Repository navigation

Release list

nyxGPT 3.0.1rc1 (release candidate) Pre-release

Pre-release

github-actions released this 08 Oct 23:48

Immutable

3.0.1rc1

631d25e

Acceptance-only release candidate built from v3.0.1 at 631d25ef1ec5539c9d20dcb286ae31dd3f468e3c.

This is not a release. pip install nyxgpt and brew install nyxgpt-api
both keep resolving to the latest stable version.

pip install nyxgpt==3.0.1rc1
brew tap dkblinux98/nyxgpt && (brew tap-trust dkblinux98/nyxgpt || brew trust dkblinux98/nyxgpt || true) && brew install nyxgpt-api@3.0.1rc nyxgpt-web@3.0.1rc

Assets 5

nyxGPT 3.0.0 (Homebrew tarballs) Pre-release

Pre-release

github-actions released this 06 Oct 07:54

Immutable

3.0.0-homebrew

2c0bb5a

Homebrew source tarballs for nyxGPT 3.0.0.

This is not a release -- see 3.0.0
for that. Releases in this repository are immutable, so a published release can
never gain an asset; the vendored nyxgpt-api / nyxgpt-web source tarballs the
stable Homebrew formulas install from are published here instead, attached at
creation (#3763).

brew tap dkblinux98/nyxgpt
brew tap-trust dkblinux98/nyxgpt || brew trust dkblinux98/nyxgpt || true
brew install nyxgpt-api nyxgpt-web

Assets 5

nyxGPT Release v2.1.0 – GitHub Public Repository Hardening and Security Hardening

dkblinux98 released this 07 Aug 02:41

Immutable

2.1.0

95871cc

nyxGPT Release v2.1.0 – GitHub Public Repository Hardening and Security Hardening

A scoped security release: everything required to take the nyxGPT repository public safely, plus remediation of the code-scanning findings surfaced once GitHub Advanced Security was enabled. No product features — all v2.0.0 functionality is unchanged.

🔓 Going-Public Hardening

MIT License — the project is now formally licensed for public release (#3601, #3602)
Actor-gated privileged workflows — comment-triggered automation (developer/review agent triggers) now verifies the actor is OWNER/MEMBER/COLLABORATOR before running, so drive-by comments on the public repo can't start privileged jobs (#3600, #3603)
@claude workflow gate — the @claude mention workflow is gated per event type on author association, defense-in-depth with the action's own actor check and a read-only job token (#3617)
Repository protections (settings, not commits): branch ruleset requiring PRs with review on master and the release branch, force-push/deletion blocking, Dependabot alerts, CodeQL code scanning, and secret scanning with push protection enabled

🛡️ Code-Scanning Remediation (CodeQL)

CodeQL's initial scan of the public repo surfaced 29 alerts (2 critical / 20 high / 7 medium). This release remediates every exploitable finding; the remainder were verified false positives and dismissed with documented rationale (#3625).

Critical

Code injection in the review-agent workflow — untrusted comment bodies are now passed via environment variables, never interpolated into scripts; same fix applied to the revert-link workflow
Command-line injection in self-heal — service/pod names are validated against a strict allowlist pattern inline at every docker/kubectl call site (#3624)

High

Reflected XSS in session HTML export — every user- and metadata-derived value is now HTML-escaped (#3628)
Path injection via the client-controlled sessions-dir override — canonicalized and confined to allowed roots (#3628)
Polynomial-backtracking ReDoS in the RAG sentence splitter (#3628)
Clear-text logging of potentially secret-bearing subprocess arguments — redacted before logging (#3628)
Missing least-privilege permissions on two workflows (#3628)

Medium

Five endpoints no longer expose internal exception detail to API clients; full detail is retained in server-side logs (#3628)

Also Included

Grafana observability fix: crash-safe $__file{} secret placeholders are seeded before the observability stack starts, and the Terraform install path now waits for Grafana health — Grafana 13.x no longer crash-loops on a fresh install (rides with #3628)

Full changelog: 2.0.0...2.1.0

Contributors

claude

Assets 3

nyxGPT 2.1.0 (Homebrew tarballs) Pre-release

Pre-release

github-actions released this 14 Aug 09:54

Immutable

2.1.0-homebrew

95871cc

Homebrew source tarballs for nyxGPT 2.1.0.

This is not a release -- see 2.1.0
for that. Releases in this repository are immutable, so a published release can
never gain an asset; the vendored nyxgpt-api / nyxgpt-web source tarballs the
stable Homebrew formulas install from are published here instead, attached at
creation (#3763).

brew tap dkblinux98/nyxgpt && (brew tap-trust dkblinux98/nyxgpt || true) && brew install nyxgpt-api nyxgpt-web

Assets 5

nyxGPT Release v2.0.0 - Enterprise Release Pre-release

Pre-release

dkblinux98 released this 03 Aug 20:35

Immutable

2.0.0

f90a592

nyxGPT Release v2.0.0 — Enterprise Release

Released: 2026-08-03 · Branch: v2.0.0 · Milestones: Phase 4, Phase 5, Phase 5.5

v2.0.0 takes nyxGPT from the v1.0.0 MVP to an enterprise-grade, local-first platform: production-style deployment, full observability, SRE tooling, and a complete stakeholder-acceptance hardening pass — all running entirely on your own machine with no cloud dependency.

218 tracked issues, 216 delivered (2 descoped — multi-node Cassandra scale-out, deferred until a multi-node deployment target exists).

Principles

Quality over features — Fix core issues before adding new capabilities
User-driven — Build what users actually need, not what's cool
Operational excellence — Every feature ships with monitoring, docs, and tests
Performance — Fast by default, optimize where it matters

Release Strategy

Fix versions (2.0.x): Fixes to production code
Minor versions (x.y+1.0): Quality improvements, small features, bug fixes
Major versions (x+1.0.0): Breaking changes, architectural shifts, major features

Phase 4 — Scale & Performance (17 issues)

Goal: Fast by default.

Caching layer — embedding cache, response cache, and RAG query-result caching
Optimized embedding generation — async processing, GPU utilization, adaptive batching
Web performance — code splitting and vendor chunking, bundle-size audit, image optimization, virtualized session/message lists
PWA — installable web app with service worker and offline fallback
Streaming hardening — robust SSE framing across CLI, TUI, API, and web UI
Descoped: multi-node Cassandra replication/scale-out (#2684, #2685) — requires a multi-node cluster; parked, not planned for the local-first line

Phase 5 — Enterprise Features (15 issues, local-first)

Goal: Production-ready operations without leaving your machine. Every capability below was re-scoped local-first — self-hosted, no SaaS.

Deployment

Docker Compose full-stack bring-up of every component
Kubernetes deployment for local clusters (kind/minikube/k3s)
Terraform IaC using local providers (docker/kind) — no cloud account required
Blue-green deployment with an SRE dashboard surface (/admin/deploy)
Canary rollout — versioned canary build, metric-gated weighted rollout, promote/rollback (nyxgpt canary, /admin/canary)

Monitoring & Observability

Prometheus metrics (/metrics) — request counts, latency histograms, error rates, chat/RAG business metrics
Grafana dashboards — system overview, RAG performance, API metrics, resource usage, self-healing — plus alerting rules, all provisioned as code
Log aggregation (Loki + promtail) — centralized search over api/web/Ollama/Cassandra logs with retention policy
Distributed tracing (OpenTelemetry → Jaeger) — request/RAG/Ollama/Cassandra spans with curated trace views
Error tracking (self-hosted GlitchTip) — backend and web-client error reporting via the Sentry SDK protocol

Administration

System health dashboard (/admin/health) — uptime, dependency reachability, resource utilization, alert indicators
Admin dashboard improvements and usage analytics
Deployment checklist docs and workflow log collection/analytics

Phase 5.5 — Stakeholder Acceptance & Hardening (184 issues)

Goal: Everything above verified usable end-to-end by a human stakeholder — and everything found along the way fixed before release.

Unified nyxgpt ops lifecycle suite — install, down, restart, stop, status, doctor, env-sync, logs, observability, glitchtip-init. One command reconciles the entire stack from scratch; no raw docker/kubectl/terraform commands anywhere in the user path
Local-first stack layout — API/web/Ollama as native Homebrew services, Cassandra as the sole core Docker container, observability tier in Compose profiles
Zero-touch error-tracking provisioning — GlitchTip admin user, org, team, project, and DSN created automatically at install; error delivery verified end-to-end in both native and Terraform modes
SRE Overview single pane of glass (/admin/observability) — one entry point reaching every Grafana dashboard, Loki query, Jaeger trace view, and the GlitchTip tracker
Self-healing — automatic service recovery with its own dashboard and audit trail
First-run experience — nyxgpt wizard interactive setup, version stamping, repo-less portability (the installed system no longer needs the source checkout)
RAG UX — per-collection document filters in chat, retrieval citations with confidence, RAG playground, direct uploads into a chosen collection
Chat — attachments, message editing and regeneration, full-text message search, per-session RAG controls
Definition of Done enforced project-wide — every user feature reachable from the web UI, every ops feature operable from the SRE/admin dashboard; backend-only implementations were treated as blocking defects and fixed

Quality process

All ~180 acceptance findings were driven through the automated agent pipeline (developer → review → merge → stakeholder re-test) and closed before release. Each unique acceptance failure was tracked as its own issue, related to and blocking its feature — features promoted to release only when every related failure was independently accepted.

Known issues (deferred to v3.0.0)

Filed as Production Defects/Improvements during final acceptance and scheduled for the next release (#3521): admin CPU-utilization accuracy (#3581), chat RAG filter scoping and filename search (#3583), mid-session citation propagation (#3585), Terraform-mode dashboard coverage of the observability tier (#3588), OTel context-detach noise on streamed turns (#3593), wrapped local Kubernetes cluster provisioning (#3596), and session storage migration to Cassandra (#3590).

Next: v3.0.0 — Enterprise Deployment & Hardening (security hardening gate, Linux-native install, cloud provisioning behind nyxgpt wrappers). Tracking: #3521

Assets 3

nyxGPT Release v1.0.0 - MVP Release Pre-release

Pre-release

dkblinux98 released this 25 Jan 07:23

Immutable

1.0.0

e3eaed5

nyxGPT Release v1.0.0 MVP

Principles

Quality over features - Fix core issues before adding new capabilities
User-driven - Build what users actually need, not what's cool
Operational excellence - Every feature ships with monitoring, docs, and tests
Performance - Fast by default, optimize where it matters

Release Strategy

Fix versions (1.0.z+1) Fixes to production code
Minor versions (1.y+1.0): Quality improvements, small features, bug fixes
Major versions (x+1.0.0): Breaking changes, architectural shifts, major features

Releases: dkblinux98/nyxGPT

Release list

nyxGPT 3.0.1rc1 (release candidate)

Uh oh!

nyxGPT Release v3.0.0 — Enterprise Deployment Hardening

nyxGPT Release v3.0.0 — Enterprise Deployment Hardening

Principles

Release Strategy

Phase 6: Enterprise Deployment & Hardening

Sprint 7 — hardening gate, decisions, cloud-independent platform

Security & CI Hardening

Decisions (owner approval, block the cloud builds)

Platform (cloud-independent)

Production Defects (carried from v2.0.0 acceptance)

Sprint 8 — the cloud build chain (capstone last)

Uh oh!

nyxGPT 3.0.0 (Homebrew tarballs)

Uh oh!

nyxGPT Release v2.1.0 – GitHub Public Repository Hardening and Security Hardening

nyxGPT Release v2.1.0 – GitHub Public Repository Hardening and Security Hardening

🔓 Going-Public Hardening

🛡️ Code-Scanning Remediation (CodeQL)

Also Included

Contributors

Uh oh!

nyxGPT 2.1.0 (Homebrew tarballs)

Uh oh!