chutes-build 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -0,0 +1,371 @@
+# Changelog
+
+All notable changes to Chutes Build will be documented in this file. The format
+is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.4.2] - 2026-08-01
+
+### Added
+
+- `/undo` is accepted as an alias for `/rewind`.
+- Added repository-wide coding-agent guidance and editor defaults.
+- The npm launcher archive now includes the changelog and security policy.
+
+### Changed
+
+- Reviewed Grok Build upstream through `0.2.117` and recorded the selective
+  port and deferral decisions.
+- Removed the orphaned Dependabot auto-merge workflow after automated version
+  update PRs were disabled.
+- The Windows CI job no longer disables real-time malware protection.
+
+### Fixed
+
+- Repeated-tool-call reminders are injected only after the preceding tool
+  results are committed, preventing duplicate results from corrupting session
+  history.
+- Empty Enter no longer silently approves a plan while the revision prompt is
+  focused; revision notes are required, with `a` as the explicit approve key.
+- Notification-hook tests that launch external shells are serialized, avoiding
+  Windows CI failures caused by concurrent PowerShell startup contention.
+- The asynchronous notification-hook test now joins its worker before checking
+  output, removing a race with slow PowerShell startup on loaded CI runners.
+- Removed Rust 1.94 Clippy warnings in the Windows crash handler, PTY text
+  rendering, and workspace utilities without changing their behavior.
+- Notification events without an owning session explicitly remove any stale
+  `CHUTES_BUILD_SESSION_ID` inherited from the parent process.
+
+### Security
+
+- Documented and aligned repository security controls for SHA-pinned Actions,
+  read-only workflow tokens, and reviewed security-update PRs.
+- Updated vulnerable transitive `rand` and AWS SDK lockfile entries to their
+  first compatible patched releases.
+
+## [0.4.1] - 2026-07-26
+
+### Added
+
+- Remote ACP background terminal tasks now persist their cumulative output
+  locally while they run; terminal results use the real remote exit status.
+- Repeated identical tool calls are detected, warned about, and eventually
+  stopped without emitting a misleading assistant response; repeated `true`
+  no-ops use a shorter limit.
+
+### Changed
+
+- Dependabot auto-merge is limited to patch updates. Minor and major updates
+  remain open for manual review.
+- The upstream-watch workflow refreshes the existing review issue with the
+  current upstream commit and version instead of leaving stale issue content.
+- Plugin subagents inherit the parent's already-connected MCP pool through the
+  normal inheritance filter, without allowing plugins to create connections.
+- A fresh managed-MCP catalog is propagated to live sessions and refreshes the
+  tool-search index without requiring an application restart.
+
+### Fixed
+
+- Session-creation failures now clear the stuck loading state, remove orphaned
+  sessions, and surface a useful warning or failure block.
+- A bare `Esc` cancels a running turn in non-vim and minimal modes while
+  fullscreen vim retains navigation semantics; the queued draft is preserved.
+- Fork/rewind copies only live history and the compaction checkpoint files it
+  actually references, rejecting malformed paths and non-regular files.
+
+### Security
+
+- Chutes and Context7 endpoint resolution now rejects insecure schemes,
+  credentials in URLs, private/special-use network targets, and unapproved
+  custom endpoints unless the corresponding explicit development opt-in is
+  enabled. API keys are never sent to custom Context7 endpoints.
+- Generated media streams to temporary files with bounded response sizes and
+  uses create-new persistence so existing artifacts cannot be overwritten.
+- Automatic permission classification only fast-paths deterministic read-only
+  shell commands; classifier failures fall back to the normal user prompt.
+- Permission resolution now honors the folder-trust verdict: an untrusted
+  project's `.claude/settings.json` (including `defaultMode: bypassPermissions`)
+  and `.chutes-build/config.toml` `[permission]` rules are no longer
+  auto-applied. A cloned repository could previously ship permission rules
+  that auto-approved tool calls regardless of the folder's trust state. Global
+  and admin-tier permission sources are unaffected. Found while reviewing
+  upstream grok-build for changes worth porting.
+
+### Documentation
+
+- Reworked the README around a concise product overview, static terminal
+  screenshot, quick start, privacy contract, common workflows, and repository
+  map; removed the obsolete promotional video assets.
+- Added dedicated getting-started and configuration guides, reorganized the
+  documentation index, and aligned privacy, security, architecture, npm,
+  contributor, and embedded `/docs` references with current behavior.
+- Corrected OAuth guidance, media response limits, automatic-permission
+  semantics, remote terminal behavior, `Esc` cancellation, and upstream
+  baseline rules.
+
+## [0.4.0] - 2026-07-23
+
+### Added
+
+- Machine-readable `--json` output for the model catalog and local session
+  list/search/delete commands.
+- Headless worktree creation, including `--worktree-ref`, and headless
+  `--no-subagents` / memory controls.
+- CSS-selector or snapshot-index addressing for browser click/type actions.
+- A complete public CLI and slash-command reference.
+
+### Changed
+
+- Session storage, search, deletion, traces, and workspace state are now
+  enforced as local-only product policy. Inherited remote write-back settings
+  cannot override it.
+- Updates are manual through npm/release artifacts. The runtime no longer links
+  or starts the inherited automatic updater.
+- Custom model catalogs use `CHUTES_MODELS_API_KEY`; ambient Chutes API/session
+  credentials are restricted to allowlisted official HTTPS endpoints.
+- Destructive session, memory, plugin, marketplace, and worktree operations
+  require confirmation or an explicit `--yes`.
+
+### Fixed
+
+- OAuth login (`l` / `/login`, "Sign in with Chutes"): the token exchange (and
+  now refresh) send a `client_secret` when one is configured. The built-in app
+  (`cid_nyt9i...`) currently rejects the token exchange with `invalid_client`
+  unless a secret is sent, despite being documented as a public PKCE client —
+  confirmed by isolating scope as a non-factor in a controlled A/B test.
+  `openid` is also requested again — Chutes' own app docs list it as
+  required, contradicting the assumption an earlier revision of this list was
+  based on.
+- A `client_secret` supplied via `CHUTES_BUILD_OAUTH2_CLIENT_SECRET` /
+  `CHUTES_BUILD_OIDC_CLIENT_SECRET` was silently dropped before reaching the
+  token request whenever `config.toml` also had an
+  `[grok_com_config.oidc]`/`[oauth2]` table: the config merge round-trips
+  through a generic TOML value, which does not preserve fields marked
+  `#[serde(skip)]`.
+- Relative `--cwd` values are canonicalized before changing directories,
+  avoiding a second relative-path resolution.
+- `--load` now behaves as an alias of `--resume`; resume/restore conflicts,
+  headless-only options, `--no-plan`, `--best-of-n`, and prompt/subcommand
+  combinations fail with actionable parser errors instead of being ignored.
+- Agent `--reauthenticate`, `--reasoning-effort`, model-list cancellation,
+  export/clipboard failures, worktree partial failures, plugin registry
+  failures, and custom OAuth refresh secrets now behave consistently.
+- `CHUTES_BUILD_HOME` now relocates user roles/personas and the bundled-agent
+  cache together with the rest of the application state, including on Windows.
+- Media writes roll back partial artifacts when either media or provenance
+  persistence fails.
+
+### Security
+
+- Removed the hidden remote workspace-exposure CLI and disabled the matching
+  leader protocol capability.
+- `mcp list --json` redacts environment/header values, command arguments, and
+  URL credentials/query/fragment data.
+- `agent serve` defaults to loopback, rejects short secrets, and requires
+  `--allow-remote-bind` for non-loopback listeners.
+- Plugin/marketplace removal and generated-media persistence now surface
+  partial failures instead of reporting false success.
+
+### Removed
+
+- Inherited remote share, feedback, coding-data retention, update, setup, and
+  workspace-exposure commands that were unavailable or incompatible with the
+  Chutes Build privacy contract.
+- The no-op `trace --local`, `agent serve --remote`, and duplicate load/update
+  flags.
+
+### Documentation
+
+- README: documented the OAuth environment variables and the custom-client
+  fallback.
+
+## [0.3.0] - 2026-07-22
+
+### Added
+
+- Voice recording bar: an animated wave visual while the mic is capturing.
+- Auto-update checks re-enabled (were previously hardcoded off regardless of
+  config or CLI flag). Still off in debug builds; honors `--no-auto-update`
+  and the new `CHUTES_BUILD_DISABLE_AUTOUPDATER` env var.
+
+### Fixed
+
+- Voice dictation actually works now: default transcription switched to a
+  batch REST call against Chutes' own STT endpoint. The prior WebSocket
+  streaming client only ever worked against the original upstream backend —
+  every dictation attempt against Chutes' inference API failed with a
+  WebSocket 404 (no such route exists there). The streaming transport is
+  still available (`stt_mode = "streaming"`) for a backend that speaks it.
+- Voice dictation: the 10-second no-speech timeout now distinguishes true mic
+  silence (permissions, muted input) from other failures and surfaces a
+  platform-specific fix hint instead of one generic message.
+- Sampler: a zero-retry budget now fails fast instead of silently falling
+  through the generic/rate-limit retry paths; retry backoff sleeps are now
+  cancellable, so a cancelled request during backoff no longer waits out the
+  full delay.
+
+### Security
+
+- Sandbox: fixed a fail-open bypass where an unopenable device file (e.g.
+  `/dev/tty` with no controlling terminal under headless/CI) aborted the
+  entire Landlock/Seatbelt ruleset instead of just skipping that one rule,
+  leaving the sandbox unenforced.
+- Permission auto-mode and exec-risk classification brought forward from a
+  stale pre-0.2.106 baseline: kubectl/`ps`/`rg` heuristic hardening
+  (credential-plugin and environment-dump risks), a 3-tier environment-risk
+  model replacing a binary check, opaque-shell detection, an ambient
+  exec-risk scan for `git -C`/`--git-dir`/submodule config paths, and
+  reinstated consecutive/total auto-deny limits.
+- MCP tool permission checks now use an overlap-aware `server__tool` name
+  parser (rejects names with more than one delimiter boundary) instead of
+  splitting on the first occurrence.
+
+## [0.2.0] - 2026-07-22
+
+### Added
+
+- Chutes-native inference, model discovery, automatic routing, and fallback
+  handling.
+- Adaptive reasoning controls backed by a centralized model capability
+  registry.
+- Advisor and parallel subagent orchestration.
+- Built-in Context7, official Chutes research, web search, browser automation,
+  and project memory.
+- Chutes usage indicators for rolling four-hour and monthly limits.
+- Typed image, video, and audio artifacts with bounded, opt-in terminal
+  previews and native-player fallbacks.
+- Privacy-first defaults with telemetry, remote trace upload, and automatic
+  update checks disabled.
+- Cross-platform npm launcher and native package pipeline.
+- Voice dictation (`/voice`, Ctrl+Space, or the mic icon), enabled by default;
+  recording still starts only on an explicit manual press.
+- Hybrid memory search enabled by default: local recall now combines full-text
+  search with semantic vector search against a built-in Chutes-hosted
+  embedding model (`Qwen/Qwen3-Embedding-8B-TEE`).
+- Advisor now reasons at maximum effort by default (previously inherited
+  whatever effort the parent session was using). `/advisor on|off` enables or
+  disables the subagent; `/advisor <model>` pins the model it uses;
+  `/advisor default` clears the pin. Writes `[subagents.roles.advisor]` /
+  `[subagents.toggle]` in config.toml — the running session's own model is
+  never touched.
+- On-demand OCR (`ocr_page` tool): extracts text verbatim from a single image
+  or PDF page via a dedicated Chutes vision model, independent of the active
+  chat model's vision support. Billed against the account's subscription
+  quota, never the separate marketplace/wallet balance third-party chutes use.
+
+### Changed
+
+- Rebranded the public product, binary, user data directory, and themes as
+  Chutes Build.
+- Cached FFmpeg and package-manager discovery for the lifetime of the process
+  so idle TUI rendering does not repeatedly probe external commands.
+- Bounded account quota fallback concurrency and cached model-capability
+  discovery to reduce unnecessary API work.
+- The model-capability catalog response and the vision transcription client's
+  chat-completion response are now parsed into small typed structs instead of
+  navigated as raw JSON, so an unexpected shape in a field we don't read can't
+  silently change behavior; fields whose absence or wrong shape must stay a
+  soft "not found"/"no match" (a model's `input_modalities`, a transcription's
+  `content`/`finish_reason`) are still parsed leniently, only genuinely
+  malformed responses now surface as a distinct decode error. Account usage
+  and per-chute media responses stay dynamic on purpose — their shapes
+  legitimately vary per tier/quota kind and per third-party chute schema.
+
+### Fixed
+
+- Interactive login: the welcome screen and `/login` had no working path to
+  the OAuth method the rebrand advertised, and no way to enter an API key
+  from inside the running app at all (only the separate `chutes-build login`
+  CLI subcommand worked, before ever starting the TUI). Added "Sign in with
+  Chutes" OAuth end-to-end (issuer, client, scopes, loopback callback) and an
+  in-TUI API key entry reachable from the welcome screen (`k`), `/login`, and
+  `/apikey`, and fixed two stale-state bugs (`auth_show_raw_url`,
+  `welcome_prompt_focused`) that silently swallowed keyboard input on the
+  auth screen.
+- `get_chutes_usage` and all media tools 401'd by default: the account/media
+  HTTP client sent the API key without the `Bearer` prefix `api.chutes.ai`
+  requires.
+- The macOS native build failed to compile (a stray `cfg` left an
+  `std::process` import unreachable in a macOS-only module).
+- The secret sanitizer that filters Sentry/Mixpanel/log output did not
+  recognize the `cpk_` Chutes API key prefix, so real keys were not redacted
+  from those sinks.
+- The browser automation tool left a dead session in place after any
+  connection-level failure (closed socket, crashed browser), making it
+  unusable for the rest of the session until an explicit `close`.
+- `generate_media` only validated the top-level shape of `params` against a
+  cord's schema, so a payload with the right outer wrapper (e.g. `args`) but
+  wrong fields nested inside it passed local validation and round-tripped to
+  Chutes for a generic "Invalid input parameters" error instead of a precise
+  local one.
+- The terminal window/tab title showed "grok" instead of "chutes-build".
+- Memory embeddings always sent requests to the chat completion base URL
+  (`llm.chutes.ai`, which does not proxy `/embeddings` and 404s), and
+  unconditionally requested Matryoshka-truncated output via a `dimensions`
+  field the default embedding model rejects outright (400). Together these
+  made vector memory search completely unusable even when `[memory.embedding]`
+  was explicitly configured. Embeddings now use their own configurable base
+  URL (defaulting to the model's dedicated endpoint) and no longer request
+  truncation.
+- `generate_media` only encoded workspace file paths found at the top level
+  of `params`; a cord requiring a wrapper shape (e.g. `{"args": {"image":
+  "input.png"}}`) never got its nested path encoded, so the literal filename
+  round-tripped to Chutes instead of the file's contents. Asset discovery now
+  recurses through nested objects and arrays.
+- `generate_media`'s schema guard unconditionally overwrote a cord's own
+  `additionalProperties`/`unevaluatedProperties` with its own default —
+  including stripping them entirely when `CHUTES_ALLOW_UNKNOWN_PARAMS` was
+  set, removing a restriction the provider declared rather than just
+  disabling this tool's own default. It now only adds its own restriction
+  where the schema has no existing opinion.
+- `generate_media` accepted any response with an empty or `octet-stream`
+  Content-Type outright, so a Chutes error response (HTML/JSON, sometimes
+  served as `octet-stream` by a proxy) could be saved to disk as if it were
+  the requested media. Responses are now verified against actual byte
+  content, not just the declared header.
+- The model-capability catalog cache held a single global lock for the
+  entire network refresh, serializing every concurrent lookup behind one
+  HTTP request whenever the cache was stale.
+- On the Windows native build, file-tool path remapping (`resolve_model_path`)
+  and the `.gitignore` out-of-repo guard both tested `Path::is_absolute()`,
+  which on Windows also requires a drive letter. The forward-slash-rooted
+  virtual paths these paths actually deal with (e.g. a sandboxed session's
+  `/home/user/project`) were therefore misclassified as relative, silently
+  breaking model-facing path resolution and letting an out-of-repo path fall
+  through to a crate call that can panic. Both now check for a root instead
+  of a full drive-qualified absolute path.
+- On the Windows native build, LSP crash-recovery silently failed to replay
+  a server's previously-open documents after a restart: it derived each
+  document's file path by stripping the literal `"file://"` prefix off its
+  URI, which on Windows leaves an invalid leading slash before the drive
+  letter (`/C:/...`), so the on-disk re-read failed and the document was
+  quietly dropped instead of being replayed. Now uses proper file-URI-to-path
+  conversion.
+
+### Security
+
+- Restricted credential-bearing media invocation to Chutes HTTPS hosts,
+  disabled credential-bearing redirects, and bounded generated-media and input
+  asset sizes.
+- Restricted browser and media output paths to canonical workspace locations,
+  prevented silent file overwrite, and redacted password values from browser
+  snapshots.
+- Added full-history secret scanning, Rust dependency/source policy checks,
+  native archive checksums, and assembled-package smoke testing to CI.
+- `CHUTES_INFERENCE_BASE_URL`/`CHUTES_API_BASE_URL`/`CHUTES_ROUTER_BASE_URL`
+  previously accepted any value with no validation, so an env-var override
+  could silently redirect Chutes credentials to an arbitrary host. These
+  (and the model-router dispatch path, which had the same gap) now require
+  HTTPS and a trusted Chutes/router host by default; `CHUTES_ALLOW_INSECURE_ENDPOINTS`
+  is an explicit opt-in for local development and forks.
+- Outbound requests for Chutes credentials and generated-media downloads now
+  refuse to connect to loopback/private/link-local/reserved addresses,
+  checked at the exact point of connection (closing a DNS-rebinding gap
+  where only literal IP addresses were previously rejected).
+- Unified secret detection: Context7's outbound-query guard and persistent
+  memory filtering matched only 12 hardcoded substrings (`api_key`,
+  `bearer`, `password`, ...) and could miss shapes like a bare AWS key or
+  GitHub token that the existing log/trace sanitizer already caught. Both
+  now route through the same canonical detector.

package/PRIVACY.md

@@ -36,6 +36,8 @@ image/video decoding uses local image codecs and FFmpeg tools when installed,
 and audio uses `ffplay` or the operating system's default player. Preview work
 is bounded, off-thread, serialized, and deferred while inference is active. No
 remote preview, thumbnail, codec, waveform, or playback service is used.
+Non-JSON media downloads stream through local temporary files and are removed
+after persistence or failure; error and JSON bodies remain memory-bounded.
 
 ## Outbound connections
 
@@ -47,9 +49,9 @@ explicit hosted feature:
 | `model-router-ten.vercel.app` | default Chutes-compatible model routing | prompts, selected context/tool schemas, model inputs, Chutes API credential |
 | `llm.chutes.ai` | Chutes inference, model catalog, semantic memory, voice transcription, OCR, and vision | model requests and the selected inputs: prompts/context, memory chunks, audio, images, PDF pages, or sampled video frames; Chutes API credential |
 | `api.chutes.ai` | Chutes account and media APIs | account requests, media parameters and user-selected media assets; Chutes API credential |
-| `api.chutes.ai/idp` | OAuth sign-in and refresh | authorization code or refresh token, PKCE verifier, public/custom client ID, and a custom client secret only when configured |
+| `api.chutes.ai/idp` | OAuth sign-in and refresh | authorization code or refresh token, PKCE verifier, registered client ID, and a client secret only when configured |
 | `chutes.ai/docs`, `chutes.ai/news` | mandatory primary-source verification for Chutes topics | requested official page URLs; no Chutes API credential |
-| `context7.com` | current library documentation | library names and documentation queries; credentials and known secrets are rejected |
+| `context7.com` | current library documentation | library names and documentation queries; known secrets are rejected and an optional Context7 key is sent only to the official HTTPS service |
 | DuckDuckGo or Brave Search | web search | search query; Brave receives only its dedicated key |
 | User-selected web pages | web fetch/browser automation | normal HTTP/browser traffic required by the requested action |
 | User-configured MCP servers/plugins | external tools | data required by the selected tool and its own configuration |
@@ -61,6 +63,12 @@ browser automation. Custom inference models must declare a dedicated
 `api_key`/`env_key`; a custom model-catalog endpoint uses
 `CHUTES_MODELS_API_KEY`.
 
+Local endpoint overrides are rejected unless they pass the official-host HTTPS
+policy or the operator explicitly enables the development-only insecure
+endpoint opt-in. That opt-in relaxes URL/DNS trust for a controlled local fork;
+it does not attach ambient Chutes credentials to arbitrary custom models.
+Likewise, a custom Context7 endpoint never receives `CONTEXT7_API_KEY`.
+
 Model catalog and account usage requests may run during startup after
 authentication. Prompts and repository content are not sent by those discovery
 requests. They leave the machine only in a model/tool request that needs them.

package/README.md

@@ -1,57 +1,38 @@
 # Chutes Build
 
-**A privacy-first, open-source coding agent built for the [Chutes](https://chutes.ai) ecosystem.**
+**A privacy-first, open-source coding agent built for the
+[Chutes](https://chutes.ai) ecosystem.**
 
 [![CI](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml/badge.svg)](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/chutes-build.svg)](https://www.npmjs.com/package/chutes-build)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 
-![Chutes Build](assets/chutes/video/chutes-build-hero.gif)
+Chutes Build combines a polished terminal interface, a production-grade agent
+runtime, Chutes-native model routing, subagents, local memory, multimodal tools,
+web research, and browser automation. Telemetry, remote trace upload, upstream
+session sharing, and phone-home updates are disabled by product policy.
 
-One CLI, no compromises: an interactive terminal UI, a full coding agent
-runtime, native Chutes model routing, parallel subagents, multimodal
-generation, web research, browser automation, and local memory — with
-telemetry, remote trace upload, and phone-home update checks disabled.
+![Chutes Build terminal interface](assets/chutes/screenshot/chutes-build.png)
 
-![Chutes Build terminal UI](assets/chutes/screenshot/chutes-build.png)
+> **Development preview:** Chutes Build is under active development. Review
+> commands and file changes before approving them, especially in unfamiliar
+> repositories.
 
-> **Development preview:** the project is under active development. Build it
-> from source and review agent actions before approving changes.
+## Why Chutes Build
 
-## Contents
-
-- [Highlights](#highlights)
-- [Quick start](#quick-start)
-- [Features](#features)
-- [Configuration](#configuration)
-- [CLI reference](#cli-reference)
-- [Privacy & security](#privacy--security)
-- [Project](#project)
-
-## Highlights
-
-- 🔒 **Privacy by construction** — telemetry, remote error reporting, automatic
-  update checks, remote trace upload, and upstream session sharing are all
-  disabled at the product-policy level.
-- ⚡ **Chutes-native inference** — live model discovery, `Auto (Chutes Router)`
-  as the default, and automatic fallback when a model is temporarily
-  unavailable.
-- 🧭 **Advisor** — an on-demand reasoning agent that reviews plans, blockers,
-  and completion claims without ever taking over the executor loop.
-- 🧩 **Subagent orchestration** — concurrent fan-out with isolated worktrees
-  for real parallel decomposition, not just sequential delegation.
-- 🎨 **Multimodal, natively** — image, video, music, speech, and on-demand OCR,
-  built directly into the Rust runtime instead of a bolted-on MCP process.
-- 🧠 **Hybrid memory & voice** — full-text plus semantic vector recall, and
-  hold-to-record voice dictation, both on by default.
-
-See [Features](#features) below for the complete list.
+| Principle | What it means |
+| --- | --- |
+| **Chutes-native** | Live model discovery, `Auto (Chutes Router)`, model-aware reasoning controls, account usage, OCR, voice, and media generation are integrated directly into the Rust runtime. |
+| **Private by default** | Sessions, memory, traces, logs, configuration, and exports stay local. Cloud features run only when their documented provider call is needed. |
+| **Built for real repositories** | Planning, permission controls, worktrees, MCP, skills, background tasks, advisor review, and parallel subagents share one coherent session model. |
+| **Transparent fork** | Chutes-specific product code is separated from retained `grok-build` infrastructure, with documented upstream review and Apache-2.0 attribution. |
 
 ## Quick start
 
-### Install with npm
+### Install
 
-Release builds install without a Rust toolchain:
+The npm package selects the native binary for Windows, macOS, or Linux. A Rust
+toolchain is not required.
 
 ```powershell
 npm install -g chutes-build
@@ -64,305 +45,162 @@ For one-off use:
 npx chutes-build
 ```
 
-The npm launcher selects a native binary for Windows, macOS, or Linux. It does
-not collect telemetry and does not download executables from an install script.
-
-### Build from source
+The launcher does not download executables from a lifecycle script.
 
-Prerequisites:
+### Authenticate
 
-- Rust stable (`rustup` is recommended)
-- Git
-- a platform C/C++ build toolchain supported by Rust
-
-Protocol Buffer tooling is vendored for normal builds; a separate `protoc`
-installation is not required.
+An API key is the most reliable way to start. Create one in the Chutes
+dashboard, then press `k` on the welcome screen, run `/apikey`, or store it
+through the hidden-input CLI flow:
 
 ```powershell
-git clone https://github.com/TheStreamCode/chutes-build.git
-cd chutes-build
-cargo build -p chutes-build --release
+chutes-build login
+chutes-build
 ```
 
-The Windows executable is `target\release\chutes-build.exe`; on macOS and
-Linux it is `target/release/chutes-build`.
-
-### First run
-
-Run `chutes-build` with no prior setup and log in from the welcome screen:
-press `l` for "Login with Chutes" (opens your browser) or `k` to paste a
-Chutes API key directly. `/login` reopens this choice at any time and
-`/apikey` jumps straight to the API-key prompt.
-
-To provide a key non-interactively instead, create one in Chutes and either
-expose it only to the current process:
+For a process-local credential:
 
 ```powershell
 $env:CHUTES_API_KEY = "your-api-key"
 chutes-build
 ```
 
-or store it using the hidden-input login flow:
+Browser-based OAuth with PKCE is available through `l` or `/login`. Chutes
+OAuth applications may require registered client credentials; see
+[Authentication](docs/getting-started.md#authentication) for the supported
+fallbacks and environment variables.
+
+### Choose a model
+
+`Auto (Chutes Router)` is the default when no model preference has been saved.
+Use `/model` interactively or inspect the live catalog from the CLI:
 
 ```powershell
-chutes-build login
-chutes-build
+chutes-build models
+chutes-build models --json
+chutes-build --model model-router
 ```
 
-`Auto (Chutes Router)` is the first entry in the model picker and the default
-when no preference has been saved. Select a concrete model with `/model` or
-`chutes-build --model <model-id>`. Inspect the resolved catalog with
-`chutes-build models` or machine-readable `chutes-build models --json`.
-
-## Features
-
-### Agent & coding
-
-- **Coding agent runtime:** repository inspection, edits, shell commands,
-  planning, goals, MCP servers, skills, sessions, worktrees, and permission
-  controls inherited from the mature upstream runtime.
-- **Local session lifecycle:** list, search, resume, fork, export, trace, and
-  delete sessions without a remote registry. Machine-readable list/search
-  output is available with `--json`; destructive commands require confirmation
-  unless `--yes` is supplied.
-- **Advisor:** a read-only, on-demand reasoning agent that reviews plans,
-  difficult decisions, blockers, and completion claims without taking over the
-  executor loop. Reasons at maximum effort by default. `/advisor on|off`
-  toggles it; `/advisor <model>` pins a specific model (e.g. your largest or
-  highest-tier available one — Chutes' catalog carries no price/size metadata
-  to pick one automatically); `/advisor default` clears the pin.
-- **Subagent orchestration:** foreground and background workers, concurrent
-  fan-out, multi-worker waits, bounded nesting, and isolated worktrees. The
-  `chutes-build-orchestrator` preset is tuned for parallel decomposition.
-
-### Chutes integration
-
-- **Chutes-native inference:** API-key authentication, live model discovery,
-  `Auto (Chutes Router)` as the first model choice, configurable fallback
-  chains, and automatic retry when a selected model is temporarily unavailable.
-- **Chutes account:** read-only subscription, quota, and usage access through
-  `get_chutes_usage`, a compact plan/quota indicator in the TUI, and detailed
-  `/usage` output. Per-model statistics remain disabled unless requested.
-- **Chutes media:** live discovery and invocation for image generation and
-  editing, video, music, speech, and other supported Chutes media models through
-  `list_media_models`, `describe_media_model`, and `generate_media`. This is the
-  native Rust integration of the `chutes-media-mcp` workflow, so Chutes Build
-  does not need to spawn a separate Node/MCP process for its core media tools.
-  Generated output crosses the tool/ACP/TUI boundary as a typed artifact:
-  images use bounded lazy previews, videos use a two-frame rolling decoder,
-  and music/speech expose local pause/resume, seek, volume, duration, and
-  waveform controls with native-player fallback. Media work starts only while
-  inference is idle, never autoplays, and stays off the TUI render thread.
-- **Capability routing:** image inputs stay with the selected model when it
-  supports vision and are otherwise delegated to a vision-capable Chutes route.
-- **On-demand OCR:** the `ocr_page` tool extracts text verbatim from a single
-  image or PDF page via a dedicated Chutes vision model, independent of the
-  active chat model's vision support. Returns extracted text only — the image
-  itself is never added to the conversation.
-
-### Research & tools
-
-- **Current coding documentation:** Context7 search and documentation tools are
-  built in and avoid sending credentials or known secrets.
-- **Official Chutes research:** before answering Chutes-specific questions, the
-  main agent and subagents consult both the official
-  [documentation](https://chutes.ai/docs) and [news](https://chutes.ai/news),
-  treating directly relevant official pages as primary authority.
-- **Research and browser tools:** native web search (DuckDuckGo by default,
-  optionally Brave) plus agentic Chrome/Edge control through a local DevTools
-  connection and an isolated temporary browser profile. Browser actions accept
-  either CSS selectors or the numeric element indices shown by snapshots.
-
-### Memory & voice
-
-- **Local memory:** Chutes Build maintains a secret-filtered `memories.md` file
-  and can be launched with `--no-memory` when a stateless session is preferred.
-  Recall is hybrid by default — full-text search combined with semantic vector
-  search against a built-in Chutes-hosted embedding model. Semantic recall
-  sends the selected memory chunks to that Chutes embedding endpoint; use
-  `--no-memory` when this is not appropriate.
-- **Voice input:** hold-to-record dictation transcribes speech into the prompt
-  box. Enabled by default; activation is always manual (mic icon, `/voice`, or
-  Ctrl+Space) — Chutes Build never records without an explicit press.
-- **Time awareness and wellness:** the agent receives the local date, time, and
-  timezone and can suggest a break after long or late sessions.
-
-### Privacy by construction
-
-Telemetry, remote error reporting, automatic update checks, remote trace
-upload, upstream session sharing, and remote workspace exposure are disabled.
-Updates are installed manually from npm or a release artifact. See
-[Privacy & security](#privacy--security) below for the full data boundary.
-
-## Configuration
-
-### State root
-
-User state defaults to `~/.chutes-build`. Set `CHUTES_BUILD_HOME` to relocate
-the complete state tree, including configuration, credentials, sessions, logs,
-trace exports, plugins, user roles/personas, and the managed bundled-agent
-cache. Chutes Build does not combine roles or bundle data from the default home
-with a custom state root.
-
-Project-scoped `.chutes-build` directories remain inside their repositories and
-continue to take precedence over user and bundled agent definitions.
-
-### Model selection, reasoning, and routing
-
-Auto sends `model-router` requests to the Chutes router endpoint, allowing the
-service to select a model for the task and handle cold or unavailable capacity.
-A concrete model remains pinned unless a qualifying pre-stream failure advances
-the explicit fallback chain.
-
-Reasoning is model-specific. The model picker exposes only the controls
-supported by the exact deployed generation: binary `Instant`/`Thinking` modes,
-GLM-5.2's three modes, or no selector for fixed and non-reasoning models. Use
-`/effort` interactively or `--effort <option-id>` in headless invocations. The
-published model default is preserved unless the user explicitly changes it.
-
-See [Model reasoning compatibility](docs/model-reasoning-compatibility.md) for
-the current model matrix and forward-compatibility rules.
+## What is included
 
-```powershell
-# Ordered comma-separated fallback chain. model-router is appended as the
-# final Chutes fallback unless strict mode is enabled.
-$env:CHUTES_FALLBACK_MODELS = "model-a,model-b"
+| Area | Capabilities |
+| --- | --- |
+| **Agent runtime** | Repository inspection, edits, shell commands, plans, goals, permissions, sandbox profiles, local sessions, worktrees, and structured headless output. |
+| **Model routing** | Live Chutes catalog, automatic routing, explicit fallback chains, exact-generation reasoning controls, and vision-capability delegation. |
+| **Orchestration** | Read-only advisor, foreground/background subagents, concurrent fan-out, bounded nesting, grouped waits, and isolated worktrees. |
+| **Knowledge** | Context7 library documentation, official Chutes source checks, web search, local full-text memory, and Chutes-hosted semantic recall. |
+| **Multimodal** | Image and PDF OCR, image/video understanding, voice dictation, and typed image, video, music, and speech generation artifacts. |
+| **Automation** | MCP servers, plugins, skills, background tasks, and isolated Chrome/Edge control through local DevTools. |
 
-# Never change the selected model automatically.
-$env:CHUTES_STRICT_MODEL = "1"
-```
+Generated media is streamed to bounded temporary storage and persisted with
+create-new semantics. Inline previews remain local; unsupported terminals use
+safe text cards and native-player fallbacks.
+
+## Privacy contract
+
+| Boundary | Policy |
+| --- | --- |
+| **Local state** | Configuration, credentials, sessions, memory, logs, traces, exports, plugins, and agent definitions live under `~/.chutes-build` or `CHUTES_BUILD_HOME`. |
+| **Hosted inference** | Prompts and selected context leave the machine only for the Chutes model request that needs them. Semantic memory sends selected memory chunks to the configured Chutes embedding route. |
+| **Explicit tools** | OCR, voice, media, web, browser, MCP, and plugin actions send only the inputs required by the selected operation and provider. |
+| **Disabled surfaces** | Product telemetry, remote error reporting, automatic trace upload, upstream session sharing/search, remote workspace exposure, and automatic updates cannot be enabled through normal configuration. |
+| **Credentials** | Ambient Chutes credentials are restricted to allowlisted official HTTPS hosts. Custom endpoints require dedicated credentials and explicit trust configuration. |
+
+Read [Privacy](PRIVACY.md) for the complete data-flow inventory and
+[Security](SECURITY.md) for the threat boundaries and reporting process.
 
-Fallback happens only for transient availability/capability responses and only
-before response streaming begins. Chutes Build does not redirect requests or
-credentials to a non-Chutes inference endpoint.
-
-Ambient Chutes credentials are attached only to official Chutes/router
-endpoints. Custom inference models must declare their own `api_key` or
-`env_key`; a custom model-catalog endpoint uses the dedicated
-`CHUTES_MODELS_API_KEY`. Neither receives `CHUTES_API_KEY` or a cached Chutes
-session token implicitly.
-
-The inference client shares pooled HTTP connections, enables TCP no-delay, and
-forwards parsed SSE events without an application-level streaming buffer. Cold
-starts and model-side generation can still dominate latency. Auto is the
-recommended default when a particular model is not required. The client does
-not apply reduced-quality generation settings; target selection and quality
-remain router decisions.
-Selecting `Instant` can reduce reasoning latency, but it intentionally changes
-the model's reasoning behavior and is never enabled silently.
-
-### Account plan and quota
-
-When authenticated, Chutes Build fetches subscription usage, plan metadata, and
-quota data concurrently. The TUI status bar shows the plan plus the rolling
-four-hour and monthly percentages when available; its color follows the most
-constrained active window and changes at 80% and 100%. Click the indicator or
-run `/usage` for every active window, percentage, and reset time. If aggregate
-quota usage is unavailable, the client falls back concurrently to the
-documented per-chute quota endpoints.
-
-### OAuth login (Sign in with Chutes)
-
-Pressing `l` at the welcome screen (or `/login`) runs a standard OAuth 2.0 +
-PKCE flow against Chutes' own identity provider. The built-in app is a public
-client and does not bundle or require a client secret. Custom confidential
-clients can be configured under
-[Chutes' developer settings](https://chutes.ai/app/api):
+## Common workflows
+
+Start an interactive session in the current repository:
 
 ```powershell
-$env:CHUTES_BUILD_OAUTH2_CLIENT_ID = "cid_..."
-$env:CHUTES_BUILD_OAUTH2_CLIENT_SECRET = "csc_..."   # only if your app has one
 chutes-build
 ```
 
-Both variables are read from the environment and are never written to
-`config.toml` or any other file on disk. The custom secret is included in both
-the initial token exchange and refresh requests. `k` / `/apikey` (pasting a
-Chutes API key directly) needs no app registration.
+Run one headless task:
 
-### Optional web and browser configuration
+```powershell
+chutes-build -p "Review this repository and report only actionable findings"
+```
 
-Web search uses DuckDuckGo without a dedicated key. For Brave Search:
+Create an isolated worktree session:
 
 ```powershell
-$env:BRAVE_SEARCH_API_KEY = "your-brave-key"
-$env:CHUTES_WEB_SEARCH_PROVIDER = "brave"
+chutes-build --worktree feature-auth
 ```
 
-Browser automation discovers Chrome or Edge automatically. Overrides:
+Resume the latest session for the current directory:
 
 ```powershell
-$env:CHUTES_BROWSER_EXECUTABLE = "C:\Program Files\Google\Chrome\Application\chrome.exe"
-$env:CHUTES_BROWSER_HEADFUL = "1" # optional; default is headless
+chutes-build --continue
 ```
 
-Browser screenshots may only be written inside the active workspace. The
-automation profile is temporary, isolated from the user's normal browser
-profile, and launched with sync and background-update features disabled.
+Use `chutes-build --help` for the installed version's authoritative option
+set. See the [CLI reference](docs/cli-reference.md) and
+[slash-command reference](docs/slash-commands.md) for the maintained overview.
 
-Video attachments are sampled locally with FFmpeg and routed as representative
-frames through the same Chutes vision path. Set `CHUTES_FFMPEG_EXECUTABLE` when
-FFmpeg is not discoverable on `PATH`; restart Chutes Build after installing or
-changing FFmpeg so the per-process capability cache is refreshed.
+## Documentation
 
-Media behavior can be tuned with the compatible `chutes-media-mcp` variables
-`CHUTES_OUTPUT_DIR`, `CHUTES_WARMUP`, `CHUTES_COLD_START_RETRIES`,
-`CHUTES_ALLOW_UNKNOWN_PARAMS`, and `CHUTES_PROVENANCE`. Downloaded media is
-limited to 512 MiB by default (`CHUTES_MAX_MEDIA_BYTES`, hard ceiling 2 GiB),
-while workspace inputs are limited to 64 MiB by default
-(`CHUTES_MAX_INPUT_ASSET_BYTES`, hard ceiling 512 MiB).
+- [Getting started](docs/getting-started.md) — installation, authentication,
+  first session, models, and troubleshooting.
+- [Configuration](docs/configuration.md) — state paths, routing, credentials,
+  web/browser options, media limits, and development-only endpoint overrides.
+- [CLI reference](docs/cli-reference.md) and
+  [slash commands](docs/slash-commands.md) — public command surfaces.
+- [Architecture](docs/ARCHITECTURE.md) — runtime layers and ownership map.
+- [npm distribution](npm/README.md) and [release procedure](docs/releasing.md)
+  — launcher contents, native packages, verification, and publication order.
+- [Privacy](PRIVACY.md), [security policy](SECURITY.md), and
+  [security review](docs/security-review.md) — operational trust boundaries.
+- [Documentation index](docs/README.md) — complete user, maintainer, and design
+  reference map.
 
-## CLI reference
+The concise guides available through `/docs` are embedded from
+`crates/codegen/xai-grok-pager/docs/user-guide/`.
 
-The complete command and option reference is in
-[docs/cli-reference.md](docs/cli-reference.md). Interactive slash commands are
-documented in [docs/slash-commands.md](docs/slash-commands.md). Installed
-binaries remain authoritative for the exact version: use
-`chutes-build --help` and `chutes-build <command> --help`.
+## Build from source
 
-## Privacy & security
+Prerequisites are Rust stable, Git, and the native C/C++ toolchain required by
+Rust on your platform. Protocol Buffer tooling is vendored for normal builds.
 
-### Local data
+```powershell
+git clone https://github.com/TheStreamCode/chutes-build.git
+cd chutes-build
+cargo build -p chutes-build --release
+```
 
-User-level state defaults to `~/.chutes-build` or the directory set in
-`CHUTES_BUILD_HOME`. Project memory is stored in `memories.md`. Configuration,
-sessions, logs, exports, credentials, plugins, user roles/personas, and bundled
-agent definitions remain local. Prompts, selected repository content, memory
-embeddings, voice recordings, OCR/media inputs, and browser traffic leave the
-machine only when their corresponding hosted feature is invoked.
+The executable is `target\release\chutes-build.exe` on Windows and
+`target/release/chutes-build` on macOS/Linux.
 
-See [PRIVACY.md](PRIVACY.md) for the exact network and data boundaries.
+### Repository map
 
-### Security model
+| Path | Ownership |
+| --- | --- |
+| `AGENTS.md` | Repository-wide guidance and verification contract for coding agents. |
+| `crates/chutes-build-core/` | Chutes routing, endpoint policy, catalog, reasoning, account, media, privacy, and product policy. |
+| `crates/codegen/` | Retained and adapted upstream runtime crates. Keep crate names stable to make upstream review practical. |
+| `npm/` | Native launcher, platform-package assembly, and npm verification. |
+| `docs/` | Public technical references, maintainer procedures, and design records. |
+| `.github/workflows/` | CI, security policy checks, upstream monitoring, and release packaging. |
+| `prod/` and `third_party/` | Shared protocol sources and retained attribution/material from upstream. |
 
-Chutes Build is an agent capable of reading files, running commands, editing
-code, and controlling an isolated browser. Use it only in repositories you
-trust, review proposed commands, and keep the default permission checks enabled
-for sensitive work. Never place API keys in prompts, source files, or committed
-configuration. See the [security review](docs/security-review.md) for release
-controls, trust boundaries, and tracked dependency exceptions.
+The root `Cargo.toml` is generated and treated as read-only. Make dependency
+changes in the owning crate manifest or generator source instead of manually
+reorganizing the generated workspace.
 
 ## Project
 
-### Provenance
-
 Chutes Build is a substantially modified fork of
-[`xai-org/grok-build`](https://github.com/xai-org/grok-build). The upstream
-project is licensed under Apache License 2.0; this fork retains the upstream
-license and third-party notices.
-
-See [NOTICE](NOTICE), [LICENSE](LICENSE), and
-[THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES) for attribution.
-
-New upstream releases and commits are detected by a read-only scheduled check
-and reviewed through the documented [upstream synchronization
-procedure](docs/upstream-sync.md); upstream changes are never merged or released
-automatically.
-
-### Contributing
+[`xai-org/grok-build`](https://github.com/xai-org/grok-build). Upstream changes
+are reviewed and ported selectively; they are never merged or released
+automatically. See [Upstream synchronization](docs/upstream-sync.md).
 
 Issues and focused pull requests are welcome. Read
-[CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
-[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) before contributing.
+[CONTRIBUTING.md](CONTRIBUTING.md), [AGENTS.md](AGENTS.md),
+[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [SECURITY.md](SECURITY.md) before
+contributing.
+
+Apache-2.0 licensing and attribution are documented in [LICENSE](LICENSE),
+[NOTICE](NOTICE), and [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES).
 
 Copyright 2026 Michael Gasperini (Mikesoft).

package/SECURITY.md

@@ -0,0 +1,73 @@
+# Security Policy
+
+## Supported versions
+
+Chutes Build is currently a development preview. Security fixes are applied to
+the latest revision of the default branch; older source snapshots are not
+supported.
+
+## Reporting a vulnerability
+
+Use the repository's private GitHub Security Advisory reporting flow. Do not
+open a public issue and do not include live credentials, private source code,
+session archives, or personal data in a report.
+
+Include:
+
+- the affected revision and platform;
+- a concise description of the impact and trust boundary;
+- minimal reproduction steps using synthetic data;
+- whether exploitation requires user approval, repository control, browser
+  access, or a malicious model/tool response;
+- any proposed mitigation.
+
+You should receive an acknowledgement when the report is reviewed. Disclosure
+and remediation timing will be coordinated according to severity and the
+availability of a safe fix.
+
+## Security boundaries
+
+Chutes Build can execute commands, modify files, invoke models, start subagents,
+and control an isolated browser. Model output, repository contents, web pages,
+MCP servers, tool responses, and downloaded documents are untrusted input. Keep
+permission prompts enabled, use trusted repositories, and never expose secrets
+in prompts or committed files.
+
+The project intentionally disables telemetry, remote trace uploads, automatic
+updates, upstream session sharing/search, remote workspace exposure, and
+upstream managed configuration. These are compile-time product policies, not
+server-controlled feature flags. Any change to those guarantees requires an
+explicit security and privacy review.
+
+Ambient Chutes credentials are restricted to allowlisted official HTTPS hosts.
+Custom inference and model-catalog endpoints require dedicated credentials.
+OAuth client secrets are read from the environment, used for token exchange
+and refresh when configured, and are never persisted by Chutes Build.
+
+Credential-bearing and download clients reject URL credentials, unexpected
+ports, insecure schemes, redirects, and private, loopback, link-local, or
+special-use DNS results. Development endpoint overrides require the explicit
+`CHUTES_ALLOW_INSECURE_ENDPOINTS=1` opt-in; the opt-in does not make ambient
+Chutes credentials transferable to arbitrary model endpoints. Custom Context7
+endpoints require their own opt-in and never receive `CONTEXT7_API_KEY`.
+
+Machine-readable MCP listings redact environment/header values and URL
+credentials. Destructive session, memory, plugin, marketplace, and worktree
+operations require an interactive confirmation unless an explicit `--yes`
+flag is provided. Media responses stream to bounded temporary storage, default
+to 128 MiB with a 512 MiB hard ceiling, and use transactional create-new
+artifact writes. Automatic permission mode only fast-paths deterministic
+read-only shell commands; classifier failure returns to the normal user prompt.
+
+## Automated release checks
+
+CI scans the complete Git history for known secret patterns and evaluates the
+resolved Rust dependency graph for advisories, licenses, duplicate versions,
+and unapproved sources. Release packaging additionally executes every native
+binary, creates SHA-256 sidecars for native npm archives, verifies those
+sidecars after artifact download, and runs the assembled launcher with its
+native Linux package before publication can begin.
+
+Documented advisory exceptions must include a bounded rationale in `deny.toml`.
+New advisories or source-policy violations fail CI by default. The current
+review record is maintained in [docs/security-review.md](docs/security-review.md).

package/npm/README.md

@@ -1,16 +1,25 @@
-# npm distribution
+# npm distribution and native packages
 
 The public `chutes-build` package is a dependency-free Node.js launcher. Its
 optional dependencies contain the native Rust executable for each supported
 platform, so installation does not require Rust and does not download an
 executable from a lifecycle script.
 
+The launcher archive includes the product README, changelog, security and
+privacy policies, license, and notice. It deliberately defines no install or
+post-install lifecycle script; executable selection happens only when the
+`chutes-build` command runs.
+
 Supported release targets:
 
 - Windows x64 and ARM64
 - macOS x64 and ARM64
 - Linux glibc x64 and ARM64
 
+For installation and first-run instructions, see the repository
+[`README`](../README.md) and the
+[getting-started guide](https://github.com/TheStreamCode/chutes-build/blob/main/docs/getting-started.md).
+
 ## Prepare a platform package
 
 Build the release executable for the target first, then stage its npm package:
@@ -30,12 +39,17 @@ or test scripts. Validate release metadata before packaging:
 
 ```powershell
 npm run verify:release
+npm test
+npm pack --dry-run
 ```
 
 The manual GitHub Actions workflow in `.github/workflows/package-release.yml`
 builds all six native packages. Its publish input is disabled by default and
-requires the protected `npm-release` environment when enabled. See
-[`docs/releasing.md`](../docs/releasing.md) for the full release procedure.
+requires the `npm-release` environment when enabled. Native archives
+are published before the launcher, every publish uses npm provenance, and an
+already published package/version is skipped during a recovery run. See
+the [release procedure](https://github.com/TheStreamCode/chutes-build/blob/main/docs/releasing.md)
+for the complete workflow.
 
 ## Verify the launcher
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "chutes-build",
-  "version": "0.4.0",
-  "description": "Privacy-first coding agent optimized for the Chutes ecosystem",
+  "version": "0.4.2",
+  "description": "Privacy-first, open-source coding agent for the Chutes ecosystem",
   "license": "Apache-2.0",
   "author": "Michael Gasperini (Mikesoft)",
   "homepage": "https://github.com/TheStreamCode/chutes-build#readme",
@@ -24,27 +24,38 @@
     "README.md",
     "LICENSE",
     "NOTICE",
-    "PRIVACY.md"
+    "PRIVACY.md",
+    "SECURITY.md",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=18"
   },
   "scripts": {
     "test": "node --test npm/tests/*.test.cjs",
-    "verify:release": "node npm/scripts/verify-release.mjs"
+    "verify:release": "node npm/scripts/verify-release.mjs",
+    "check": "npm test && npm run verify:release && npm pack --dry-run"
   },
   "optionalDependencies": {
-    "chutes-build-darwin-arm64": "0.4.0",
-    "chutes-build-darwin-x64": "0.4.0",
-    "chutes-build-linux-arm64-gnu": "0.4.0",
-    "chutes-build-linux-x64-gnu": "0.4.0",
-    "chutes-build-win32-arm64": "0.4.0",
-    "chutes-build-win32-x64": "0.4.0"
+    "chutes-build-darwin-arm64": "0.4.2",
+    "chutes-build-darwin-x64": "0.4.2",
+    "chutes-build-linux-arm64-gnu": "0.4.2",
+    "chutes-build-linux-x64-gnu": "0.4.2",
+    "chutes-build-win32-arm64": "0.4.2",
+    "chutes-build-win32-x64": "0.4.2"
   },
   "keywords": [
     "ai",
+    "ai-agents",
     "chutes",
     "cli",
-    "coding-agent"
+    "coding-agent",
+    "developer-tools",
+    "mcp",
+    "multimodal",
+    "privacy",
+    "rust",
+    "terminal",
+    "tui"
   ]
 }