chutes-build 0.4.2 → 1.0.0

package/CHANGELOG.md

@@ -6,6 +6,534 @@ project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-08-07
+
+Chutes Build is re-based onto `xai-org/grok-build` 1.0.0 (`afbc0fb`) and adopts
+its version, so the number now says which upstream this build actually is.
+
+### Why the re-base
+
+`.github/upstream.json` recorded `lastReviewedVersion: 0.2.117`, but those
+commits had been *reviewed and not taken* — the records said "nothing safe to
+port in isolation". For the retained crates the tree was still at the 2026-07-17
+fork point, 2075 files and roughly 440k lines behind upstream. Cherry-picking
+could not close that: upstream added 94k lines in five days. Measuring the fork
+showed why re-basing was the cheaper path — only 102 files existed here and not
+upstream, and only 26 actually consume `chutes-build-core`.
+
+### Added
+
+Everything upstream shipped between the fork point and 1.0.0 arrives at once:
+1348 files of work from the never-taken window, plus the roughly 110 changes
+between 0.2.117 and 1.0.0. Highlights users will notice: session recaps that
+follow the language of the conversation, narrow markdown tables that reflow
+inside their cells with hard splits on grapheme boundaries, a plan-viewer
+scrollbar that is easier to grab, `--output-format streaming-messages-json`,
+tabbed usage and session-info, and a large batch of terminal, tmux and session
+fixes.
+
+### Security
+
+Carried forward and, where upstream had since fixed them differently, taken from
+upstream instead:
+
+- Permission rules for Read, Edit and Grep lexically normalize the tool's path
+  before the glob match, so `Read(src/**)` can no longer be escaped with
+  `src/../../etc/passwd`.
+- `NotebookEdit` / `NotebookRead` no longer alias onto `Edit` / `Read`.
+- A client-forwarded MCP server matching an on-disk Claude or Cursor config is
+  rejected while that vendor's `mcps` switch is off.
+- Diagnostic logging of a credential fragment no longer panics on a non-ASCII
+  token.
+- Chutes API keys (`cpk_`) are recognised by the secret redactor.
+- Memory passes through the secret filter at every write path, and every write
+  path now creates its file owner-only. Three of the four created files with the
+  process umask, so a fresh install's `MEMORY.md` and both bootstrap templates
+  were world-readable — and memory holds whatever you asked the agent to
+  remember.
+- `model-router` dispatch validates `CHUTES_ROUTER_BASE_URL` through the
+  endpoint policy before a session credential is sent to it.
+- The default inference endpoint is `llm.chutes.ai` again. The re-base had left
+  upstream's `api.x.ai/v1`, so any model entry without an explicit base URL
+  would have sent a Chutes API key to xAI.
+- The relay and gateway WebSocket endpoints are loopback sentinels again, not
+  `code.grok.com` and `grok.com`. Chutes Build has no vendor relay; those paths
+  must fail closed.
+- The changelog fetch, the update check and the remote-session/workspace clients
+  point at a closed loopback port, so none of them can phone home.
+- The npm scaffold that would install `@xai-official/grok-<platform>` binaries on
+  postinstall is gone, along with the version check that compared this build
+  against upstream's package.
+
+### Fixed
+
+- Cloudflare edge failures (520–524, 529, 530) are retried instead of ending the
+  turn, while origin-TLS 525/526 stay fatal.
+- A server `Retry-After` is clamped to 30s and jittered.
+- Failed requests no longer dump a Cloudflare HTML error page into the terminal.
+- The sandbox starts on large workspaces (deny-glob entry budget 200k → 2M).
+- `bin/protoc` is a DotSlash wrapper Windows cannot execute from a build script;
+  a vendored platform binary is now the fallback.
+
+### Fixed (the Chutes tool layer was unreachable)
+
+- **`generate_media`, `list_media_models`, `describe_media_model`, `browser`,
+  `ocr_page` and `get_chutes_usage` were in no toolset.** The re-base kept every
+  implementation and dropped every registration, so six thousand lines of working
+  code compiled, passed their own tests, and could not be called. Upstream's
+  toolsets carried its Imagine tools instead, which talk to an endpoint Chutes has
+  no equivalent for.
+- **`/imagine` and `/imagine-video` had disappeared**, for the same reason: the
+  pager hides a command whose required tools are not advertised, and they required
+  the xAI Imagine tools. Both now use `generate_media`, and their instructions
+  teach the Chutes workflow — list the catalog, describe the model, compose the
+  payload from the cord's own example — because no two Chutes media models share a
+  schema. `/imagine-video` is rewritten rather than renamed: upstream's guidance
+  opens with "there is no text-to-video tool", which is true of that API and false
+  here.
+- **Plugin sources in the system temp directory were auto-trusted on Windows.**
+  Auto-trust covers anything under the user's home, and on Windows temp *is* under
+  the home — so a plugin unpacked there skipped the explicit trust step entirely.
+  Found by a test that had been failing on Windows since before the re-base.
+- Five upstream test failures on Windows are gone; `xai-grok-agent` now passes all
+  578. Two were real defects rather than test bugs: the trust hole above, and a
+  home-directory guard no test on Windows could reach.
+
+### Authentication
+
+Upstream ships an OAuth application everyone signs in through, so its
+documentation and defaults put browser login first and treat the API key as a
+fallback. Chutes does not work that way: OAuth needs an application you register in
+your own account area at [chutes.ai/app/api](https://chutes.ai/app/api), so there is
+no client ID that could serve anyone but its owner.
+
+- **The compiled-in OAuth client ID is gone.** It offered a sign-in that would fail
+  for every user but one. `OAuth2ProviderConfig::from_env` now returns `None` unless
+  `CHUTES_BUILD_OAUTH2_CLIENT_ID` names an app, which is also upstream's shape and
+  so one seam fewer at the next merge. With no app configured, `login` already said
+  the right thing — "Sign-in is not available for this deployment. Set
+  CHUTES_API_KEY instead." — and now that message is reachable.
+- **A cached session survives a shell with no OAuth app configured.** The
+  compatibility check compares a credential's issuer against the configured one;
+  with no provider configured there is nothing to compare against, and the question
+  becomes which credentials are self-sufficient. A session is: `oidc::refresh`
+  renews it from the issuer and client id stored in the credential itself, not from
+  the config. So exporting `CHUTES_BUILD_OAUTH2_CLIENT_ID`, signing in, and then
+  launching from a desktop shortcut or a cron entry that lacks the variable keeps
+  working — discarding the session there would strand the user in the one state
+  where interactive login is unavailable. The legacy issuer-less `WebLogin`
+  credential is still rejected, now for either config shape, because it has neither
+  issuer nor client id to renew with.
+- **The documentation was rewritten around the API key**, which is the primary and
+  always-valid credential rather than a fallback: the authentication chapter, the
+  first-launch section of the getting-started guide, `docs/getting-started.md` and
+  the README. `docs/getting-started.md` had also described a "bundled client ID"
+  that no longer exists.
+- **`jsonwebtoken` had no provider to sign or verify with.** It picks one from cargo
+  features, and this graph enables both: the shell declares `rust_crypto`, while
+  `xai-file-utils` -> `gcloud-storage` -> `gcloud-auth` enables `jwt-aws-lc-rs`. Cargo
+  unifies features across the graph, so neither can be turned off from here, and with
+  both on the crate refuses to choose — every signature operation panics. Production
+  survived on placement alone: `run_login_flow_with_config` installed a provider and
+  is the only entry to the one function that verifies an id_token, which holds exactly
+  until a second verification path appears. The install now sits at each point of use,
+  behind a `OnceLock`, so the library is correct by construction; 23 auth tests that
+  had been failing on Linux CI depend on it too.
+- **Six example keys read `CHUTES_API_KEY="xai-..."`** — upstream's prefix, left
+  behind when the rebrand renamed the variable but not its value. A Chutes key is
+  `cpk_`-prefixed, which the redactor already knew and the docs did not.
+
+The API key also has to be *enterable*, and on this branch it was not:
+
+- **`/apikey` did not exist.** `slash/commands/apikey.rs` came across in the
+  re-base and was never declared in `slash/commands/mod.rs`, so it was not
+  compiled — the same registration gap as the Chutes tool layer, in a third
+  registry, and invisible for the same reason: an unreferenced module is not
+  built, so nothing warns. Everything it needs went with it —
+  `Action::EnterApiKey`/`SubmitApiKey`, `Effect::SubmitApiKey`,
+  `AuthMode::ApiKeyEntry`, the dispatchers, the welcome-screen arm, the `k` key.
+  The shell half was intact the whole time: `chutes.build/setApiKey` is handled in
+  `extensions/auth.rs` and allow-listed in `acp_agent.rs`. Nothing could reach it.
+- **`/login` jumped straight into OAuth** instead of asking, because
+  `Action::ShowLoginMenu` went the same way. It now opens the choice menu
+  ("Login with …" / "Enter API key" / "Quit") that the fork's `/login` always did.
+- Together these meant a fresh install advertised exactly one login method —
+  browser sign-in — which without a registered app cannot run. The only way in was
+  to set the environment variable before starting the program.
+- Four registries now, and the fourth caught itself: the pager's
+  `pager_builtin_triggers_are_reserved_in_shell` failed the moment `/apikey`
+  became real, because `apikey` was not in the shell's `PAGER_COMMAND_KEYS` and a
+  skill of that name could have shadowed it. Reserved. The new
+  `apikey_registered_in_builtin_commands` is the test that would have caught the
+  original gap.
+
+The documentation had described `/apikey` and the in-app entry all along, in
+`docs/slash-commands.md` and `docs/getting-started.md`. Third time in this release
+that auditing the docs against the code found the code wrong.
+
+### Fixed (voice had no working transport)
+
+- **Speech-to-text could not work at all.** The re-base took upstream's 1.0.0 voice
+  crate, which is streaming-only — it opens a WebSocket to `{api_base}/v1/stt` — and
+  the rebrand pointed that at `api.chutes.ai`, where the route does not exist. Chutes
+  serves Whisper-family models as ordinary chutes over request/response HTTP, which
+  is exactly why the fork wrote a batch transport and made it the default. The two
+  files implementing it, `pcm.rs` and `stt/batch.rs`, came across in Fase 1 and were
+  never declared in any module, so neither was compiled; `SttMode`, `batch_api_base`
+  and the pipeline's batch branch were not copied at all. What shipped was a feature
+  whose only transport was a route the backend does not serve.
+- Restored as a graft onto upstream's newer pipeline rather than a copy over it:
+  the subprocess capture that replaced the in-process one no longer exposes
+  `peak_meter()`, so the silence guard takes its running peak from the chunks with
+  `pcm::peak_abs_i16_le` — which is what that module is for, and the batch path holds
+  every sample anyway.
+- `[voice].api_base` goes back to a closed loopback address. Streaming has no Chutes
+  backend, so the default must fail immediately rather than resolve to a real host
+  that cannot answer.
+- Batch STT now posts through `xai_grok_http::shared_client()` instead of building a
+  bare `reqwest::Client`. The fork's version skipped `CHUTES_EXTRA_CA_BUNDLE` — a
+  proxy-terminated corporate network is precisely where that request would otherwise
+  fail — and the connection health-checks.
+- The STT transport is documented in `docs/configuration.md`, which had listed the
+  media variables and said nothing about how speech is transcribed. The 0.4.x
+  changelog had mentioned `stt_mode = "streaming"` all along.
+- `xai-grok-http/src/extra_ca.rs` deleted: upstream 1.0.0 ships `xai-grok-extra-ca`,
+  reading the same `CHUTES_EXTRA_CA_BUNDLE` with a size cap and rustls validation the
+  fork's copy lacked, and `xai-grok-http` already calls it. The old module was dead
+  code that a reader would have taken for the live one.
+
+A sweep for the same failure mode — a source file that no `mod` declaration
+reaches, and so is never compiled — found four in total across the tree, honouring
+`#[path]` and `include!` to avoid false positives. All four are addressed in this
+release; the sweep now returns nothing.
+
+### Added (the Advisor is back)
+
+The fourth undeclared file was `/advisor`, and unlike the others its backend had
+not come across either — so this is a feature port rather than a registration,
+though a small one, because the `[subagents.roles]` model-pin mechanism it hangs
+off is upstream's and was already here.
+
+- **The `advisor` built-in subagent**, invoked like any other through `task` with
+  `subagent_type: "advisor"`: an on-demand senior reviewer for architecture,
+  correctness, security and trade-offs. Read-only by construction — repository
+  inspection, Context7, memory and web fetch, with no shell, no edit and no nested
+  agents — so it can review a claim without being able to act on it. Defaults to
+  maximum reasoning effort, because it is called sparingly for plans, blockers and
+  completion claims, where review quality matters more than latency.
+- **`/advisor`** turns it on or off and pins the model it uses, writing
+  `[subagents.toggle].advisor` and `[subagents.roles.advisor].model`. An empty pin
+  clears it and the advisor inherits the session's model. `true` is removed rather
+  than written, so an untouched config file stays untouched.
+- `advisor` is reserved in the shell's `PAGER_COMMAND_KEYS` — the check that caught
+  the same omission for `/apikey`.
+
+### Security (`agent serve` authentication)
+
+Two CodeQL alerts pointed at `print_serve_startup_info` writing a secret to stderr.
+Following them found the token itself was the problem, and the printing was the
+least of it:
+
+```rust
+let raw = uuid::Uuid::new_v4().to_string().replace('-', "");
+raw.chars().cycle().take(len).collect()   // len = 12
+```
+
+- **The token was 48 bits.** Twelve characters of a v4 UUID's hex, for a credential
+  that authorises a server which runs shell commands and edits files, on a `/ws`
+  endpoint with no rate limit. Now 32 bytes from the OS CSPRNG, base64url without
+  padding. The `cycle()` also meant any length above 32 repeated the same UUID while
+  looking like it added entropy.
+- **The comparison was not constant-time.** `token == expected_secret` on `&str`
+  returns at the first differing byte, so an unauthenticated caller could recover the
+  token one byte at a time — roughly 12 x 16 attempts instead of 2^48. Now
+  `ring::constant_time::verify_slices_are_equal`, with the length compared separately
+  because it is not secret. `ring` moves from dev-dependency to dependency, which
+  costs nothing: it was already in this crate's normal build graph via aws-config.
+- **The token is printed only when stderr is a terminal.** An operator reading their
+  own console still gets it; a redirected stderr — a systemd journal, a CI log,
+  `2>serve.log` — no longer persists a live credential to disk. That was CodeQL's
+  actual finding.
+- **A non-loopback `--bind` now warns.** The transport is `ws://` and the token
+  travels as a query parameter, so binding to a routable address puts both on the
+  wire in cleartext. Previously silent.
+
+Eight tests, including that a correct prefix does not authenticate and that an empty
+presented token is rejected.
+
+The other 308 open alerts were triaged by reading each flagged line on `main`: 263
+are test fixtures, and the rest are `session_id` values (a UUID naming a local file,
+not a credential), closed-loopback sentinels for the features policy disables, or
+URLs whose `https` scheme `endpoint_policy::validate_endpoint_url` enforces where
+CodeQL cannot see it through a `format!`. One more real finding needs no fix here:
+`bin/trace_classify.rs` logged an API key, and this release deletes that binary.
+
+Those 308 are now dismissed on GitHub, each with the reasoning for its group rather
+than a blanket note; the 3 real ones stay open so the next scan closes them as fixed,
+which is a truer record. The two Dependabot `lru` alerts are dismissed as `not_used`:
+the advisory is an `IterMut` Stacked Borrows violation, and neither crate holding an
+`LruCache` ever iterates it — `ratatui 0.29` memoizes layouts through `get`/`put`,
+`aws-sdk-s3` has no `iter_mut()` at all. Bumping `aws-sdk-s3` to the release that
+does require the patched `lru` was tried and reverted: it drags the aws-smithy stack
+forward, wants rustc 1.94.1 against this repo's 1.94.0 pin, and still leaves
+`ratatui 0.29` as a source. `docs/code-review-2026-08-01.md` CR-003 records the
+evidence and what closing it would actually cost.
+
+### Repository and CI
+
+Landing the re-base exposed two checks that had never run against this tree, both
+broken by the re-base itself rather than by anything in it:
+
+- **The secrets scan pinned its allowlist to commit SHAs.** `.gitleaksignore` listed
+  twelve reviewed fixtures as `<sha>:<path>:<rule>:<line>`; the re-base moved every
+  one into a new commit and all twelve went stale together. Since this project tracks
+  upstream by re-basing, that mechanism was guaranteed to break at every sync. Six
+  fixtures are now allowlisted **by value** in `.gitleaks.toml`, which survives a
+  rewrite, and six that exist only in old commits — from before upstream annotated
+  the lines — keep SHA pins, in published history that will not move. Verified three
+  ways: clean tree, clean 159-commit history, and a probe proving a realistic `ghp_`
+  token and a real ES256 JWT sharing the fixtures' own header are still reported.
+- **`cargo deny` had been skipped every run**, because gitleaks failed before it in
+  the same job. It reported an undeclared git source — `our-forks/async-openai`,
+  upstream's fork and the client the sampler uses for Chutes' OpenAI-compatible API —
+  and five advisories, none with a patched release. Each is now ignored with a
+  reachability check that was run rather than assumed: no `{:p}` anywhere for the
+  crossbeam-epoch formatting bug, zero `git2::Remote::list` call sites, and a logging
+  stack that does not depend on `rand` for the re-entrancy advisory.
+
+- `git2` 0.20.4 for the `Buf` dereference advisory, carrying libgit2 1.9.1 -> 1.9.6.
+  Its two other advisories have no fixed release yet.
+- Releases now carry the six platform executables. All three existing releases have
+  notes and **zero assets**, while the README said "take a binary from Releases" —
+  so anyone not using npm had nowhere to download this program from. The workflow
+  attaches them from the run that built them, and refuses to publish if one is
+  missing.
+- A social-preview card, three README badges, and the release notes taken from this
+  file rather than written twice.
+
+### Documentation
+
+The documentation was audited against the code rather than proofread, which is a
+different exercise and found things a read-through would not:
+
+- **The README presented the project as SpaceXAI's, under SpaceXAI's logo.** This
+  is a fork; upstream wrote most of the code and is credited for it, but not with
+  authorship of this tree, and their mark is theirs. `CONTRIBUTING.md` likewise
+  described upstream's "no external patches" policy as if it were ours.
+- **`SECURITY.md` sent vulnerability reports to xAI's HackerOne programme** — to
+  people who do not maintain this code and cannot fix it, disclosing our issue to
+  a third party on the way.
+- **Every install instruction was a 404.** `chutes.ai/cli/install.sh`,
+  `install.ps1`, `chutes.ai/cli`, `chutes.ai/build/changelog`,
+  `console.chutes.ai`, and the `docs.chutes.ai/build/overview` that `/docs` itself
+  opened. Each replacement was checked with a request.
+- **Config examples named `grok-4.5`**, which this build cannot serve, and
+  `chutes-build update` was documented as the way to upgrade when it installs
+  nothing.
+- **The ACP extension methods were documented under `x.ai/`** while the handlers
+  answer on `chutes.build/` — the page integrators read to know what to call.
+- **Version pinning, the telemetry knobs and the coding-data row were documented
+  as working controls.** All four version keys parse and nothing acts on them; the
+  telemetry switches are compiled out; the privacy row is locked. Each now says so.
+- **Two guide chapters existed on disk and shipped nowhere.** `USER_GUIDE` lists
+  what `/docs` shows and what is extracted to `$CHUTES_BUILD_HOME/docs`, and the
+  fork's Chutes-ecosystem and browser chapters were not in it — the same
+  registration gap as the tool layer, in a different registry. Renumbered to 25 and
+  26 and registered.
+- Memory's owner-only file permissions and the absence of any coding-data
+  retention control are now stated in `PRIVACY.md`, where a reader looks for them.
+
+One code defect came out of the audit, in the direction that matters — the docs
+were right and the code was not:
+
+- **A custom model-catalog endpoint received the ambient `CHUTES_API_KEY`.**
+  `PRIVACY.md` promises it never does and documents `CHUTES_MODELS_API_KEY` for
+  that case; the re-base dropped the separate auth arm, so pointing
+  `CHUTES_BUILD_MODELS_LIST_URL` at any host sent it your Chutes credential during
+  startup. Restored, with the test asserting the separation.
+
+### Changed
+
+- The upstream sync procedure changes from "port selectively, never merge" to a
+  merge of `upstream/main` with conflicts expected in the Chutes seams. See
+  `docs/upstream-sync.md`.
+- `project_picker` and the bundled `SKILL.md` files follow upstream and are
+  removed.
+- The coding-data retention row in settings is locked with a reason instead of
+  offered: this build has no such control, and the extension behind the row
+  already refused the call. The data-sharing banner never renders for the same
+  reason.
+- Rate-limit and tier-restriction messages no longer pitch an upstream
+  subscription. The 429 message named SuperGrok and linked to it; the media
+  tools told the model to sell it.
+- `scripts/seam_sweep.py` (new) compares the values the previous release shipped
+  against a re-based tree. It exists because a constant whose value came from
+  upstream compiles fine and its tests assert against the constant, which is how
+  the endpoint and credential defaults above survived a green gate.
+
+### Fixed (identity)
+
+Behavioural verification of the built binary, which the gate cannot do, found
+the product still calling itself Chutes Build in the places users actually look:
+
+- `--version` printed `grok 1.0.0`; `Usage:` printed `grok`, because `parse_cli`
+  filters `argv[0]` against a launcher allowlist that did not include our own
+  binary name.
+- 983 occurrences of the bare product word in CLI help and error text had no
+  rebrand rule at all, and 14 stderr diagnostics were prefixed `grok:` — the
+  name of a program that does not exist.
+- `models` offered `grok-4.5`: the model catalog had come across from upstream.
+- The built-in agent profiles parsed as `grok-build-plan` while every caller
+  asked for `chutes-build-plan`, so `--agent chutes-build-plan` resolved to
+  nothing and plan mode fell back to the default profile.
+- The session update and close notifications kept upstream's `_x.ai` extension
+  namespace in the replay filter, the session store and the pager's method table,
+  while the handlers answered on ours. (Written without the trailing slash on
+  purpose: the rebrand rule that fixes those names would otherwise rewrite this
+  sentence describing them, as it did once already.)
+
+Then a real Chutes API key went in, and found what no static check had:
+
+- **The ambient API key was read from `XAI_API_KEY`**, while every error message,
+  every doc page and the fork itself said `CHUTES_API_KEY`. Anyone following the
+  instructions was never authenticated. The auth-method id users write as
+  `preferred_method` in `config.toml` was upstream's too. 304 occurrences across
+  69 files.
+- **570 places told the user to run `grok login`, `grok doctor`, `grok wrap …`**
+  in help text, error messages and the bundled user guide. An instruction naming
+  a binary that does not exist is worse than no instruction.
+- **`update --check` reached `storage.googleapis.com`** for a channel pointer in a
+  bucket that does not exist — a third update endpoint, hidden from the seam
+  sweep because rustfmt had wrapped its value onto the next line. Deadened at
+  loopback like the other two.
+
+- **The notification-hook tests were writing the whole process environment,
+  API key included, into files in the crate root.** They interpolated an
+  unquoted Windows path into `sh -c`, so the redirect missed the temp directory.
+  Thirty such files had accumulated and been committed to the re-base branch;
+  history was purged, `.gitignore` now blocks the pattern, and the keys were
+  rotated. The branch had never been pushed.
+- **A blank `CHUTES_API_KEY` counted as set**, so a CI job exporting a secret
+  that does not exist was told it was using an API key and then failed to
+  authenticate. Blank is unset now, as it already was for per-model `env_key`.
+
+With those fixed, a live run authenticates, lists the 15 Chutes models from
+`llm.chutes.ai`, and completes a turn through the Auto router in about 13
+seconds, talking only to `api.chutes.ai`, `llm.chutes.ai` and the configured
+router — never to `x.ai` or `grok.com`, and writing nothing outside
+`$CHUTES_BUILD_HOME`.
+
+
+## [0.4.3] - 2026-08-03
+
+### Added
+
+- The `browser` tool gained the actions its workflow was missing: `wait`
+  (until a selector is visible or page text appears), `key` (`Enter`, `Tab`,
+  `Escape`, arrows, `Home`/`End`, `PageUp`/`PageDown`), `scroll`, `select`,
+  `back`, `reload`, `text` (full visible page text), and `console` / `network`,
+  which report the session's browser logs, uncaught errors, and requests.
+- Documented desktop control as an opt-in MCP integration, including what
+  enabling it gives away, since no built-in tool captures the screen or
+  synthesizes input.
+- `--output-format streaming-messages-json` emits headless output in the
+  Anthropic Messages API wire shape: a `system`/`init` line, `assistant` lines
+  whose `content[]` carries thinking, text and `tool_use` blocks, `user` lines
+  carrying each `tool_result`, and a final `result`. Ported from upstream.
+- `streaming-json` now reports tool activity as `tool_call` and
+  `tool_call_update` lines. The headless runner ignored ACP tool-call updates
+  entirely, so a consumer could see the agent's prose but never what it did.
+- `CHUTES_EXTRA_CA_BUNDLE` adds extra TLS roots from a PEM bundle, for networks
+  where a proxy terminates TLS with its own root. Opt-in and additive: unset by
+  default, never replaces the built-in roots, and never disables verification.
+  A bundle that is oversized, unreadable, or unparseable is reported and
+  ignored instead of breaking every request. Ported from upstream, reworked to
+  use reqwest's own PEM bundle parsing rather than adding a crate to the
+  generated workspace root.
+
+### Fixed
+
+- `browser click` now focuses the element before clicking, matching a real
+  pointer click. Without it a click on a field left focus on the body, so a
+  following `key` went nowhere.
+- Cancelling now stops an in-flight `/compact`. Compaction runs as a command
+  rather than a turn, so the cancel path returned early and left a long
+  compaction running with no way to stop it. Other commands are unaffected.
+  Ported from upstream.
+- Saving MCP settings no longer discards the rest of `config.toml`. Every MCP
+  writer parsed the file with a fallback to an empty table, so one syntax error
+  turned the next save into a full rewrite containing only what that call was
+  persisting. Unparseable configs are now refused, the user-config write lock
+  covers the whole read-modify-write so concurrent saves cannot erase each
+  other, and writes go through the shared atomic helper instead of a fixed
+  temporary filename two writers could collide on. Ported from upstream.
+- The encrypted prompt templates no longer depend on how the repository was
+  checked out. Generator and staleness test compared raw `include_str!` bytes,
+  so arrays built on a CRLF working tree matched only on Windows; both sides
+  now fold line endings first, which also makes the decrypted prompt
+  byte-identical on every platform.
+- Two pager tests no longer depend on the machine they run on: one budgeted its
+  wait in poll counts rather than elapsed time, and two built past instants by
+  subtracting more than the machine's uptime, which panics on a recently booted
+  box or a fresh CI runner.
+- `/advisor` now spawns. Its curated toolset already declares `memory_search`,
+  `memory_get` and `web_fetch`, and session-level injection appended a second
+  copy of each; both entries resolved to one client-facing name, so toolset
+  validation rejected the agent with `duplicate client_name` on every attempt.
+  Injection now skips tools the agent already declares.
+- Bundled skills cited tool names the model is never shown (`task` is exposed
+  as `spawn_subagent`, `run_in_background` as `background`), sending it after
+  tools absent from its schema. Names corrected in `/best-of-n` and
+  `/check-work`, with a test tying skill text to the advertised names.
+- Repaired the nine stale `xai-grok-agent` tests: two asserted behavior the
+  code no longer has (retired `grok_*` toolset presets, `web_search` before it
+  became a default-on native provider), three compared prompt budgets against
+  raw `include_str!` output that a CRLF checkout inflates, two compared paths
+  with hardcoded forward slashes, and two staged a fake home through `$HOME`,
+  which `dirs::home_dir` honours only on Unix. The two home-dependent rules are
+  now split into injectable helpers covered on every platform, and their
+  environment-driven integration tests are marked Unix-only.
+- The CI Rust job now runs the `xai-grok-agent` library tests and the bundled
+  skill checks, which were previously never executed by any workflow.
+
+### Changed
+
+- `generate_media` is self-contained: it resolves a plain model name against
+  the catalog and places the new top-level `prompt` into whatever text field
+  the selected cord declares, so `{model, kind, prompt}` is a complete call.
+  `params` is now optional and only needed for non-default settings or input
+  assets, and schema-mismatch errors list the accepted fields instead of
+  directing the caller back to `describe_media_model`. The `/imagine`,
+  `/imagine-video` and `imagine` skill instructions no longer mandate the
+  three-call list → describe → generate sequence.
+- Updated the pinned `actions/checkout` workflow dependency to `v7.0.1`,
+  including its Git argument escaping and pull-request safety fixes.
+
+### Security
+
+- Marked the three synthetic secret-detection fixtures explicitly so both
+  worktree and full-history Gitleaks scans pass without weakening real-secret
+  detection.
+
+### Documentation
+
+- Recorded the CodeQL static-analysis triage in the security review: current
+  alert counts, the disposition of each query, and the reachability argument
+  showing the retained upstream backend client cannot run while
+  `REMOTE_SESSION_REGISTRY` is `false`.
+- Documented the pinned Rust/Node toolchain, the single supported package
+  manager, the artifacts the project actually produces, the protected assets
+  and generated files, and the repository-visibility rules in `AGENTS.md`.
+- Described the advisor's actual read-only toolset and the `/advisor` controls
+  in the subagents guide, and recorded the self-contained `generate_media`
+  workflow in the Chutes ecosystem and MCP guides.
+- Listed the browser tool's full action set — what each reading action reports
+  and how elements are addressed — in the web and browser guide, and documented
+  `CHUTES_EXTRA_CA_BUNDLE` alongside the endpoint settings.
+- Documented both headless streaming formats and what each line carries in the
+  CLI reference, and noted in the slash-command list that `/compact` can now be
+  stopped while it runs.
+
 ## [0.4.2] - 2026-08-01
 
 ### Added
@@ -16,7 +544,7 @@ project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 
-- Reviewed Grok Build upstream through `0.2.117` and recorded the selective
+- Reviewed Chutes Build upstream through `0.2.117` and recorded the selective
   port and deferral decisions.
 - Removed the orphaned Dependabot auto-merge workflow after automated version
   update PRs were disabled.

package/PRIVACY.md

@@ -11,13 +11,23 @@ where supported, sessions, logs, local exports, and user memory under
 `~/.chutes-build` (or `CHUTES_BUILD_HOME`). Plugins, user roles/personas, and
 managed bundled-agent definitions use that same root; setting
 `CHUTES_BUILD_HOME` does not fall back to those resources in the default home.
-Project memory is maintained in `memories.md`. Known secret formats are filtered
-before memory writes, but users should still avoid entering secrets into
-prompts.
+Project and global memory are maintained in `MEMORY.md` under that root, with
+per-session logs beside them. Known secret formats are filtered before every
+memory write, but users should still avoid entering secrets into prompts. Memory
+files are created owner-only (mode 0600 where the platform has POSIX
+permissions), including the bootstrap templates written on first run.
 
 `chutes-build trace` always creates a local archive. Remote session sharing and
 search, remote workspace exposure, upstream managed configuration commands, and
-automatic update checks are disabled. Session storage is forced to local mode
+automatic update checks are disabled — compiled out through
+`chutes-build-core::product`, with their endpoints pointed at a closed loopback
+port rather than left resolvable.
+
+There is no coding-data retention opt-in. Upstream offers one, both as a settings
+row and as a startup banner; here the setting is locked with the reason shown
+inline and the banner never appears, because the control would have nothing to
+enable. Nothing in this build sends your prompts, code, or traces to us or to
+anyone else for retention or training. Session storage is forced to local mode
 even if inherited write-back settings are present. Updates are installed
 manually.
 

package/README.md

@@ -1,206 +1,167 @@
-# Chutes Build
+<div align="center">
 
-**A privacy-first, open-source coding agent built for the
-[Chutes](https://chutes.ai) ecosystem.**
+<h1>Chutes Build (<code>chutes-build</code>)</h1>
 
-[![CI](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml/badge.svg)](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml)
-[![npm version](https://img.shields.io/npm/v/chutes-build.svg)](https://www.npmjs.com/package/chutes-build)
-[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![CI](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/chutes-build?logo=npm&color=cb3837)](https://www.npmjs.com/package/chutes-build)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
-Chutes Build combines a polished terminal interface, a production-grade agent
-runtime, Chutes-native model routing, subagents, local memory, multimodal tools,
-web research, and browser automation. Telemetry, remote trace upload, upstream
-session sharing, and phone-home updates are disabled by product policy.
+**Chutes Build** is a terminal-based AI coding agent for the
+[Chutes](https://chutes.ai) ecosystem. It runs as a full-screen TUI that
+understands your codebase, edits files, executes shell commands, searches the web,
+and manages long-running tasks — interactively, headlessly for scripting/CI, or
+embedded in editors via the Agent Client Protocol (ACP).
 
-![Chutes Build terminal interface](assets/chutes/screenshot/chutes-build.png)
+[Installing](#installing) ·
+[Building from source](#building-from-source) ·
+[Documentation](#documentation) ·
+[Repository layout](#repository-layout) ·
+[Development](#development) ·
+[Contributing](#contributing) ·
+[License](#license)
 
-> **Development preview:** Chutes Build is under active development. Review
-> commands and file changes before approving them, especially in unfamiliar
-> repositories.
+![Chutes Build TUI](assets/chutes/screenshot/chutes-build.png)
 
-## Why Chutes Build
+</div>
 
-| Principle | What it means |
-| --- | --- |
-| **Chutes-native** | Live model discovery, `Auto (Chutes Router)`, model-aware reasoning controls, account usage, OCR, voice, and media generation are integrated directly into the Rust runtime. |
-| **Private by default** | Sessions, memory, traces, logs, configuration, and exports stay local. Cloud features run only when their documented provider call is needed. |
-| **Built for real repositories** | Planning, permission controls, worktrees, MCP, skills, background tasks, advisor review, and parallel subagents share one coherent session model. |
-| **Transparent fork** | Chutes-specific product code is separated from retained `grok-build` infrastructure, with documented upstream review and Apache-2.0 attribution. |
+## What this is, and what it is built on
 
-## Quick start
+Chutes Build is a fork of [`xai-org/grok-build`](https://github.com/xai-org/grok-build)
+— SpaceXAI's Grok Build — re-based onto upstream 1.0.0 and adapted to run on
+Chutes. Upstream wrote most of the code in this tree and it is used here under
+Apache-2.0; the project is not affiliated with or endorsed by SpaceXAI.
 
-### Install
+What the fork changes:
 
-The npm package selects the native binary for Windows, macOS, or Linux. A Rust
-toolchain is not required.
+- **Chutes, not xAI.** Inference goes to `llm.chutes.ai`, the model catalog is
+  Chutes', `model-router` ("Chutes Auto") is the default route, and media
+  generation, OCR, usage and quota all go through Chutes APIs.
+- **Nothing phones home.** Telemetry, remote error reporting, upload, session
+  sharing, remote workspace exposure and self-update are off at compile time and
+  their endpoints are deadened, not merely unused. See
+  [`PRIVACY.md`](PRIVACY.md).
+- **A few exclusive features**: Chutes media generation and editing, OCR, voice
+  input through a Chutes STT endpoint, Context7 documentation lookup, and an
+  isolated browser tool.
 
-```powershell
-npm install -g chutes-build
-chutes-build
-```
-
-For one-off use:
-
-```powershell
-npx chutes-build
-```
-
-The launcher does not download executables from a lifecycle script.
-
-### Authenticate
-
-An API key is the most reliable way to start. Create one in the Chutes
-dashboard, then press `k` on the welcome screen, run `/apikey`, or store it
-through the hidden-input CLI flow:
-
-```powershell
-chutes-build login
-chutes-build
-```
-
-For a process-local credential:
-
-```powershell
-$env:CHUTES_API_KEY = "your-api-key"
-chutes-build
-```
+Everything else is meant to track upstream closely, so their fixes arrive by
+merge rather than by hand. [`docs/upstream-sync.md`](docs/upstream-sync.md)
+documents that procedure and records each sync;
+[`.github/upstream.json`](.github/upstream.json) records the commit this tree is
+level with. `SOURCE_REV` is inherited from upstream's published tree and refers to
+their monorepo, not to anything in this repository.
 
-Browser-based OAuth with PKCE is available through `l` or `/login`. Chutes
-OAuth applications may require registered client credentials; see
-[Authentication](docs/getting-started.md#authentication) for the supported
-fallbacks and environment variables.
+---
 
-### Choose a model
+## Installing
 
-`Auto (Chutes Router)` is the default when no model preference has been saved.
-Use `/model` interactively or inspect the live catalog from the CLI:
+Via npm, which fetches the binary for your platform:
 
-```powershell
-chutes-build models
-chutes-build models --json
-chutes-build --model model-router
+```sh
+npm i -g chutes-build
+chutes-build --version
 ```
 
-## What is included
+Or build from source below.
 
-| Area | Capabilities |
-| --- | --- |
-| **Agent runtime** | Repository inspection, edits, shell commands, plans, goals, permissions, sandbox profiles, local sessions, worktrees, and structured headless output. |
-| **Model routing** | Live Chutes catalog, automatic routing, explicit fallback chains, exact-generation reasoning controls, and vision-capability delegation. |
-| **Orchestration** | Read-only advisor, foreground/background subagents, concurrent fan-out, bounded nesting, grouped waits, and isolated worktrees. |
-| **Knowledge** | Context7 library documentation, official Chutes source checks, web search, local full-text memory, and Chutes-hosted semantic recall. |
-| **Multimodal** | Image and PDF OCR, image/video understanding, voice dictation, and typed image, video, music, and speech generation artifacts. |
-| **Automation** | MCP servers, plugins, skills, background tasks, and isolated Chrome/Edge control through local DevTools. |
+From 1.0.0 on, each
+[release](https://github.com/TheStreamCode/chutes-build/releases) also carries the
+six platform executables as downloadable assets. Earlier releases (0.4.x) carry
+release notes only — npm is the way to install those.
 
-Generated media is streamed to bounded temporary storage and persisted with
-create-new semantics. Inline previews remain local; unsupported terminals use
-safe text cards and native-player fallbacks.
+There is no self-update: `chutes-build` never contacts an update server, and the
+`update` subcommand reports where to get a newer version rather than fetching one.
+[`CHANGELOG.md`](CHANGELOG.md) records what changed in each release.
 
-## Privacy contract
+## Building from source
 
-| Boundary | Policy |
-| --- | --- |
-| **Local state** | Configuration, credentials, sessions, memory, logs, traces, exports, plugins, and agent definitions live under `~/.chutes-build` or `CHUTES_BUILD_HOME`. |
-| **Hosted inference** | Prompts and selected context leave the machine only for the Chutes model request that needs them. Semantic memory sends selected memory chunks to the configured Chutes embedding route. |
-| **Explicit tools** | OCR, voice, media, web, browser, MCP, and plugin actions send only the inputs required by the selected operation and provider. |
-| **Disabled surfaces** | Product telemetry, remote error reporting, automatic trace upload, upstream session sharing/search, remote workspace exposure, and automatic updates cannot be enabled through normal configuration. |
-| **Credentials** | Ambient Chutes credentials are restricted to allowlisted official HTTPS hosts. Custom endpoints require dedicated credentials and explicit trust configuration. |
+Requirements:
 
-Read [Privacy](PRIVACY.md) for the complete data-flow inventory and
-[Security](SECURITY.md) for the threat boundaries and reporting process.
+- **Rust** — the toolchain is pinned by [`rust-toolchain.toml`](rust-toolchain.toml);
+  `rustup` installs it automatically on first build.
+- **[DotSlash](https://dotslash-cli.com)** — required so hermetic tools under
+  [`bin/`](bin/) (notably [`bin/protoc`](bin/protoc)) can download and run.
+  Install it and ensure `dotslash` is on your `PATH` **before** building:
 
-## Common workflows
+  ```sh
+  cargo install dotslash
+  # or: prebuilt packages — https://dotslash-cli.com/docs/installation/
+  /usr/bin/env dotslash --help   # sanity check
+  ```
 
-Start an interactive session in the current repository:
+- **protoc** — proto codegen resolves [`bin/protoc`](bin/protoc) via DotSlash,
+  or falls back to a `protoc` on `PATH` / `$PROTOC`.
+- Windows, macOS and Linux all build. Windows is where this tree is developed and
+  gated, and it needs the vendored `protoc` fallback carried here — upstream 1.0.0
+  does not build on Windows at all, because `bin/protoc` is a DotSlash wrapper the
+  platform cannot execute from a build script.
 
-```powershell
-chutes-build
+```sh
+cargo run -p chutes-build              # build + launch the TUI
+cargo build -p chutes-build --release  # release binary: target/release/chutes-build
+cargo check -p chutes-build            # fast validation
 ```
 
-Run one headless task:
-
-```powershell
-chutes-build -p "Review this repository and report only actionable findings"
-```
-
-Create an isolated worktree session:
-
-```powershell
-chutes-build --worktree feature-auth
-```
-
-Resume the latest session for the current directory:
-
-```powershell
-chutes-build --continue
-```
-
-Use `chutes-build --help` for the installed version's authoritative option
-set. See the [CLI reference](docs/cli-reference.md) and
-[slash-command reference](docs/slash-commands.md) for the maintained overview.
+The binary artifact is named `xai-grok-pager`; official installs ship it as
+`chutes-build`. On first launch it asks for a Chutes API key — the primary
+credential, created at [chutes.ai/app/api](https://chutes.ai/app/api) and also
+readable from `CHUTES_API_KEY`. Browser login is opt-in and needs an OAuth app you
+register yourself; see the
+[authentication guide](crates/codegen/xai-grok-pager/docs/user-guide/02-authentication.md).
 
 ## Documentation
 
-- [Getting started](docs/getting-started.md) — installation, authentication,
-  first session, models, and troubleshooting.
-- [Configuration](docs/configuration.md) — state paths, routing, credentials,
-  web/browser options, media limits, and development-only endpoint overrides.
-- [CLI reference](docs/cli-reference.md) and
-  [slash commands](docs/slash-commands.md) — public command surfaces.
-- [Architecture](docs/ARCHITECTURE.md) — runtime layers and ownership map.
-- [npm distribution](npm/README.md) and [release procedure](docs/releasing.md)
-  — launcher contents, native packages, verification, and publication order.
-- [Privacy](PRIVACY.md), [security policy](SECURITY.md), and
-  [security review](docs/security-review.md) — operational trust boundaries.
-- [Documentation index](docs/README.md) — complete user, maintainer, and design
-  reference map.
-
-The concise guides available through `/docs` are embedded from
-`crates/codegen/xai-grok-pager/docs/user-guide/`.
-
-## Build from source
-
-Prerequisites are Rust stable, Git, and the native C/C++ toolchain required by
-Rust on your platform. Protocol Buffer tooling is vendored for normal builds.
-
-```powershell
-git clone https://github.com/TheStreamCode/chutes-build.git
-cd chutes-build
-cargo build -p chutes-build --release
+The documentation lives in this repository. There is no separate site: an earlier
+link to `docs.chutes.ai/build/overview` was a 404 dressed as a promise.
+
+The user guide ships with the pager crate:
+[`crates/codegen/xai-grok-pager/docs/user-guide/`](crates/codegen/xai-grok-pager/docs/user-guide/)
+— getting started, keyboard shortcuts, slash commands, configuration, theming,
+MCP servers, skills, plugins, hooks, headless mode, sandboxing, and more.
+
+## Repository layout
+
+| Path | Contents |
+|------|----------|
+| `crates/codegen/xai-grok-pager-bin` | Composition-root package `chutes-build`; builds the `chutes-build` binary |
+| `crates/codegen/xai-grok-pager` | The TUI: scrollback, prompt, modals, rendering |
+| `crates/codegen/xai-grok-shell` | Agent runtime + leader/stdio/headless entry points |
+| `crates/codegen/xai-grok-tools` | Tool implementations (terminal, file edit, search, ...) |
+| `crates/codegen/xai-grok-workspace` | Host filesystem, VCS, execution, checkpoints |
+| `crates/codegen/...` | The rest of the CLI crate closure (config, MCP, markdown, sandbox, ...) |
+| `crates/common/`, `crates/build/`, `prod/mc/` | Small shared leaf crates pulled in by the closure |
+| `third_party/` | Vendored upstream source (Mermaid diagram stack) — see below |
+
+> [!IMPORTANT]
+> The root `Cargo.toml` (workspace members, dependency versions, lints,
+> profiles) is **generated** — treat it as read-only. Prefer editing per-crate
+> `Cargo.toml` files.
+
+## Development
+
+```sh
+cargo check -p <crate>        # always target specific crates; full-workspace builds are slow
+cargo test -p xai-grok-config # per-crate tests
+cargo clippy -p <crate>       # lint config: clippy.toml at the repo root
+cargo fmt --all               # rustfmt.toml at the repo root
 ```
 
-The executable is `target\release\chutes-build.exe` on Windows and
-`target/release/chutes-build` on macOS/Linux.
-
-### Repository map
-
-| Path | Ownership |
-| --- | --- |
-| `AGENTS.md` | Repository-wide guidance and verification contract for coding agents. |
-| `crates/chutes-build-core/` | Chutes routing, endpoint policy, catalog, reasoning, account, media, privacy, and product policy. |
-| `crates/codegen/` | Retained and adapted upstream runtime crates. Keep crate names stable to make upstream review practical. |
-| `npm/` | Native launcher, platform-package assembly, and npm verification. |
-| `docs/` | Public technical references, maintainer procedures, and design records. |
-| `.github/workflows/` | CI, security policy checks, upstream monitoring, and release packaging. |
-| `prod/` and `third_party/` | Shared protocol sources and retained attribution/material from upstream. |
-
-The root `Cargo.toml` is generated and treated as read-only. Make dependency
-changes in the owning crate manifest or generator source instead of manually
-reorganizing the generated workspace.
+## Contributing
 
-## Project
+> [!NOTE]
+> External contributions are not accepted. See [`CONTRIBUTING.md`](CONTRIBUTING.md).
 
-Chutes Build is a substantially modified fork of
-[`xai-org/grok-build`](https://github.com/xai-org/grok-build). Upstream changes
-are reviewed and ported selectively; they are never merged or released
-automatically. See [Upstream synchronization](docs/upstream-sync.md).
+## License
 
-Issues and focused pull requests are welcome. Read
-[CONTRIBUTING.md](CONTRIBUTING.md), [AGENTS.md](AGENTS.md),
-[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [SECURITY.md](SECURITY.md) before
-contributing.
+First-party code in this repository is licensed under the **Apache License,
+Version 2.0** — see [`LICENSE`](LICENSE).
 
-Apache-2.0 licensing and attribution are documented in [LICENSE](LICENSE),
-[NOTICE](NOTICE), and [THIRD-PARTY-NOTICES](THIRD-PARTY-NOTICES).
+Third-party and vendored code remains under its original licenses. See:
 
-Copyright 2026 Michael Gasperini (Mikesoft).
+- [`THIRD-PARTY-NOTICES`](THIRD-PARTY-NOTICES) — crates.io / git dependencies,
+  bundled UI themes, and **in-tree source ports** (including openai/codex and
+  sst/opencode tool implementations)
+- [`crates/codegen/xai-grok-tools/THIRD_PARTY_NOTICES.md`](crates/codegen/xai-grok-tools/THIRD_PARTY_NOTICES.md)
+  — crate-local notice for the codex and opencode ports (license texts +
+  Apache §4(b) change notice)
+- [`third_party/NOTICE`](third_party/NOTICE) — vendored Mermaid-stack index

package/SECURITY.md

@@ -1,73 +1,35 @@
 # Security Policy
 
-## Supported versions
+Chutes Build is a fork of
+[`xai-org/grok-build`](https://github.com/xai-org/grok-build). Where to report
+depends on which part is affected, and if you are not sure, report it here first.
 
-Chutes Build is currently a development preview. Security fixes are applied to
-the latest revision of the default branch; older source snapshots are not
-supported.
+## Report it here
 
-## Reporting a vulnerability
+Use GitHub's private vulnerability reporting on this repository:
+<https://github.com/TheStreamCode/chutes-build/security/advisories/new>.
 
-Use the repository's private GitHub Security Advisory reporting flow. Do not
-open a public issue and do not include live credentials, private source code,
-session archives, or personal data in a report.
+Please do not open a public issue for a vulnerability.
 
-Include:
+Anything in the fork's own surface belongs here:
 
-- the affected revision and platform;
-- a concise description of the impact and trust boundary;
-- minimal reproduction steps using synthetic data;
-- whether exploitation requires user approval, repository control, browser
-  access, or a malicious model/tool response;
-- any proposed mitigation.
+- credential resolution and storage (`CHUTES_API_KEY`, `auth.json`, the OAuth
+  flow against the Chutes IdP);
+- which endpoints may receive a credential (`chutes-build-core::endpoint_policy`);
+- the plugin trust boundary, permission rules, and the sandbox;
+- the Chutes tools — media generation, OCR, the isolated browser, Context7;
+- memory storage and the secret filter.
 
-You should receive an acknowledgement when the report is reviewed. Disclosure
-and remediation timing will be coordinated according to severity and the
-availability of a safe fix.
+## Report it upstream too
 
-## Security boundaries
+If the flaw is in code inherited from upstream and reproduces on Grok Build, it
+affects their users as well: please also report it through their process. A fix
+landing upstream reaches more people, and it comes back here by merge.
 
-Chutes Build can execute commands, modify files, invoke models, start subagents,
-and control an isolated browser. Model output, repository contents, web pages,
-MCP servers, tool responses, and downloaded documents are untrusted input. Keep
-permission prompts enabled, use trusted repositories, and never expose secrets
-in prompts or committed files.
+## What this build does not do
 
-The project intentionally disables telemetry, remote trace uploads, automatic
-updates, upstream session sharing/search, remote workspace exposure, and
-upstream managed configuration. These are compile-time product policies, not
-server-controlled feature flags. Any change to those guarantees requires an
-explicit security and privacy review.
-
-Ambient Chutes credentials are restricted to allowlisted official HTTPS hosts.
-Custom inference and model-catalog endpoints require dedicated credentials.
-OAuth client secrets are read from the environment, used for token exchange
-and refresh when configured, and are never persisted by Chutes Build.
-
-Credential-bearing and download clients reject URL credentials, unexpected
-ports, insecure schemes, redirects, and private, loopback, link-local, or
-special-use DNS results. Development endpoint overrides require the explicit
-`CHUTES_ALLOW_INSECURE_ENDPOINTS=1` opt-in; the opt-in does not make ambient
-Chutes credentials transferable to arbitrary model endpoints. Custom Context7
-endpoints require their own opt-in and never receive `CONTEXT7_API_KEY`.
-
-Machine-readable MCP listings redact environment/header values and URL
-credentials. Destructive session, memory, plugin, marketplace, and worktree
-operations require an interactive confirmation unless an explicit `--yes`
-flag is provided. Media responses stream to bounded temporary storage, default
-to 128 MiB with a 512 MiB hard ceiling, and use transactional create-new
-artifact writes. Automatic permission mode only fast-paths deterministic
-read-only shell commands; classifier failure returns to the normal user prompt.
-
-## Automated release checks
-
-CI scans the complete Git history for known secret patterns and evaluates the
-resolved Rust dependency graph for advisories, licenses, duplicate versions,
-and unapproved sources. Release packaging additionally executes every native
-binary, creates SHA-256 sidecars for native npm archives, verifies those
-sidecars after artifact download, and runs the assembled launcher with its
-native Linux package before publication can begin.
-
-Documented advisory exceptions must include a bounded rationale in `deny.toml`.
-New advisories or source-policy violations fail CI by default. The current
-review record is maintained in [docs/security-review.md](docs/security-review.md).
+Some classes of report do not apply, because the behaviour is compiled out rather
+than merely disabled: telemetry, remote error reporting, session sharing, remote
+workspace exposure, trace upload, and self-update. See
+[`PRIVACY.md`](PRIVACY.md) and `chutes-build-core::product`. If you find one of
+them active, that *is* a vulnerability and we want to hear about it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chutes-build",
-  "version": "0.4.2",
+  "version": "1.0.0",
   "description": "Privacy-first, open-source coding agent for the Chutes ecosystem",
   "license": "Apache-2.0",
   "author": "Michael Gasperini (Mikesoft)",
@@ -37,12 +37,12 @@
     "check": "npm test && npm run verify:release && npm pack --dry-run"
   },
   "optionalDependencies": {
-    "chutes-build-darwin-arm64": "0.4.2",
-    "chutes-build-darwin-x64": "0.4.2",
-    "chutes-build-linux-arm64-gnu": "0.4.2",
-    "chutes-build-linux-x64-gnu": "0.4.2",
-    "chutes-build-win32-arm64": "0.4.2",
-    "chutes-build-win32-x64": "0.4.2"
+    "chutes-build-darwin-arm64": "1.0.0",
+    "chutes-build-darwin-x64": "1.0.0",
+    "chutes-build-linux-arm64-gnu": "1.0.0",
+    "chutes-build-linux-x64-gnu": "1.0.0",
+    "chutes-build-win32-arm64": "1.0.0",
+    "chutes-build-win32-x64": "1.0.0"
   },
   "keywords": [
     "ai",