Admin and deployment guide

This guide is for the people who roll Nib out and keep it in policy. Items marked Not yet don't exist today. We list them so you can plan around them.

Set up the organizationСкопировать ссылку на раздел

1. Create the organization and invite people under Account → Organization. Roles are owner, admin and member; see Organizations.

2. Choose a plan under Account → Plan & billing. Enterprise is a contract; write to sales@nib.gg.

3. Set spend limits:

   • the monthly cap on usage beyond the plan;
   • a default monthly budget per member, with per-member overrides.

   You can also export usage as CSV for chargeback. See Plans and billing.

4. Decide data handling. Under Plan & billing → Nib models and your data, Team and Enterprise can require zero data retention for Nib models. Prompts to Nib models never go to providers that may train on them. See Your data.

5. Read the activity log under Account → Organization → Activity, or export it as JSON lines for a SIEM.

Not yet:

• single sign-on (SAML or OIDC), SCIM provisioning, domain verification and auto-join;
• custom roles;
• policy pushed from the cloud to devices.

Managed settingsСкопировать ссылку на раздел

Nib reads a managed settings file that users can't override. Deploy it with your usual tooling: MDM file payloads, Group Policy file copy, or configuration management.

Managed files already deployed for other agents in the same format (…/ClaudeCode/…, /etc/claude-code/…) are also read, at lower precedence than Nib's. A managed NIB.md in the same folder adds organization-wide instructions to every session.

Precedence, highest first: managed, then command-line --settings, then the project's local settings, then the project's settings, then the user's settings.

• Single values come from the highest level that sets them.
• Lists are combined.

Some keys work differently:

A project's own settings can't:

• switch on auto or bypass mode;
• widen the sandbox;
• set protected environment variables;
• add hooks or allow rules before the person trusts the folder.

If a managed file isn't valid JSON, it's skipped with a warning. Validate it before you roll it out.

Not yet:

• native MDM formats (configuration profiles, ADMX);
• managed keys for telemetry, sync, turning the Hub off, or updates;
• a provider allowlist.

Install and updateСкопировать ссылку на раздел

Desktop app. Bundle id gg.nib.desktop, published by Wex Labs Limited. Downloads are at nib.gg/download.

Windows and Linux follow in a later release.

Silent installs use the standard installer switches (NSIS /S, msiexec /qn). We haven't tested them across versions yet.

Updates.

• The desktop app asks the update feed, updates.nib.gg, for a newer version at launch and every 4 hours, and asks before installing. The stable channel is the default, and people can switch to beta in the app.
• The feed's update files redirect to GitHub releases (§ Network).
• Not yet: turning updates off, pinning a version, or setting the channel by policy.

CLI.

Будет доступно с первым публичным релизом.

• For CI, nib setup-token registers a device token.

NetworkСкопировать ссылку на раздел

Nib needs outbound HTTPS to:

Sync and remote control use a WebSocket to api.nib.gg.

On the computer:

• The daemon listens on 127.0.0.1 only, on a random port.
• It refuses other addresses unless started with --allow-remote.
• Its sandbox proxy and preview server also bind to loopback.

Proxies and custom CAs:

• The CLI and the daemon follow the standard HTTPS_PROXY, NO_PROXY and NODE_EXTRA_CA_CERTS variables. Test them in your environment before you roll out.
• Not yet: reading the system proxy or PAC files in the desktop app, and client certificates (mTLS).

TelemetryСкопировать ссылку на раздел

Telemetry is off until a person opts in during setup:

• crash reports are scrubbed of paths, tokens and code;
• usage metrics are counts and timings, labelled by model.

To keep it off on a machine, set NIB_TELEMETRY=off or DO_NOT_TRACK=1 in the environment. The CLI and the daemon honour it. Not yet: a managed setting that turns it off fleet-wide in the desktop app.

Platform supportСкопировать ссылку на раздел

Where data lives on the computerСкопировать ссылку на раздел

The cloud keeps data for the periods in Your data.