What's new in 0.15

First launch never offers to install packages, bwn's own connections use your proxy and the operating system's certificate store, and auto-update stays within your minor version. A repository's hooks, commands, skills and allow rules take effect only after you trust them, and the terminal UI asks before it uses the repository's AGENTS.md. An approval for rm and similar commands covers only that exact command, deny rules match commands inside wrappers, and provider keys stay out of the agent's commands. Setup finishes only after the chosen model answers. Every mode shares one conversation. A headless run's exit code tells you how it ended. The release also adds helpers that run in parallel, extra working folders, sign-in for MCP servers that use OAuth, editor support over the Agent Client Protocol, a GitHub Action, Claude Code's hook decisions and events, and pictures, PDFs and screenshots the model can read.

Permissions and approvals

• accept-edits mode. File edits inside the project and inside folders added with --add-dir run without a prompt. Commands, deletions, network access, sensitive paths and changes inside .git still ask. Turn it on with --permission-mode accept-edits or /permissions accept-edits.
• bwn checks permission names. "permission": "acceptEdits" and "accept-edits" now select accept-edits mode. In 0.14 they meant auto. An unknown --permission-mode exits 2, and an unknown permission setting prints a warning and uses ask.
• Allow, ask and deny rules go in settings.json, along with network host lists. Deny overrides ask, and ask overrides allow. A deny rule refuses in every permission mode, an ask rule asks even in auto, and an allow rule skips the prompt. Read-only mode still refuses every change, and sensitive paths and dangerous commands such as rm -rf / still ask. A project's settings add ask and deny rules right away. They add allow rules only after you trust the folder.
• Some approvals cover only the exact command. Answering s or a for rm, mv, cp, chmod, kill and similar programs covers that exact command. The same holds for a git command that discards changes or rewrites history, such as git reset --hard, git push --force, git branch -D or git clean. Esc at an approval refuses the call and stops the turn. d <reason> refuses and lets the model continue.
• Deny and ask rules match commands inside wrappers. A run_command(git push*) deny rule also refuses sudo sh -c 'git push', git -C . push, env FOO=1 git push and make && git push. The rules match the command behind env, sudo, xargs, find -exec, uv run and other wrappers. They also match inside sh -c, cmd /c and $(…), and after git's own options.
• Destructive Windows commands ask even in auto. These include rd /s, del /q, diskpart, reg delete and Remove-Item -Recurse -Force. Sensitive-path checks read Windows paths too, so rg . C:\Users\me\.ssh\id_rsa asks first.
• A turn that answers a question in PLAN or BRAINSTORM is read-only, whatever the session's permission mode.
• @diff and @status ask before running git in a repository whose git config can run programs, as /diff and /commit do.
• A permission switch lasts for the session. Typing "use auto" or running /permissions auto no longer writes settings, but /permissions default <mode> does. /permissions lists saved approvals and rules, and /permissions remove <entry> removes one.
• Web search asks first outside auto, like a fetch.
• Keys stay out of commands. bwn removes provider key variables, such as *_API_KEY and *_API_TOKEN, from the environment of every command the agent runs. shell_env_passthrough keeps the variables you name. On Linux and macOS, bwn's own environment block shows provider keys as ****. A process's /proc/<pid>/environ is a sensitive path, so reading it asks first in every mode.
• A call quoted in an answer never runs. When a local model describes a tool call in prose, such as "you could send {"name": "run_command", …}", bwn keeps it as text in every mode.
• Network rules match every spelling of an address. A rule for 127.0.0.1 also matches [::ffff:7f00:1]. bwn refuses a redirect to a denied host before following it.
• bwn sends a desktop notification when an approval or a question is waiting. By default it sends one only while the terminal is unfocused. The notify setting changes that.

{
  "permissions": {
    "allow": ["run_command(cargo test*)"],
    "ask":   ["write_file(migrations/**)"],
    "deny":  ["run_command(git push*)"]
  },
  "network": { "deny": ["*.internal.example"] }
}

Hooks and trust

• Hook matchers take Claude Code tool names such as Bash, Edit, Write, WebFetch and mcp__.*, so a matcher copied from a Claude Code settings file matches the same calls. "on_error": "deny" makes a PreToolUse hook that crashes block the call. bwn reports unknown events instead of ignoring them.
• bwn checks a project hook's trust again each time the hook runs. If the hook changed since you trusted the folder, bwn asks again and names the file that changed. A headless run skips the changed hook with a warning. The trust prompt is one screen with one question. Answer y to trust everything listed, or n, the default, to trust nothing. A third answer, e, trusts everything except base_url and permission. bwn offers it when the project settings set one of those two keys along with other keys, and a permission of readonly does not count.
• The question about a repository's AGENTS.md defaults to No. Anything you type while it is open goes to the composer when it closes. A headless run uses the file whatever you answered. It prints a notice on stderr until you answer y in the terminal UI.
• For CI, buildwithnexus trust --print prints a digest of the project settings, and --trust-project <digest> trusts exactly that content for one run. A repository base_url, or a permission other than readonly, also needs --trust-project-allow base_url,permission.
• A repository's own commands, skills and agent files load only after you trust them. Adding, editing or removing one asks again.
• A repository's .buildwithnexus/system.md applies only after you trust the folder, and bwn adds it after your own system.md instead of replacing it. A repository skill with the same name as a bundled or user skill loads as /project:<name>.
• Hooks take and return Claude Code's formats. A PostToolUse hook can add to the result the model sees. A Stop hook can keep the agent going for at most 3 rounds. tool_input carries Claude Code's field names.
• The new hook events are PermissionRequest, PreCompact and Notification. A PermissionRequest hook can answer allow, deny or ask for you. Notification fires when an approval or question is waiting, a turn is done, or the prompt is idle. A hook with "type": "http" POSTs the event as JSON to a URL.

Keys and setup

• bwn hides a key as you type it and saves it only after the provider accepts it. Setup, /login and /model share one key question. bwn refuses anything that cannot be a key, such as a sentence or a menu number, without sending it. A /command closes the question and sends nothing, and in a session the command runs next. bwn asks again after the provider rejects a key.
• bwn saves a custom OpenAI-compatible endpoint's key for that endpoint only. Pointing /model at a new address asks for that address's own key and never sends another server's.
• Setup finishes only after the chosen model answers. When it cannot finish, it says why, such as an unreachable address, an Ollama with no models, or a gateway that needs a key.
• /login and buildwithnexus login replace a rejected key in place and check the new key before saving it.
• First launch never offers to install packages. buildwithnexus doctor prints the install command for each missing tool and exits 1 when a check fails.
• /model remembers each provider's address. The banner names the preset and its address, such as LM Studio (localhost:1234), instead of the wire protocol.
• /init writes AGENTS.md from the repository's own build and test files and shows it as a diff for you to approve.

Local models

• bwn uses the real context window that llama.cpp, LM Studio and vLLM report instead of guessing 8,192 tokens. /context shows what fills it.
• Image support follows what the server reports. A vision setting overrides it.
• Errors say what to do: a rejected key points at /login, a missing Ollama model names its ollama pull command, and a stopped server reads nothing is answering at <host>.
• With a spend cap set, a run on a remote model without a known price stops before the first request, exits 2 and asks for a price. A model server on another machine counts as remote, unless bwn reaches it through Ollama's native API. A prices setting gives any model a price.
• bwn retries a 429, 500, 502, 503, 504 or 529 answer 3 times. In 0.14 it retried 4 times for remote models and 14 times for local servers. bwn never retries an out-of-memory error. A server that answers 503 while it loads a model gets 14 retries, about two minutes. BWN_MAX_RETRIES sets the count, from 0 to 20.
• bwn's own connections use HTTPS_PROXY, HTTP_PROXY, ALL_PROXY, NO_PROXY and the operating system's certificate store. They always reach loopback addresses directly. They also go directly to private network addresses, such as a model server on your local network, unless you set BWN_PROXY_PRIVATE=1.

Helpers and folders

• Helpers that only read and isolated helpers started by the same reply run at the same time. max_parallel_helpers caps how many run at once. It defaults to 3. With a local preset or a server at a loopback address, it defaults to the number of requests the server reports it answers at once, up to 3, or to 1 when the server reports none. Each helper shows in its own block when it finishes. Helpers that write in your folder still run one after another.
• Helper agents. An agent file with name, description and tools frontmatter in ~/.buildwithnexus/agents or ~/.claude/agents becomes a helper agent the model can delegate to, limited to those tools. A trusted repository's .buildwithnexus/agents and .claude/agents count too. /agents lists them.
• bwn commits an isolated helper's uncommitted edits to the helper's bwn-sub-* branch, and the result names the branch and the git merge command. In 0.14 bwn deleted those edits when the helper finished.
• read_only: true in an agent file, or on the call, makes a helper that can read and search but never change anything.
• --add-dir <path> and /add-dir add folders to work in for the session. The sandbox lets commands write there too. bwn never loads their settings, hooks or commands.

Pictures, PDFs and screenshots

• read_file on a PNG, JPEG, GIF or WebP shows the picture to a model that takes images. bwn tells a text-only model why it sees none.
• read_file reads a PDF as text through poppler's pdftotext when it is installed.
• A new screenshot_url tool uses a local headless Chrome, Chromium or Edge to screenshot a page served on this machine, such as http://localhost:3000. bwn opens a page on another host only when network.allow or an allow rule names that host. The page can then load from that host and from this machine, and bwn refuses its requests to every other host.
• "vision": false turns off pictures and screenshot_url. read_file still reads PDFs as text.

MCP servers that ask you to sign in

/mcp and bwn mcp list show an http MCP server that requires OAuth as needs login. bwn mcp login <name> or /mcp login <name> signs in through the browser. It saves the token in ~/.buildwithnexus/mcp-auth/ for that server only. The token refreshes on its own. bwn mcp logout <name> deletes the saved token and asks the authorization server to revoke it when that server offers revocation. Headless runs never open a browser.

Editors

buildwithnexus acp runs an Agent Client Protocol server on stdio, so Zed, JetBrains IDEs and Neovim plugins can control bwn. The editor shows streamed replies and plans, and it shows tool calls with diffs. Approvals come up as questions in the editor. Add this to Zed's settings.json:

{
  "agent_servers": {
    "buildwithnexus": {
      "type": "custom",
      "command": "bwn",
      "args": ["acp"],
      "env": {}
    }
  }
}

Conversations and sessions

• Every mode shares one conversation, and bwn saves it as the session. The mode changes only when you change it, or when you answer y to the model's offer to switch. A task typed in BRAINSTORM gets a tip to switch modes.
• bwn continue reopens this folder's latest session, and /resume lists this folder's sessions first. /rename, bwn sessions rm and bwn sessions export are new.
• /undo asks before overwriting a file you changed after the agent edited it, and says what it cannot undo. /rewind goes back to an earlier prompt and restores the code, the conversation, or both.
• /commit shows the drafted message and commits only after you press c.
• /diff lists every changed and new file, and /diff turn shows what the last turn changed. /export, /copy and /ask are new. /ask answers a side question without adding it to the conversation.
• The plan selector has a new Revise Plan choice. Say what to change and you get a revised plan. Edit Step opens the step's text in the composer.
• Background workflows from /schedule and /loop run with the session's permission mode, provider and model instead of the ones in settings.json.

Headless and CI

Piped stdin becomes the task when you give none. When you also pass a task, bwn adds stdin after it as context, for example git diff | bwn run "review this". Custom commands and skills run headless and take $ARGUMENTS. The new --base-url flag points a run at a gateway, and the new --worktree <name> flag runs the session on its own branch. buildwithnexus review and buildwithnexus update are new commands. A mistyped /command exits 2 instead of reaching the model. When a custom command or skill differs from it by at most two letters, the message names that one. Failure messages name flags and variables rather than slash commands. An http hook fills in $NAME in its headers from the variables it lists in allowed_env_vars. The exit code tells you how a run ended:

With --json, the last event names the outcome, the session id, tokens, estimated cost and every refused call. --legacy-exit-codes turns the codes for runs that stopped short back into 0.

The repository is also a GitHub Action. It runs bwn run or bwn review, turns the exit code into the step's result with annotations, and can comment on the pull request:

- uses: Garretts-Apps/buildwithnexus@v0.15.1
  with:
    command: review
    review-base: origin/${{ github.base_ref }}
    provider: anthropic
    max-budget-usd: "1"
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Terminal

• bwn has new dark, light and ansi colour themes. The theme setting defaults to auto, which follows the terminal's background, so a light terminal gets the light theme. /theme switches and saves it.
• --plain or TERM=dumb selects line mode, for screen readers and plain consoles.
• Esc cancels a question. Pickers filter as you type, a digit moves to a row, and only Enter picks. Ctrl+C on an empty prompt quits only on a second press.
• Pasted line breaks reach the model. /help, the / popup and Tab completion list every command.
• Each tool call shows as one plain line, and the agent's todo list shows as a checklist.
• The file tools skip what .gitignore ignores.

Auto-update

"auto_update": "install" installs only patch releases within your minor version. bwn announces a new minor or major version and tells you to run buildwithnexus update. "install-any" installs any newer release, as "install" did in 0.14.10. The npm launcher keeps the binary in ~/.buildwithnexus/bin/<version>/, outside the npm package. The Windows exe links the C runtime statically, so it runs without the Visual C++ Redistributable.

Next: Changelog →