases on GitHub →