notebook-intelligence 6.0.0a2__tar.gz → 6.1.0__tar.gz

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/CHANGELOG.md

@@ -8,13 +8,42 @@ For each release we list user-facing changes grouped as **Added**, **Changed**,
 
 <!-- <START NEW CHANGELOG ENTRY> -->
 
-## [5.4.1] - unreleased
+## [6.0.0] - unreleased
 
-### Fixed
+6.0.0 adds Chatbook, a notebook whose cells can be written in English and executed as generated code, together with its admin policy, its own kernel, and the context, mention, and ruleset plumbing around it. The rest of the release is hardening: the experimental ACP agent mode gets a tighter sandbox and better approval cards, and a long tail of chat, settings, MCP, and readiness fixes. The major version marks Chatbook's arrival rather than a compatibility break: no traitlet, env var, REST route, command id, or on-disk format was renamed or removed, `requires-python` is unchanged at `>=3.10`, and the supported JupyterLab range widened rather than narrowed. Upgrading needs no migration.
+
+### Added
+
+- **Chatbook: notebooks whose cells are written in English** (#406, #448, #480). A Chatbook is an ordinary `.ipynb` opened against a new `chatbook` kernel, in which each cell is either a natural-language prompt (**NL**) or ordinary code (**Cd**). Running an NL cell generates code for the notebook's backend kernel and runs it; the cell badge is a button and `Ctrl J` / `Ctrl Shift J` switch the active cell or every cell between the two modes. Generated code is governed by an execution mode: `always-confirm` (the default) shows the code and waits, `confirm-if-risky` waits only when a scan finds destructive filesystem, shell, or process calls, and `auto-run` executes without asking. `NBI_CHATBOOK_POLICY` gates the whole feature the way every other admin policy does, and `NBI_CHATBOOK_MAX_EXECUTION_MODE` caps how permissive a user may be, so a tenant can pin `always-confirm` and remove the rest from the dropdown. The backend kernel is resolved from the notebook rather than assumed, so Chatbook is not Python-only, and rules under `modes/chatbook/` apply to generation. Cells can pull context with `@` mentions, served by built-in providers and by any that an extension registers (see [`docs/chatbook-extensions.md`](docs/chatbook-extensions.md)); a Chatbook can be exported to a plain code notebook for the backend language. Running a **Cd** cell also asks the model for an English description of that code, stored in cell metadata, so a hand-written cell can be read as prose later. Chatbook ships a kernelspec and one new route, `POST /notebook-intelligence/chatbook/generate`; `ipykernel` is now a runtime dependency. See [`docs/chatbook.md`](docs/chatbook.md).
+- **The MCP handshake is bounded** (#456). A `mcp.json` entry pointing at a command that is not an MCP server never answered the protocol handshake, and the connect attempt could occupy the backend indefinitely. Connect and disconnect now run under deadlines, `NBI_MCP_CONNECT_TIMEOUT` (60 seconds by default) and `NBI_MCP_DISCONNECT_TIMEOUT`, after which the server is marked failed and the log says the command may not be an MCP server. A command that writes non-JSON output in a loop would otherwise fill the log with one parse error per line, so those records are capped and the number withheld is reported with the failure.
 
-- **Saving Claude settings keeps keys the tab does not show.** The Claude settings tab saves the keys it renders when it opens, and the server stored that object in place of the old one. Any other `claude_settings` key was erased, including `jupyter_ui_tools_external` (#398), which is set by hand in `config.json`. `POST /notebook-intelligence/config` now merges a posted `claude_settings` onto the stored value. Settings saves also re-read `config.json` first, so a hand edit made while JupyterLab runs is no longer overwritten when a settings tab next saves.
+### Changed
+
+- **Tab accepts an inline suggestion only when one is on screen** (#444). The accept binding was scoped to `.jp-mod-completer-enabled`, which is set whenever the completer is active, so Tab could be swallowed in an edit-mode cell with nothing to accept instead of indenting. It is now scoped to `.jp-mod-inline-completer-active`. Inline completion responses are also identified per request, so a reply that arrives after its request was superseded is discarded rather than accepted.
+- **Ollama's chat-model list is fetched lazily and bounded** (#427). Enumerating models ran at startup and waited on the Ollama host, so a configured but unreachable host delayed the extension. The enumeration is deferred and time-bounded, and a failure logs a warning instead of holding up load.
+- **A disabled provider no longer advertises its models** (#431). `disabled_providers` removed a provider from the picker but the capabilities response still carried its model list, so a disabled provider's models remained selectable through a stale or hand-edited config.
+- **Dependency floors and build pins** (#422, #445). `@jupyterlab/launcher` widened from `~4.2.0` to `^4.0.0`, which stops JupyterLab 4.6 flagging the dependency. `fast-uri` and `js-yaml` resolutions were raised past HIGH-severity advisories. The build pins `hatchling<1.32`: 1.32 made `BuildHookInterface` generic over two type parameters, and `hatch-jupyter-builder` subclasses it with one, so sdist and wheel builds failed with `TypeError: Too few arguments`. A later audit (#492) raised six Python floors that still named a release carrying a published advisory (`jupyter_server` to 2.21.0, `cryptography` to 50.0.0, `litellm` to 1.84.0, `mistune` to 3.3.3, `python-multipart` to 0.0.31, `aiohttp` to 3.14.3), added the `python-dotenv>=1.2.2` floor that litellm's old `==1.0.1` hard pin had blocked, moved the `pytest` test extra to `>=9.0.3`, and added npm resolutions for `browserslist`, `baseline-browser-mapping`, `colord`, and `postcss-selector-parser`. Those four are build and lint tooling and do not reach the shipped bundle.
+
+### Fixed
 
-## [5.4.0] - unreleased
+- **A forged approval prompt can no longer impersonate the real one** (#415). Command text rendered into a Claude Bash approval card could close the displayed block and add its own trailing content, so what the card showed and what would run could differ. Command text is now fenced with a collision-resistant delimiter and bidirectional control characters are rejected. ACP approval cards apply the same policy.
+- **Backend-requested UI commands are gated behind an allowlist** (#443). The response stream could ask the frontend to execute a JupyterLab command by id, with no restriction on which. Requests are now checked against an allowlist at a single chokepoint. `run-command-in-terminal` remains allowlisted, so shell reachability is unchanged; the change removes the ability to reach arbitrary commands.
+- **ACP agents are no longer served the client's filesystem or terminal** (#418, #419, #423, #424). NBI refused some agent requests and honored others, which let an agent borrow the Jupyter server process's reach. Filesystem reads and writes, terminal methods, and agent extension requests are now refused at the router, so the agent does its own I/O under its own sandbox. Full access, when an admin allows it, grants workspace writes rather than unrestricted access. Approval cards show the command and the reason the agent gave, rendered as separate labeled blocks so a long detail cannot hide the command. An NBI-supplied API key no longer spreads through Codex's own configuration, and the cleanup of previously written credentials states its limits rather than implying it is complete.
+- **The ACP session picker shows something useful** (#421). Session titles were cut inside a context pointer, and previews carried pointer segments that meant nothing to a reader; titles are now cut on a boundary and pointer segments are stripped. Session files are named relative to the open directory.
+- **Saving Claude settings keeps keys the tab does not show** (#420). The Claude settings tab saves the keys it renders when it opens, and the server stored that object in place of the old one. Any other `claude_settings` key was erased, including `jupyter_ui_tools_external` (#398), which is set by hand in `config.json`. `POST /notebook-intelligence/config` now merges a posted `claude_settings` onto the stored value. Settings saves also re-read `config.json` first, so a hand edit made while JupyterLab runs is no longer overwritten when a settings tab next saves. Settings changes are judged against the running state rather than the state the tab opened with.
+- **Readiness reports a blank required model instead of answering Ready** (#459). An OpenAI-compatible or LiteLLM-compatible provider with the **Model** field left empty persisted as an empty string. Readiness answered "Ready. Nothing needs configuring" while every chat turn went out with no model name and failed. A blank required property is now a blocking row naming the field, and the settings form marks it once touched.
+- **The performance report names the provider that served a turn** (#461). Turns were labeled from the resolved model, which reported `copilot` for every Claude-mode turn and mislabeled a Copilot user pinned outside the fallback list. The label now comes from the configured provider, and a malformed config no longer raises on the chat path.
+- **A stopped response says so in the transcript** (#474, #477, #478, #479). Stopping a response left the bubble exactly as it was, indistinguishable from a model that returned nothing. The turn is now marked, and the marker survives both later deltas and a second turn streaming alongside it. Stop also reaches every turn that is running, not only the one the sidebar input started, so a response begun from an editor command can be stopped; and the openai-compatible, LiteLLM-compatible, and Ollama chat models now read the cancel token and close the stream, so a stopped turn stops generating at the provider instead of running to completion.
+- **Concurrent turns no longer erase each other from the transcript** (#478). A streaming turn rewrote the whole transcript from a snapshot taken when it started, so a turn begun from an editor command while a sidebar response streamed removed that response and its prompt. Each turn now updates only its own message, and a response is placed next to the prompt it answers.
+- **Enter sends a message that starts with an unmatched `@` or `/`** (#464). Typing a prefix that matched no completion left the suggestion popover open with nothing selected, and Enter raised rather than sending; the message could not be sent at all without editing it.
+- **The MCP config editor reports a JSON syntax error** (#470) and **no longer deletes a temp file it has not created** (#460). Saving malformed JSON parsed the document outside the error handling, so the edit was dropped with no message anywhere but the devtools console while the tab looked saved. Opening the editor also deleted its temp file first, which answered 404 on every open because the file is normally absent.
+- **A malformed `mcp.json` no longer takes down MCP support** (#433). A bad `mcpServers` or `participants` section raised during parsing; the malformed section is now skipped with a log line and the rest of the file is honored.
+- **`NBI_ENABLED_PROVIDERS` is parsed as a CSV list** (#435). It was read as a single value, so an admin re-enabling more than one provider re-enabled none of them.
+- **Open files are reverted more carefully** (#429). A file changed on disk was reverted even while its kernel was running, which could swap the source out from under an executing cell; the revert is now skipped while the kernel is busy and announced when it happens. The reload notice is scoped to the visible document instead of firing for background files.
+- **Chatbook fixes** (#457, #458). The mention menu could outlive the cell that opened it and reappear over an unrelated cell. Cells whose generated code never ran no longer take an execution number, so a cell waiting on the confirm bar does not look like it executed.
+- **Settings panel layout and labels** (#462, #471, #472). The content pane collapsed to nothing in a narrow window while the tab column kept its full width. Buttons pairing an icon with a label rendered the label outside the button, where it painted over the panel background and became invisible. Decorative tab icons are hidden from the accessibility tree.
+
+## [5.4.0] - 2026-09-01
 
 5.4.0 adds a second agent mode (ACP, with Codex as the first agent type) alongside Claude mode, a way to serve NBI's Jupyter-UI tools to an agent running outside the Lab page, and two diagnostic surfaces for deployments where something is misconfigured or slow: a configuration readiness preflight that names the missing piece, and opt-in performance diagnostics with per-turn timelines. ACP mode, performance diagnostics, and the tool proxy are opt-in and default to off; the readiness preflight's non-billing checks run when Settings opens, and its live endpoint test is opt-in. No traitlet, env-var, REST route, or on-disk-format renames or removals.
 
@@ -467,7 +496,13 @@ A multi-PR accessibility pass landed across most NBI surfaces. Together these ma
 - Settings UI restructured around Claude vs default mode.
 - WebSocket connection reliability improvements.
 
-[unreleased]: https://github.com/plmbr/notebook-intelligence/compare/v5.1.0...HEAD
+[unreleased]: https://github.com/plmbr/notebook-intelligence/compare/v6.0.0...HEAD
+[6.0.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.4.0...v6.0.0
+[5.4.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.3.1...v5.4.0
+[5.3.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.3.0...v5.3.1
+[5.3.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.2.1...v5.3.0
+[5.2.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.2.0...v5.2.1
+[5.2.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.1.0...v5.2.0
 [5.1.0]: https://github.com/plmbr/notebook-intelligence/compare/v5.0.1...v5.1.0
 [5.0.1]: https://github.com/plmbr/notebook-intelligence/compare/v5.0.0...v5.0.1
 [5.0.0]: https://github.com/plmbr/notebook-intelligence/compare/v4.8.0...v5.0.0

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/CONTRIBUTING.md

@@ -37,6 +37,9 @@ NBI has two halves:
   - `notebook_intelligence/rule_manager.py`, `rule_injector.py`, `ruleset.py` — ruleset discovery and prompt injection.
   - `notebook_intelligence/built_in_toolsets.py` — built-in tool implementations (`nbi-notebook-edit`, `nbi-command-execute`, etc.).
   - `notebook_intelligence/github_copilot.py` — GitHub Copilot device-flow auth and token storage.
+  - `notebook_intelligence/chatbook_kernel/` — the Chatbook kernel: `kernel.py` (the wrapper that proxies to a backend kernelspec), `codegen.py`, `execution.py` (execution modes), `danger.py` (the risk scan), and the shipped kernelspec.
+  - `notebook_intelligence/chatbook_generate.py` — the generate, summarize, and danger-scan endpoint behind Chatbook cells.
+  - `notebook_intelligence/acp_agent.py`, `acp_registry.py` — ACP agent mode: the protocol client, what NBI serves or refuses an agent, and adapter launch.
 - **Frontend extension** — TypeScript package `src/`. Compiled to a JupyterLab labextension. Key entry points:
   - `src/index.ts` — JupyterLab plugin registration.
   - `src/chat-sidebar.tsx` — chat sidebar React tree.
@@ -44,6 +47,7 @@ NBI has two halves:
   - `src/components/skills-panel.tsx` — Claude Skills management UI.
   - `src/api.ts` — high-level client for the server extension (chat WebSocket, capabilities, config).
   - `src/handler.ts` — thin wrapper over Jupyter's `ServerConnection.makeRequest`.
+  - `src/chatbook.ts`, `src/chatbook-core.ts` — Chatbook cell behavior: mode switching, the confirm bar, export, and the cell metadata format.
 
 The two halves communicate over the routes registered in `extension.py` (REST and WebSocket). All routes live under `/notebook-intelligence/`. See [`docs/admin-guide.md`](docs/admin-guide.md#http-api-surface) for the full list.
 
@@ -159,9 +163,10 @@ The `jupyter labextension develop` command leaves a symlink behind. Run `jupyter
 
 ## Running tests
 
-TypeScript unit tests:
+TypeScript type check and unit tests:
 
 ```bash
+jlpm tsc --noEmit
 jlpm test
 ```
 
@@ -172,7 +177,7 @@ pip install -e ".[test]"
 pytest tests/ -q
 ```
 
-CI runs both suites on every push, in that order. Every test is capped at 30 seconds by `pytest-timeout`, so a hung subprocess or pipe fails the run instead of stalling the job.
+CI runs both suites on every push, Python first, then TypeScript. Every test is capped at 30 seconds by `pytest-timeout`, so a hung subprocess or pipe fails the run instead of stalling the job.
 
 ## Linting
 

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: notebook_intelligence
-Version: 6.0.0a2
+Version: 6.1.0
 Summary: AI coding assistant for JupyterLab
 Project-URL: Homepage, https://github.com/plmbr/notebook-intelligence
 Project-URL: Bug Tracker, https://github.com/plmbr/notebook-intelligence/issues
@@ -694,22 +694,23 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
-Requires-Dist: agent-client-protocol==0.10.1
-Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: agent-client-protocol<1,>=0.11.0
+Requires-Dist: aiohttp>=3.14.3
 Requires-Dist: anthropic>=0.22.1
 Requires-Dist: claude-agent-sdk
-Requires-Dist: cryptography>=48.0.1
+Requires-Dist: cryptography>=50.0.0
 Requires-Dist: fuzy-jon==0.1.0
 Requires-Dist: ipykernel>=6.0
-Requires-Dist: jupyter-server<3,>=2.20.0
-Requires-Dist: litellm>=1.83.7
+Requires-Dist: jupyter-server<3,>=2.21.0
+Requires-Dist: litellm>=1.84.0
 Requires-Dist: mcp<2,>=1.28.1
-Requires-Dist: mistune>=3.3.0
+Requires-Dist: mistune>=3.3.3
 Requires-Dist: ollama
 Requires-Dist: openai
 Requires-Dist: psutil>=5.7
 Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: python-multipart>=0.0.27
+Requires-Dist: python-dotenv>=1.2.2
+Requires-Dist: python-multipart>=0.0.31
 Requires-Dist: sseclient-py
 Requires-Dist: starlette>=1.3.1
 Requires-Dist: tiktoken
@@ -718,7 +719,7 @@ Requires-Dist: urllib3>=2.7.0
 Provides-Extra: test
 Requires-Dist: psutil; extra == 'test'
 Requires-Dist: pytest-timeout>=2.3.0; extra == 'test'
-Requires-Dist: pytest<9,>=7.0; extra == 'test'
+Requires-Dist: pytest<10,>=9.0.3; extra == 'test'
 Requires-Dist: pyyaml; extra == 'test'
 Description-Content-Type: text/markdown
 
@@ -736,6 +737,8 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 - [Feature highlights](#feature-highlights)
   - [Claude mode](#claude-mode)
   - [Agent mode](#agent-mode)
+  - [ACP agent mode](#acp-agent-mode)
+  - [Chatbook](#chatbook)
   - [Code generation with inline chat](#code-generation-with-inline-chat)
   - [Auto-complete](#auto-complete)
   - [Chat interface](#chat-interface)
@@ -765,7 +768,7 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 
 - Python 3.10+
 - JupyterLab 4.x
-- Node.js — only required for [Claude mode](#claude-mode) (the Claude Code CLI) and for MCP servers that launch via `npx`.
+- Node.js — required for [Claude mode](#claude-mode) (the Claude Code CLI), for [ACP agent mode](#acp-agent-mode), which launches its adapter with `npx` on every start, and for MCP servers that launch via `npx`.
 - A fresh virtualenv or conda env is recommended so NBI doesn't conflict with system Python.
 
 ## Quick start
@@ -874,6 +877,20 @@ In Agent mode, the built-in AI agent creates, edits, and executes notebooks for
 
 ![Agent mode](media/agent-mode.gif)
 
+### ACP agent mode
+
+An experimental second agent mode that drives an external coding agent over the [Agent Client Protocol](https://agentclientprotocol.com/), with OpenAI Codex as the only agent type today. The agent runs as a subprocess and does its own file and command work, asking for approval through NBI's confirmation cards; NBI deliberately does not lend it the Jupyter server's filesystem or terminal.
+
+It is off by default and the Settings tab stays hidden until an admin allows the mode, and it cannot be used at the same time as Claude mode. See [`docs/acp.md`](docs/acp.md).
+
+### Chatbook
+
+A Chatbook is a notebook whose cells can be written in English. Running a prompt cell generates code for the notebook's backend kernel and runs it; each cell carries a badge showing whether it is a prompt (**NL**) or ordinary code (**Cd**), and `Ctrl J` switches between them.
+
+What happens to generated code before it runs is yours to choose: **Always confirm** (the default) shows the code and waits, **Confirm if risky** waits only when a scan finds destructive calls, and **Auto-run** executes straight away. Admins can cap that choice fleet-wide, or turn Chatbook off entirely.
+
+Prompts can pull in context with `@` mentions, rules apply to generation the same way they apply to chat, the backend kernel need not be Python, and a Chatbook exports to a plain code notebook when you want to hand someone the result instead of the prompts. See [`docs/chatbook.md`](docs/chatbook.md).
+
 ### Code generation with inline chat
 
 Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the inline chat popover.
@@ -884,7 +901,7 @@ Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the in
 
 ### Auto-complete
 
-Auto-complete suggestions are shown as you type. `Tab` accepts. NBI provides auto-complete in code cells and Python file editors.
+Auto-complete suggestions are shown as you type. `Tab` accepts one while it is on screen, and indents otherwise. NBI provides auto-complete in code cells and Python file editors.
 
 <img src="media/inline-completion.gif" alt="Auto-complete" width=700 />
 
@@ -904,6 +921,8 @@ Right-click a cell output (or hover for the toolbar) to send it straight into th
 
 Each is per-user toggleable from Settings (saved as `enable_explain_error`, `enable_output_followup`, `enable_output_toolbar` in `config.json`, default on) and admin-lockable via `NBI_EXPLAIN_ERROR_POLICY` / `NBI_OUTPUT_FOLLOWUP_POLICY` / `NBI_OUTPUT_TOOLBAR_POLICY`.
 
+A revert is skipped while that document's kernel is busy, so a change landing mid-execution is applied when the cell finishes rather than swapped in under it, and the notice naming the reloaded file is shown only for the document you are looking at.
+
 ### Notebook toolbar generation
 
 Active notebooks show a sparkle icon on the toolbar. Click it to open a popover that scopes the generation request to that specific notebook — handy for multi-notebook sessions where you don't want the chat sidebar to compete for context.
@@ -1210,7 +1229,8 @@ Full guide, including the span and event reference, the probe thresholds, worked
 - [`docs/admin-guide.md`](docs/admin-guide.md) — deployment, env vars, security model, air-gap, multi-tenancy.
 - [`docs/skills.md`](docs/skills.md) — Claude Skills management and the org-manifest reconciler.
 - [`docs/rulesets.md`](docs/rulesets.md) — ruleset frontmatter and discovery.
-- [`docs/chatbook.md`](docs/chatbook.md) — Chatbook execution modes and why there is no per-cell sandbox.
+- [`docs/acp.md`](docs/acp.md) — using the experimental ACP agent mode, and its limits.
+- [`docs/chatbook.md`](docs/chatbook.md) — writing Chatbook cells, execution modes, export, and why there is no per-cell sandbox.
 - [`docs/chatbook-extensions.md`](docs/chatbook-extensions.md) — dynamic Chatbook context and mention providers.
 - [`docs/troubleshooting.md`](docs/troubleshooting.md) — common problems with copy-pasteable fixes.
 - [`docs/performance-diagnostics.md`](docs/performance-diagnostics.md): turn timelines, the environment probe, and how to read both.
@@ -1228,7 +1248,7 @@ Full guide, including the span and event reference, the probe thresholds, worked
 
 ## Roadmap
 
-NBI 5.x is stable. New features land in minor releases (5.1, 5.2, …); breaking changes are reserved for the next major (6.x) and will be announced in the [changelog](CHANGELOG.md). Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
+NBI 6.x is the current line. New features land in minor releases (6.1, 6.2, …); breaking changes are reserved for a major release and announced in the [changelog](CHANGELOG.md). 6.0 itself is not a breaking release: it marks Chatbook's arrival, and no traitlet, env var, REST route, or on-disk format was renamed or removed, so upgrading from 5.x needs no migration. Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
 
 ## License
 

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/PRIVACY.md

@@ -6,14 +6,15 @@ This page documents what NBI sends to external services, when, and how administr
 
 The table below describes what each LLM provider receives **when you actively use a feature** (chat message, inline completion, agent action). An idle JupyterLab does not contact the provider.
 
-| Provider                          | What is sent                                                                                            | When                                                 | Destination                                                                           |
-| --------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| **GitHub Copilot**                | Prompt, surrounding cell source, attached files (when you click _attach_)                               | Per request (chat) and as you type (inline complete) | `api.githubcopilot.com`, `api.github.com` (auth)                                      |
-| **OpenAI-compatible**             | Prompt, surrounding cell source, attached files                                                         | Per request and per inline-completion request        | The Base URL you configured (`api.openai.com` by default)                             |
-| **LiteLLM-compatible**            | Same as OpenAI-compatible; the LiteLLM proxy forwards to the upstream model you configured              | Per request                                          | The Base URL of your LiteLLM proxy                                                    |
-| **Ollama (local)**                | Prompt, surrounding cell source, attached files                                                         | Per request                                          | Localhost (or the host you configured); **no external network**                       |
-| **Anthropic API** (Claude mode)   | Prompt, surrounding cell source, attached files                                                         | Per inline-chat or auto-complete request             | `api.anthropic.com` (or your configured Base URL)                                     |
-| **Claude Code CLI** (Claude mode) | Prompt, working-directory file reads requested by Claude, shell-command output for tools Claude invokes | Per agent turn in the chat panel                     | Whatever the Claude Code CLI is configured to talk to (typically `api.anthropic.com`) |
+| Provider                          | What is sent                                                                                                     | When                                                          | Destination                                                                                                                               |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| **GitHub Copilot**                | Prompt, surrounding cell source, attached files (when you click _attach_)                                        | Per request (chat) and as you type (inline complete)          | `api.githubcopilot.com`, `api.github.com` (auth)                                                                                          |
+| **OpenAI-compatible**             | Prompt, surrounding cell source, attached files                                                                  | Per request and per inline-completion request                 | The Base URL you configured (`api.openai.com` by default)                                                                                 |
+| **LiteLLM-compatible**            | Same as OpenAI-compatible; the LiteLLM proxy forwards to the upstream model you configured                       | Per request                                                   | The Base URL of your LiteLLM proxy                                                                                                        |
+| **Ollama (local)**                | Prompt, surrounding cell source, attached files                                                                  | Per request                                                   | Localhost (or the host you configured); **no external network**                                                                           |
+| **Anthropic API** (Claude mode)   | Prompt, surrounding cell source, attached files                                                                  | Per inline-chat or auto-complete request                      | `api.anthropic.com` (or your configured Base URL)                                                                                         |
+| **Claude Code CLI** (Claude mode) | Prompt, working-directory file reads requested by Claude, shell-command output for tools Claude invokes          | Per agent turn in the chat panel                              | Whatever the Claude Code CLI is configured to talk to (typically `api.anthropic.com`)                                                     |
+| **ACP agent** (ACP mode)          | Prompt and NBI's notebook context, plus whatever files the agent reads and command output it collects on its own | Per agent turn in the chat panel, and per Chatbook generation | Whatever the agent is configured to talk to (`api.openai.com` or your Base URL on the API-key path, or the agent's own signed-in backend) |
 
 ### Cell outputs are included when the cell is attached
 
@@ -28,19 +29,19 @@ If your cells contain sensitive outputs (PHI, PII, secrets), clear them before i
 
 Hosts NBI may contact, depending on which features are enabled:
 
-| Host                                            | Purpose                                                                                                          |
-| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `api.githubcopilot.com`                         | GitHub Copilot chat and inline completion                                                                        |
-| `api.github.com`                                | GitHub Copilot device-flow login; managed-skills manifest fetches when hosted on github.com; skill imports       |
-| `github.com`, `codeload.github.com`             | Skill tarball downloads (Import from GitHub and the managed-skills reconciler)                                   |
-| `raw.githubusercontent.com`                     | Manifest fetches when `NBI_SKILLS_MANIFEST` points at a `raw.githubusercontent.com` URL                          |
-| `api.anthropic.com`                             | Anthropic API for Claude-mode inline chat and auto-complete; also the default destination of the Claude Code CLI |
-| `api.openai.com`                                | OpenAI-compatible provider (default Base URL)                                                                    |
-| Your configured Base URL                        | OpenAI-compatible, LiteLLM-compatible, or Claude when pointed at a self-hosted endpoint                          |
-| `localhost:11434` (or your Ollama host)         | Ollama local model serving                                                                                       |
-| `registry.npmjs.org` and configured npm mirrors | Only if MCP servers are configured to launch via `npx -y` — `npx` fetches the package on first run               |
+| Host                                            | Purpose                                                                                                                                                                 |
+| ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `api.githubcopilot.com`                         | GitHub Copilot chat and inline completion                                                                                                                               |
+| `api.github.com`                                | GitHub Copilot device-flow login; managed-skills manifest fetches when hosted on github.com; skill imports                                                              |
+| `github.com`, `codeload.github.com`             | Skill tarball downloads (Import from GitHub and the managed-skills reconciler)                                                                                          |
+| `raw.githubusercontent.com`                     | Manifest fetches when `NBI_SKILLS_MANIFEST` points at a `raw.githubusercontent.com` URL                                                                                 |
+| `api.anthropic.com`                             | Anthropic API for Claude-mode inline chat and auto-complete; also the default destination of the Claude Code CLI                                                        |
+| `api.openai.com`                                | OpenAI-compatible provider (default Base URL)                                                                                                                           |
+| Your configured Base URL                        | OpenAI-compatible, LiteLLM-compatible, or Claude when pointed at a self-hosted endpoint                                                                                 |
+| `localhost:11434` (or your Ollama host)         | Ollama local model serving                                                                                                                                              |
+| `registry.npmjs.org` and configured npm mirrors | MCP servers configured to launch via `npx -y`, and ACP mode, which launches its adapter with `npx` on every agent start unless `NBI_ACP_AGENT_COMMAND` points elsewhere |
 
-For the configurable destinations above (Base URLs, Ollama host, MCP `npx` packages), the destination is whatever you or your admin set. There is no other implicit network activity.
+For the configurable destinations above (Base URLs, Ollama host, MCP `npx` packages), the destination is whatever you or your admin set. NBI itself starts no other network activity. In ACP mode the agent subprocess makes its own calls, which NBI neither proxies nor enumerates: the destinations there are the agent's to document, and blocking egress at the network layer is the only way to bound them from outside.
 
 For air-gapped or egress-restricted environments, see [`docs/admin-guide.md`](docs/admin-guide.md#air-gap-deployment).
 
@@ -55,6 +56,7 @@ For air-gapped or egress-restricted environments, see [`docs/admin-guide.md`](do
 | `~/.claude/skills/`             | User-scope Claude skills                                                   |
 | `<project>/.claude/skills/`     | Project-scope Claude skills                                                |
 | `~/.claude/projects/`           | Claude Code session transcripts (managed by Claude CLI, not NBI)           |
+| `~/.jupyter/nbi/codex-home/`    | ACP agent configuration and session files, when an API key is configured   |
 
 > Treat `~/.jupyter/nbi/config.json` and `~/.jupyter/nbi/user-data.json` as secrets. They contain your API keys and (encrypted) GitHub token. Do not commit them to git, share them, or sync them across users. If a key leaks, rotate it at the provider immediately.
 
@@ -74,7 +76,7 @@ LLM outputs are non-deterministic. Pinning the model name, temperature, and seed
 
 For HIPAA, FedRAMP, classroom, or otherwise restricted environments:
 
-- **Force local-only models.** Disable every cloud provider via `disabled_providers` and use Ollama. See the [HIPAA / sensitive-data preset](docs/admin-guide.md#hipaa--sensitive-data-preset) in the admin guide.
+- **Force local-only models.** Disable every cloud provider via `disabled_providers`, force both agent modes off with `claude_mode_policy` and `acp_mode_policy`, and use Ollama. Disabling providers is not sufficient on its own: neither agent mode is a provider, and Claude mode is available to users unless an admin turns it off. See the [HIPAA / sensitive-data preset](docs/admin-guide.md#hipaa--sensitive-data-preset) in the admin guide.
 - **Restrict skill imports.** Block egress to `github.com` and serve managed skills from an internal manifest URL.
 - **Disable "remember GitHub Copilot login"** for shared systems where users share home directories.
 - **Pre-pull MCP servers** rather than allowing `npx -y` (which downloads from npmjs).

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/README.md

@@ -12,6 +12,8 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 - [Feature highlights](#feature-highlights)
   - [Claude mode](#claude-mode)
   - [Agent mode](#agent-mode)
+  - [ACP agent mode](#acp-agent-mode)
+  - [Chatbook](#chatbook)
   - [Code generation with inline chat](#code-generation-with-inline-chat)
   - [Auto-complete](#auto-complete)
   - [Chat interface](#chat-interface)
@@ -41,7 +43,7 @@ NBI is free and open-source. Connect it to a free or paid LLM provider of your c
 
 - Python 3.10+
 - JupyterLab 4.x
-- Node.js — only required for [Claude mode](#claude-mode) (the Claude Code CLI) and for MCP servers that launch via `npx`.
+- Node.js — required for [Claude mode](#claude-mode) (the Claude Code CLI), for [ACP agent mode](#acp-agent-mode), which launches its adapter with `npx` on every start, and for MCP servers that launch via `npx`.
 - A fresh virtualenv or conda env is recommended so NBI doesn't conflict with system Python.
 
 ## Quick start
@@ -150,6 +152,20 @@ In Agent mode, the built-in AI agent creates, edits, and executes notebooks for
 
 ![Agent mode](media/agent-mode.gif)
 
+### ACP agent mode
+
+An experimental second agent mode that drives an external coding agent over the [Agent Client Protocol](https://agentclientprotocol.com/), with OpenAI Codex as the only agent type today. The agent runs as a subprocess and does its own file and command work, asking for approval through NBI's confirmation cards; NBI deliberately does not lend it the Jupyter server's filesystem or terminal.
+
+It is off by default and the Settings tab stays hidden until an admin allows the mode, and it cannot be used at the same time as Claude mode. See [`docs/acp.md`](docs/acp.md).
+
+### Chatbook
+
+A Chatbook is a notebook whose cells can be written in English. Running a prompt cell generates code for the notebook's backend kernel and runs it; each cell carries a badge showing whether it is a prompt (**NL**) or ordinary code (**Cd**), and `Ctrl J` switches between them.
+
+What happens to generated code before it runs is yours to choose: **Always confirm** (the default) shows the code and waits, **Confirm if risky** waits only when a scan finds destructive calls, and **Auto-run** executes straight away. Admins can cap that choice fleet-wide, or turn Chatbook off entirely.
+
+Prompts can pull in context with `@` mentions, rules apply to generation the same way they apply to chat, the backend kernel need not be Python, and a Chatbook exports to a plain code notebook when you want to hand someone the result instead of the prompts. See [`docs/chatbook.md`](docs/chatbook.md).
+
 ### Code generation with inline chat
 
 Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the inline chat popover.
@@ -160,7 +176,7 @@ Use the sparkle icon on the cell toolbar or the keyboard shortcut to show the in
 
 ### Auto-complete
 
-Auto-complete suggestions are shown as you type. `Tab` accepts. NBI provides auto-complete in code cells and Python file editors.
+Auto-complete suggestions are shown as you type. `Tab` accepts one while it is on screen, and indents otherwise. NBI provides auto-complete in code cells and Python file editors.
 
 <img src="media/inline-completion.gif" alt="Auto-complete" width=700 />
 
@@ -180,6 +196,8 @@ Right-click a cell output (or hover for the toolbar) to send it straight into th
 
 Each is per-user toggleable from Settings (saved as `enable_explain_error`, `enable_output_followup`, `enable_output_toolbar` in `config.json`, default on) and admin-lockable via `NBI_EXPLAIN_ERROR_POLICY` / `NBI_OUTPUT_FOLLOWUP_POLICY` / `NBI_OUTPUT_TOOLBAR_POLICY`.
 
+A revert is skipped while that document's kernel is busy, so a change landing mid-execution is applied when the cell finishes rather than swapped in under it, and the notice naming the reloaded file is shown only for the document you are looking at.
+
 ### Notebook toolbar generation
 
 Active notebooks show a sparkle icon on the toolbar. Click it to open a popover that scopes the generation request to that specific notebook — handy for multi-notebook sessions where you don't want the chat sidebar to compete for context.
@@ -486,7 +504,8 @@ Full guide, including the span and event reference, the probe thresholds, worked
 - [`docs/admin-guide.md`](docs/admin-guide.md) — deployment, env vars, security model, air-gap, multi-tenancy.
 - [`docs/skills.md`](docs/skills.md) — Claude Skills management and the org-manifest reconciler.
 - [`docs/rulesets.md`](docs/rulesets.md) — ruleset frontmatter and discovery.
-- [`docs/chatbook.md`](docs/chatbook.md) — Chatbook execution modes and why there is no per-cell sandbox.
+- [`docs/acp.md`](docs/acp.md) — using the experimental ACP agent mode, and its limits.
+- [`docs/chatbook.md`](docs/chatbook.md) — writing Chatbook cells, execution modes, export, and why there is no per-cell sandbox.
 - [`docs/chatbook-extensions.md`](docs/chatbook-extensions.md) — dynamic Chatbook context and mention providers.
 - [`docs/troubleshooting.md`](docs/troubleshooting.md) — common problems with copy-pasteable fixes.
 - [`docs/performance-diagnostics.md`](docs/performance-diagnostics.md): turn timelines, the environment probe, and how to read both.
@@ -504,7 +523,7 @@ Full guide, including the span and event reference, the probe thresholds, worked
 
 ## Roadmap
 
-NBI 5.x is stable. New features land in minor releases (5.1, 5.2, …); breaking changes are reserved for the next major (6.x) and will be announced in the [changelog](CHANGELOG.md). Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
+NBI 6.x is the current line. New features land in minor releases (6.1, 6.2, …); breaking changes are reserved for a major release and announced in the [changelog](CHANGELOG.md). 6.0 itself is not a breaking release: it marks Chatbook's arrival, and no traitlet, env var, REST route, or on-disk format was renamed or removed, so upgrading from 5.x needs no migration. Upgrading from 4.x? See the [5.0.0 migration note](CHANGELOG.md#migration-note) for the `fastmcp` → `mcp` dependency swap, the new path sandboxes, and the workspace-file-attach behavior change.
 
 ## License
 

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/RELEASE.md

@@ -14,13 +14,22 @@ Python package. Before generating a package, you first need to install some tool
 pip install build twine hatch
 ```
 
-Bump the version using `hatch`. By default this will create a tag.
-See the docs on [hatch-nodejs-version](https://github.com/agoose77/hatch-nodejs-version#semver) for details.
+Bump the version using `hatch`. See the docs on
+[hatch-nodejs-version](https://github.com/agoose77/hatch-nodejs-version#semver) for details.
 
 ```bash
 hatch version <new-version>
 ```
 
+`hatch version` writes the version; it does not tag. Tag the release yourself
+afterwards, and spell the tag the way the existing history does
+(`v5.4.0`, `v5.4.0a1`) rather than with a hyphen before the prerelease segment.
+
+Before tagging, add the release's entry to [`CHANGELOG.md`](CHANGELOG.md) above
+the `<!-- <START NEW CHANGELOG ENTRY> -->` marker, date the heading, and add its
+compare link at the foot of the file. The Jupyter Releaser workflows below read
+that marker, so an entry added after the fact is not picked up.
+
 Make sure to clean up all the development files before building the package:
 
 ```bash

notebook_intelligence-6.1.0/SECURITY.md

@@ -0,0 +1,53 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Do not** open a public GitHub issue for security vulnerabilities.
+
+Email the maintainer directly at **mbektasgh@outlook.com** with:
+
+- A description of the vulnerability and the impact you observed.
+- Steps to reproduce, including affected versions of NBI, JupyterLab, and Python.
+- Any proof-of-concept code or logs (redact secrets).
+
+Expect an acknowledgement within five business days. Once we confirm the issue, we'll work with you on a coordinated disclosure timeline.
+
+## Supported versions
+
+NBI follows semantic versioning starting with 4.0.0. Security fixes land on the latest minor release of the current major line. Earlier major lines are not actively maintained.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 6.x     | Yes (latest minor) |
+| < 6.0   | No                 |
+
+## Scope
+
+In-scope:
+
+- The `notebook_intelligence` server extension and its HTTP handlers.
+- The `@plmbr/notebook-intelligence` JupyterLab frontend.
+- Built-in tools (`nbi-notebook-edit`, `nbi-notebook-execute`, `nbi-python-file-edit`, `nbi-file-edit`, `nbi-file-read`, `nbi-command-execute`).
+- The Claude Skills import and managed-manifest reconciler.
+- ACP agent mode: the protocol router, what NBI serves or refuses an agent, and the credential handling around the adapter subprocess.
+- The Chatbook kernel and its generate API, which execute model-written code as the user.
+- The UI-tools relay (`/notebook-intelligence/ui-tools`) and the `notebook_intelligence.mcp_ui_proxy` standalone server.
+
+Out of scope:
+
+- Vulnerabilities in upstream dependencies (`litellm`, `anthropic`, `openai`, `ollama`, `claude-agent-sdk`, `mcp`, `agent-client-protocol`) — please report those upstream. We will pick up patched releases when they ship.
+- Vulnerabilities in MCP servers users install from third-party sources.
+- Vulnerabilities in LLM providers themselves (data handling at OpenAI, Anthropic, GitHub Copilot, etc.).
+
+## Security model
+
+NBI is a **per-user** tool. The server extension runs inside the user's Jupyter Server process and inherits that user's permissions. Built-in tools shell out as the user, MCP stdio servers run as the user, the Chatbook kernel executes generated code as the user, and the Claude Code CLI inherits the user's environment. There is no privilege boundary between the extension and the user's account.
+
+Within that, a few boundaries are deliberate and worth stating, because they are what a report should be measured against:
+
+- **An ACP agent is not lent the client's reach.** NBI refuses filesystem reads and writes, terminal methods, and agent extension requests at the protocol router, so the agent does its own I/O under its own sandbox rather than through the Jupyter server process. The approval cards are the mediation point, with the honest limit that the agent chooses what to ask about.
+- **Approval prompts are rendered so they cannot be forged.** Command text is fenced with a collision-resistant delimiter and bidirectional control characters are rejected, so what an approval card shows is what would run.
+- **Commands the backend can ask the frontend to run are allowlisted** at a single chokepoint, rather than being any JupyterLab command id. `run-command-in-terminal` stays on that list, so shell reachability is unchanged by it.
+- **`mcp_stdio_command_allowlist`** is the mitigation admins have for stdio MCP servers, which otherwise run any command an `mcp.json` names. See [Restricting MCP stdio commands](docs/admin-guide.md#restricting-mcp-stdio-commands).
+
+For multi-tenant deployments, see [`docs/admin-guide.md`](docs/admin-guide.md) for guidance on disabling features that are unsafe to expose without additional sandboxing (notably `nbi-command-execute` and `nbi-file-edit`).

notebook_intelligence-6.1.0/docs/acp.md

@@ -0,0 +1,34 @@
+# ACP agent mode
+
+ACP mode drives an external coding agent over the [Agent Client Protocol](https://agentclientprotocol.com/) instead of using NBI's own chat path. It is experimental, off by default, and mutually exclusive with Claude mode: enabling one disables the other.
+
+OpenAI Codex, through the `codex-acp` adapter, is the only agent type available today.
+
+For the admin side of this feature (the two policies, the approval posture NBI pins, credential containment, and the known limitations) see [Gating the experimental ACP agent](admin-guide.md#gating-the-experimental-acp-agent-378). This page is about using it.
+
+## Turning it on
+
+The **ACP** tab in Settings is hidden until an admin allows the mode, because `acp_mode_policy` defaults to `force-off`. If you do not see the tab, that is why; ask for `NBI_ACP_MODE_POLICY=user-choice`.
+
+With the tab visible, pick the agent type, then set the chat model, API key, and base URL. The adapter is launched with `npx` on every agent start, so the server needs Node.js on its `PATH` even though nothing is installed permanently.
+
+## What a turn looks like
+
+The agent runs as a subprocess and does its own work: it reads and writes files itself, and runs its own commands. NBI deliberately does not serve it the client filesystem or terminal methods, so the agent cannot borrow the Jupyter server process's reach; it is confined to whatever sandbox the agent applies to itself, which is what the admin policies pin.
+
+When the agent wants to do something it considers worth asking about, NBI shows an approval card naming the command and the reason the agent gave. Approving grants a lasting permission for that kind of action in the session, not a one-off, so a later action of the same kind may not ask again. The agent decides what to ask about; NBI shows what it is asked, and cannot promise that everything the agent does passes through a card.
+
+Previous sessions are listed by the history control, and picking one resumes it through the agent's own session storage rather than NBI's.
+
+## Limits worth knowing
+
+- **The first start is slow, and it is bounded.** An agent has 60 seconds to spawn, download the adapter through `npx`, initialize, authenticate, and create a session. On a cold cache over a slow link the download alone can exceed that, and the failure reads `ACP agent did not start in time`. Run the adapter command once by hand to warm the cache, or point `NBI_ACP_AGENT_COMMAND` at a pre-installed copy.
+- **A turn is capped at 30 minutes**, after which it fails with an agent response timeout.
+- **Session listing is optional.** Resuming depends on the agent advertising the capability, and listing is an optional protocol extension. An agent that implements neither reports that it does not support listing sessions; this is the agent's limitation, not a misconfiguration.
+- **Chatbook uses ACP differently.** When ACP mode is active, Chatbook generation runs in a separate session with full access forced off, no MCP servers, and permission requests denied, so a Chatbook cell cannot approve its way into running commands.
+
+## Where its state lives
+
+When you configure an API key, NBI points the agent at an isolated `CODEX_HOME` under `~/.jupyter/nbi/codex-home/` so it reads neither the workspace's nor your personal `~/.codex` configuration. Its session files live there. Signing in through the agent's own ChatGPT flow instead uses your `~/.codex` as usual.
+
+See [`PRIVACY.md`](../PRIVACY.md) for what leaves the machine in this mode.

{notebook_intelligence-6.0.0a2 → notebook_intelligence-6.1.0}/docs/admin-guide.md

@@ -113,6 +113,8 @@ The full surface, in one table.
 | `NBI_MCP_STDIO_COMMAND_ALLOWLIST`                | csv  | unset                       | env (appends to traitlet)                    | Comma-separated regex patterns added to the traitlet at startup. Per-pod additions on an org baseline.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `tour_config_path`                               | str  | `""`                        | traitlet                                     | Filesystem path to a YAML/JSON file with admin overrides for the first-run sidebar tour copy. See [`docs/admin-tour-config.md`](admin-tour-config.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `NBI_TOUR_CONFIG_PATH`                           | str  | unset                       | env (overrides traitlet)                     | Same as above; env takes precedence.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `tour_disabled`                                  | bool | `False`                     | traitlet                                     | Suppress the first-run tour. The "Show NBI tour" command still replays it. See [`docs/admin-tour-config.md`](admin-tour-config.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `NBI_TOUR_DISABLED`                              | bool | unset                       | env (overrides traitlet)                     | Same as above; env takes precedence.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `NBI_GH_ACCESS_TOKEN_PASSWORD`                   | str  | `nbi-access-token-password` | env                                          | Password used to encrypt the stored Copilot token in `user-data.json`. **Change in multi-tenant deployments.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `NBI_REFUSE_DEFAULT_TOKEN_PASSWORD_ON_SHARED_FS` | bool | unset                       | env                                          | When set, refuse to write `user-data.json` if the default `NBI_GH_ACCESS_TOKEN_PASSWORD` is still in use AND `~/.jupyter/nbi/` is readable by group or other. Opt-in to preserve backwards compatibility on single-user deployments where the directory mode is incidental.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `NBI_ALLOW_DEFAULT_TOKEN_PASSWORD`               | bool | unset                       | env                                          | Per-pod opt-out that disengages the refuse-on-shared-fs guard above. Admins who knowingly accept the risk (e.g., during a transition before rolling out a per-user password) set this so writes continue.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -278,7 +280,8 @@ Steps for deploying to a network with no general internet egress:
 2. **Manifest hosting.** Set `NBI_SKILLS_MANIFEST` to either a `file://` path (a manifest baked into the image) or an internal `https://` URL on a network the pod can reach.
 3. **Skill bundles.** Either bake the skills into the image under `~/.claude/skills/` (managed status will reset since they aren't from the manifest), or host the GitHub-style tarballs at an internal mirror and write the manifest URLs to point at it.
 4. **Disable user-initiated GitHub imports** at the network layer — block `github.com`, `codeload.github.com`, and `raw.githubusercontent.com`. Users can still install skills from the local filesystem by dropping bundles into `~/.claude/skills/`.
-5. **MCP `npx -y` is incompatible with air-gap.** Pre-install the server binary and reference it directly:
+5. **ACP mode is `npx`-only by default.** The adapter is fetched with `npx` on every agent start, so an air-gapped deployment must either leave ACP off (it is `force-off` by default) or pre-install the adapter and point `NBI_ACP_AGENT_COMMAND` at it. A replacement command must still accept the `-c` overrides NBI passes, or the approval posture those pin is lost.
+6. **MCP `npx -y` is incompatible with air-gap.** Pre-install the server binary and reference it directly:
 
    ```json
    {
@@ -291,7 +294,7 @@ Steps for deploying to a network with no general internet egress:
    }
    ```
 
-6. **LLM endpoint.** Air-gap requires a self-hosted endpoint (vLLM, TGI, or a LiteLLM proxy in front of a VPC-endpoint Bedrock, etc.). See [Self-hosted LLM endpoints](#self-hosted-llm-endpoints).
+7. **LLM endpoint.** Air-gap requires a self-hosted endpoint (vLLM, TGI, or a LiteLLM proxy in front of a VPC-endpoint Bedrock, etc.). See [Self-hosted LLM endpoints](#self-hosted-llm-endpoints).
 
 ---
 
@@ -309,8 +312,17 @@ c.NotebookIntelligence.disabled_providers = [
 c.NotebookIntelligence.allow_enabling_providers_with_env = False  # users cannot override
 c.NotebookIntelligence.disabled_tools = ["nbi-command-execute", "nbi-file-edit"]
 c.NotebookIntelligence.allow_enabling_tools_with_env = False
+
+# Both agent modes reach a cloud provider without going through the provider
+# list above, so disabling providers alone does not make a deployment
+# local-only. acp_mode is already force-off by default; it is pinned here so
+# the preset keeps working if that default is ever relaxed.
+c.NotebookIntelligence.claude_mode_policy = "force-off"
+c.NotebookIntelligence.acp_mode_policy = "force-off"
 ```
 
+> **`disabled_providers` does not gate Claude mode or ACP mode.** Whether an agent mode handles a turn is read from its own settings (`claude_settings.enabled` / `acp_settings.enabled`), not from the provider list, and `claude_mode_policy` otherwise defaults to `user-choice`. Without the two policy lines above, a user can enable Claude mode and send data to Anthropic through the Claude Code CLI, which can hold a subscription login the deployment never issued a key for.
+
 Pair with `<env-prefix>/share/jupyter/nbi/config.json` selecting the Ollama provider and your local models:
 
 ```json
@@ -912,6 +924,7 @@ NBI is tested against the JupyterLab and `jupyter_server` versions declared in [
 
 | NBI version | JupyterLab | jupyter_server | Python    |
 | ----------- | ---------- | -------------- | --------- |
+| 6.0.x       | 4.x        | 2.x            | 3.10+     |
 | 5.4.x       | 4.x        | 2.x            | 3.10+     |
 | 5.3.x       | 4.x        | 2.x            | 3.10+     |
 | 5.2.x       | 4.x        | 2.x            | 3.10+     |