NEXUS v0.2.2

Highlights

• Stability sprint: the headline is reliability. A real crash fix (#114), a repaired self-updater, installers that actually finish the job, and the dependency bot un-broken — NEXUS is stable now.
• SQLite Task Log, done properly: the observability store now records full task data (costs, byte counts, hashes, model/provider — #112), the TUI reads it from SQLite exclusively, and legacy JSONL history is imported once at startup. The JSONL dual-write is removed entirely: one source of truth, no drift between formats.
• Fresh installs work: thanks to @blakesaunders (#111), Claude Code loads the NEXUS orchestrator and the MCP server starts on a fresh install.
• Tech currency: Go 1.27.1, MCP SDK 1.32.1, GitHub Actions off Node 20, npm audit at zero vulnerabilities.

Fixed

• configureMCP nil-map panic on null MCP configs (#114).
• TUI self-update was checking a checksum GoReleaser never creates — fixed.
• install.sh now installs the MCP server's npm dependencies (it was the one setup path that didn't).
• setup-nexus.sh builds with the real version instead of permanent "dev", which had been silently killing update checks.
• The five MCP config writers are unified into one canonical merger — the Go writer no longer silently drops keys the shell versions preserved.
• recurring-chores.yml granted push permissions — the dead dep bot is why everything went stale.

Changed

• Task Log reads SQLite exclusively; the JSONL write path is removed (legacy entries are imported once, idempotently, at server startup).
• Installers now enforce Node.js 22.13+ and git prerequisites up front.
• Ubuntu runners pinned to 24.04 ahead of the ubuntu-latest migration.

Security

• proxy-addr critical advisory resolved via the SDK bump.
• Go 1.26.3 → 1.27.1 (known stdlib CVEs on the old toolchain).

Upgrade notes

• Node.js 22.13+ is now enforced by the installers (previously just required).
• On first start after upgrading, the MCP server imports any legacy JSONL history into SQLite once — idempotent, and it can't block startup.
• No action needed for the JSONL removal: existing history is preserved in the database.

Thanks

• @blakesaunders for the fresh-install fixes (#111).