v0.87.0

Added

• Claude Code's instruction files reach the run. Beside AGENTS.md, Chimera now reads CLAUDE.md, .claude/CLAUDE.md and CLAUDE.local.md, with their @file imports (CHIMERA_CLAUDE_COMPAT, on by default), and the Context card names the files a turn was given. Your personal ~/.claude/CLAUDE.md joins only your own surfaces, the CLI chat and code and the desktop Code turn, never a bot, webhook, scheduled job, subagent or shared-link guest, and it has its own budget. Imports stay inside the folder they belong to, are capped in size and count, and are re-read when their content changes. Prompt snapshots and benchmarks pin the switch off so they do not depend on the machine. (#1221)

• .worktreeinclude, and archived worktrees cleaned up. A new conversation worktree can copy the ignored files the project's .worktreeinclude names, such as .env, once you consent for that project and that version of the file; the consent shows which files it selects, and a new matching file asks again. Each copy is checked to be ignored inside the worktree, links are rechecked right before copying, and listing stops after 20 seconds and says so. The worktree of a conversation archived for 30 days is then removed (CHIMERA_WORKTREE_CLEANUP, on by default), but only when its tree is clean, everything is pushed and no ignored file is left that .worktreeinclude did not copy, so it can always be recovered from the remote branch; the sweep never forces a removal or deletes an unmerged branch, and keeps a folder another conversation still uses. (#1220)

• Claude Code hooks, and they can only tighten. Hooks in a project's .claude/settings.json and .claude/settings.local.json, and in your ~/.claude/settings.json, run through Chimera's hook runner for PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop, SessionStart, Notification and PreCompact, and Settings lists them with their origin. A hook can refuse or narrow a call, never widen it: allow means "no objection" and a rewritten input applies only if it narrows. A project's hooks never run on your machine, only in the sandbox with the network off, and only after you trust that exact version from your own screen; a change to the file, or to a file the command names, asks again. The file tools may not write .claude/settings*.json. Switches CHIMERA_CLAUDE_HOOKS_REPO and CHIMERA_CLAUDE_HOOKS_USER are on by default and owner-only; running your own hooks on the host needs a separate switch, off by default. (#1223)

• /skill-doctor: what your skills cost. /skill-doctor on the Code screen, or chimera skills doctor in the CLI, lists every skill a run is told about with its estimated context cost on each turn, its origin, how often it was used and a suggestion, such as a learned card nobody uses. It only reports; switching a skill off is still a click on the Skills screen. (#1222)

• Select an element in the preview and send it to the agent. "Select element" in the Preview panel (or Ctrl/Cmd+Shift+S) shows a picture of the dev server's page; a click on it puts the element in the composer as chips, its tag and text plus a crop. It runs in Chimera's own browser with a throwaway cookie profile, injects no script into the project's page, only reaches the conversation's own dev server, and refuses the pick if the page changed since the picture. What comes from the page is outside content: the text and the crop both taint the turn. (#1218)

• Claude Code subagents work in Chimera. Agents written for Claude Code in .claude/agents (up to the repository root), ~/.claude/agents and plugins are listed beside .chimera/agents, with their origin, role and memory shown on the Agents screen. A file can only narrow what it gets: its tools are intersected with the session's governed tools, permissionMode can only restrict, bypassPermissions is ignored with a warning, and a model name such as opus maps to a role the owner sets in Settings. An agent with memory keeps fenced notes through scoped Read/Write/Edit, and notes that come from the repository are treated as untrusted when the workspace isn't trusted. (#1219)

• Dev-server preview with auto-verify on the Code screen. .chimera/launch.json (or .claude/launch.json) names the project's dev servers; the preview panel starts and stops them, shows their log and frames the page, and the agent's preview tool can start one, take a screenshot and read the console. Starting a server is running a command, so it goes through the same run_shell path — sandbox, governance, deny list, taint, the Manual card — and the panel's own button is checked against the hard blocks too. Before answering, a turn that changed front-end files checks the page and is not reported verified while the console shows errors; it never starts a server after reading outside content or after the launch file, package.json or a config file changed in that turn. Only ports a server of the turn actually listens on are reachable, the app's own ports never are, and the frame runs without same-origin access. (#1217)

• /code-review on the Code screen. It reviews the conversation's changes (the git diff, or the conversation's own edits when there is no repository) with a model that has no tools, and returns a card grouped by file: severity, file and line, "Show in diff" (scrolls to the line) and "Apply fixes" for the findings you tick. The diff is treated as outside content, so the conversation is marked tainted and applying fixes asks first; findings the verifier did not check are labelled and left unticked; the review has a size, batch and time budget and says what it left out; and it only reviews the conversation's own folder. (#1214)

• A plan panel on the Code screen. When a turn proposes a plan, the panel lists its steps and, while the plan waits for you, offers Approve and Ask for changes through the same approval the card uses, so answering in one place answers in both. It shows only the latest turn's plan, says when the turn is waiting on the card even after a reload, and announces the decision you sent until the turn finishes. (#1213)

Changed

• Manual mode now asks before every edit and every command. Each file write — editing, patching, charts, downloads, generated media, design exports — and each command shows a card first (with the proposed diff for text edits): allow once, allow editing that file or running that exact command for this conversation, or refuse. Reading never asks; a turn with no screen (bots, schedules, background work, the bridge) is refused at once instead of waiting; Manual ignores old project-wide "always allow" rules and the allow approval mode; and only the owner's screen can grant "for this conversation". One table now names every tool that writes to the workspace, read by the ledger, the read-only posture and Manual alike. (#1215)