nowdocs v0.2.0

Added

• Added an agent-first machine contract with deterministic capabilities, read-only status, one-plan setup plan / setup apply, offline verify, and guarded setup rollback commands.
• Added managed setup adapters for Codex CLI, Claude Code, and Cursor. Claude Desktop returns MCPB guidance, while generic MCP clients receive deterministic manual configuration.
• Added registry-aware ensure planning plus best-effort, throttled reminders for newer nowdocs binaries and installed registry docsets.
• Added optional native Cohere reranking. It is disabled by default, transmits only disclosed, bounded search inputs when explicitly configured, and falls back to the local ranking on provider failure.
• Added signal-preserving retrieval evidence, calibrated answer states, evaluator reports, and stricter cross-platform automation CI gates.

Security

• Separated read-only discovery and verification from explicit state-changing CLI actions; MCP remains read-only over stdio.
• Added approved-root permission validation, no-follow file handling, atomic configuration replacement, digest-guarded rollback, and one-shot rollback authorization.
• Client adapters fail closed on missing tools, unsafe paths, malformed or conflicting configuration, unsupported platforms, and ambiguous client state.

Changed

• Agent setup now reports exact risk, network-access, confirmation, verification, and partial-reversibility boundaries in machine-readable results.
• Update checks are non-blocking, independently throttled per binary and registry channel, and can be disabled with NOWDOCS_UPDATE_CHECK=0.