v0.48.0
Dies ist die Release Note so, wie sie veröffentlicht wurde, keine Neufassung davon. Release Notes werden in der Sprache veröffentlicht, in der sie geschrieben wurden.
Fifty release candidates, and the two things to read before upgrading are both defaults that changed under you.
The default sandbox is no longer the host. SECURITY.md always said the local sandbox is not isolated, so the shipped boundary between a command the model chose and your machine was the governance kernel plus a confirmation prompt — and a prompt is something a tired person waves through and an injected instruction routes around. The default is now auto: Seatbelt on macOS with a (deny default) profile, bubblewrap on Linux with --unshare-net --unshare-pid --unshare-ipc --cap-drop ALL over a read-only bind of /. Network off, writes confined to the working directory and the temp dir.
Windows gets nothing, and says so. The mechanism there is a restricted token plus network filters, which this does not attempt — approximating it would be worse than its absence, because a boundary that is believed and missing is more dangerous than one known to be missing. Same for a Linux kernel that refuses unprivileged user namespaces: the binary is installed, the syscall fails, and the report is unavailable.
The default model is DeepSeek V3.1, not GPT-5.5. A default is what a fresh install spends money on before anyone has made a decision, and this one was the most expensive model in the catalogue: $0.25/$0.95 per 1M against $5.00/$30.00. CHIMERA_DEFAULT_MODEL still wins, and the picker changes it per conversation.
An eleven-lens audit read this application — 65,760 lines of Python, 41,782 of frontend — and produced 66 recommendations. Classified by their own diagnosis, 26 were "exists and is switched off" and 11 "exists and is hidden": 56% of the work was wiring, not product. Most of this release is doors. The rest is what testing each release candidate as a user turned up.
Then a second audit, from the other direction: reading another agent's source end to end turned up twenty-eight gaps here, and they share one shape — the code ran, returned, logged, and was wrong, and nothing anywhere said so. A refused tool counted as a successful step. A cron job that only ever failed kept its slot forever. Six of seven credential-carrying strings went to disk intact. A cancelled run was recorded as one that never happened. Each of those fixes was accepted only after the fix was reverted and a test went red for it — about a hundred sabotages, of which roughly fifteen caught a defect in the test rather than in the code.
New in this release, briefly: credentials in the OS keychain (chimera secrets), a decision answerable by someone who is not at the keyboard (chimera approve), a coding turn that survives a dropped connection, commands proved read-only that stop asking for confirmation, MCP servers that can be opened rather than handed over, and three new gates in CI.
The full account is in CHANGELOG.md.