Ship v0.43.1: Perplexity Agent API, trusted project rules, faster first request

- Perplexity: Sonar's Chat Completions endpoint was retired on 2026-09-27.
  The route now speaks Responses at api.perplexity.ai/v1 and starts on
  perplexity/sonar. api::perplexity fits each request to the Agent API's
  narrower schema (message / function_call / function_call_output items
  only, typed messages, input_* parts, image URLs within 2048 characters,
  no include / tool_choice / parallel_tool_calls / prompt_cache_key,
  effort-only reasoning, an output ceiling for anthropic/* models).
- Permissions: a project's .nur/permissions.toml applied its allow rules
  on open, so a cloned repo could approve its own bash and writes even in
  manual mode. Its deny and ask rules still apply at once; its allow rules
  wait for /permissions trust or `nur permissions trust`, recorded per
  directory against a digest of the list, so an edit holds them again.
  nur names what a project asks to auto-approve at startup (stderr for
  `nur run`), and /cd reloads the rules for the new directory.
- First request: a session's first turn launched `npm prefix -g`
  (find_bin looking for `py`), and every turn launched the PLUR CLI,
  before the first model request. find_bin now asks PATH before probing
  runtimes; PLUR context and the OptMem wake are fetched as a session
  opens and reused, PLUR refreshed between turns. Release builds here:
  TUI Enter-to-request ~2.1 s -> ~0.27 s, a warm headless `nur run`
  ~2.3 s -> ~1.3 s.
- The demo film pipeline moved out of the repository; the README shows
  the site-hosted poster.
- NUR_STARTUP_TRACE: writeln! through serde_json's Display wrote a row
  token by token, so rows from concurrent threads interleaved mid-line
  (174 of 1600 parsed under contention) and the startup suite failed
  intermittently. Each row is now one append.
- E2E: scenarios 25-27 (Perplexity wire shape, untrusted and trusted
  project rules). The harness's warm skill index never matched a new
  scenario home, so every scenario rescanned every skill root; it now
  carries its paths into each home and refreshes after every run. The
  startup and regression suites, which hold the index builder's lease to
  test indexing, start cold on purpose (warm_skills=False).

Author: nuroctane

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "nur-cli"
-version = "0.43.0"
+version = "0.43.1"
 edition = "2021"
 description = "NurCLI - fully loaded multi-provider coding agent (TUI, inline kitty/sixel vision, tools, sandbox, TypeSafe/Jev typed judgments with local engines, Graphify/PLUR/Ruflo/Executor + sc-research whitehat pack + historical SC vuln library)."
 license = "GPL-3.0-or-later"

Cargo.toml

@@ -17,7 +17,7 @@ The harness supersedes stale duplicate reads, spills large tool results, preserv
 </p>
 
 <p align="center">
-  <a href="https://www.nuroctane.xyz/cli#demo"><img src="docs/assets/nur-demo.webp" alt="NurCLI demo: an approval with its inline diff, live theme previews in 3D, and the 65-provider login vault" width="760"></a>
+  <a href="https://www.nuroctane.xyz/cli#demo"><img src="https://www.nuroctane.xyz/assets/nur-demo-poster.jpg" alt="NurCLI demo: the gold TUI with its live sidegraph, an inline diff and the fixed calc suite" width="760"></a>
   <br>
   <sub><a href="https://www.nuroctane.xyz/cli#demo">Watch the full demo</a></sub>
 </p>

README.md

@@ -273,6 +273,24 @@ nur plugins uninstall <id>
 
 In the TUI, bare **`/plugins`** opens the full marketplace picker (provider-picker UX).
 
+### `nur permissions`
+
+Show the allow/deny/ask rules in force in this directory, or decide whether this
+project's own rules may approve tool calls.
+
+```bash
+nur permissions            # same as `nur permissions show`
+nur permissions trust      # apply this project's .nur/permissions.toml allow rules
+nur permissions untrust    # hold them again
+```
+
+A project's `.nur/permissions.toml` arrives with the repository, so its `deny`
+and `ask` rules always apply but its `allow` rules stay off until you trust them.
+Trust covers the list as it is now: if a later commit edits it, nur holds it
+again and says so at startup (`nur run` prints the note to stderr).
+
+---
+
 ### `nur doctor`
 
 Diagnose install, auth, config, ecosystem, and plugin marketplace readiness.
@@ -521,7 +539,7 @@ Type these inside the `nur` TUI. Aliases are shown in the same row.
 | `/todos` | Show the session task list |
 | `/init` | Generate a `NUR.md` project guide |
 | `/config` | Show config + data paths |
-| `/permissions` | Show or reload allow/deny/ask rules |
+| `/permissions` | Show or reload allow/deny/ask rules; `trust` / `untrust` this project's allow rules |
 | `/hooks` | Show local tool hook status |
 | `/feedback` | File a GitHub issue from here |
 | `/bug` | Report an issue (GitHub link) |

docs/assets/nur-demo.webp

@@ -267,6 +267,13 @@ tool behavior because tool support depends on the selected model template.
 
 Optional file: **`~/.nur/permissions.toml`** (and/or project **`.nur/permissions.toml`** - both are merged).
 
+A project file comes with the repository, so it can only tighten on its own: its
+`deny` and `ask` rules apply at once, while its `allow` rules are held until you
+trust that exact list with `/permissions trust` or `nur permissions trust`. An
+edit to the list (a `git pull`, say) holds it again, and nur tells you at
+startup what the project asks to auto-approve. Trust is recorded per directory
+in `~/.nur/trusted-permissions.json`; `/permissions untrust` withdraws it.
+
 ```toml
 # Patterns: "tool" or "tool:glob"  (* = any sequence)
 # Order: deny > ask > allow > mode default
@@ -283,7 +290,7 @@ allow = ["bash:git status*", "bash:cargo test*"]
 | **ask** | Force an approval prompt (even in auto) |
 | **allow** | Skip approval in manual (plan structural blocks still win) |
 
-Reload without restart: `/permissions reload`.
+Reload without restart: `/permissions reload`. `/cd` reloads them for the new directory.
 
 ---
 

docs/commands.md

@@ -62,7 +62,7 @@ capability for this exact Nur route/model, so Nur must treat it as unverified.
 | `nebius` - Nebius Token Factory | `NEBIUS_API_KEY`; `https://api.tokenfactory.nebius.com/v1`; CC; `Qwen/Qwen3.5-397B-A17B-fast` | [Nebius Token Factory](https://docs.nebius.ai/foundation-models/) | Verify compatibility features for the selected endpoint/model. | Create a Nebius API key. |
 | `sambanova` - SambaNova | `SAMBANOVA_API_KEY`; `https://api.sambanova.ai/v1`; CC; `Meta-Llama-3.3-70B-Instruct` | [SambaNova Cloud API](https://docs.sambanova.ai/cloud/docs/get-started/overview) | Not established publicly for full tools/usage conformance. | Create a SambaNova key. |
 | `nvidia` - NVIDIA NIM | `NVIDIA_API_KEY`; `https://integrate.api.nvidia.com/v1`; CC; `meta/llama-3.3-70b-instruct` | [NVIDIA API catalog](https://docs.api.nvidia.com/) | Tool/stream/usage is model-specific. | Create an NVIDIA API key. |
-| `perplexity` - Perplexity | `PERPLEXITY_API_KEY`; `https://api.perplexity.ai`; CC; `sonar-pro` | [Perplexity API](https://docs.perplexity.ai/) | Verify tool semantics versus Sonar's own web-grounding behavior. | Create a Perplexity API key. |
+| `perplexity` - Perplexity | `PERPLEXITY_API_KEY`; `https://api.perplexity.ai/v1`; R (Agent API); `perplexity/sonar` | [Agent API](https://docs.perplexity.ai/docs/agent-api/quickstart) | Sonar's Chat Completions endpoint was retired on 2026-09-27. The Agent API takes `provider/model` ids (`perplexity/sonar`, `anthropic/...`, `openai/...`, `google/...`, `xai/...`) and a narrower Responses schema; nur fits each request to it (no replayed reasoning, text-only assistant turns, image URLs up to 2048 characters). Perplexity's hosted `web_search` tool is not enabled; nur's own web tools are offered instead. | Create a Perplexity API key. |
 | `baseten` - Baseten | `BASETEN_API_KEY`; `https://inference.baseten.co/v1`; CC; `deepseek-ai/DeepSeek-V3-0324` | [Baseten API](https://docs.baseten.co/) | Not established publicly for full OpenAI-tool conformance. | Create a Baseten API key. |
 | `friendli` - Friendli | `FRIENDLI_TOKEN`; `https://api.friendli.ai/serverless/v1`; CC; `Qwen/Qwen3-235B-A22B-Instruct-2507` | [Friendli API](https://docs.friendli.ai/) | Live serverless catalog and features can change; verify before use. | Use a Friendli token. |
 | `chutes` - Chutes | `CHUTES_API_TOKEN`; `https://llm.chutes.ai/v1`; CC; `deepseek-ai/DeepSeek-V3.2-TEE` | [Chutes API](https://docs.chutes.ai/) | Verify tools/stream/usage for the chosen chute. | Use a Chutes API token; this model requires its `-TEE` suffix. |

docs/configuration.md

@@ -45,7 +45,7 @@ NurCLI hardens shell execution by default:
 - **SSRF blocks**: web tools reject private-IP targets
 - **Atomic IO**: all writes to `~/.nur/` use atomic file operations (write-to-temp, rename)
 - **Session bak**: each session save copies the previous file to `*.json.bak` first
-- **Optional rules**: `permissions.toml` deny/ask/allow; plan mode still blocks code authoring / VCS. Rules hold for read-only tools too: a call a deny or ask rule names leaves the free parallel batch and takes the gated path
+- **Optional rules**: `permissions.toml` deny/ask/allow; plan mode still blocks code authoring / VCS. A project's own `.nur/permissions.toml` cannot loosen anything until you trust it: its deny/ask rules apply at once, its allow rules wait for `/permissions trust` (or `nur permissions trust`), and an edit to that list holds it again. Rules hold for read-only tools too: a call a deny or ask rule names leaves the free parallel batch and takes the gated path
 - **What the model reads, it sees**: as in Claude Code and Codex, file contents and tool output reach your provider verbatim, secrets included. nur never redacts tool results, because a rewritten key corrupts the config edits the model makes. To keep a file away from the model, deny it, e.g. `deny = ["read_file:*.env"]` in `~/.nur/permissions.toml`. Rules match a tool's primary argument (the path for file tools, the command for `bash`), so a repo-wide `grep` or a `cat` in `bash` can still surface the file; deny those patterns too if that matters. (nur's own spill files, context store and memory still refuse secret-shaped bodies.)
 - **Optional hooks**: `hooks.toml` pre/post tool shell (local only; you control the script)
 - **TypeSafe (Jev) guard**: the `typesafe` tool is declared read-only, so it runs without approval, and it refuses secret-shaped content in `state` / `query` / `candidates` before any request is sent. A loopback endpoint needs no key (local engine); a hosted endpoint needs `TYPESAFE_API_KEY`

docs/providers.md

@@ -63,7 +63,7 @@ repair or upgrade ecosystem components.
 **All green:**
 
 ```text
-nur doctor · v0.43.0
+nur doctor · v0.43.1
 
 binary  C:\Users\you\.local\bin\nur.exe
 config  model=muse-spark-1.3 effort=high max_turns=∞ budget=∞$/∞tok  (C:\Users\you\.nur\config.toml)

docs/security.md

@@ -376,7 +376,7 @@ The note is appended to your persistent memory file and recalled automatically i
 | `/init` | Initialise project instructions (`NUR.md`) |
 | `/scan` | Map this codebase → local `.foglamp/scan.json`, then optionally publish to foglamp.dev. `/scan [focus]` centers the map. **Writes need manual/auto** (plan is lifted to auto). Ask only before **upload**, not before the local file. |
 | `/config` | Show config + data paths |
-| `/permissions` | Show or reload allow/deny/ask rules (`permissions.toml`) |
+| `/permissions` | Show or reload allow/deny/ask rules (`permissions.toml`); `trust` / `untrust` this project's allow rules |
 | `/hooks` | Local tool hook status (`hooks.toml`) |
 | `/doctor` | Inline health check: version · auth · ecosystem · shell · budgets |
 | `/help` | Show keys + commands reference |