v0.68.0

⚠️ Do not install this release. The desktop app's backend fails to start: the PyInstaller freeze left out chimera.cli.commands.apilogs, which the CLI imports by name (ModuleNotFoundError). Use v0.67.4 until v0.68.1 is out. The PyPI package is not affected.

Added

• MCP servers can be paused without losing configuration. chimera mcp disable/enable preserves the server and its approved manifest while excluding disabled servers from connection and agent mounts; local stdio servers also support --cwd, runtime {env:NAME} references and a separate --catalog-timeout.

• Optional provider-bound image resizing. Vision attachments are reduced to configured dimension and base64-size limits when Pillow is available; originals remain unchanged, and resized dimensions are recorded in the turn receipt.

• The Code agent can ask the user a bounded question. ask_user pauses an attended Code turn for an option or free-text answer, returns an explicit no-response result on timeout, and remains a distinct data-only kind that cannot approve a governed action. Terminal, bot, and unattended turns do not register it.

• Global and nested AGENTS.md instructions are reloaded with receipt provenance. Owner guidance from CHIMERA_HOME/AGENTS.md precedes project rules; focused nested files share the existing character budget, and changed instruction versions are announced without copying their contents into the receipt. Nested guidance discovered during a read is appended to conversation history without rebuilding the stable system prompt or changing the open edit.

• Web search supports Tavily, Firecrawl, Exa and Brave Search. CHIMERA_WEBSEARCH_PROVIDER=auto selects the first configured key and automatically tries another provider after HTTP 429, respecting Retry-After; a fixed provider never fails over.

• Discover local Agent Skills as reviewable bundles. Skills found in workspace and user .claude/skills and .agents/skills trees are imported through the bounded upload path, remain pending and tainted until approved, and return to pending when their manifest changes; the API reports the winning source and collisions.

• Project and global Markdown prompt commands. Terminal chat and the TUI discover namespaced templates in .chimera/commands/ and <CHIMERA_HOME>/commands/, expand $ARGUMENTS and $1… into ordinary message text, and keep embedded slash commands authoritative; template content is never executed.

• Code conversations can undo to any retained turn across restarts. Per-turn snapshots are stored outside the project, range rollback compare-checks each changed file, redo is available until a new turn runs, and deleted conversations release their snapshots. (#918)

• Project formatters can run after a successful file edit. CHIMERA_FORMAT_AFTER_EDIT=true opts in; a project-declared formatter runs through argv only when the existing host-execution gate permits it, and the edit receipt reports changes, skips or failures without undoing the write. (#919)

• Remember approvals for a project and reject a run's pending approvals with a reason. Project rules are owner-managed, recorded in the audit log when used, and answer matching review questions without bypassing BLOCK or surface floors; the owner-approved two-token shell prefix also applies after tainted reads. A reject-all decision is limited to its run and its reason is shown in the refusal. (#922)

• Local API and log diagnostics, plus proxy/CA deployment guidance. chimera api reads the desktop server's announced URL, sends the configured bearer token without displaying it, and requires --yes for state-changing methods, ignores proxy variables on loopback and refuses to send the token to a remote http:// URL; chimera logs reads, filters (tracebacks stay with their record) and follows the backend warning/error file across rotation, which chimera serve now writes too (only chimera app did). Document proxy and CA environment setup for shell and Docker deployments. (#925)

• Owner deployment policy, deny-only. Ordered provider.use, integration.use (mcp:<name>, skill:<name>) and tool.use rules in <CHIMERA_HOME>/policy.json — or the file CHIMERA_POLICY_FILE names, which the desktop bridge may not change — take providers, MCP servers, skills and tools away from the whole install: a denied provider leaves the model lists and the tier ladder and its calls are refused (a permitted fallback answers instead), a denied MCP server never connects, a denied skill is never loaded, a denied tool is refused at the registry. The golden rule: a later allow only undoes an earlier deny of the same file and never reopens CHIMERA_TOOL_DENYLIST, the reach floor or a kernel block. An invalid file stops serve, chat, assist, tui, acp and fails doctor; the desktop starts, reports it on GET /api/governance/policy and refuses every tool until it is fixed; a file that breaks at run time keeps the last valid rules. The agent's write tools cannot write the policy file. chimera policy show (hidden) prints the rules in force. (#926)

• Owner-declared named read-only references. Attended desktop and terminal agents (chat, assist, tui, an attended solve, the desktop Code turn — never scenarios, cron or bots) can read, list, search, and glob @alias/path inside folders the owner configured in <CHIMERA_HOME>/references.json; reads count as project content in the taint ledger, every writer refuses a declared alias, a reference to a filesystem root, the user's home or the data folder is refused, and the authenticated /api/references Settings API is not exposed through the MCP bridge. (#927)

• Appearance: a live code-diff preview, a default transcript view and interface zoom. The Code font row previews a three-line diff with the conversation's own DiffView in light and dark at once; Default transcript view (Normal / Steps / Detailed) sets how a newly opened conversation starts, built only from what it can already show (the stream carries no model reasoning, so none is shown); Interface zoom (80–120%) persists, applies before first paint and follows into conversation windows through src/lib/uiZoom.ts, which the zoom shortcuts will share. OpenDyslexic is wired to src/assets/fonts/ but stays hidden until the licensed file is added. (#928)

• Live step and turn clocks, and context in % while a turn runs. The code conversation times the running tool step and the whole turn from the server's start time (started_at on the opening and tool_start frames), stops on the server-measured duration_seconds / elapsed_seconds, and shows "Context 30%" with a small bar from a new numbers-only context frame sent only when the measure moves a percentage point — plain tokens, never a percentage of the 128k fallback, when no window is known. The frame has its own channel so bots and the terminal do not print it. (#929)

• Reasoning-effort variants and a model pinned per Code conversation. A slug may carry #low, #medium or #high: the gateway sends it as OpenRouter's reasoning.effort or OpenAI's reasoning_effort only where the route takes it (not to an openai/ slug on another endpoint, nor under CHIMERA_API_BASE), and the receipt names a variant only when it was sent, on complete, acomplete and stream_complete alike. Window, vision, price, reviewer family and fusion temperature are looked up by the base slug through one base_slug/split_effort in chimera/providers/catalog.py. CodeTurnRequest.model_pinned keeps the owner's pick with the conversation (and with no model unpins); a reopened conversation's picker shows the pin, and the Code screen offers the effort for models the provider's index says reason, in all ten languages. A guest's turn, a refusal's retry and the spoken talk model never move or take the pin. (#930)

• Continue a Code conversation from Discord or Telegram. In the desktop app the bot's listed owner sends /link (lists recent conversations) or /link <id or unique prefix>, and their text in that chat becomes a turn of that conversation — shown live in the app with the platform as its author — until /unlink. The turn runs on the bot floor (only the MCP servers named in CHIMERA_BOT_MCP_SERVERS, no OpenAPI connectors, no desktop posture or shell grant), approval codes are still intercepted before they could become a turn, voice notes and images are refused rather than passed on untainted, and a conversation already working answers with a sentence instead of running a second turn. Strangers in a linked room, bots and every sender of a bot with no allowlist keep reaching the bot's own session. Links live in <CHIMERA_HOME>/channel_links.json, replaced atomically and inside the data folder no file route, bridge call or write tool may touch; chimera serve answers /link with why there is nothing to link. (#931)

• The pull request cycle in the Code conversation (C1). A PR opened from the Git panel is recorded on its conversation (an optional, backward-compatible field a turn's save cannot erase), and the card shows its state, mergeability, check counts and failing names, polling only while it is open with checks pending and never with the window hidden; the gh read is one call, cached for 60 seconds in a bounded cache that never keeps an error. Two per-conversation options, both off by default: "offer a fix turn when the CI fails" puts a ready turn in the conversation's message box (it never sends one) asking the agent to read the failing logs itself, and "clean up after the merge" removes the conversation's Chimera worktree and local branch, then archives it, only when the worktree is clean, every commit is pushed to an existing upstream, and it is neither the main checkout nor its current branch — never a push or a remote branch. Neither option, the cleanup nor the status read is reachable from the desktop bridge. (#932)

• Troubleshooting in Settings: open the logs or data folder, copy the installation ID, clear the cache and restart, reset app data to a dated backup. The page still has no Tauri IPC: it asks the backend, which leaves the desktop shell one action word (open_logs, open_data, restart, reset_data) and never a path — the shell builds every path from its own data directory. Clearing the cache removes only <home>/cache (a symlink or junction there is unlinked, never followed); a reset needs the word RESET typed exactly, stops the backend, MOVES its data folder to data-backup-YYYYMMDD-HHMMSS beside it and copies .env and the installation ID back — nothing is deleted. The installation ID is random, kept in the app's data and included in the diagnostics report. None of these routes is in the desktop bridge's table or the guest app, and a planned restart no longer writes a crash report. (#933)

• Markdown subagents for projects and the owner. chimera solve --subagents discovers .chimera/agents/*.md and <CHIMERA_HOME>/agents/*.md and lets spawn_subagent run one by name (agent). A file can only narrow: its tools are intersected with the session's governed tools (an empty intersection grants nothing), its steps are capped by the session's, unknown frontmatter keys are refused, and a project file's instruction is fenced as untrusted data. Only owner-global files may pin a model, and only from the catalogue; a project file's model is ignored with a diagnostic. Collisions (app > project > global, and case-only filename clashes) are reported. Listing in the app, chat, bots and desktop is not part of this change. (#934)

• Edit the browser's allowed sites and choose its cookie retention in Settings. CHIMERA_BROWSER_SITES becomes an add/remove list checked as the server checks it, with a hint that states what the list governs; CHIMERA_BROWSER_COOKIE_RETENTION keeps cookies in one shared profile, one profile per conversation (named by a digest of its id and deleted with it), or nowhere (ephemeral, the default). The MCP bridge cannot change either setting. (#935)

• Desktop: the shortcuts that were missing, from one table. Ctrl+Shift+T reopens the conversation last left (a stack kept for the app session), Ctrl+Tab / Ctrl+Shift+Tab walk conversations in sidebar order, Ctrl+F finds in the transcript (F3 / Shift+F3 to step, Esc to close; painted with the CSS Highlight API, never by editing the transcript's DOM), Ctrl+= / Ctrl+- / Ctrl+0 step the interface zoom through src/lib/uiZoom.ts, and Ctrl+; opens a sheet rendered from the same SHORTCUTS table the listeners match on. The command palette shows each command's chord and finds commands by it. No shortcut acts in a field that holds text; the conversation ones do act from an empty composer, which takes focus whenever a conversation opens. (#936)

• chimera service start|stop|restart|status runs the desktop backend without a window. One detached server per data folder (the folder claim decides, not the port), found through ~/.chimera/service-<channel>.json (0600, atomic) and trusted only after GET /api/info confirms its pid, version and folder; it requires the owner's persistent service.token, listens on loopback only, steps down if another live service takes its record, publishes no desktop bridge without a window, and the token alone still cannot approve a question. Hidden from --help until the desktop app starts it; chimera app --standalone publishes nothing. (#937)

• Durable per-conversation Code turn inbox. mode: "queue" on POST /api/code/turn runs at once on an idle conversation and otherwise keeps the message (deduplicated by client_id, at most 20 waiting) with the posture it was sent with; items run one at a time as turns end and once at startup, always as the owner unless the share-link route queued them, and an item a crash left running is shown as interrupted (a notice frame and the queue route) instead of being replayed. (#939)

• Conversation states and pull-request counts in the Code sidebar. Each row of GET /api/code/sessions carries a rule-derived state (blocked, running, failed, done, review, idle — in that precedence, no model call), the latest pull request the agent opened from it (pull_request) and how many (pull_request_count); the owner can mark a conversation done (POST /api/code/sessions/{id}/done, not reachable from the desktop bridge, cleared by the next turn), and the sidebar filters by all / blocked / for review. (#940)

• chimera service start starts the installed desktop backend. The frozen backend records desktop-install.json (0600, four path variables only, never a token); the CLI starts that executable from the install folder, where its .env is read, and refuses a record whose executable is not chimera-backend. (#943)

• chimera code new and chimera code resume reach the background service. A conversation started in the terminal shows in the app and back; the service record is trusted only after GET /api/info agrees, only loopback URLs are used, and approving from the terminal needs the question's code. (#944)

• Activity panels can be grouped into tabs and split side by side. Tabs are a real tablist with arrow-key navigation, a split is resizable and persists, and a layout saved before this opens exactly as it did. (#946)

• Side cards for the open Code conversation: environment (folder, branch, worktree, posture), context in %, connectors with a retest, the conversation's pull requests or changed files, and its background tasks. (#949)

• The desktop app attaches to the background service instead of always starting its own backend. It checks the service record against /api/info, attaches to the same or a newer compatible version, drains and replaces an older one, and runs --standalone for a different data folder; the tray can switch the service off, restart or stop it, and an update stops it first. The service runs from its own copy (<data>/service-bin/<version>/chimera-service.exe), so the installer can replace the app while it runs. A window leases the service its screen credential only with a per-launch launcher key the shell hands to the service it started, never with the token on disk; on a service the current app did not start, a yes takes the question's code until the app restarts it. The desktop bridge is published only while a window is connected. (#952)

• Pair your own phone or browser with a one-time code, and list and revoke devices. chimera service pair (or Pair a device in Settings) prints a code valid once for five minutes, with a QR of the pairing address, served by a second LAN listener that is closed at every start and opened only by the owner. A paired device reads and talks: conversations, turns, guidance, answers to the agent's questions and refusals. Approving still takes each question's code, settings, folders, bots, file and git routes answer 403, credential files and the owner's folders are refused in any parameter, and every answer to a device is scrubbed of credentials. Revoke ends one device at once, including an open stream; Revoke all devices replaces the device secret. Chimera runs no relay: to reach it from outside, put a tunnel you control in front of it. (#953)

Changed

• The Windows CI tests run in three shards. One runner could no longer hold the suite: green runs on main took 34 to 41 minutes against a 45-minute limit, and on #903 pytest ran 44:35 with 11,816 passing and nothing failing before the job was cancelled. Each shard runs whole test files chosen deterministically from CI_TEST_SHARD, balanced by test count, under a 30-minute limit; a test pins that the three together run every file exactly once and that the matrix and the /3 agree. verdict, the only check branch protection requires, still waits on all three.

• The Linux CI test job gets 30 minutes instead of 20. Green runs took 16 to 19 minutes; on #913 pytest finished with 12,067 passed in 19:16 and the job was cancelled four seconds later, a red with nothing failing. (#921)

• list_dir and grep leave out symlinks whose target is outside the workspace. Reading such a link was already refused; listing it only invited the retry. A link between two folders of the same project is still shown. (#927)

• gitleaks keeps its default rules and allowlists two flagged values that are not credentials. A false positive cannot be fixed by a later commit, because every commit of a pull request is scanned; .gitleaks.toml names each value exactly (a test fixture and the shortcut table's keys: "Ctrl+Shift+Tab"), matched against the flagged secret, and a planted key is still reported. (#941)

Fixed

• The Linux AppImage and .deb run on glibc 2.35 again (Ubuntu 22.04, Debian 12, Mint 21). They were built on Ubuntu 24.04 and required glibc 2.39, so they did not start on those systems; the AppImage catalog's test caught it. The Linux build now runs on Ubuntu 22.04, and measured inside the new AppImage no file asks for more than GLIBC_2.35 (the old one: GLIBC_2.39, from the app binary itself). (#960)

• An approval is not recorded as a refusal because Windows held its answer file. An antivirus or the indexer opens the answer the moment it lands, and the waiting question read it once, failed with a sharing violation and recorded unreadable — a refusal nobody gave. The read now retries a busy file like the write already did. (#957)

• The frozen desktop browser installs and launches Chromium from the same user cache. Playwright's frozen launch default pointed inside the sidecar bundle while first-use installation used the user cache; the sidecar now configures Playwright's OS-specific user directory before either operation, unless the user explicitly sets PLAYWRIGHT_BROWSERS_PATH.

• Reject bash heredocs before host approval on Windows. run_shell now explains that cmd.exe has no heredocs and suggests saving a script or using PowerShell, instead of waiting for approval before failing.

• Context compaction retains deterministic run progress and recovers once from provider overflow. Restore successful read/write targets with size and short hashes, retain recent history to a token budget, and force one compaction retry when the provider rejects an oversized prompt.

• Undo puts files back with the line endings they had. The checkpoint read files with read_text and wrote them with write_text, which translate newlines: on Windows every LF file an undo restored came back with CRLF endings, and on every platform CRLF and lone CR were lost, so the text looked the same while the diff was every line. A turn that only changed line endings was also not recorded as a change. Snapshots and restores now read and write bytes. (#920)

• The conversation list no longer re-reads every stored conversation on each call. CodeSessionStore.list_meta parsed all code_sessions/*.json files every time, and the sidebar asks for the list whenever the set of running turns changes; with ~15 Code turns running that was several full re-reads a second (69 files, some 190 KB+, four corrupt files warning on every call) until the desktop backend stopped answering and the supervisor killed it with every turn. Rows are now cached per file by (mtime_ns, size), save() updates its own row, and an unreadable file is warned about once per version. (#923)

• Require a per-launch bearer token for the Tauri owner API. The desktop shell passes a random secret to its sidecar and injects it into the webview before the frontend starts; API fetches and SSE streams send it in Authorization, while static assets and separately tokened guest links remain public. A token the owner already set is reused rather than replaced, the tray authenticates with the launch token, workspace images in answers load through the authenticated client, and gh/git for pull requests no longer inherit secret environment variables. (#924)

• An open bot no longer loads the owner's API connectors. The refusal compared the surface name exactly against platform, app-messaging and serve, but every bot passes platform:<adapter> or app-messaging:<adapter>, so on a bot with an empty allowlist (which answers anyone) the connectors the owner had sent to unattended surfaces loaded, with the owner's key. Surfaces are now classified by family in one place (chimera.governance.surfaces), which the bot MCP opt-in and the chat answer path also use. Cron, board, MCP, A2A and the attended surfaces are unchanged. (#938)

• The repository map credits the module that defines a name imported through a package facade. from chimera.core import X used to give rank to chimera/core/__init__.py only; 510 product imports went through such facades. chimera/core/autonomous.py is back inside the default budget (19th of 27 lines) without raising the budget or unpinning it. (#942)

• OpenDyslexic is offered in Appearance. The font has shipped in public/fonts since #763 (the official, unmodified file, with its OFL licence); the @font-face pointed at src/assets/fonts, a folder that never existed, so the option read as missing from the build. (#945)

• The owner's connectors stay off GitHub issue jobs and an unauthenticated /v1/chat/completions. Anyone who opens an issue in a configured repository, or reaches /v1 while CHIMERA_SERVER_TOKEN is unset, used to run with the owner's connectors; the rule now lives with the bot rule in chimera/governance/surfaces.py. (#947)

• One record holds every pull request of a Code conversation. A PR opened from the panel now counts in the sidebar and moves the conversation's state, and one opened by the agent shows on the card; conversations stored in either earlier format read correctly. (#948)

• Approving without a code needs the screen credential, not just a token. A token read from disk (service.token, or one in .env) used to approve the backend's own questions with one request; now only the owner's screen, with a per-launch credential that never touches disk, approves without the question's code. (#950)

• A card that appears is approvable at once. The approval code was remembered after the question file was written, so a click on a card in that moment was answered "asked by another process, use the code" for a question asked right there; the code is now held before the file exists, and dropped if the file cannot be written. (#954)

• Catalogue prices for deepseek-v4-flash-0731 and glm-5.3-flash record the OpenRouter readings of 2026-10-16. The fallback keeps the highest figure seen, so a receipt never reads low. (#955)