v0.70.0

Chimera 0.70.0

[0.70.0] - 2026-10-19

Added

• The terminal chat now compacts, plans and undoes like the desktop. chimera chat and chimera assist compact the context by default with the desktop's policy (--no-compact turns it off). /plan <task> shows a plan first and runs the task only once you approve it; approving pre-approves no risky action. /undo N lists the files of the last N turns, asks, and puts them back through the same durable store the Code screen uses, keeping any file you edited afterwards. Plain /undo still takes back the last turn. (#1015)

• Go back to before any turn of a conversation, from a timeline in its header. A rewind button opens the points the durable undo kept, with the hour and how many files each touched; choosing one first shows exactly which files would be restored and which would be left as they are because you edited them afterwards, and asks for confirmation. Going back means before that turn — the old restore only undid the turns after the one you picked — and the restore itself can be redone from the same timeline. A turn with no saved copy of any file is shown disabled with the reason. The preview route writes nothing and applies the restore's own rule; neither route is on the desktop bridge, so no paired device or outside client can restore files. (#1014)

• The Editor marks what git sees, opens files by name, previews HTML and asks before dropping unsaved work. The file tree shows modified, added and untracked files with a letter and their folders with a dot, from the same git status as the Changes card, refreshed after a save and when an agent turn ends; files carry an icon by type. "No file open" lists recent files for the project and the files changed in this folder, and Ctrl+P opens a file by name. An .html file has a Preview toggle in the same sandbox the Code screen uses, showing unsaved edits too — handy for Chimera Design's export. Closing a tab with unsaved changes asks to keep editing, close without saving, or save and close. (#1010)

• Select code in the Editor and ask Chimera about it, or ask for a change shown as a diff. A floating bar on a selection (Ctrl/⌘+L to ask, Ctrl/⌘+I to change, in the shortcuts table) takes an instruction in place: "Ask" sends the lines to the project's Code conversation as a context item, the same path as an @ mention; "Change this" adds propose_change, which the server runs read-only with one file and line range, so the proposal comes back as an inline diff with Accept and Reject and is never applied on its own — Accept saves through the Editor, and disappears when the lines changed since the request. A file that changes on disk while open is held with its diff and stays read-only until "Keep" or "Undo"; it says "Changed by Chimera" only while a Chimera turn or run is active in the project. The Editor gets a breadcrumb with the project's name and its own status bar (line and column, language, encoding, saved); the conversation's bar leaves the Editor while nothing runs. (#1005)

• Mention files, folders, designs and conversations with @ in the Code composer. Typing @ opens a keyboard-first list — the project's files and folders (fuzzy), designs and recent conversations — announced to screen readers; a choice becomes a removable chip and travels with the turn as typed context. A file up to 8,000 characters is attached inline, sanitised and fenced as data and recorded in the ledger as a read; a larger one or a folder goes by path for the agent to read; a design by id with a short summary; a conversation by id and title, never its transcript. Absolute paths and .. are refused before the turn runs, symlinks out of the project and Chimera's own .env are refused when resolved, and a guest on a share link cannot mention designs or conversations. POST /api/fs/paths lists names inside the workspace for the picker, capped at 20,000 entries. Slash commands work as before, and the first turn's title is the line you typed, not the attached context. (#1003)

• Chimera Design, part 6: export to PDF, PNG and PPTX, and to a chat as a file. PDF is the static page printed by Playwright's Chromium, one page per artboard at its size, with JavaScript off and every request that is not data: aborted (a test shows the same hostile page runs its script without the guard); PNG is one image per artboard, or a zip of them; PPTX (python-pptx, the documents-out extra) puts each element at its frame on a slide per artboard. When Chromium or python-pptx is missing, the export refuses with what to install — nothing is downloaded on its own — and the export dialog shows that sentence. The route and the design tool accept the four formats, still behind confirmation and outside the bridge; a linked chat gets PDF by default through the existing attachment rules, never HTML. Images stay placeholders until there is an asset store. (#1002)

• Chimera Design, part 5: designing beside the conversation on the Code screen. The canvas opens in the Code screen's centre slot — conversation on the left, canvas on the right, a switch between them on narrow windows with both kept alive. It autosaves through the operations route with a visible state (saving, saved with the revision, conflict, offline); a conflict reloads the server copy and re-applies unsaved edits only when they all still fit. Manual and agent edits share one undo history. A turn that asks for a design shows "Open in Chimera Design" (an explicit ask opens it with the brief), and each change the agent makes shows a card that opens the document. Beside the canvas: propose from a brief (summary, assumptions, checks and a preview of the dry run, applied only when you click Apply), refine the selection, audit, edit the tokens and check the design against them with a jump to each finding, comments per element, versions with restore, and export to HTML — restore and export ask first. The palette has "Open design" and "New design"; the client now deletes a group's children and allows deleting inside a group, as the server does. (#998)

• Full control through the desktop bridge, switched on from the screen only. A third bridge switch, "Full control" (CHIMERA_BRIDGE_FULL_CONTROL, off by default), lets an outside agent such as Claude Code do through the MCP bridge what today only the screen does: answer approvals and setting suggestions, take owner decisions (folder grants, approval rules, plugins, marketplaces, worktree pruning), call the routes that need confirm: true (design restore, delete and export; storage clean-ups; troubleshooting), change the owner's settings directly, and open any screen of the app (ui.navigate, checked against the app's own screens). Only the screen credential can turn it on, the bridge and PATCH /api/config refuse to, and turning it off takes effect on the next call; while it is on, a bar on every screen says so with a one-click off, and each call made with that authority writes an audit entry with ids only, listed in Settings › Security. Still out of reach with it on: credentials (keys, tokens, OAuth, the .env, the Runner), who can reach the app (pairing, sharing, the LAN door, the server token, messaging bots and their allowlists, the bridge's own switches) — and an approval still never overrides a governance BLOCK. With the switch off nothing changes. (#1000)

• A grid of 27 categories in Discover, on Skills, Connectors and Plugins, with Productivity among them. Each tile has a line drawing in the theme's ink and the number of items that clicking it would list (search and the other filters applied); an empty category does not appear, the grid shows eight tiles until "Show all", and a pressed tile sets cat= in the address, ticks the same box in the filter menu and clears on a second click. Every category value shipped today — the skills catalogue and its topics, the bundled skills, the curated MCP servers — maps to one of the 27, and a test fails the build when one falls through to "other"; the 27 ids are checked against the backend's list and the three public catalogues share the same file. Productivity is new: the reverse-engineering tool rea, the Apple notes and reminders suite, smart home and translation file there instead of security or documents, GitHub files under code, and Firebase under databases next to Supabase. (#992, #994)

• Chimera Design, part 3: the HTTP routes. /api/design lists, creates and reads design documents, applies validated operations against an expected revision (a conflict answers 409 with the inverse operations), lists versions, checks a document against its tokens, and asks the configured model to propose, refine or audit — a proposal comes back validated and dry-run but is never applied: the screen shows it and applies it through the same operations route. Restore, delete and the HTML export (a download, never a page) require confirm: true, and those three stay out of the desktop bridge so no outside client can answer the owner's question for them; the rest are reachable from the bridge at the operate tier. Every change writes an audit event with ids and counts only, model calls are metered under "design", and the storage card counts the designs folder. (#993)

• Chimera Design, part 4: the agent tool, offered when a turn asks for a visual design. A deterministic detector (Portuguese, English and Spanish, accents folded, whole words) reads each Code turn: naming Chimera Design, asking to use it, or asking for something presented as a design opens it outright; a bare "design" only counts with a visual signal (landing page, slide, banner, mockup, screen…), and code senses such as "design pattern", "system design" or "o design do banco" never fire — 97 cases pinned in a test. Only then does the turn get the design tool (create, summary, apply, propose, export to HTML in the workspace), a short note about it in the turn context, and a design_suggestion frame; other turns are unchanged and carry no extra schema. The tool obeys the posture (read-only returns a proposal without applying it), never sends HTML to a bot, marks its output as untrusted, stays out of guest turns, and CHIMERA_TOOL_DENYLIST=design removes it. (#995)

• A grid of 26 categories in Discover, on Skills, Connectors and Plugins. Each tile has a line drawing in the theme's ink and the number of items that clicking it would list (search and the other filters applied); an empty category does not appear, the grid shows eight tiles until "Show all", and a pressed tile sets cat= in the address, ticks the same box in the filter menu and clears on a second click. Every category value shipped today — the skills catalogue and its topics, the bundled skills, the curated MCP servers — maps to one of the 26, and a test fails the build when one falls through to "other"; the 26 ids are checked against the backend's list. (#992)

• Chimera Design, part 2: the document domain. chimera/design/ holds the design document (pages, artboards, text, shape, path, image and group nodes, element comments, design tokens) with a schema version and migrations; operations applied all-or-nothing with an inverse for every one, using the same wire names and camelCase keys as the desktop canvas; ids a model proposes for new elements are replaced by server ids; a store under designs/ with optimistic revisions, the last 50 versions kept and restore as a new revision, never a rewrite; a static HTML export with every text escaped, no script and a restrictive CSP; checks against the tokens (colours, fonts, 4.5:1 text contrast, elements off the artboard); image import checked by magic bytes, SVG refused. The model call (propose, refine, audit) fences the brief, requests and canvas text as untrusted data, asks once more when the JSON does not validate, and dry-runs the operations so an invalid proposal is reported instead of applied. No route or tool yet. (#991)

• The catalogues carry real dates, GitHub stars with the date they were read, and sections computed on this machine. pins.json now records, at bump time, the first and last commit that touched each item's own content (not its generated card, which every metadata refresh rewrites), so "New" and "Updated" are measured against the pin's date and stay stable. Stars come with stars_at and stars_repo: the count the pinned catalogue recorded, then a background read of api.github.com through the plugin installer's allowlisted fetch, cached 24 hours, never awaited by the route, and off with CHIMERA_CATALOG_STARS=false. GET /api/catalogs/{kind} adds sections — For you (from MCP servers configured, skills installed and the manifests of registered projects, each with its reason, absent without a signal), Works without setup, From the Chimera library, New and Updated; an empty section is never sent, and the schema still has no install counts. (#990)

• Chimera Design, part 1: the canvas editor. The desktop gains an SVG design canvas (components/design/, lib/design/), not yet mounted in a screen: artboards with size presets, text, rectangle, ellipse, line and freehand shapes, comment pins; select, marquee and shift-select, move by drag or arrow keys, resize with eight handles, align with snapping guides, inline text editing, duplicate and delete, zoom anchored at the pointer and pan; undo and redo with a drag recorded as one step. Every shortcut is in one table that both the key handler and the ? help sheet read, the whole flow works from the keyboard with actions announced to screen readers, and the inspector folds away on narrow widths. Colours come from the document as data and are checked against a strict pattern before they reach an attribute; the design gate gains no exception. No new dependency. (#986)

• The app reads the public plugin, skill and connector catalogues from pinned commits only. chimera/catalogs/pins.json names each of brcampidelli/chimera-plugins, chimera-skills and chimera-connectors by full commit sha and the sha256 of every file read; the loader fetches only those exact files, checks the hash before parsing (a mismatch is refused and never cached), caps each file at 1 MiB, caches verified bytes per commit so it works offline, and without cache or network returns an empty catalogue with the reason. GET /api/catalogs/{kind} serves neutral items (with the same refusal reason the plugin installer gives); nothing updates at runtime — chimera catalog pins --check only reports newer commits, and a release bumps pins on purpose (scripts/bump_catalog_pins.py). The schema has no install counts, and a test fails if one appears. (#984)

• One set of catalog components for Skills, Connectors and Plugins. The desktop gains shared catalog primitives (screen with Mine/Discover, search with the / shortcut and a two-step Esc, filter and sort menus kept in the address, sections, cards, status pill, skeleton) and a neutral item model. A card says what an item runs before who made it, keeps a non-installable item visible with the reason, shows a vendor badge only when the catalog flag and the pinned repository's owner both prove it, and sorts by GitHub stars with items lacking data at the end rather than as zero; the model has no install counts, and a test fails if one appears. Nothing uses the screen yet; the next PRs move Plugins, Skills and Connectors onto it. (#983)

• MCP servers that sign in with OAuth connect natively, registering themselves. Chimera's HTTP MCP client now discovers the server's authorization server (RFC 9728 / RFC 8414), registers a client dynamically when none is configured (RFC 7591), and signs in with the authorization code and PKCE S256 on a loopback redirect, with the resource indicator; tokens are refreshed and stored in the OS keychain (or a 0600 file in the data folder), never in mcp.json, logs or routes. Notion, Linear and similar hosted servers work without the mcp-remote bridge. A browser sign-in opens only from the owner's screen (Connect) or an interactive chimera mcp login; Test, bots, cron and serve use stored tokens or say to connect in the app. The agent's read tools and shell refuse the token folder. (#981)

Changed

• The Code screen speaks plainly at the top, in the status bar and before the first turn. "Commands off" is a badge that leads to the folder's setting instead of looking like a button. The status bar names tools in words ("Task list updated" rather than todo_write ✓), shows tokens compactly with how much came from the cache ("1.6M tokens (98% cached)") and the cost in the interface language — four decimals below one cent, so a small turn is never shown as zero — and appears only on the Code screen. An empty conversation welcomes you with suggestions from the folder's git state (review the changes, run the tests, explain the project, or set the folder up as a project). The two voice buttons say what each does, and a conversation's title skips a leading "Read …" instruction line when real content follows. (#1013)

• The Code screen's side panel, part 2: plain words, the whole environment, connectors you can act on, and a calmer layout. The Memory card says how many memories this turn used instead of "1 recuperado(s) (fts)"; Environment shows the whole approval policy, and says when the conversation is in a worktree and which project it belongs to; each Connectors line has Test and a link to Settings › Connectors, and an OAuth server shows connected or expired with Reconnect. The default order puts approvals and changes first and machine and environment last — an untouched 0.68 or 0.69 layout moves to it, a rearranged one keeps its arrangement — the drag and close controls appear on hover or keyboard focus with no animation, and the status at the top of the panel no longer repeats the status bar. (#1009)

• Settings › General opens with the basics, Settings can be searched, and the Profile shows what Chimera uses about you. General now starts with interface language, default project, default model and response style; Voice is its own section, long labels with benchmark figures are a short sentence with "Learn more", and "only for turns longer than (seconds)" is a selector, with a "Custom" entry kept for a stored value that is not one of the presets. A search field (Ctrl/Cmd+K) finds an option by its translated label or description and opens its tab, and the content uses more of the width. The Profile shows the response language saved for the agent (and the interface language when it differs), the response style as read-only with a link to the composer, the registered projects, and the persona facts, editable in place — nothing new is stored. (#1008)

• Settings › Connectors puts MCP servers and OpenAPI connectors on one catalogue screen. Mine lists both, with what waits for you first (a held server, one that still needs its OAuth sign-in, an OpenAPI connector that arrived switched off); testing, the last result, approving a held change and OAuth connect or disconnect live in the item's detail panel (item=). Discover shows the curated MCP catalogue, with each server's containment on its capability line, and the pinned public catalogue (brcampidelli/chimera-connectors); a curated entry is configured in its detail with secrets in password fields that are never echoed and nothing saved before Add. The "Official vendor" badge now needs proof: each curated entry names its upstream repository, and a test fails the build when an official entry is not published by its vendor's organisation. (#989)

• Settings › Skills moves onto the shared catalogue screen. Mine opens with the skills active now, then what waits for you (installed but unread, learned and pending), on, off, and the learned skills with their uses and wins; Discover has the Chimera library in work order, the pinned public catalogue (brcampidelli/chimera-skills) and the third-party catalogue, each card with its portability verdict and licence. A skill's detail panel (item=) shows what it is, what reaches the agent (read in place, which also satisfies "read before switching on"), licence, source and commit, and the steps install → read → switch on; checking for an update and uninstalling live there. The old Knowledge addresses and anchors redirect to the matching view and section. The bundled library and the pinned catalogue are both listed, each with its source, rather than one silently replacing the other. (#988)

• Settings › Plugins moves onto the shared catalogue screen, with a detail panel of its own. Mine groups plugins as Waiting for you (pending and held) first, then On, then Off or denied; Discover shows "Work without setup" first and each marketplace after, and an item that cannot be installed stays listed with its reason on the card and as the + button's description. Opening a card shows a side panel at its own address (item=): what the plugin is, its source and licence, and the steps install switched off → review → switch on, built on the existing switch-on dialog and update diff. Back and Esc close it and focus returns to the card; a link to an item that no longer exists says so. Switching on stays an owner-only action outside the desktop bridge. (#985)

• Settings has a Personalization group: Skills, Connectors and Plugins. The settings column now reads General, Appearance, then Personalization (Skills, Connectors, Plugins) and System (Connections, Usage, Security, Decisions). Skills moved from Knowledge and the MCP servers and OpenAPI connectors moved out of Connections into Connectors, each screen unchanged for now. Old links keep working: #/knowledge?tab=skills and the Connections MCP/OpenAPI tabs redirect to the new places without adding a history step, and the command palette points at them. Group headers are not tab stops and the arrow keys skip them. (#982)

• Plugins from a subfolder of a GitHub repository install too, and rounded-card has its token. A marketplace entry with a git-subdir source pinned to a commit on github.com now installs, downloading only that folder with the usual size, name and link limits; a url source pointing at the root of a GitHub repository with a commit sha is read as a GitHub source. Other hosts and unpinned sources stay refused. Thirteen desktop components used rounded-card without its token and rendered square; the token exists now and the design gate refuses a utility name with no token. (#979)

Fixed

• Five defects found by driving Chimera from outside: titles, long options, "Other", expired questions and commands that are off. A conversation whose first message named several files took the first heading of the first one as its title — an agent's instruction file won over "T1 · Side panel…"; the heading is now used only when exactly one ordinary file is named in a short message. ask_user cuts an option label over 120 characters with an ellipsis and keeps the full text as its tooltip and answer, instead of refusing it and making the agent ask again. Choosing "Other" focuses the text box and sends nothing until there is text. A question that expired while you typed says so and offers "Send as the next message" with your text kept, and the bridge and the screen now agree on whether a turn is running. A turn without commands in its folder is told so up front, and a refused run_shell says "commands are off for this folder — ask the owner to allow them" instead of a raw OS error. (#1011)

• Typing straight after picking an @ mention no longer scrambles the next word. Picking a mention removes @word from the draft, and the composer put the caret back with a requestAnimationFrame that ran unconditionally with the position from the moment of the pick; keys typed before that frame landed at the end of the box and the frame pulled the caret back in the middle, so @login became gin@lo and the list never opened. It showed only on a loaded machine — or with a fast typist or a busy long conversation — and failed CI three times while passing locally, so #1006's longer wait could not help. The caret is now set in a layout effect in the same commit that writes the draft, only if the box still holds that text; a regression test holds frames back mid-word, and the extra waits are gone. (#1007)

• Read-only turns run beside each other, and a turn stopped while it waits for its folder never starts. The rule that a turn with no write tool skips the folder lock existed but reached nobody: the bridge's desktop_send accepted a narrower posture only at full control, although the server accepts narrowing at every tier, and with CHIMERA_DEFER_TOOLS on the tool_call proxy always counted as a writer. A client can now ask for posture: {reach: "read_only"} at any tier, the proxy is judged by its catalogue, and writers — MCP tools included — still take the folder one at a time (a reader may see a tree mid-edit; it makes no undo). Stopping a queued turn used to answer "stopping" and leave it listed as running for up to a quarter second, long enough for the bridge to read it; it now leaves the queue before the answer, returns stopped_before_start, and starting and stopping decide under the same lock, so a stopped turn never starts. (#1004)

• A turn survives a dropped connection, a damaged conversation stays listed, and the bridge's job status is short and complete. A provider connection that drops mid-stream used to end the coding turn with nothing kept; the agent now resends the step twice (1 s, then 4 s), then tries once without streaming through the fallback models, and only then fails with the cause — real refusals (key, credit, context, policy, rate limit) are not retried, and a tool never runs twice. A conversation file that no longer parses was omitted from the list in silence; each save now keeps the previous good copy, a read falls back to it, an unreadable file is set aside instead of overwritten, and a conversation no copy can open is listed as damaged and never deleted. Over the bridge, desktop_job without since returns a bounded summary (last events, every approval, notice and error, counts per tool, the receipt) instead of the whole turn, pages with since, and always shows the turn's pending approvals; context drift becomes a notice in the conversation instead of a log line. (#1001)

• Knowledge › Profile lists each fact once, and Memory puts the facts first. The profile route sends the same facts twice — profile, the ordered text for the model's prompt with an English suffix, and persona, the same facts as records — and the screen drew both; the test mocked a profile the real route never returns, so the duplicate never showed in it. The screen now draws one list from persona, an unverified fact carries a translated badge, and the model's suffix never reaches the screen; the API keeps both fields for the bridge. Memory opens with the facts and a one-line summary, hides fact types with nothing in them, explains "clean" and "unverified" in plain words (a source Chimera trusts versus outside content), filters to the unverified facts in one click, and names the origin in words. (#999)

• The Code screen's side panel shows only cards with something in them, and "Background" and "Tasks" are one card. The empty-card rule knew only the last turn's panels; the rest relied on a CSS rule that does not act on a minimised card or a tab group (and jsdom, which runs the tests, applies no CSS — a test even asserted the empty Background frame was there). One rule now decides "empty" for the card and the panel alike, for every card, open, minimised or tabbed; Context, Connectors (none configured), Changes (clean or not a repository) and Background disappear when empty, and when every card is empty the right column goes too. "Tasks" listed the same jobs as "Background": Background keeps its stop button and output and now also shows the turn queue, and saved layouts that held Tasks hand its place to Background. A guard renders every card empty in the default, all-minimised and all-tabbed layouts and fails if one shows. (#997)

• Smaller fixes on the Code screen: empty projects, the composer's settings, the palette, wrapping and search. A registered project with no conversations starts collapsed and, opened, says so with a "Start one here" button, instead of an open header over nothing. The composer's settings block opens for one visit and closes when a turn starts; "Keep open" is the remembered choice (a block left open by the old behaviour is closed once), and the no-sandbox warning stays outside it. The command palette lists the eight most recent conversations and searches all of them, archived ones marked, opening the one chosen. The file viewer has a wrap toggle remembered per kind of file, and a search result in the Editor opens the file at its line. (#996)

• The catalogue price of deepseek-v4-flash-0731 follows OpenRouter to 0.10 in / 0.30 out per million tokens. The live check on main read the input nine times dearer than the row's 0.0108; the row is what a receipt falls back to when the live index is unreachable, so it now carries the live pair and 0.0108/1.28 joins the figures already seen. (#987)