Chimera 0.73.0

Chimera 0.73.0

[0.73.0] - 2026-10-22

Changed

• The Chrome extension's popup now looks like part of Chimera, in light and dark. It used to show bare browser buttons; the connection status, the button that allows a site, Stop and the pairing code are now laid out and themed, and follow the system's dark mode. (#1059)

Added

• A project can tell Chimera how to prepare and test it. Besides its verification command, .chimera/verify.toml can declare a setup command (for example installing dependencies). After you approve that exact command, Chimera runs it once when a fresh worktree has no environment, and every turn tells the agent which command tests the project instead of letting it guess. Worktrees the app creates for a project now inherit the project's command permission and approved commands; any other folder still asks for its own. Worktrees created by the app before this version stop inheriting until they are recreated. (#1063)

• The verify-and-repair loop on the Code screen can now be turned on. With CHIMERA_CODE_VERIFY_RETRY=1, a coding turn checks its work with the project's verification command before it closes, hands a failure back to the agent for up to two repairs (tests stay read-only while it repairs), and can end by saying the test contradicts the request. It was built in 0.71.0 but nothing could switch it on. It stays off by default, and the MCP bridge can ask for it one turn at a time. (#1061)

Security

• Before Chimera sends anything from your Chrome, the card shows what will go out and to whom. For a send, post, purchase, deletion or form submission, the approval card now lists the fields it can read (for example To, Subject and the message body, including Gmail's recipient chips), or the surrounding text when there are none, and says so when it cannot read the page. Text Chimera is about to type is shown too. Password, card and verification-code fields never appear. If a field you approved changes before the click, or a recipient is added, nothing is sent. (#1062)

Fixed

• The model catalogue knows glm-5.3-flash's cheaper route. OpenRouter now quotes it at about $0.007 per million input tokens on one route; the catalogue accepts that reading alongside its earlier ones instead of flagging the price as stale. (#1064)