notebook-intelligence 5.4.0a3__tar.gz → 6.0.0__tar.gz

notebook_intelligence-6.0.0/AGENTS.md

@@ -0,0 +1,27 @@
+# Agent notes for notebook-intelligence
+
+Guidance for coding agents working in this repository. [CONTRIBUTING.md](CONTRIBUTING.md) covers the full development setup.
+
+## Before pushing
+
+Run all four and make sure they pass:
+
+```bash
+pytest tests/ -q
+jlpm tsc --noEmit
+jlpm lint:check
+jlpm jest
+```
+
+If `jlpm lint:check` reports formatting problems, run `jlpm lint` to auto-fix them with the repo's Prettier (this covers Markdown too).
+
+## JavaScript tooling
+
+- Use `jlpm` for every frontend command (install, build, lint, test). Do not use a system `yarn` or `npm`. `jlpm` is the Yarn bundled with JupyterLab, and CI installs with it.
+- Do not add a `packageManager` field to `package.json`. `jlpm` ignores it, so it only changes which Yarn a plain `yarn` command runs. A lockfile written by a different Yarn version gets a different TypeScript builtin patch hash, and CI's immutable `jlpm` install then fails with `YN0028`.
+- After changing dependencies or `resolutions`, regenerate the lockfile with `jlpm install`, then confirm `jlpm install --immutable` passes. The `yarn.lock` diff should touch only the packages you meant to change.
+
+## Code conventions
+
+- Adding an admin policy touches seven places. The comment above `FEATURE_POLICY_SPEC` in `notebook_intelligence/extension.py` lists them all; update every one, or the policy silently stops working in one direction.
+- Import `react-icons` icons from `src/icons.ts`, not directly from `react-icons/vsc` or `react-icons/md`. That module re-types the icons so they compile under `@types/react` 18.

{notebook_intelligence-5.4.0a3 → notebook_intelligence-6.0.0}/CHANGELOG.md

@@ -8,17 +8,52 @@ For each release we list user-facing changes grouped as **Added**, **Changed**,
 
 <!-- <START NEW CHANGELOG ENTRY> -->
 
-## [5.4.0] - unreleased
+## [6.0.0] - unreleased
 
-5.4.0 adds a second agent mode (ACP, with Codex as the first agent type) alongside Claude mode, a way to serve NBI's Jupyter-UI tools to an agent running outside the Lab page, and two diagnostic surfaces for deployments where something is misconfigured or slow: a configuration readiness preflight that names the missing piece, and opt-in performance diagnostics with per-turn timelines. Every one of them is opt-in and defaults to off. No traitlet, env-var, REST route, or on-disk-format renames or removals.
+6.0.0 adds Chatbook, a notebook whose cells can be written in English and executed as generated code, together with its admin policy, its own kernel, and the context, mention, and ruleset plumbing around it. The rest of the release is hardening: the experimental ACP agent mode gets a tighter sandbox and better approval cards, and a long tail of chat, settings, MCP, and readiness fixes. The major version marks Chatbook's arrival rather than a compatibility break: no traitlet, env var, REST route, command id, or on-disk format was renamed or removed, `requires-python` is unchanged at `>=3.10`, and the supported JupyterLab range widened rather than narrowed. Upgrading needs no migration.
+
+### Added
+
+- **Chatbook: notebooks whose cells are written in English** (#406, #448, #480). A Chatbook is an ordinary `.ipynb` opened against a new `chatbook` kernel, in which each cell is either a natural-language prompt (**NL**) or ordinary code (**Cd**). Running an NL cell generates code for the notebook's backend kernel and runs it; the cell badge is a button and `Ctrl J` / `Ctrl Shift J` switch the active cell or every cell between the two modes. Generated code is governed by an execution mode: `always-confirm` (the default) shows the code and waits, `confirm-if-risky` waits only when a scan finds destructive filesystem, shell, or process calls, and `auto-run` executes without asking. `NBI_CHATBOOK_POLICY` gates the whole feature the way every other admin policy does, and `NBI_CHATBOOK_MAX_EXECUTION_MODE` caps how permissive a user may be, so a tenant can pin `always-confirm` and remove the rest from the dropdown. The backend kernel is resolved from the notebook rather than assumed, so Chatbook is not Python-only, and rules under `modes/chatbook/` apply to generation. Cells can pull context with `@` mentions, served by built-in providers and by any that an extension registers (see [`docs/chatbook-extensions.md`](docs/chatbook-extensions.md)); a Chatbook can be exported to a plain code notebook for the backend language. Running a **Cd** cell also asks the model for an English description of that code, stored in cell metadata, so a hand-written cell can be read as prose later. Chatbook ships a kernelspec and one new route, `POST /notebook-intelligence/chatbook/generate`; `ipykernel` is now a runtime dependency. See [`docs/chatbook.md`](docs/chatbook.md).
+- **The MCP handshake is bounded** (#456). A `mcp.json` entry pointing at a command that is not an MCP server never answered the protocol handshake, and the connect attempt could occupy the backend indefinitely. Connect and disconnect now run under deadlines, `NBI_MCP_CONNECT_TIMEOUT` (60 seconds by default) and `NBI_MCP_DISCONNECT_TIMEOUT`, after which the server is marked failed and the log says the command may not be an MCP server. A command that writes non-JSON output in a loop would otherwise fill the log with one parse error per line, so those records are capped and the number withheld is reported with the failure.
+
+### Changed
+
+- **Tab accepts an inline suggestion only when one is on screen** (#444). The accept binding was scoped to `.jp-mod-completer-enabled`, which is set whenever the completer is active, so Tab could be swallowed in an edit-mode cell with nothing to accept instead of indenting. It is now scoped to `.jp-mod-inline-completer-active`. Inline completion responses are also identified per request, so a reply that arrives after its request was superseded is discarded rather than accepted.
+- **Ollama's chat-model list is fetched lazily and bounded** (#427). Enumerating models ran at startup and waited on the Ollama host, so a configured but unreachable host delayed the extension. The enumeration is deferred and time-bounded, and a failure logs a warning instead of holding up load.
+- **A disabled provider no longer advertises its models** (#431). `disabled_providers` removed a provider from the picker but the capabilities response still carried its model list, so a disabled provider's models remained selectable through a stale or hand-edited config.
+- **Dependency floors and build pins** (#422, #445). `@jupyterlab/launcher` widened from `~4.2.0` to `^4.0.0`, which stops JupyterLab 4.6 flagging the dependency. `fast-uri` and `js-yaml` resolutions were raised past HIGH-severity advisories. The build pins `hatchling<1.32`: 1.32 made `BuildHookInterface` generic over two type parameters, and `hatch-jupyter-builder` subclasses it with one, so sdist and wheel builds failed with `TypeError: Too few arguments`. A later audit (#492) raised six Python floors that still named a release carrying a published advisory (`jupyter_server` to 2.21.0, `cryptography` to 50.0.0, `litellm` to 1.84.0, `mistune` to 3.3.3, `python-multipart` to 0.0.31, `aiohttp` to 3.14.3), added the `python-dotenv>=1.2.2` floor that litellm's old `==1.0.1` hard pin had blocked, moved the `pytest` test extra to `>=9.0.3`, and added npm resolutions for `browserslist`, `baseline-browser-mapping`, `colord`, and `postcss-selector-parser`. Those four are build and lint tooling and do not reach the shipped bundle.
+
+### Fixed
+
+- **A forged approval prompt can no longer impersonate the real one** (#415). Command text rendered into a Claude Bash approval card could close the displayed block and add its own trailing content, so what the card showed and what would run could differ. Command text is now fenced with a collision-resistant delimiter and bidirectional control characters are rejected. ACP approval cards apply the same policy.
+- **Backend-requested UI commands are gated behind an allowlist** (#443). The response stream could ask the frontend to execute a JupyterLab command by id, with no restriction on which. Requests are now checked against an allowlist at a single chokepoint. `run-command-in-terminal` remains allowlisted, so shell reachability is unchanged; the change removes the ability to reach arbitrary commands.
+- **ACP agents are no longer served the client's filesystem or terminal** (#418, #419, #423, #424). NBI refused some agent requests and honored others, which let an agent borrow the Jupyter server process's reach. Filesystem reads and writes, terminal methods, and agent extension requests are now refused at the router, so the agent does its own I/O under its own sandbox. Full access, when an admin allows it, grants workspace writes rather than unrestricted access. Approval cards show the command and the reason the agent gave, rendered as separate labeled blocks so a long detail cannot hide the command. An NBI-supplied API key no longer spreads through Codex's own configuration, and the cleanup of previously written credentials states its limits rather than implying it is complete.
+- **The ACP session picker shows something useful** (#421). Session titles were cut inside a context pointer, and previews carried pointer segments that meant nothing to a reader; titles are now cut on a boundary and pointer segments are stripped. Session files are named relative to the open directory.
+- **Saving Claude settings keeps keys the tab does not show** (#420). The Claude settings tab saves the keys it renders when it opens, and the server stored that object in place of the old one. Any other `claude_settings` key was erased, including `jupyter_ui_tools_external` (#398), which is set by hand in `config.json`. `POST /notebook-intelligence/config` now merges a posted `claude_settings` onto the stored value. Settings saves also re-read `config.json` first, so a hand edit made while JupyterLab runs is no longer overwritten when a settings tab next saves. Settings changes are judged against the running state rather than the state the tab opened with.
+- **Readiness reports a blank required model instead of answering Ready** (#459). An OpenAI-compatible or LiteLLM-compatible provider with the **Model** field left empty persisted as an empty string. Readiness answered "Ready. Nothing needs configuring" while every chat turn went out with no model name and failed. A blank required property is now a blocking row naming the field, and the settings form marks it once touched.
+- **The performance report names the provider that served a turn** (#461). Turns were labeled from the resolved model, which reported `copilot` for every Claude-mode turn and mislabeled a Copilot user pinned outside the fallback list. The label now comes from the configured provider, and a malformed config no longer raises on the chat path.
+- **A stopped response says so in the transcript** (#474, #477, #478, #479). Stopping a response left the bubble exactly as it was, indistinguishable from a model that returned nothing. The turn is now marked, and the marker survives both later deltas and a second turn streaming alongside it. Stop also reaches every turn that is running, not only the one the sidebar input started, so a response begun from an editor command can be stopped; and the openai-compatible, LiteLLM-compatible, and Ollama chat models now read the cancel token and close the stream, so a stopped turn stops generating at the provider instead of running to completion.
+- **Concurrent turns no longer erase each other from the transcript** (#478). A streaming turn rewrote the whole transcript from a snapshot taken when it started, so a turn begun from an editor command while a sidebar response streamed removed that response and its prompt. Each turn now updates only its own message, and a response is placed next to the prompt it answers.
+- **Enter sends a message that starts with an unmatched `@` or `/`** (#464). Typing a prefix that matched no completion left the suggestion popover open with nothing selected, and Enter raised rather than sending; the message could not be sent at all without editing it.
+- **The MCP config editor reports a JSON syntax error** (#470) and **no longer deletes a temp file it has not created** (#460). Saving malformed JSON parsed the document outside the error handling, so the edit was dropped with no message anywhere but the devtools console while the tab looked saved. Opening the editor also deleted its temp file first, which answered 404 on every open because the file is normally absent.
+- **A malformed `mcp.json` no longer takes down MCP support** (#433). A bad `mcpServers` or `participants` section raised during parsing; the malformed section is now skipped with a log line and the rest of the file is honored.
+- **`NBI_ENABLED_PROVIDERS` is parsed as a CSV list** (#435). It was read as a single value, so an admin re-enabling more than one provider re-enabled none of them.
+- **Open files are reverted more carefully** (#429). A file changed on disk was reverted even while its kernel was running, which could swap the source out from under an executing cell; the revert is now skipped while the kernel is busy and announced when it happens. The reload notice is scoped to the visible document instead of firing for background files.
+- **Chatbook fixes** (#457, #458). The mention menu could outlive the cell that opened it and reappear over an unrelated cell. Cells whose generated code never ran no longer take an execution number, so a cell waiting on the confirm bar does not look like it executed.
+- **Settings panel layout and labels** (#462, #471, #472). The content pane collapsed to nothing in a narrow window while the tab column kept its full width. Buttons pairing an icon with a label rendered the label outside the button, where it painted over the panel background and became invisible. Decorative tab icons are hidden from the accessibility tree.
+
+## [5.4.0] - 2026-09-01
+
+5.4.0 adds a second agent mode (ACP, with Codex as the first agent type) alongside Claude mode, a way to serve NBI's Jupyter-UI tools to an agent running outside the Lab page, and two diagnostic surfaces for deployments where something is misconfigured or slow: a configuration readiness preflight that names the missing piece, and opt-in performance diagnostics with per-turn timelines. ACP mode, performance diagnostics, and the tool proxy are opt-in and default to off; the readiness preflight's non-billing checks run when Settings opens, and its live endpoint test is opt-in. No traitlet, env-var, REST route, or on-disk-format renames or removals.
 
 ### Added
 
 - **Experimental ACP agent mode** (#378). A second agent mode that drives an external coding agent over the [Agent Client Protocol](https://agentclientprotocol.com/), with OpenAI Codex (via the `codex-acp` adapter) as the first selectable agent type. Adds an ACP tab in Settings with an agent-type dropdown, chat model, API key, and base URL; session listing and resume through the agent's own `session/list` and `session/load`; and streaming, tool-call, and permission-request handling that reuses NBI's existing confirmation flow. ACP mode and Claude mode are mutually exclusive: enabling one disables the other on save, and a hand-edited config that enables both resolves to Claude. Two new admin policies both default to `force-off` rather than `user-choice`: `acp_mode_policy` (`NBI_ACP_MODE_POLICY`), the off switch for the whole mode, and `acp_full_access_policy` (`NBI_ACP_FULL_ACCESS_POLICY`), which governs whether the agent may run tools without asking. While full access is `force-off`, NBI pins Codex to `approval_policy = untrusted` through the adapter's `-c` command-line override, so it asks before anything beyond trusted read-only commands. Credentials and model follow the same env-override locks as Claude (`OPENAI_API_KEY`, `OPENAI_BASE_URL`, `NBI_ACP_CHAT_MODEL`), and `NBI_ACP_AGENT_COMMAND` overrides the adapter command NBI launches. When an API key is configured, codex runs with an isolated `CODEX_HOME` under the NBI user directory so neither the workspace's nor the user's `~/.codex` config is read. See [Gating the experimental ACP agent](docs/admin-guide.md#gating-the-experimental-acp-agent-378).
 - **Proxied Jupyter UI tools for external agents** (#398). NBI's Jupyter-UI tools (create and edit notebooks, run cells, open files, drive the terminal) were only reachable from the in-process MCP server NBI registers with the Claude SDK. Managed and enterprise Claude Code configurations can forbid dynamically configured MCP servers, which made those tools unavailable in exactly the deployments that most need them. A standalone stdio MCP server, `python -m notebook_intelligence.mcp_ui_proxy`, now serves the same tool manifest and relays each call over HTTP to the running Jupyter Server, so it can be declared in a static `mcp.json` like any other server. Setting `jupyter_ui_tools_external` in the Claude settings switches Claude mode from the in-process tools to the relay. The relay endpoint is `/notebook-intelligence/ui-tools` (GET for the manifest, POST to invoke); it requires Jupyter authentication like every other NBI route, and the proxy additionally sends a per-process bridge secret in an `X-NBI-UI-Tools-Token` header, which the relay uses only to exempt the call from the XSRF check (not as an identity). `NBI_UI_TOOLS_URL`, `NBI_UI_TOOLS_TOKEN`, `NBI_UI_TOOLS_SECRET`, `NBI_UI_TOOLS_HTTP_TIMEOUT`, and `NBI_UI_TOOLS_SERVER_NAME` configure the proxy when discovery cannot find the server on its own. See [Serving the Jupyter UI tools to an external agent](docs/admin-guide.md#serving-the-jupyter-ui-tools-to-an-external-agent-398).
 
-- **Configuration readiness preflight** (#410). NBI Settings now opens on a Status card answering whether the deployment is configured to work and, if not, which specific piece is missing. Checks resolve the provider and model, confirm the model list is reachable and that the selected model is one the endpoint actually serves, and for the agent modes confirm the CLI answers `--version` and that credentials are present; a missing key is a warning rather than an error, because the Claude CLI and ACP agents can hold subscription logins NBI cannot see. Every row that is not `ok` carries a remedy naming the next action. `GET /notebook-intelligence/readiness` runs the checks that bill nothing. An opt-in `POST` with `{"live": true}` sends one short real request, which is the only way to catch a gateway that returns 200s but buffers instead of streaming, or a proxy that strips the `tools` field so agent mode silently never calls a tool; it is refused when `NBI_READINESS_LIVE_CHECK=off` (traitlet `readiness_live_check_allowed`) and returns 429 if one is already running. No model output is retained. See [Configuration readiness](docs/admin-guide.md#configuration-readiness).
-- **Opt-in performance diagnostics** (#408). A Performance tab that answers "where did this turn's time go," aimed at internal LLM gateways, network home directories, and TLS-intercepting proxies. Each chat turn records a phase timeline (rule and context preparation, agent connect and spawn, time to first token, streaming with stall events, tool calls, time spent waiting on the user) plus token counts and the SDK-reported API duration, with a verdict naming the dominant phase; comparing active time against API time separates a slow gateway from a slow machine. An environment probe measures filesystem, subprocess, and optional network latency from the server's own vantage point. Off by default, and when off the cost is a single boolean check per instrumentation site. Attributes are redacted by default (paths hashed to basenames), turns are held in a capped ring buffer, and each turn is also summarized as one `perf turn ...` INFO line so headless installs get the same signal. `NBI_PERF_DIAGNOSTICS` locks the enabled state, `NBI_PERF_DIAGNOSTICS_POLICY` governs it fleet-wide, `NBI_PERF_PROBE_NETWORK=off` disables just the network check, and `NBI_PERF_LOG_DIR` redirects the optional JSONL log. See [`docs/performance-diagnostics.md`](docs/performance-diagnostics.md).
+- **Configuration readiness preflight** (#410). NBI Settings now opens on a Status card answering whether the deployment is configured to work and, if not, which specific piece is missing. Checks resolve the provider and model, confirm the model list is reachable and that the selected model is one the endpoint actually serves, and for the agent modes check what each needs (in Claude mode, that the CLI answers `--version`; in ACP mode, that the adapter command and `npx` resolve) and whether credentials are present; a missing key is a warning rather than an error, because the Claude CLI and ACP agents can hold subscription logins NBI cannot see. Every warning or blocking row carries a remedy naming the next action. `GET /notebook-intelligence/readiness` runs the checks that bill nothing. An opt-in `POST` with `{"live": true}` sends one short real request, which is the only way to catch a gateway that returns 200s but buffers instead of streaming, or a proxy that strips the `tools` field so agent mode silently never calls a tool. It applies to the model-provider chat path and reports itself as not applicable in Claude and ACP modes, where the agent owns the model call. It is refused when `NBI_READINESS_LIVE_CHECK=off` (traitlet `readiness_live_check_allowed`) and returns 429 if one is already running. No model output is retained. See [Configuration readiness](docs/admin-guide.md#configuration-readiness).
+- **Opt-in performance diagnostics** (#408). A Performance tab that answers "where did this turn's time go," aimed at internal LLM gateways, network home directories, and TLS-intercepting proxies. Each chat turn records a phase timeline (rule and context preparation, agent connect and spawn, time to first token, streaming with stall events, tool calls, time spent waiting on the user) with a verdict naming the dominant phase. In Claude mode, turns also carry token counts and the SDK-reported API duration, and comparing active time against API time separates a slow gateway from a slow machine. An environment probe measures filesystem, subprocess, and optional network latency from the server's own vantage point. Off by default, and when off the cost is a single boolean check per instrumentation site. Attributes are redacted by default (paths hashed to basenames), turns are held in a capped ring buffer, and each turn is also summarized as one `perf turn ...` INFO line so headless installs get the same signal. `NBI_PERF_DIAGNOSTICS` locks the enabled state, `NBI_PERF_DIAGNOSTICS_POLICY` governs it fleet-wide, `NBI_PERF_PROBE_NETWORK=off` disables just the network check, and `NBI_PERF_LOG_DIR` redirects the optional JSONL log. See [`docs/performance-diagnostics.md`](docs/performance-diagnostics.md).
 - **Separate model for inline chat** (#413). New optional `claude_settings.inline_chat_model` picks the model used by the inline chat popover, falling back to `chat_model` when unset so existing configs behave exactly as before. Inline chat calls the Anthropic API directly while the other Claude modes go through the Claude Code CLI, and the two transports do not accept the same model-id grammar: a CLI-only id spelling reaches the raw API verbatim and is rejected. Exposed as a collapsible "Inline chat model" control nested under Claude → Chat model, and pinnable via `NBI_CLAUDE_INLINE_CHAT_MODEL`. `NBI_CLAUDE_CHAT_MODEL` keeps governing both surfaces as it does today (while it is set the inline key is ignored and its control is disabled), so an existing pin loses no coverage on upgrade; pin the inline var as well to give the two transports different models.
 
 ### Changed
@@ -36,6 +71,7 @@ For each release we list user-facing changes grouped as **Added**, **Changed**,
 - **AI-streamed code blocks no longer pick up trailing whitespace** (#384). The chat renderer ran a blanket `\n` to `  \n` string replace before markdown parsing, intended for user input but applied to every message, which injected two trailing spaces into every line of a streamed fenced code block and carried them into anything copy-pasted out. The pre-parse transform is gone; NBI now uses the `remark-breaks` plugin, which converts soft breaks to hard breaks at the AST level and is fence-aware, so prose still breaks on single newlines while code blocks are left alone in both directions.
 - **Inline-code styling no longer leaks into fenced code blocks** (#401). `react-markdown` 9 stopped setting the `inline` prop, so the chat renderer's `inline || !match` branch also caught fenced blocks with an unrecognized or missing language and gave them the inline-code pill background; the visible symptom reported was a first-line indent on highlighted blocks, which is that rule's `padding: 1px 4px` landing on a `<code>` it was never meant to reach. Inline and fenced content are now told apart by content shape (`remark-rehype` appends a trailing newline to fenced code and never to an inline span), and the CSS targets an explicit `.inline-code` class instead of `:not(pre) > code`, which had itself been broken by the `PreTag="div"` wrapper the syntax highlighter inserts.
 - **Korean and other IME composition needs only one Enter to submit** (#400). The chat input listened for `keydown` without checking composition state, so the Enter that commits an IME candidate also submitted the message, and users typing Hangul had to retype the last syllable. The handler now ignores Enter while a composition is in progress.
+- **Claude auto-complete no longer raises on every keystroke when the server has no Anthropic credential** (#425). Claude mode signs in through the Claude CLI, which accepts a subscription login, but inline completions call the Anthropic API directly and need a credential of their own. With none available the Anthropic SDK raised `TypeError: "Could not resolve authentication method"` while building each request, so every pause in typing produced a fresh traceback in the server log. NBI now checks whether the SDK resolved a credential before selecting the Claude auto-complete model, leaves the feature off when it did not, and logs one warning per server run naming the remedy. The check asks the SDK itself rather than inspecting an API key, so every credential that SDK accepts counts, which on current releases includes `ANTHROPIC_AUTH_TOKEN`, a profile, the workload-identity variables, and an `ANTHROPIC_CUSTOM_HEADERS` header; a blank value is treated as no credential, since the SDK would send an empty header and take a 401 per request. A credential-resolution error can no longer fail the whole capabilities response either. The readiness Status card's Anthropic credentials row now recognizes `ANTHROPIC_AUTH_TOKEN` as well, and names auto-complete alongside chat as something to check, without asserting that either is off: that row sees one settings field and two environment variables, while the SDK can authenticate from sources it cannot see.
 
 ## [5.3.1] - 2026-07-29
 
@@ -460,7 +496,13 @@ A multi-PR accessibility pass landed across most NBI surfaces. Together these ma
 - Settings UI restructured around Claude vs default mode.
 - WebSocket connection reliability improvements.
 
-[unreleased]: https://github.com/plmbr/notebook-intelligence/compare/v5.1.0...HEAD
+[unreleased]: https://github.com/plmbr/notebook-intelligence/compare/v6.0.0...HEAD
+[6.0.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.4.0...v6.0.0
+[5.4.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.3.1...v5.4.0
+[5.3.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.3.0...v5.3.1
+[5.3.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.2.1...v5.3.0
+[5.2.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.2.0...v5.2.1
+[5.2.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.1.0...v5.2.0
 [5.1.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.0.1...v5.1.0
 [5.0.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.0.0...v5.0.1
 [5.0.0]: https://github.com/plmbr/notebook-intelligence/compare/v4.8.0...v5.0.0

notebook_intelligence-6.0.0/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

{notebook_intelligence-5.4.0a3 → notebook_intelligence-6.0.0}/CONTRIBUTING.md

@@ -37,6 +37,9 @@ NBI has two halves:
   - `notebook_intelligence/rule_manager.py`, `rule_injector.py`, `ruleset.py` — ruleset discovery and prompt injection.
   - `notebook_intelligence/built_in_toolsets.py` — built-in tool implementations (`nbi-notebook-edit`, `nbi-command-execute`, etc.).
   - `notebook_intelligence/github_copilot.py` — GitHub Copilot device-flow auth and token storage.
+  - `notebook_intelligence/chatbook_kernel/` — the Chatbook kernel: `kernel.py` (the wrapper that proxies to a backend kernelspec), `codegen.py`, `execution.py` (execution modes), `danger.py` (the risk scan), and the shipped kernelspec.
+  - `notebook_intelligence/chatbook_generate.py` — the generate, summarize, and danger-scan endpoint behind Chatbook cells.
+  - `notebook_intelligence/acp_agent.py`, `acp_registry.py` — ACP agent mode: the protocol client, what NBI serves or refuses an agent, and adapter launch.
 - **Frontend extension** — TypeScript package `src/`. Compiled to a JupyterLab labextension. Key entry points:
   - `src/index.ts` — JupyterLab plugin registration.
   - `src/chat-sidebar.tsx` — chat sidebar React tree.
@@ -44,6 +47,7 @@ NBI has two halves:
   - `src/components/skills-panel.tsx` — Claude Skills management UI.
   - `src/api.ts` — high-level client for the server extension (chat WebSocket, capabilities, config).
   - `src/handler.ts` — thin wrapper over Jupyter's `ServerConnection.makeRequest`.
+  - `src/chatbook.ts`, `src/chatbook-core.ts` — Chatbook cell behavior: mode switching, the confirm bar, export, and the cell metadata format.
 
 The two halves communicate over the routes registered in `extension.py` (REST and WebSocket). All routes live under `/notebook-intelligence/`. See [`docs/admin-guide.md`](docs/admin-guide.md#http-api-surface) for the full list.
 
@@ -159,9 +163,10 @@ The `jupyter labextension develop` command leaves a symlink behind. Run `jupyter
 
 ## Running tests
 
-TypeScript unit tests:
+TypeScript type check and unit tests:
 
 ```bash
+jlpm tsc --noEmit
 jlpm test
 ```
 
@@ -172,7 +177,7 @@ pip install -e ".[test]"
 pytest tests/ -q
 ```
 
-CI runs both suites on every push, in that order. Every test is capped at 30 seconds by `pytest-timeout`, so a hung subprocess or pipe fails the run instead of stalling the job.
+CI runs both suites on every push, Python first, then TypeScript. Every test is capped at 30 seconds by `pytest-timeout`, so a hung subprocess or pipe fails the run instead of stalling the job.
 
 ## Linting
 
@@ -194,6 +199,8 @@ Both layers only run Prettier, which is safe to apply automatically; ESLint and
 
 If `jlpm install` produces unexpected lockfile changes, your local Yarn version probably differs from the one bundled with JupyterLab. `jlpm` ships with JupyterLab — use it directly instead of a system-wide `yarn`.
 
+If you work with a coding agent, [AGENTS.md](AGENTS.md) holds these `jlpm` and lockfile rules in a form agents pick up automatically.
+
 ## Packaging
 
 See [RELEASE.md](RELEASE.md).

{notebook_intelligence-5.4.0a3 → notebook_intelligence-6.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.5
+Metadata-Version: 2.4
 Name: notebook_intelligence
-Version: 5.4.0a3
+Version: 6.0.0
 Summary: AI coding assistant for JupyterLab
 Project-URL: Homepage, https://github.com/plmbr/notebook-intelligence
 Project-URL: Bug Tracker, https://github.com/plmbr/notebook-intelligence/issues
@@ -695,29 +695,31 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Requires-Dist: agent-client-protocol==0.10.1
-Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: aiohttp>=3.14.3
 Requires-Dist: anthropic>=0.22.1
 Requires-Dist: claude-agent-sdk
-Requires-Dist: cryptography>=48.0.1
+Requires-Dist: cryptography>=50.0.0
 Requires-Dist: fuzy-jon==0.1.0
-Requires-Dist: jupyter-server<3,>=2.20.0
-Requires-Dist: litellm>=1.83.7
+Requires-Dist: ipykernel>=6.0
+Requires-Dist: jupyter-server<3,>=2.21.0
+Requires-Dist: litellm>=1.84.0
 Requires-Dist: mcp<2,>=1.28.1
-Requires-Dist: mistune>=3.3.0
+Requires-Dist: mistune>=3.3.3
 Requires-Dist: ollama
 Requires-Dist: openai
 Requires-Dist: psutil>=5.7
 Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: python-multipart>=0.0.27
+Requires-Dist: python-dotenv>=1.2.2
+Requires-Dist: python-multipart>=0.0.31
 Requires-Dist: sseclient-py
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: tiktoken
-Requires-Dist: tornado>=6.5.7
+Requires-Dist: tornado>=6.5.10
 Requires-Dist: urllib3>=2.7.0
 Provides-Extra: test
 Requires-Dist: psutil; extra == 'test'
 Requires-Dist: pytest-timeout>=2.3.0; extra == 'test'
-Requires-Dist: pytest<9,>=7.0; extra == 'test'
+Requires-Dist: pytest<10,>=9.0.3; extra == 'test'
 Requires-Dist: pyyaml; extra == 'test'
 Description-Content-Type: text/markdown
 
@@ -735,6 +737,8 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 - [Feature highlights](#feature-highlights)
   - [Claude mode](#claude-mode)
   - [Agent mode](#agent-mode)
+  - [ACP agent mode](#acp-agent-mode)
+  - [Chatbook](#chatbook)
   - [Code generation with inline chat](#code-generation-with-inline-chat)
   - [Auto-complete](#auto-complete)
   - [Chat interface](#chat-interface)
@@ -764,7 +768,7 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 
 - Python 3.10+
 - JupyterLab 4.x
-- Node.js — only required for [Claude mode](#claude-mode) (the Claude Code CLI) and for MCP servers that launch via `npx`.
+- Node.js — required for [Claude mode](#claude-mode) (the Claude Code CLI), for [ACP agent mode](#acp-agent-mode), which launches its adapter with `npx` on every start, and for MCP servers that launch via `npx`.
 - A fresh virtualenv or conda env is recommended so NBI doesn't conflict with system Python.
 
 ## Quick start
@@ -873,6 +877,20 @@ In Agent mode, the built-in AI agent creates, edits, and executes notebooks for
 
 ![Agent mode](media/agent-mode.gif)
 
+### ACP agent mode
+
+An experimental second agent mode that drives an external coding agent over the [Agent Client Protocol](https://agentclientprotocol.com/), with OpenAI Codex as the only agent type today. The agent runs as a subprocess and does its own file and command work, asking for approval through NBI's confirmation cards; NBI deliberately does not lend it the Jupyter server's filesystem or terminal.
+
+It is off by default and the Settings tab stays hidden until an admin allows the mode, and it cannot be used at the same time as Claude mode. See [`docs/acp.md`](docs/acp.md).
+
+### Chatbook
+
+A Chatbook is a notebook whose cells can be written in English. Running a prompt cell generates code for the notebook's backend kernel and runs it; each cell carries a badge showing whether it is a prompt (**NL**) or ordinary code (**Cd**), and `Ctrl J` switches between them.
+
+What happens to generated code before it runs is yours to choose: **Always confirm** (the default) shows the code and waits, **Confirm if risky** waits only when a scan finds destructive calls, and **Auto-run** executes straight away. Admins can cap that choice fleet-wide, or turn Chatbook off entirely.
+
+Prompts can pull in context with `@` mentions, rules apply to generation the same way they apply to chat, the backend kernel need not be Python, and a Chatbook exports to a plain code notebook when you want to hand someone the result instead of the prompts. See [`docs/chatbook.md`](docs/chatbook.md).
+
 ### Code generation with inline chat
 
 Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the inline chat popover.
@@ -883,7 +901,7 @@ Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the in
 
 ### Auto-complete
 
-Auto-complete suggestions are shown as you type. `Tab` accepts. NBI provides auto-complete in code cells and Python file editors.
+Auto-complete suggestions are shown as you type. `Tab` accepts one while it is on screen, and indents otherwise. NBI provides auto-complete in code cells and Python file editors.
 
 <img src="media/inline-completion.gif" alt="Auto-complete" width=700 />
 
@@ -903,6 +921,8 @@ Right-click a cell output (or hover for the toolbar) to send it straight into th
 
 Each is per-user toggleable from Settings (saved as `enable_explain_error`, `enable_output_followup`, `enable_output_toolbar` in `config.json`, default on) and admin-lockable via `NBI_EXPLAIN_ERROR_POLICY` / `NBI_OUTPUT_FOLLOWUP_POLICY` / `NBI_OUTPUT_TOOLBAR_POLICY`.
 
+A revert is skipped while that document's kernel is busy, so a change landing mid-execution is applied when the cell finishes rather than swapped in under it, and the notice naming the reloaded file is shown only for the document you are looking at.
+
 ### Notebook toolbar generation
 
 Active notebooks show a sparkle icon on the toolbar. Click it to open a popover that scopes the generation request to that specific notebook — handy for multi-notebook sessions where you don't want the chat sidebar to compete for context.
@@ -937,26 +957,35 @@ Most settings panel toggles can be locked by org administrators. Two shapes:
 
 **Boolean policies** use the `*_POLICY` suffix and accept three values: `user-choice` (default — user toggles freely), `force-on` (locked enabled), `force-off` (locked disabled). When forced, the panel control is disabled with a "Locked by your administrator" tooltip and any client-side write is ignored.
 
-| Env var                                        | Locks the Settings panel control for                                                                                                                                                                                         |
-| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `NBI_EXPLAIN_ERROR_POLICY`                     | "Explain cell errors"                                                                                                                                                                                                        |
-| `NBI_OUTPUT_FOLLOWUP_POLICY`                   | "Ask about cell outputs"                                                                                                                                                                                                     |
-| `NBI_OUTPUT_TOOLBAR_POLICY`                    | "Show output toolbar"                                                                                                                                                                                                        |
-| `NBI_CLAUDE_MODE_POLICY`                       | "Enable Claude mode"                                                                                                                                                                                                         |
-| `NBI_ACP_MODE_POLICY`                          | "Enable ACP mode" (experimental agent mode over the Agent Client Protocol, with Codex as the first agent type; defaults to `force-off`, set `user-choice` to allow it)                                                       |
-| `NBI_ACP_FULL_ACCESS_POLICY`                   | "Full access" for the ACP agent: run tools without asking (defaults to `force-off`, so the agent asks before anything beyond trusted read-only commands; `user-choice` lets users opt into unattended runs)                  |
-| `NBI_CLAUDE_CONTINUE_CONVERSATION_POLICY`      | "Remember conversation history"                                                                                                                                                                                              |
-| `NBI_CLAUDE_CODE_TOOLS_POLICY`                 | "Claude Code tools"                                                                                                                                                                                                          |
-| `NBI_CLAUDE_JUPYTER_UI_TOOLS_POLICY`           | "Jupyter UI tools"                                                                                                                                                                                                           |
-| `NBI_CLAUDE_SETTING_SOURCE_USER_POLICY`        | Setting source: User                                                                                                                                                                                                         |
-| `NBI_CLAUDE_SETTING_SOURCE_PROJECT_POLICY`     | Setting source: Project                                                                                                                                                                                                      |
-| `NBI_STORE_GITHUB_ACCESS_TOKEN_POLICY`         | "Remember my GitHub Copilot access token"                                                                                                                                                                                    |
-| `NBI_SKILLS_MANAGEMENT_POLICY`                 | The Skills tab (force-off hides it and 403s the API; also disables the managed-skills reconciler)                                                                                                                            |
-| `NBI_CLAUDE_MCP_MANAGEMENT_POLICY`             | The Claude-mode MCP Servers tab (force-off hides it and 403s `/claude-mcp/*`; independent of the non-Claude MCP Servers tab)                                                                                                 |
-| `NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY`         | The Claude-mode Plugins tab (force-off hides it and 403s `/plugins/*`)                                                                                                                                                       |
-| `NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY`         | "Bypass Permissions" in the Claude permission-mode selector (defaults to `force-off`, as do `NBI_ACP_MODE_POLICY` and `NBI_ACP_FULL_ACCESS_POLICY`; `user-choice` exposes the option, which the user still arms per session) |
-| `NBI_TERMINAL_DRAG_DROP_POLICY`                | Terminal drag-drop file attach feature                                                                                                                                                                                       |
-| `NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY` | "Refresh open files when changed on disk"                                                                                                                                                                                    |
+| Env var                                        | Locks the Settings panel control for                                                                                                                                                                                                                                                                                                     |
+| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `NBI_EXPLAIN_ERROR_POLICY`                     | "Explain cell errors"                                                                                                                                                                                                                                                                                                                    |
+| `NBI_OUTPUT_FOLLOWUP_POLICY`                   | "Ask about cell outputs"                                                                                                                                                                                                                                                                                                                 |
+| `NBI_OUTPUT_TOOLBAR_POLICY`                    | "Show output toolbar"                                                                                                                                                                                                                                                                                                                    |
+| `NBI_CLAUDE_MODE_POLICY`                       | "Enable Claude mode"                                                                                                                                                                                                                                                                                                                     |
+| `NBI_ACP_MODE_POLICY`                          | "Enable ACP mode" (experimental agent mode over the Agent Client Protocol, with Codex as the first agent type; defaults to `force-off`, set `user-choice` to allow it)                                                                                                                                                                   |
+| `NBI_ACP_FULL_ACCESS_POLICY`                   | "Full access" for the ACP agent: edit workspace files and run commands without asking, inside Codex's workspace-write sandbox with network access off unless Codex's config enables it (defaults to `force-off`, so the agent asks before anything beyond trusted read-only commands; `user-choice` lets users opt into unattended runs) |
+| `NBI_CLAUDE_CONTINUE_CONVERSATION_POLICY`      | "Remember conversation history"                                                                                                                                                                                                                                                                                                          |
+| `NBI_CLAUDE_CODE_TOOLS_POLICY`                 | "Claude Code tools"                                                                                                                                                                                                                                                                                                                      |
+| `NBI_CLAUDE_JUPYTER_UI_TOOLS_POLICY`           | "Jupyter UI tools"                                                                                                                                                                                                                                                                                                                       |
+| `NBI_CLAUDE_SETTING_SOURCE_USER_POLICY`        | Setting source: User                                                                                                                                                                                                                                                                                                                     |
+| `NBI_CLAUDE_SETTING_SOURCE_PROJECT_POLICY`     | Setting source: Project                                                                                                                                                                                                                                                                                                                  |
+| `NBI_STORE_GITHUB_ACCESS_TOKEN_POLICY`         | "Remember my GitHub Copilot access token"                                                                                                                                                                                                                                                                                                |
+| `NBI_SKILLS_MANAGEMENT_POLICY`                 | The Skills tab (force-off hides it and 403s the API; also disables the managed-skills reconciler)                                                                                                                                                                                                                                        |
+| `NBI_CLAUDE_MCP_MANAGEMENT_POLICY`             | The Claude-mode MCP Servers tab (force-off hides it and 403s `/claude-mcp/*`; independent of the non-Claude MCP Servers tab)                                                                                                                                                                                                             |
+| `NBI_CLAUDE_PLUGINS_MANAGEMENT_POLICY`         | The Claude-mode Plugins tab (force-off hides it and 403s `/plugins/*`)                                                                                                                                                                                                                                                                   |
+| `NBI_CLAUDE_BYPASS_PERMISSIONS_POLICY`         | "Bypass Permissions" in the Claude permission-mode selector (defaults to `force-off`, as do `NBI_ACP_MODE_POLICY` and `NBI_ACP_FULL_ACCESS_POLICY`; `user-choice` exposes the option, which the user still arms per session)                                                                                                             |
+| `NBI_TERMINAL_DRAG_DROP_POLICY`                | Terminal drag-drop file attach feature                                                                                                                                                                                                                                                                                                   |
+| `NBI_REFRESH_OPEN_FILES_ON_DISK_CHANGE_POLICY` | "Refresh open files when changed on disk"                                                                                                                                                                                                                                                                                                |
+| `NBI_CHATBOOK_POLICY`                          | Chatbook natural-language notebook cells (force-off hides the kernel, launcher tile, Settings tab, and commands, and 403s the generate and mention APIs)                                                                                                                                                                                 |
+
+Chatbook NL execution is capped separately (not a boolean policy):
+
+| Env var / traitlet                | Effect                                                                                                                                     |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `NBI_CHATBOOK_MAX_EXECUTION_MODE` | Users cannot choose a more permissive Chatbook mode than this. Values: `always-confirm`, `confirm-if-risky`, `auto-run` (default, no cap). |
+
+The matching traitlets are `c.NotebookIntelligence.chatbook_policy` and `c.NotebookIntelligence.chatbook_max_execution_mode`. See [`docs/chatbook.md`](docs/chatbook.md).
 
 The first three also have matching traitlets on `NotebookIntelligence` (`explain_error_policy`, `output_followup_policy`, `output_toolbar_policy`); add the others as needed in the same shape:
 
@@ -988,7 +1017,7 @@ Per-user preferences (default on for the cell-output features) live in `config.j
 
 Inline chat calls the Anthropic API directly while the other Claude modes go through the Claude Code CLI, so a deployment can need a different model id for each. It uses `inline_chat_model`, falling back to `chat_model` when that is unset. `NBI_CLAUDE_CHAT_MODEL` therefore governs both surfaces: while it is set, a stored `inline_chat_model` is ignored and its control is disabled. Set `NBI_CLAUDE_INLINE_CHAT_MODEL` as well to pin inline chat to a different model — it takes precedence and re-enables nothing, so both surfaces stay administrator-controlled.
 
-`NBI_ACP_AGENT_COMMAND` (not a settings lock) overrides the adapter command NBI launches for the selected ACP agent type; the value is shell-split. Leave it unset to use the agent's registered default command.
+`NBI_ACP_AGENT_COMMAND` (not a settings lock) overrides the adapter command NBI launches for the selected ACP agent type; the value is shell-split. For Codex, NBI appends its `-c` approval and sandbox options to that command, so a replacement must pass them through to codex-acp. Leave it unset to use the agent's registered default command.
 
 Provider IDs: `github-copilot`, `openai-compatible`, `litellm-compatible`, `ollama`, `none`. The `*_MODEL_ID` value is whatever the chosen provider exposes (e.g. `gpt-4o`, `llama3:latest`). Claude model IDs are the literal IDs from the Anthropic API (e.g. `claude-opus-4-7`, `claude-sonnet-4-6`); empty string = "Default (recommended)"; `NBI_CLAUDE_INLINE_COMPLETION_MODEL` also accepts `none` (no inline completion in Claude mode) or `inherit` (use the General-tab Auto-complete model).
 
@@ -1103,7 +1132,7 @@ To temporarily disable a configured server without removing it, set `"disabled":
 
 ## Rulesets
 
-NBI's ruleset system lets you define guidelines and best practices that get injected into AI prompts automatically — for consistent coding standards, project conventions, or domain knowledge. Rules are markdown files in `~/.jupyter/nbi/rules/` and can scope by file pattern, kernel, directory, or chat mode.
+NBI's ruleset system lets you define guidelines and best practices that get injected into AI prompts automatically — for consistent coding standards, project conventions, or domain knowledge. Rules are markdown files in `~/.jupyter/nbi/rules/` and can scope by file pattern, kernel, directory, or mode (`ask`, `agent`, `inline-chat`, `chatbook`).
 
 A two-line example:
 
@@ -1200,6 +1229,9 @@ Full guide, including the span and event reference, the probe thresholds, worked
 - [`docs/admin-guide.md`](docs/admin-guide.md) — deployment, env vars, security model, air-gap, multi-tenancy.
 - [`docs/skills.md`](docs/skills.md) — Claude Skills management and the org-manifest reconciler.
 - [`docs/rulesets.md`](docs/rulesets.md) — ruleset frontmatter and discovery.
+- [`docs/acp.md`](docs/acp.md) — using the experimental ACP agent mode, and its limits.
+- [`docs/chatbook.md`](docs/chatbook.md) — writing Chatbook cells, execution modes, export, and why there is no per-cell sandbox.
+- [`docs/chatbook-extensions.md`](docs/chatbook-extensions.md) — dynamic Chatbook context and mention providers.
 - [`docs/troubleshooting.md`](docs/troubleshooting.md) — common problems with copy-pasteable fixes.
 - [`docs/performance-diagnostics.md`](docs/performance-diagnostics.md): turn timelines, the environment probe, and how to read both.
 - [`PRIVACY.md`](PRIVACY.md) — what NBI sends to which provider, and the egress allowlist.
@@ -1216,7 +1248,7 @@ Full guide, including the span and event reference, the probe thresholds, worked
 
 ## Roadmap
 
-NBI 5.x is stable. New features land in minor releases (5.1, 5.2, …); breaking changes are reserved for the next major (6.x) and will be announced in the [changelog](CHANGELOG.md). Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
+NBI 6.x is the current line. New features land in minor releases (6.1, 6.2, …); breaking changes are reserved for a major release and announced in the [changelog](CHANGELOG.md). 6.0 itself is not a breaking release: it marks Chatbook's arrival, and no traitlet, env var, REST route, or on-disk format was renamed or removed, so upgrading from 5.x needs no migration. Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
 
 ## License
 

{notebook_intelligence-5.4.0a3 → notebook_intelligence-6.0.0}/PRIVACY.md

@@ -6,14 +6,15 @@ This page documents what NBI sends to external services, when, and how administr
 
 The table below describes what each LLM provider receives **when you actively use a feature** (chat message, inline completion, agent action). An idle JupyterLab does not contact the provider.
 
-| Provider                          | What is sent                                                                                            | When                                                 | Destination                                                                           |
-| --------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| **GitHub Copilot**                | Prompt, surrounding cell source, attached files (when you click _attach_)                               | Per request (chat) and as you type (inline complete) | `api.githubcopilot.com`, `api.github.com` (auth)                                      |
-| **OpenAI-compatible**             | Prompt, surrounding cell source, attached files                                                         | Per request and per inline-completion request        | The Base URL you configured (`api.openai.com` by default)                             |
-| **LiteLLM-compatible**            | Same as OpenAI-compatible; the LiteLLM proxy forwards to the upstream model you configured              | Per request                                          | The Base URL of your LiteLLM proxy                                                    |
-| **Ollama (local)**                | Prompt, surrounding cell source, attached files                                                         | Per request                                          | Localhost (or the host you configured); **no external network**                       |
-| **Anthropic API** (Claude mode)   | Prompt, surrounding cell source, attached files                                                         | Per inline-chat or auto-complete request             | `api.anthropic.com` (or your configured Base URL)                                     |
-| **Claude Code CLI** (Claude mode) | Prompt, working-directory file reads requested by Claude, shell-command output for tools Claude invokes | Per agent turn in the chat panel                     | Whatever the Claude Code CLI is configured to talk to (typically `api.anthropic.com`) |
+| Provider                          | What is sent                                                                                                     | When                                                          | Destination                                                                                                                               |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| **GitHub Copilot**                | Prompt, surrounding cell source, attached files (when you click _attach_)                                        | Per request (chat) and as you type (inline complete)          | `api.githubcopilot.com`, `api.github.com` (auth)                                                                                          |
+| **OpenAI-compatible**             | Prompt, surrounding cell source, attached files                                                                  | Per request and per inline-completion request                 | The Base URL you configured (`api.openai.com` by default)                                                                                 |
+| **LiteLLM-compatible**            | Same as OpenAI-compatible; the LiteLLM proxy forwards to the upstream model you configured                       | Per request                                                   | The Base URL of your LiteLLM proxy                                                                                                        |
+| **Ollama (local)**                | Prompt, surrounding cell source, attached files                                                                  | Per request                                                   | Localhost (or the host you configured); **no external network**                                                                           |
+| **Anthropic API** (Claude mode)   | Prompt, surrounding cell source, attached files                                                                  | Per inline-chat or auto-complete request                      | `api.anthropic.com` (or your configured Base URL)                                                                                         |
+| **Claude Code CLI** (Claude mode) | Prompt, working-directory file reads requested by Claude, shell-command output for tools Claude invokes          | Per agent turn in the chat panel                              | Whatever the Claude Code CLI is configured to talk to (typically `api.anthropic.com`)                                                     |
+| **ACP agent** (ACP mode)          | Prompt and NBI's notebook context, plus whatever files the agent reads and command output it collects on its own | Per agent turn in the chat panel, and per Chatbook generation | Whatever the agent is configured to talk to (`api.openai.com` or your Base URL on the API-key path, or the agent's own signed-in backend) |
 
 ### Cell outputs are included when the cell is attached
 
@@ -28,19 +29,19 @@ If your cells contain sensitive outputs (PHI, PII, secrets), clear them before i
 
 Hosts NBI may contact, depending on which features are enabled:
 
-| Host                                            | Purpose                                                                                                          |
-| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `api.githubcopilot.com`                         | GitHub Copilot chat and inline completion                                                                        |
-| `api.github.com`                                | GitHub Copilot device-flow login; managed-skills manifest fetches when hosted on github.com; skill imports       |
-| `github.com`, `codeload.github.com`             | Skill tarball downloads (Import from GitHub and the managed-skills reconciler)                                   |
-| `raw.githubusercontent.com`                     | Manifest fetches when `NBI_SKILLS_MANIFEST` points at a `raw.githubusercontent.com` URL                          |
-| `api.anthropic.com`                             | Anthropic API for Claude-mode inline chat and auto-complete; also the default destination of the Claude Code CLI |
-| `api.openai.com`                                | OpenAI-compatible provider (default Base URL)                                                                    |
-| Your configured Base URL                        | OpenAI-compatible, LiteLLM-compatible, or Claude when pointed at a self-hosted endpoint                          |
-| `localhost:11434` (or your Ollama host)         | Ollama local model serving                                                                                       |
-| `registry.npmjs.org` and configured npm mirrors | Only if MCP servers are configured to launch via `npx -y` — `npx` fetches the package on first run               |
+| Host                                            | Purpose                                                                                                                                                                 |
+| ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `api.githubcopilot.com`                         | GitHub Copilot chat and inline completion                                                                                                                               |
+| `api.github.com`                                | GitHub Copilot device-flow login; managed-skills manifest fetches when hosted on github.com; skill imports                                                              |
+| `github.com`, `codeload.github.com`             | Skill tarball downloads (Import from GitHub and the managed-skills reconciler)                                                                                          |
+| `raw.githubusercontent.com`                     | Manifest fetches when `NBI_SKILLS_MANIFEST` points at a `raw.githubusercontent.com` URL                                                                                 |
+| `api.anthropic.com`                             | Anthropic API for Claude-mode inline chat and auto-complete; also the default destination of the Claude Code CLI                                                        |
+| `api.openai.com`                                | OpenAI-compatible provider (default Base URL)                                                                                                                           |
+| Your configured Base URL                        | OpenAI-compatible, LiteLLM-compatible, or Claude when pointed at a self-hosted endpoint                                                                                 |
+| `localhost:11434` (or your Ollama host)         | Ollama local model serving                                                                                                                                              |
+| `registry.npmjs.org` and configured npm mirrors | MCP servers configured to launch via `npx -y`, and ACP mode, which launches its adapter with `npx` on every agent start unless `NBI_ACP_AGENT_COMMAND` points elsewhere |
 
-For the configurable destinations above (Base URLs, Ollama host, MCP `npx` packages), the destination is whatever you or your admin set. There is no other implicit network activity.
+For the configurable destinations above (Base URLs, Ollama host, MCP `npx` packages), the destination is whatever you or your admin set. NBI itself starts no other network activity. In ACP mode the agent subprocess makes its own calls, which NBI neither proxies nor enumerates: the destinations there are the agent's to document, and blocking egress at the network layer is the only way to bound them from outside.
 
 For air-gapped or egress-restricted environments, see [`docs/admin-guide.md`](docs/admin-guide.md#air-gap-deployment).
 
@@ -55,6 +56,7 @@ For air-gapped or egress-restricted environments, see [`docs/admin-guide.md`](do
 | `~/.claude/skills/`             | User-scope Claude skills                                                   |
 | `<project>/.claude/skills/`     | Project-scope Claude skills                                                |
 | `~/.claude/projects/`           | Claude Code session transcripts (managed by Claude CLI, not NBI)           |
+| `~/.jupyter/nbi/codex-home/`    | ACP agent configuration and session files, when an API key is configured   |
 
 > Treat `~/.jupyter/nbi/config.json` and `~/.jupyter/nbi/user-data.json` as secrets. They contain your API keys and (encrypted) GitHub token. Do not commit them to git, share them, or sync them across users. If a key leaks, rotate it at the provider immediately.
 
@@ -74,7 +76,7 @@ LLM outputs are non-deterministic. Pinning the model name, temperature, and seed
 
 For HIPAA, FedRAMP, classroom, or otherwise restricted environments:
 
-- **Force local-only models.** Disable every cloud provider via `disabled_providers` and use Ollama. See the [HIPAA / sensitive-data preset](docs/admin-guide.md#hipaa--sensitive-data-preset) in the admin guide.
+- **Force local-only models.** Disable every cloud provider via `disabled_providers`, force both agent modes off with `claude_mode_policy` and `acp_mode_policy`, and use Ollama. Disabling providers is not sufficient on its own: neither agent mode is a provider, and Claude mode is available to users unless an admin turns it off. See the [HIPAA / sensitive-data preset](docs/admin-guide.md#hipaa--sensitive-data-preset) in the admin guide.
 - **Restrict skill imports.** Block egress to `github.com` and serve managed skills from an internal manifest URL.
 - **Disable "remember GitHub Copilot login"** for shared systems where users share home directories.
 - **Pre-pull MCP servers** rather than allowing `npx -y` (which downloads from npmjs).