chutes-build 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -6,6 +6,100 @@ project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fixed
+
+- **Only streaming requests could survive a busy model.** The Chutes fallback
+  chain — selected model, then `CHUTES_FALLBACK_MODELS`, then `model-router` —
+  was wired into `chat_completion_stream` and never into `chat_completion`. The
+  two paths had diverged by omission rather than by any decision, so an
+  interactive turn recovered quietly from `429 Infrastructure is at maximum
+  capacity` while compaction, title generation and the advisor surfaced it raw.
+  Both paths now share one chain and one policy. Nothing on the non-streaming
+  path can be mid-stream, so the "never switch models once bytes have shipped"
+  rule is satisfied trivially there.
+- The chain's ordering is now testable without touching process-wide
+  environment variables, which no test could do safely while the rest of the
+  suite runs in parallel — the env reads moved to a wrapper around a pure core.
+- **`CHUTES_BUILD_OAUTH2_PRINCIPAL_TYPE=Team` could never complete a flow.**
+  `default_team_oauth2_scopes()` was still upstream's — `grok-cli:access`,
+  `api:access`, `team:read`, `conversations:*`, `workspaces:*`. The user-facing
+  list was corrected during the re-base cleanup and this one was missed.
+  `api.chutes.ai` advertises no team principal at all: its `scopes_supported` is
+  entirely user-level, so an authorization server was being asked for scopes it
+  has never heard of. The default is now the user list; a deployment that really
+  does define a team principal says so through `CHUTES_BUILD_OAUTH2_SCOPES`.
+  Established by reading the IdP's own discovery document rather than the prose
+  documentation, which does not cover team principals either way.
+
+### Documentation
+
+- `docs/upstream-sync.md` records the pending port measured rather than
+  estimated: 3 commits, 238 files, of which 147 overlap work of ours and 91 do
+  not. It also records that `git diff HEAD upstream/main` is the wrong
+  instrument — it reports 1424 files, because the fork is not a descendant of
+  upstream and the diff is mostly our own re-base read backwards.
+- `AGENTS.md` records that `xai-grok-pager --lib` reports seven failures when
+  run from a VS Code terminal, and that they are the terminal rather than the
+  code: `default_actions()` reads the process environment, so Quit binds to
+  Ctrl+D there and the `ctrl_q` tests fail against a correct app.
+
+## [1.0.3] - 2026-08-11
+
+Measured against the live Chutes endpoint with a real key, not reasoned about from
+the source. Two of the findings below contradicted what the code looked like it
+did, and one contradicted an earlier fix in this same release.
+
+### Fixed
+
+- **Every model claimed a 256,000-token context.** The catalogue at
+  `llm.chutes.ai/v1/models` publishes `context_length` per model;
+  `parse_remote_model_value` looked for `contextWindow`, `context_window` and two
+  `_meta` spellings, none of which Chutes sends, so all thirteen fell through to
+  one default. It was wrong in both directions at once: `Qwen3-32B` holds 40,960,
+  so the product promised six times what exists and its requests were refused;
+  `DeepSeek-V4-Flash`, `Kimi-K3` and `GLM-5.2` hold 1,048,576, so three quarters
+  of the window went unused. Compaction and truncation were sizing themselves
+  against a figure no model agreed with. Eleven of thirteen now carry their
+  published value; the two that publish nothing keep a default.
+- **Each model now carries its own output limit**, from `max_output_length` —
+  but only where that is *smaller* than the window. Several models publish the
+  two as the same number, which means "output may use the whole context" rather
+  than "always ask for this much": sending it as `max_tokens` leaves no room for
+  the prompt, and `Qwen3-32B` answers `400 Requested token count exceeds`. Nine
+  models gain a real cap, two are skipped. This was caught by testing the fix
+  against the endpoint before shipping it — the first version of the change would
+  have broken a model that previously worked.
+- **An endpoint override reached inference but not the catalogue.**
+  `docs/configuration.md` documents `CHUTES_ROUTER_BASE_URL`,
+  `CHUTES_INFERENCE_BASE_URL` and `CHUTES_MODELS_BASE_URL`, and
+  `chutes-build-core` honours them, but the re-base left the agent's
+  `EndpointsConfig` reading only the `CHUTES_BUILD_*` spellings. The documented
+  names come first now, with the others kept as fallbacks.
+- **The system prompt introduced the agent as xAI's.** The re-base overwrote
+  `templates/prompt.md` with upstream's, so every model was told at every turn
+  that it was "released by xAI" instead of "a privacy-first coding agent
+  optimized for the Chutes ecosystem" — the branding fix in 1.0.1 covered what
+  the user could see, not what the model was told. The same overwrite deleted
+  the `<official_chutes_sources>` block, which is the larger loss: it is what
+  directed the model to treat `chutes.ai/docs` and `chutes.ai/news` as the
+  primary authority on Chutes products, APIs, models, pricing and quotas, to
+  say when a claim is unverified rather than blending fact with inference, and
+  — a security instruction, not a stylistic one — never to put API keys,
+  credentials, private code or repository contents into a search query or
+  outbound request. Both restored from 0.4.3 and the encrypted templates
+  regenerated. Present in the 1.0.3 binaries; this entry was written after the
+  build was dispatched, so the 1.0.3 tag does not carry it.
+
+### Notes on tool compatibility
+
+The catalogue's `supported_features` is accurate: every model advertising `tools`
+emits a real `tool_calls` finish, and the two advertising nothing do not. A first
+probe suggested three Qwen models were broken — they were not. The probe gave them
+96 output tokens, which a reasoning model spends thinking before it can emit the
+call. That is the finding worth keeping: **a thinking model needs output budget
+before tool use works at all**, and without it the failure is silent and looks like
+missing support.
+
 ## [1.0.2] - 2026-08-11
 
 Three faults a user meets in the first minute. All reproduced against the live

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chutes-build",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Privacy-first, open-source coding agent for the Chutes ecosystem",
   "license": "Apache-2.0",
   "author": "Michael Gasperini (Mikesoft)",
@@ -37,12 +37,12 @@
     "check": "npm test && npm run verify:release && npm pack --dry-run"
   },
   "optionalDependencies": {
-    "chutes-build-darwin-arm64": "1.0.2",
-    "chutes-build-darwin-x64": "1.0.2",
-    "chutes-build-linux-arm64-gnu": "1.0.2",
-    "chutes-build-linux-x64-gnu": "1.0.2",
-    "chutes-build-win32-arm64": "1.0.2",
-    "chutes-build-win32-x64": "1.0.2"
+    "chutes-build-darwin-arm64": "1.0.3",
+    "chutes-build-darwin-x64": "1.0.3",
+    "chutes-build-linux-arm64-gnu": "1.0.3",
+    "chutes-build-linux-x64-gnu": "1.0.3",
+    "chutes-build-win32-arm64": "1.0.3",
+    "chutes-build-win32-x64": "1.0.3"
   },
   "keywords": [
     "ai",