What changed in each version.

Fixes

• When repairing Windows OpenSSH configuration, the agent and installer preserve the file’s existing line endings. Previously, a repaired line in a CRLF sshd_config received a different ending. sshd still worked, but the file became inconsistent for manual editing.

Agent

• When adding a Windows SSH key, the agent checks whether OpenSSH will actually accept it and reports the result. Previously, the key could be in the right file and the operation reported success, yet login failed without an explanation.
• The agent checks OpenSSH configuration. A localized administrators group name in sshd_config prevents reading the administrators’ key file. The agent reports it and, on explicit request, repairs the entry, backs up the configuration, and restarts sshd.

Installer

• The installer performs the same OpenSSH check on every installation, including when it finds an existing OpenSSH server and otherwise leaves it unchanged. Repairs keep a backup beside the original configuration.

CLI

• The operator MCP tool returns an explanatory error if the key is installed but OpenSSH will reject it. repair_sshd_config permits repair; it is disabled by default because it changes sshd_config and restarts the service.
• Legacy-agent tunnel hints list all supported Windows versions and suggest ver to identify the exact version. Previously they claimed Windows 7 or Server 2008 R2, although the same build also supports 8.1 and Server 2012 R2.

Security

• Windows administrators’ key file permissions are reset to allow only Administrators and SYSTEM. Previously, extra explicit permissions could remain and cause OpenSSH to reject the file.

Fixes

• Read-only commands that discard output, such as 2>nul, 2>/dev/null, and 2>&1, are no longer rejected as redirection. This applies to operators and workers. Redirection to files remains prohibited.

CLI

• nyx-operator agents now matches the dashboard: name, host, status, OS, agent version, relay, and tags. Previously only ID and hostname appeared, making familiar dashboard names hard to find.
• Dashboard-style filters: arbitrary text across columns, --online, --os, and --tag. Repeated --tag flags require all tags to match.
• --ids adds an ID column; --json provides machine-readable output. The summary goes to stderr so the table can be piped cleanly.
• nyx-operator tunnel accepts a machine name, hostname, login, or ID, including unique partial matches. If multiple records match and only one is online, it is selected, avoiding stale reenrollment records. The selected target is printed before opening the tunnel.
• nyx-operator --help includes first-login, filtered-list, and named-tunnel examples, and explains that operators create their own tokens in the dashboard, where values are shown once.
• --port and --listen have descriptions. Tunnels support any TCP port, and --listen 127.0.0.1:0 lets the system select a free local port.

CLI

• Set up Linux x86_64 operator tools with curl -fsSL https://nx.3fe.ru/downloads/install-operator.sh | bash. It installs nyx-operator and nyx-mcp into ~/.local/bin, or /usr/local/bin as root. Previously, tools required a source build.
• The same command updates tools, comparing installed and published versions and replacing only changes. --check reports versions without modifying anything. A running nyx-mcp is replaced safely while the existing process continues until exit.
• Every download is checked against its published sha256 checksum; mismatches abort installation.
• With root and --with-agent --token … --name …, the same script installs the agent, enrolls the machine, and adds a systemd service. --only selects components, --prefix changes the destination, and --force reinstalls regardless of version.
• nyx-mcp now supports --version, allowing the installer to determine whether replacement is needed.
• Operator MCP tunnel hints match the target port: ssh for 22, an RDP client for 3389, psql, mysql, or sqlcmd for database ports, and URLs for web ports. Previously every tunnel suggested SSH, including RDP tunnels where it does not work.

Installer

• Failed enrollment no longer produces a green installation-complete page. Previously, an expired token produced an agent error but the wizard reported success even though no service was registered and the machine did not connect.
• Enrollment errors explain that tokens are single-use, may expire, and where to obtain a new one.

Installer

• One file covers Windows 7 SP1 and Server 2008 R2 through Windows 11, both 32-bit and 64-bit. Previously, the installer refused to run on anything older than Windows 10, leaving older fleets without an installation path.
• The installer detects the OS version and architecture and extracts the appropriate agent build. There is no need to identify the machine first or choose among downloads.
• OpenSSH Server is bundled. Windows 7 and Server 2008 R2 lack a component store and cannot download it with TLS 1.2 disabled by default. Windows 10 and later try the built-in component first, keeping the bundle as fallback when Windows Update is unavailable and removing it if unused.
• Bundled OpenSSH goes into a separate agent folder, preserving administrator-installed OpenSSH. An existing sshd service is enabled and started without replacement. OpenSSH remains after agent removal, preserving SSH access.
• Bundling OpenSSH increases installer size to about 12 MB.

Agent

• Legacy builds are available, including 32-bit. They lack browser terminals because ConPTY arrived in Windows 10 1809, but machines still appear in the dashboard with SSH relay, tunnels, read-only commands, and updates. Open a terminal through a neighboring modern machine using SSH to another agent.
• Automatic updates now work on older systems: releases are signed for all three builds. Previously, legacy agents had no published signed updates.
• Operator MCP hints account for older systems and suggest wmic and Get-WmiObject instead of commands absent from PowerShell 2.0.

Security

• The gateway now explicitly recognizes more modifying Windows commands: del, rd, ren, move, xcopy, robocopy, format, diskpart, bcdedit, taskkill, icacls, msiexec, sc stop|start|delete|config, reg add|delete|import, task creation/modification/deletion/execution with schtasks, and log clearing with wevtutil. Chat and operator tools share these rules.
• Network diagnostics run as read-only without approval: ping, tracert, pathping, nbtstat, nslookup, dig, host, mtr, netsh … show, Test-NetConnection, Test-Connection, and Resolve-DnsName.
• Chain refusals identify the offending segment by number, such as “segment 2 del x is state-changing; the rest is allowed”, instead of a generic approval-required message. You can see what needs changing without trying commands one at a time.

Dashboard

• Offline machines show when they were last online, such as “last seen 3 days ago”, on cards, machine pages, and the admin table.
• Offline machine pages retain the last reported OS and agent version instead of becoming empty.

CLI

• nyx-mcp preserves the full refusal reason, includes last connection time in machine details, and warns that command output remains in the machine’s language.

Fixes

• Switching the console to UTF-8 in 0.1.53 did not solve every case: built-ins such as dir still used OEM encoding, while tools such as sc switched to English. The agent now leaves the console code page alone and decodes output itself: valid UTF-8 passes through, and other bytes are decoded from the OEM code page. Russian output from all tools stays readable.

Fixes

• SSH key file permissions used the English Administrators group name and failed where the group had a localized name. Agents now use system identifiers, so key installation works in any Windows locale.
• Standard argument escaping corrupted quotes passed through cmd /C, causing powershell -Command "…" to print commands instead of executing them. The command line is now passed exactly as written.
• Console tools returned OEM-encoded output that appeared garbled in the dashboard. The agent now requests UTF-8 output, adding the prefix itself without changing command gateway rules.

Agent

• Agents can install an operator’s public SSH key without requiring prior machine access. On Linux, it goes into the specified user’s authorized_keys with the permissions sshd expects. On Windows, it goes into the administrators’ key file with the required access restrictions. Reinstalling the same key changes nothing.

CLI

• nyx-mcp now installs keys, defaulting to ~/.ssh/id_ed25519.pub, so tunnel and SSH access can be set up on a new machine without visiting it.

Security

• Only administrators can install keys, and only on online agents. Both control plane and agent validate the format. The audit event records key type and comment, not the key itself.

Security

• The command gateway previously recognized only Unix status commands, rejecting harmless Windows commands such as ver, systeminfo, tasklist, dir, type, sc query, reg query, wmic … get, ipconfig, and powershell Get-*. These now run as read-only, while modifying variants (sc stop, reg add, wmic … call) still require approval.
• Chains and pipelines (;, &, &&, ||, |) pass when every segment is read-only. One modifying segment sends the entire command for approval.
• PowerShell is allowed only in a known-safe form: no encoded commands, script files, code blocks, substitutions, or iex, and a read-only cmdlet at the start and every pipeline stage.
• Sensitive read paths now include Windows secrets: SAM, SECURITY, and SYSTEM hives, the domain account database, related registry branches, unattended-installation files, and .ssh directories. Reading them requires approval, as on Linux.

Workers

• The same rules apply in chat: asking about a Windows service no longer fails with an incorrect state-changing-command refusal.

CLI

• nyx-mcp refusals list allowed commands instead of a generic state-changing message, and SSH examples adapt to the machine’s OS.

Dashboard

• Machine tags now have a dedicated editor instead of a text prompt: selected tags are chips, alongside tags already used by agents and enrollment tokens. Click to add or remove; type a new tag and accept it with Enter, a comma, or a space.
• The same editor is included in enrollment-token creation, so machines arrive already tagged.

CLI

• New workstation tool: the nyx-mcp MCP server lets Claude Code, Claude Desktop, and other clients work with the fleet like a terminal operator. Find machines by name, hostname, login, OS, or tags; open a local relay port for SSH, scp, or RDP; run quick read-only commands through the control plane; and set tags.
• No inbound machine ports are needed; the agent only needs to be online. Tunnels are reused, close after inactivity, and all terminate when the MCP client exits, leaving no listening ports on your workstation.
• nyx-mcp does not execute modifying commands. The same approval gateway used by the dashboard rejects them and explains that changes should use SSH through a tunnel under your own machine credentials.

Fixes

• Losing the control plane connection while a session was open could leave an agent silent: the process stayed alive, but the machine remained offline until a manual service restart. This happened after control plane updates that disconnected all agents. The agent now closes live session processes and reconnects on its normal retry schedule.
• Multiplexer sessions survive and recover on reconnection; plain shells close with the connection, matching the control plane’s existing expectations.

Installer

• The wizard asks for an optional dashboard machine name, such as “Checkout 2, warehouse”; leaving it empty uses the computer name. Silent installation supports /NAME=. Machines appear with a recognizable name immediately, without manual renaming.

Agent

• Enrollment supports --display-name and NYTHRONIX_DISPLAY_NAME, bringing the same feature to Linux and custom rollout scripts. Names accept any language, stripping only control and invisible characters.

Dashboard

• Enrollment tokens show only active entries by default. Expired, used, and revoked tokens are behind a “show (n)” toggle, each has a status, and only active tokens can be revoked. Tokens expired for more than a week are removed automatically.

Dashboard

• Agent administration now opens with Connect a new machine: three Windows steps (download the installer, create a token, paste it into the wizard) and a ready-made Linux command. Previously, password registration appeared first, giving users a password the installer could not accept.
• Password registration remains collapsed at the bottom as manual registration, the legacy method, with a note that the Windows installer does not need it.
• Token creation shows two copyable values: the nyxet_… token for the Windows installer and the full Linux enrollment command.
• Login, hostname, and display name are combined in a Machine column. Action buttons wrap, and wide admin tables scroll inside cards, keeping Delete on screen.

Installer

• Server URLs and tokens are cleaned of invisible characters, including nonbreaking spaces, byte-order marks, and zero-width characters. Tokens copied from messages no longer fail format validation.

Dashboard

• New Admin → Requests section for closed-beta applications from the site, with status filtering and per-row changes (new, contacted, accepted, rejected). It shows applicants, use cases, fleet size, and operating systems, and indicates whether email is enabled.

Self-hosted

• A public form endpoint with no authentication, a limit of five requests per hour per IP, a bot honeypot, and strict size limits. Every request is audited.
• Outbound email: configure NYTHRONIX_SMTP_URL (smtps:// or smtp://), optionally NYTHRONIX_SMTP_FROM, and NYTHRONIX_BETA_NOTIFY_TO to receive applications by email. Delivery runs in the background and does not prevent acceptance when SMTP is unavailable. The site does not expose your address.

Self-hosted

• Host the dashboard separately, for example on app.<domain>, while agents and workers use the main control plane address. NYTHRONIX_EXTRA_ORIGINS permits cookie-authenticated WebSockets from additional origins. Documentation covers the landing-page and dashboard split.

Fixes

• Browsers could show a stale dashboard shell for weeks and redirect users to sign-in because HTML lacked explicit cache rules. The shell and service worker are now always revalidated, while hashed assets are cached for a year.

Dashboard

• Agent tags such as env:prod, client:acme, and role:db, editable in Admin → Agents. Join tokens can assign tags automatically to newly enrolled machines.
• A shared filter bar across the dashboard, new-session machine selector, tunnels, and administration: search login, hostname, name, and tags; use tag chips, online-only filtering, and grouping by tag key. Dashboard filters are saved in the URL for sharing.
• Windows installer links on the sign-in page and agent administration.
• MCP approval cards show the skill name and arguments instead of raw data labeled as a command.

Installer

• A complete Windows agent installer (Windows 10 1809+ / Server 2019+). The wizard asks for the control plane URL and join token, optionally installs built-in OpenSSH Server for relay access behind NAT, then registers and starts the service.
• Silent installation with /SERVER=, /TOKEN=, and /VERYSILENT, with no blocking dialogs. It takes over manually installed legacy services; an empty token preserves existing enrollment for updates.

Self-hosted

• A ready-made skills-host container for internet-dependent skills such as page fetching and search. It joins as a separate agent; subprocesses can reach only SKILLS_ALLOW domains. It refuses to start with unrestricted egress.
• A script and systemd unit for domain-based skill egress restrictions on any agent host, including fetch and DuckDuckGo examples.

Fixes

• Fixed Windows agent builds broken since 0.1.42 by Unix-only skill privilege reduction. Windows skills run under the service account.

Workers

• The worker skills preset now takes effect: enter skill server names separated by spaces or commas, with wildcard support. A database worker loads only database skills, reducing distraction and privileges. Empty, all, or * loads all skills as before.

Dashboard

• The worker form now explains how the preset field restricts skills.

Security

• Skill servers no longer run as root: when the agent runs as root, every skill subprocess drops to the unprivileged user used for worker commands. A compromised skill does not gain access to the whole machine.

Agent

• Privilege reduction is part of subprocess creation, so the agent still stops servers correctly when skills change. Agents already running without root behave as before.

Dashboard

• Admin → Agents now has Manage skills: toggle entries from the machine catalog, fill in parameters, and see running and read-only badges. Desired skills can also be edited for offline agents and apply on reconnection.

Agent

• Agents publish the full catalog with parameters and read-only flags alongside running servers, letting the dashboard offer skills without knowing launch commands.

Workers

• When the owner marks a skill server read-only, its tools run without approval prompts. This reduces noise for safe third-party servers without per-tool annotations.

Fixes

• Skill lists are correct immediately after an agent restart: the agent remembers the applied set and reports it again on reconnection.

Agent

• Machine skills can now be configured from the control plane instead of manually editing server files, initially through the API, with dashboard UI coming next. The agent starts and stops skill servers to match the desired set.
• The control plane stores and sends only skill names and parameters, such as database addresses. The machine owner’s catalog maps names to commands, so even a compromised control plane can enable only preapproved capabilities.

Workers

• Workers handle several tool calls in one model turn correctly. Previously, two or more consecutive approvals caused a resume error.
• Verified compatibility with third-party MCP servers, including Postgres, through mcp-proxy.

Workers

• Skills that can modify a machine now wait for operator approval or rejection in the channel, just like shell commands. Read-only skills run immediately; absent an explicit safety declaration, approval is required by default.
• Skill calls appear as worker steps in chat, showing the skill, arguments, and result. Previously they were invisible.

Security

• Every skill call is audited with organization, operator, machine, server, and tool, just like command execution.

Fixes

• Fixed the worker image being built without the skills module and crashing at startup.

Workers

• Workers discover MCP skill servers on your machines and load their tools. For machine state such as disk, memory, uptime, service status, log tails, and files, workers now prefer structured skills over raw shell commands.
• Workers communicate only with the control plane, which relays skill requests to machines. This works even with worker outbound traffic otherwise fully blocked.

Agent

• The agent starts configured MCP skill servers as supervised subprocesses, restarts them after crashes, and reports availability. A minimal built-in read-only server is included.

Self-hosted

• Per-organization LLM keys and models: the supervisor reads NYX_LLM_PROFILES_FILE every cycle, so new clients require no restart. LLM secrets stay off the internet-facing control plane.
• Worker egress isolation: NYX_WORKER_NETWORK moves workers to a separate Docker network, while a host script and SNI filter allow only control plane and LLM access. A systemd unit preserves rules across reboots.

Security

• Worker containers can reach only the control plane and LLM, not the local network, other containers, cloud metadata, or neighboring sites behind the same ingress.

Workers

• A crashed worker no longer remains a dead container: the runtime removes and recreates it if it is still needed. It returns online in chat without operator intervention.
• Hung workers whose processes are alive but unresponsive are detected through missing heartbeats and restarted after a grace period.

Self-hosted

• The worker supervisor is now a Compose service instead of a separate docker run, restarting with the stack and keeping configuration together. Set NYTHRONIX_RUNTIME_TOKEN on the control plane to enable runtime API.
• Configure the hung-worker grace period with NYX_HUNG_GRACE_SECS (default 90 seconds). Update the control plane before the supervisor: older control planes do not report online status, causing all workers to be treated as hung.
• Added a full architecture description to the documentation.

A summary of everything from the first commit through 0.1.36 (May–July 2026). This is the foundation for subsequent releases.

Dashboard

• Password sign-in, operator roles, and an initial owner created with an empty database. Administration for organizations, operators, agents, NX endpoints, and a filterable audit log.
• Machine cards with online/offline status, joinable active sessions, and configurable live terminal previews as color mosaics.
• Browser terminals with shell, tmux, and zellij engines: sessions survive agent and control plane restarts, multiple browsers can join, and persistent terminal modes are restored on reconnection.
• Mobile support: home-screen installation (PWA and an offline shell), on-demand keyboard, Tab and other keys, touch scrolling including inside tmux/zellij, fullscreen mode, and admin tables that become cards.
• New navigation: a left drawer with running sessions, zellij-style automatic session names, themes, a shared design system, loading states, and accessibility.
• Split view with up to four interactive terminals. Select a working directory using a folder browser on the machine.
• Agent-to-agent relay: SSH to another agent in the new-session form, a browser port console, Open as web page for local machine web interfaces, and managed tunnels with a copyable nyx-operator command.
• Consent-code access: connect to a machine using a single-use code issued by its owner with a selected access mode.
• Settings with operator API tokens.
• Releases: publish, promote, and revoke signed builds; configure update policies per agent and NX endpoint.
• AI worker chat: channels, multiple workers per channel, presence, command approval cards showing exactly what will run and why, Start/Stop and Pause/Resume controls, and shared or per-channel memory.
• The agents table shows platform, version, execution identity, and Docker status. Agents can be renamed.

Agent

• A real Linux PTY agent with shell/tmux/zellij, automatic reconnection with exponential backoff, a half-open connection watchdog that reconnects instead of hanging, and TLS (wss).
• Self-updates verify SHA-256 and an Ed25519 signature against a pinned key and reject unsigned builds. Update policies are configured in the control plane.
• Enrollment with join tokens instead of manual registration.
• Windows: service mode, native ConPTY terminals, capability detection including Windows 7 / Server 2008 R2, zellij on modern Windows with recoverable sessions, automatic updates, and tmux/zellij discovery beside the binary.
• Unprivileged worker commands with targeted sudo policies. Operator terminals run under their real accounts and recover after agent restarts.
• Local machine-owner policy overrides the control plane: it cannot grant more than the owner allows. Agents report effective permissions to workers.
• nythronix-agent tunnel and share directly on the machine for relay tunnels and consent codes.
• NX endpoint: codex/claude profiles, profile snapshots, and isolated tool configuration.

Installer

• One-command curl installation for the agent, NX, and nx-cli, with TLS and subsequent self-updates.
• Linux agent enrollment script using join tokens, plus systemd templates for the agent and NX.

Workers

• AI workers run commands through agents; the control plane enforces operator approval for everything outside the read-only allowlist.
• Command classification, a separate barrier for reading secrets, and separation of duties: only operators with the required category can approve a command.
• Long-term worker and channel memory on the control plane, channel isolation, pause/resume, start/stop from the dashboard, and managed container execution.

CLI

• nx: local nx codex <profile> and nx self-update; nx ssh and nx tunnel for self-hosted deployments.
• nyx-operator: API-token sign-in and relay tunnels from your workstation.
• Server administration commands, including agent update policies.

Self-hosted

• Docker image, Compose with Caddy, nginx/Caddy configurations, systemd units, release script, deployment documentation, and a runbook.
• Backends: Postgres for data, sessions, and audit; Redis for download tokens; S3/MinIO for builds.
• Production configuration preflight: the server refuses to start with unsafe settings.

Security

• Argon2id password storage, CSRF-protected cookie sessions, WebSocket Origin checks, and an append-only audit log.
• Atomic writes without lost updates, Postgres referential integrity, and safe cascading deletes.