chutes-build 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -6,6 +6,242 @@ project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.4] - 2026-08-12
+
+Two threads. The manual port from upstream `b13fa526` begins — one area per
+commit, each landing with its own tests green and measured against a pre-port
+baseline rather than an absolute count. And the verification system itself was
+overhauled, because three of the previous release's problems were failures to
+*notice*, not failures of code: 188 tests were failing where nobody looked, a
+pager suite reported failures that were the terminal rather than the product,
+and a kill switch that documents a privacy guarantee turned out to gate nothing.
+
+### Security
+
+- **`webbrowser` updated for RUSTSEC-2026-0257**, argument injection through the
+  Unix `BROWSER` template: an attacker-controlled non-HTTP(S) URL retaining
+  spaces could become extra browser arguments, reproduced upstream by injecting
+  `--remote-debugging-port` and `--proxy-server`. Chutes Build opens a browser on
+  the OAuth login path, so this is a path we use. Fixed in 1.2.2; the lock now
+  resolves 1.2.4. The advisory was published while this release was being
+  prepared and turned a commit red that had passed an hour earlier — which is
+  what `cargo deny` reading the live database is for.
+- **The self-update kill switch gated nothing.**
+  `product::AUTOMATIC_SELF_UPDATE` documents that a running Chutes Build never
+  downloads its own update, and it appeared exactly once in the tree — inside a
+  comment. What held the line was narrower and accidental: the `internal`
+  installer's base URLs are deadened to `127.0.0.1:9`. But `get_installer()`
+  honours `CHUTES_BUILD_INSTALLER=npm` and `[cli] installer` in `config.toml`,
+  and neither the npm path (`npm view`) nor gh-release (the GitHub API) is
+  deadened, so one line of user configuration turned a release binary into one
+  that contacts a registry at startup and can spawn a download child. The gate
+  is read now, and a test asserts it is read rather than merely present.
+
+### Added
+
+- **A failed `SKILL.md` read now says where that skill is actually registered**,
+  instead of a bare "does not exist". Ambiguous names, disabled skills, stale
+  registrations and reads that are not `SKILL.md` deliberately suggest nothing,
+  so a wrong pointer is never preferred to no pointer.
+- **Every workspace RPC declares whether it reads or writes** (`ACTIVITY`), and
+  the proxy client can report the server binary's version.
+
+### Changed
+
+- The terminal runtime sizes its worker pool against per-user ceilings
+  (`pids.max` / `RLIMIT_NPROC`) using upstream's reworked logic, with 329 lines
+  of tests it did not have before — including the EAGAIN path.
+- Sandbox hook write-deny is compiled only where it enforces. Its identity
+  capture, symlink and rename-race errors and JSON snapshot check move from
+  `#[cfg(unix)]` to `#[cfg(any(target_os = "linux", all(unix, test)))]`: the
+  rules are applied through Linux namespaces, so on macOS that code compiled and
+  never ran. Linux behaviour is unchanged.
+
+### Fixed
+
+- **A busy model is waited for, not replaced.** A capacity 429 used to swap the
+  model you chose for `model-router` on the first attempt, instantly, discarding
+  the `Retry-After` the server had just sent — the header was parsed and then
+  dropped at that layer. A short delay (≤5s) on a 429 or 503 is now honoured on
+  the selected model before any switch; a long one still switches, because that
+  chute is busy for a while and another candidate can answer now. A server
+  sending `x-should-retry: false` is obeyed rather than retried against.
+- **Esc worked only once a stream existed.** Everything before the first chunk
+  ignored the cancellation token, so a slow connect left the key dead until the
+  request returned on its own. All three backends now race the request against
+  cancellation, with the cancel arm biased first — the request goes out on the
+  future's first poll, so an already-cancelled turn was previously winning only
+  about half the time.
+- **`scripts/rebrand.py` rewrote the sentences that name upstream on purpose.**
+  Running `--apply` over the tree changed six files with nothing to do with the
+  port in hand, every one of them wrongly: the README attribution became
+  "SpaceXAI's Chutes Build", `AGENTS.md` came to say the re-base replaced our own
+  wordmark with our own, and the getting-started guide gained a fork link to
+  `github.com/xai-org/chutes-build`, which does not exist. `--check` reported the
+  correct sentences as violations, so it would have pushed the next person to
+  "fix" them. The rules cannot tell "Grok Build, the thing we forked" from "Grok
+  Build, a name to replace"; those six are now pinned by exact text, and the
+  script fails loudly if one is reworded rather than silently exempting a file.
+
+### Verification
+
+- **Those two crates' failing tests are not a fixed set, and that is the
+  finding.** CI ran narrow filters over `xai-grok-tools` and
+  `xai-grok-workspace`, leaving ~188 tests neither passing nor watched, so a new
+  failure among them was indistinguishable from the rest. The intended fix was a
+  committed per-test baseline that CI compares against — and it does not work
+  here, because the set moves: of 53 `xai-grok-workspace` failures recorded on a
+  local Windows machine, 17 pass on the Windows runner and 2 others fail; a
+  `daemonize` test failed on Linux in one run and not in the run 90 minutes
+  before. Same commit, same platform.
+
+  So `scripts/known_failures.py` and the two baselines ship as a **local
+  diagnostic**, not a CI gate, and the CI steps are removed. A gate is possible
+  once these suites are deterministic, and making them so is the actual work
+  this uncovered — the baseline is not a substitute for it. Separately, the full
+  `xai-grok-tools --lib` suite never completes on the Windows runner at all: 107
+  minutes, then 140, then a 40-minute timeout, against six minutes on Linux.
+  Both are recorded in `docs/upstream-sync.md` under what is still open.
+- **The pager suite reported seven failures that were the terminal.**
+  `default_actions()` reads the process environment, so inside a VS Code terminal
+  Quit binds to Ctrl+D, interject moves to Ctrl+L, and a terminal with native
+  link hover owns link clicks. Each test asserted one side of a rule that has
+  two. They use the pinned registries that already existed, and the link test now
+  asserts both sides — covering something nothing covered: with native link
+  hover, *not* intercepting is correct. 8275 pass in both configurations.
+- `scripts/port_assist.py` sorts an upstream delta into what needs a judgement
+  call and what does not — files absent here, files we never touched, and files
+  whose divergence *is* the rebrand, verifiable because
+  `rebrand(upstream@base)` reproduces our version character for character. 127 of
+  the 208 outstanding files need no human decision. It leaves genuine divergence
+  alone, refuses to resurrect files we deleted on purpose, and skips binaries.
+- A notification-hook test waited five seconds for a forked shell and went red on
+  a loaded runner. `run_hook` returns its join handle now, so the test waits for
+  the fact rather than the clock.
+
+### Documentation
+
+- `docs/upstream-sync.md` records what the first areas taught, for the eighty-six
+  files still to come: an area is always bigger than the module it started as and
+  clippy's `dead_code` is what proves it, since `dead_modules.py` cannot see a
+  module that *is* reachable; measure the baseline failure set before attributing
+  anything; and upstream's fixtures assume POSIX absolute paths, which on Windows
+  are drive-relative, so eleven tests failed here that pass on upstream's CI.
+- `AGENTS.md` gains the three rules the port produced — check `git status` after
+  every rebrand run, finish an area on clippy rather than on green tests, and
+  measure the baseline failure set before attributing anything — and
+  `docs/releasing.md` records that a cancelled job ships nothing even when it
+  built everything.
+
+
+
+## [1.0.3] - 2026-08-11
+
+Measured against the live Chutes endpoint with a real key, not reasoned about from
+the source. Two of the findings below contradicted what the code looked like it
+did, and one contradicted an earlier fix in this same release.
+
+### Fixed
+
+- **Every model claimed a 256,000-token context.** The catalogue at
+  `llm.chutes.ai/v1/models` publishes `context_length` per model;
+  `parse_remote_model_value` looked for `contextWindow`, `context_window` and two
+  `_meta` spellings, none of which Chutes sends, so all thirteen fell through to
+  one default. It was wrong in both directions at once: `Qwen3-32B` holds 40,960,
+  so the product promised six times what exists and its requests were refused;
+  `DeepSeek-V4-Flash`, `Kimi-K3` and `GLM-5.2` hold 1,048,576, so three quarters
+  of the window went unused. Compaction and truncation were sizing themselves
+  against a figure no model agreed with. Eleven of thirteen now carry their
+  published value; the two that publish nothing keep a default.
+- **Each model now carries its own output limit**, from `max_output_length` —
+  but only where that is *smaller* than the window. Several models publish the
+  two as the same number, which means "output may use the whole context" rather
+  than "always ask for this much": sending it as `max_tokens` leaves no room for
+  the prompt, and `Qwen3-32B` answers `400 Requested token count exceeds`. Nine
+  models gain a real cap, two are skipped. This was caught by testing the fix
+  against the endpoint before shipping it — the first version of the change would
+  have broken a model that previously worked.
+- **An endpoint override reached inference but not the catalogue.**
+  `docs/configuration.md` documents `CHUTES_ROUTER_BASE_URL` and
+  `CHUTES_INFERENCE_BASE_URL` — `CHUTES_MODELS_BASE_URL` was supported and
+  undocumented, and is in the table now — and `chutes-build-core` honours them,
+  but the re-base left the agent's
+  `EndpointsConfig` reading only the `CHUTES_BUILD_*` spellings. The documented
+  names come first now, with the others kept as fallbacks.
+- **The system prompt introduced the agent as xAI's.** The re-base overwrote
+  `templates/prompt.md` with upstream's, so every model was told at every turn
+  that it was "released by xAI" instead of "a privacy-first coding agent
+  optimized for the Chutes ecosystem" — the branding fix in 1.0.1 covered what
+  the user could see, not what the model was told. The same overwrite deleted
+  the `<official_chutes_sources>` block, which is the larger loss: it is what
+  directed the model to treat `chutes.ai/docs` and `chutes.ai/news` as the
+  primary authority on Chutes products, APIs, models, pricing and quotas, to
+  say when a claim is unverified rather than blending fact with inference, and
+  — a security instruction, not a stylistic one — never to put API keys,
+  credentials, private code or repository contents into a search query or
+  outbound request. Both restored from 0.4.3 and the encrypted templates
+  regenerated.
+- **Only streaming requests could survive a busy model.** The Chutes fallback
+  chain — selected model, then `CHUTES_FALLBACK_MODELS`, then `model-router` —
+  was wired into `chat_completion_stream` and never into `chat_completion`. The
+  two paths had diverged by omission rather than by any decision, so an
+  interactive turn recovered quietly from `429 Infrastructure is at maximum
+  capacity` while compaction, title generation and the advisor surfaced it raw.
+  Both paths now share one chain and one policy. Nothing on the non-streaming
+  path can be mid-stream, so the "never switch models once bytes have shipped"
+  rule is satisfied trivially there. The chain's ordering also became testable
+  without touching process-wide environment variables, which no test could do
+  safely while the rest of the suite runs in parallel — the env reads moved to a
+  wrapper around a pure core.
+- **`CHUTES_BUILD_OAUTH2_PRINCIPAL_TYPE=Team` could never complete a flow.**
+  `default_team_oauth2_scopes()` was still upstream's — `grok-cli:access`,
+  `api:access`, `team:read`, `conversations:*`, `workspaces:*`. The user-facing
+  list was corrected during the re-base cleanup and this one was missed.
+  `api.chutes.ai` advertises no team principal at all: its `scopes_supported` is
+  entirely user-level, so an authorization server was being asked for scopes it
+  has never heard of. The default is now the user list; a deployment that really
+  does define a team principal says so through `CHUTES_BUILD_OAUTH2_SCOPES`.
+  Established by reading the IdP's own discovery document rather than the prose
+  documentation, which does not cover team principals either way.
+
+### Release engineering
+
+- **The first 1.0.3 built every artifact and shipped none.** `darwin-arm64`
+  finished in 118m40s of a 120-minute budget: binary, strip, smoke test,
+  package, checksum and upload all succeeded, and the wall then killed the
+  cache-save step eighty seconds later. A cancelled job fails the run, so
+  `Publish GitHub release` and `Publish npm packages` were skipped. Not a
+  regression — the macOS jobs of the previous three releases ran 67, 74, 91, 84,
+  96 and 102 minutes, so the budget had been within ~15% of the slowest observed
+  build for several releases. Raised to 180.
+- **`main` had been red since 06:40 and nothing showed it.** A rebranded string
+  grew three characters past 100 columns, `Check formatting` is the first step of
+  the Linux job, and its failure skipped the six test steps and clippy behind it.
+  It stayed invisible because `cancel-in-progress: true` plus a run of quick
+  pushes cancelled every CI run in between.
+
+### Documentation
+
+- `docs/upstream-sync.md` records the pending port measured rather than
+  estimated: 3 commits, 238 files, of which 147 overlap work of ours and 91 do
+  not. It also records that `git diff HEAD upstream/main` is the wrong
+  instrument — it reports 1424 files, because the fork is not a descendant of
+  upstream and the diff is mostly our own re-base read backwards.
+- `AGENTS.md` records that `xai-grok-pager --lib` reports seven failures when
+  run from a VS Code terminal, and that they are the terminal rather than the
+  code: `default_actions()` reads the process environment, so Quit binds to
+  Ctrl+D there and the `ctrl_q` tests fail against a correct app.
+
+### Notes on tool compatibility
+
+The catalogue's `supported_features` is accurate: every model advertising `tools`
+emits a real `tool_calls` finish, and the two advertising nothing do not. A first
+probe suggested three Qwen models were broken — they were not. The probe gave them
+96 output tokens, which a reasoning model spends thinking before it can emit the
+call. That is the finding worth keeping: **a thinking model needs output budget
+before tool use works at all**, and without it the failure is silent and looks like
+missing support.
+
 ## [1.0.2] - 2026-08-11
 
 Three faults a user meets in the first minute. All reproduced against the live

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chutes-build",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Privacy-first, open-source coding agent for the Chutes ecosystem",
   "license": "Apache-2.0",
   "author": "Michael Gasperini (Mikesoft)",
@@ -37,12 +37,12 @@
     "check": "npm test && npm run verify:release && npm pack --dry-run"
   },
   "optionalDependencies": {
-    "chutes-build-darwin-arm64": "1.0.2",
-    "chutes-build-darwin-x64": "1.0.2",
-    "chutes-build-linux-arm64-gnu": "1.0.2",
-    "chutes-build-linux-x64-gnu": "1.0.2",
-    "chutes-build-win32-arm64": "1.0.2",
-    "chutes-build-win32-x64": "1.0.2"
+    "chutes-build-darwin-arm64": "1.0.4",
+    "chutes-build-darwin-x64": "1.0.4",
+    "chutes-build-linux-arm64-gnu": "1.0.4",
+    "chutes-build-linux-x64-gnu": "1.0.4",
+    "chutes-build-win32-arm64": "1.0.4",
+    "chutes-build-win32-x64": "1.0.4"
   },
   "keywords": [
     "ai",