chutes-build 1.4.0 → 1.5.1

package/CHANGELOG.md

@@ -4,7 +4,134 @@ All notable changes to Chutes Build will be documented in this file. The format
 is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
 project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.5.1] - 2026-10-15
+
+### Fixed
+
+- **Authentication is API-key-only: no login screen, ever.** Starting without
+  a key showed a `Login with Chutes Build` option that could only fail with
+  `No OAuth2 configuration available. Run 'chutes-build login'`. The Chutes
+  distribution now withholds account login end to end: no login method is
+  advertised, no session (inline env or `auth.json`) is served or honored,
+  the blocked screen names the one credential (`CHUTES_API_KEY`) instead of
+  a dead login option, and `chutes-build login` / `logout` explain the
+  setup instead of starting an OAuth flow. All headless, ACP, and sampling
+  auth errors point at the API key too.
+- **Terminal tab no longer says `grok`.** The TUI title string is now
+  `chutes-build` (or `<title> - chutes-build`), still within the 80-column
+  guarantee.
+
+### Tests
+
+- New pins: API-key-only method advertising (with and without a key, across
+  all `preferred_method` pins), ignored legacy session env, ignored session
+  in the `models` banner precedence, and the blocked-screen API-key setup
+  text with no login option.
+- Known limitation: the `xai-grok-login` session-store machinery tests
+  (~106: manager refresh/recovery, OIDC refresher, device code) fail in
+  this build because the login store they exercise is intentionally absent
+  — reads find nothing and writes are refused by the pre-existing
+  distribution gate. They are not run by CI; the injected-distribution
+  storage tests pin both sides (STOCK reads/writes, withheld finds
+  nothing and refuses writes).
+
+## [1.5.0] - 2026-10-15
+
+### Changed
+
+- **The runtime is re-based onto upstream `1.0.45` (`2bdd1d6a`).** The 1.0.12 tree
+  is replaced by the upstream 1.0.45 tree with the Chutes layer re-applied on
+  top (OAuth to the Chutes IdP, Chutes endpoints, prompt identity, tool
+  namespace, themes, wordmark). New upstream features carried: strict-harness
+  agent profiles, the `send_feedback` adjudication tool, hashline file tools,
+  concise tool variants, skill/plugin registries with trust stores, and the
+  memory-v2 filesystem knowledge base.
+- **The Chutes ecosystem is now native to the agent.** New agent-callable tools:
+  document extraction from PDF/images (DocuExtract), speech transcription
+  (AudioDojo STT), and text embeddings (Qwen3-Embedding-8B), joining image,
+  video, music, image-edit, OCR, usage, browser, and Context7 tools. Text-only
+  models automatically delegate image reads to a multimodal model, and every
+  capability fails over to an equivalent chute when its primary is unavailable
+  — with an honest error note when no fallback exists at all.
+- **Token efficiency re-baselined.** The fixed system prompt is pinned at 2,161
+  estimated tokens (ceiling 2,175) after compressing the Chutes sources block,
+  and the per-turn tool catalog is pinned at 12,784 tokens across 30 tools
+  (ceiling 12,820) by a re-ported census test. See
+  `docs/token-efficiency-plan.md`.
+- **Reasoning registry refreshed against the live catalog.** Qwen3.8 joins the
+  verified `enable_thinking` toggle family; Kimi-K3, DeepSeek-V4-Flash, and
+  Nemotron-3-Nano stay fail-closed (`Unknown`, no reasoning keys sent) until a
+  chat-template switch is verified for them.
+- **User guide rewritten for Chutes.** Every model example uses the live
+  catalog (`model-router` default, `cpk_...` keys), auth/update/telemetry
+  pages describe Chutes-only behavior, and the ecosystem page gains a
+  capability-defaults table verified against Chutes Docs and the code's
+  pinned slugs.
+
+### Fixed
+
+- **Chutes-native tools now resolve in every agent build.** The tool-pack
+  registration ran after the registry snapshot was taken, so curated toolsets
+  listing `ChutesBuild:*` ids failed at finalize time; registration now happens
+  before the builder snapshots the packs.
+- **Pre-rebrand preset names keep resolving.** `grok-build`, `grok-computer`,
+  and their concise/plan variants work as aliases of the `chutes-*` canonical
+  presets, so existing configs and upstream tests continue to work.
+- **`--version` reports the fork name.** The version line read `grok x.y.z`;
+  it now reads `chutes-build x.y.z`.
+- **`update` targets this repo's releases.** The GitHub-release updater
+  queried `xai-org-shared/chutes-build` for `grok-<version>-<platform>`
+  assets; it now queries `TheStreamCode/chutes-build` for the
+  `chutes-build-<target>[.exe]` assets the release workflow publishes,
+  installs to `bin/chutes-build[.exe]`, and maintains a
+  `chutes-build-latest` link. Managed-install detection, on-disk version
+  parsing, and stale-download cleanup follow the same names.
+- **System config moved to `/etc/chutes-build`.** The Unix system layer no
+  longer reads Grok's `/etc/grok` managed files.
+- **OAuth strings match the live issuer.** Help and docs named
+  `auth.chutes.ai`; both hosts serve discovery but the canonical issuer —
+  and the token `iss` — is `https://api.chutes.ai`, which the code
+  already used.
+
+### Removed
+
+- **The unused static model scorer is gone.** `routing::TaskClass`,
+  `ModelCapabilities`, `ModelCandidate`, and `select_capable_model` had no
+  callers; equivalent-model selection lives in
+  `catalog::find_equivalent_chat_model`, which ranks the live catalog.
+
+### Privacy
+
+- **Stock builds talk to Chutes and only Chutes.** Inference (API-key and
+  session), the model catalog, and every default endpoint resolve to Chutes
+  hosts; xAI hosts can no longer appear in a default resolution (pinned by
+  `stock_endpoints_resolve_to_chutes_only`). A probe of the rebased tree had
+  shown `https://api.x.ai/v1` as the resolved default — fixed.
+- **The Chutes distribution withholds telemetry, error reporting, remote
+  control, and voice dictation.** `Distribution::current()` is now `CHUTES`,
+  which forces telemetry mode to `Disabled`, disables trace upload, gates the
+  feedback surface and session-signal sync behind the `Telemetry` capability,
+  and refuses relay connections (plus discard-port relay/gateway defaults).
+- **No automatic update checks.** `should_check_for_updates` honors
+  `AUTOMATIC_SELF_UPDATE=false`; the `update` subcommand still checks on
+  explicit request.
+- **The wire no longer identifies as Grok.** Request headers are renamed to
+  `x-chutes-build-*` (version, identifier, conversation/request/session/agent
+  ids, user agent); the legacy `X-XAI-Token-Auth` headers attach only for
+  genuine xAI hosts (BYOK compat).
+- **Managed-config sync needs an explicit operator endpoint.** Stock builds
+  sync nothing instead of polling a default URL.
+- **Dead Grok surfaces removed.** The unused grok-web skills client (and its
+  unreachable slash-command hook), the vestigial `curl|bash` installers that
+  fetched Grok Build binaries from xAI's bucket, and the unused xAI npm
+  packaging template are gone. The retention toggle is local-only (Chutes
+  serves no retention API), and `chutes-build models` works again
+  (`x.ai/models/list` → `chutes.ai/models/list`).
+- **Rebase regressions restored.** The rebase had lost the fork's
+  `chutes-build` package/binary identity (breaking `cargo build -p
+  chutes-build` and the release workflow), the Chutes endpoint defaults, and
+  the external-OTEL compile-time deadening — all restored from `main` and
+  pinned by tests.
 
 ## [1.4.0] - 2026-09-03
 

package/README.md

@@ -17,6 +17,7 @@ embedded in editors via the Agent Client Protocol (ACP).
 [Documentation](#documentation) ·
 [Repository layout](#repository-layout) ·
 [Development](#development) ·
+[Troubleshooting](#troubleshooting) ·
 [Contributing](#contributing) ·
 [License](#license)
 
@@ -26,10 +27,11 @@ embedded in editors via the Agent Client Protocol (ACP).
 
 ## What this is, and what it is built on
 
-Chutes Build is a fork of [`xai-org/grok-build`](https://github.com/xai-org/grok-build)
-— SpaceXAI's Grok Build — re-based onto upstream 1.0.0 and adapted to run on
-Chutes. Upstream wrote most of the code in this tree and it is used here under
-Apache-2.0; the project is not affiliated with or endorsed by SpaceXAI.
+Chutes Build started from [`xai-org/grok-build`](https://github.com/xai-org/grok-build)
+(re-based onto upstream 1.0.45) and is developed independently, for the Chutes
+ecosystem only: it talks to Chutes services and nothing else. Upstream code in
+this tree is used under Apache-2.0 (see [`NOTICE`](NOTICE)); the project is not
+affiliated with or endorsed by xAI.
 
 What the fork changes:
 
@@ -41,9 +43,12 @@ What the fork changes:
   sharing, remote workspace exposure and self-update are off at compile time and
   their endpoints are deadened, not merely unused. See
   [`PRIVACY.md`](PRIVACY.md).
-- **A few exclusive features**: Chutes media generation and editing, OCR, voice
-  input through a Chutes STT endpoint, Context7 documentation lookup, and an
-  isolated browser tool.
+- **A few exclusive features**: native Chutes ecosystem tools the agent calls
+  by itself — image generation and editing, video and music generation,
+  speech-to-text and text-to-speech, PDF/document extraction, OCR, text
+  embeddings, and Context7 documentation lookup — plus an isolated browser
+  tool, automatic vision delegation for text-only models, and automatic
+  equivalent-model fallback when a chute is unavailable.
 
 Everything else is meant to track upstream closely, so their fixes arrive by
 merge rather than by hand. [`docs/upstream-sync.md`](docs/upstream-sync.md)
@@ -93,14 +98,14 @@ Requirements:
 - **protoc** — proto codegen resolves [`bin/protoc`](bin/protoc) via DotSlash,
   or falls back to a `protoc` on `PATH` / `$PROTOC`.
 - Windows, macOS and Linux all build. Windows is where this tree is developed and
-  gated, and it needs the vendored `protoc` fallback carried here — upstream 1.0.0
+  gated, and it needs the vendored `protoc` fallback carried here — upstream
   does not build on Windows at all, because `bin/protoc` is a DotSlash wrapper the
   platform cannot execute from a build script.
 
 ```sh
 cargo run -p chutes-build              # build + launch the TUI
 cargo build -p chutes-build --release  # release binary: target/release/chutes-build
-cargo check -p chutes-build            # fast validation
+cargo check --workspace                # fast validation
 ```
 
 The binary artifact is named `xai-grok-pager`; official installs ship it as
@@ -144,9 +149,51 @@ MCP servers, skills, plugins, hooks, headless mode, sandboxing, and more.
 cargo check -p <crate>        # always target specific crates; full-workspace builds are slow
 cargo test -p xai-grok-config # per-crate tests
 cargo clippy -p <crate>       # lint config: clippy.toml at the repo root
-cargo fmt --all               # rustfmt.toml at the repo root
 ```
 
+## Troubleshooting
+
+### Missing `CHUTES_API_KEY`
+
+On first launch `chutes-build` asks for a Chutes API key (created at
+[chutes.ai/app/api](https://chutes.ai/app/api)); it is also readable from the
+`CHUTES_API_KEY` environment variable. If requests fail with authentication
+errors, check that the variable is exported in the launching shell — Chutes
+Build reads the process environment and does not load `.env` files
+automatically (see [`docs/configuration.md`](docs/configuration.md)).
+Never commit a real key; use your shell, CI platform, or secret manager to
+provide it, and run `chutes-build inspect --json` to verify the effective
+non-secret configuration.
+
+### Model-pool routing errors
+
+The default model route is Chutes' native routing: the saved `default` pool
+(managed at chutes.ai/app → Model Routing), or an inline pool via
+`CHUTES_ROUTING_POOL` (comma-separated catalogue ids sent as one `model`
+value, e.g. `modelA,modelB,modelC`). If the `default` alias cannot resolve
+and no dashboard pool is saved, the built-in fallback chain steps down to a
+live inline pool from the current catalogue; a saved dashboard pool, once
+configured, takes priority. Common fixes: save a pool on the dashboard, set
+`CHUTES_ROUTING_POOL` explicitly, check `CHUTES_FALLBACK_MODELS` ordering (or
+`CHUTES_STRICT_MODEL=1`, which disables automatic fallback), and pick a
+strategy with `CHUTES_ROUTING_STRATEGY` (`sequential` default, `latency`, or
+`throughput`). Full reference: [`docs/configuration.md`](docs/configuration.md)
+("Native model routing").
+
+### Windows console shows wrong glyphs
+
+The TUI degrades decorative glyphs on the legacy Windows console (ConHost
+`cmd.exe` / `powershell.exe`, Consolas/Lucida Console raster font, no font
+fallback): arrows, checkmarks, diamonds, and spinners fall back to ASCII or
+CP437-safe stand-ins (see
+[`crates/codegen/xai-grok-pager-render/src/glyphs.rs`](crates/codegen/xai-grok-pager-render/src/glyphs.rs)).
+This is expected on legacy ConHost — for the full rendering use Windows
+Terminal, VS Code's terminal, or another modern emulator. Note that CI forces
+the modern-glyph path with `CHUTES_BUILD_FORCE_LEGACY_CONSOLE=0` (see
+[`.github/workflows/ci.yml`](.github/workflows/ci.yml)), so screenshots and
+test rendering may look richer than a legacy local console.
+
+
 ## Contributing
 
 > [!NOTE]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chutes-build",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Privacy-first, open-source coding agent for the Chutes ecosystem",
   "license": "Apache-2.0",
   "author": "Michael Gasperini (Mikesoft)",
@@ -37,12 +37,12 @@
     "check": "npm test && npm run verify:release && npm pack --dry-run"
   },
   "optionalDependencies": {
-    "chutes-build-darwin-arm64": "1.4.0",
-    "chutes-build-darwin-x64": "1.4.0",
-    "chutes-build-linux-arm64-gnu": "1.4.0",
-    "chutes-build-linux-x64-gnu": "1.4.0",
-    "chutes-build-win32-arm64": "1.4.0",
-    "chutes-build-win32-x64": "1.4.0"
+    "chutes-build-darwin-arm64": "1.5.1",
+    "chutes-build-darwin-x64": "1.5.1",
+    "chutes-build-linux-arm64-gnu": "1.5.1",
+    "chutes-build-linux-x64-gnu": "1.5.1",
+    "chutes-build-win32-arm64": "1.5.1",
+    "chutes-build-win32-x64": "1.5.1"
   },
   "keywords": [
     "ai",