Chimera 0.72.0

Chimera 0.72.0

[0.72.0] - 2026-10-21

Added

• The Chrome extension is ready for the store, and only your own screen hands Chimera your Chrome. The extension's popup is back (it holds Stop and the per-site permission button, which the previous version had lost), with icons, a reproducible package and a page that states each permission and what happens to page content: it goes to the app and from there to the model provider you configured. A turn opened with the server token alone no longer gets your Chrome; downloads triggered by a page are denied; cancelling Chrome's debugging bar stops everything; replying, sharing, forwarding and inviting ask first; and with the bridge's full control on, an irreversible action or a Google search in your Chrome is still approved only on the app's screen. (#1056)

• Settings → Browser now controls your own Chrome. It shows whether the Chimera extension is paired and connected (with the one command to register it), lets you list the sites where Chimera may click and type without asking, turn Google search off or to ask each time, stop the Chimera tabs and unpair. A browser action's approval card can now say "Always on this site", except for payments, sending, deleting and publishing, which always ask. Changing that list, stopping and unpairing need the app's own screen: the server token alone, which any local process can read, is not enough. (#1054)

• Chimera can click and type in your own Chrome, with trust given per site. On the sites you list in CHIMERA_BROWSER_TRUSTED_SITES, your desktop turns click and type without asking, as Claude in Chrome does; anywhere else each action shows you a card. Buying, paying, sending, deleting, publishing and form submissions still ask on a trusted site; passwords, card numbers, verification codes, payment frames, downloads and uploads are refused outright; at a CAPTCHA it stops and hands you the tab. The extension checks again, just before acting, that the element is the one decided and nothing covers it. One limit is stated plainly: on a site you trusted, a plain element that runs its own script is not recognised as irreversible. (#1053)

• Google search in your own Chrome, off unless you turn it on. With CHIMERA_BROWSER_GOOGLE=ask, your own desktop turns can search Google in a visible tab of your paired Chrome, and each search first shows you a card, even with approvals set to allow. It runs at a person's pace (one per 20 seconds, five per turn, 30 a day), uses no disguise, and stops and hands you the tab at the first CAPTCHA or unusual-traffic page, without trying again for 30 minutes. Results come back as titles, links and snippets, marked as fetched content. Bots, scheduled jobs and the MCP bridge never get it. (#1052)

Fixed

• A flaky test of the worktree prune is deterministic. Its helper recorded a child process before the child had finished starting, so it sometimes named the parent's command line and the check correctly called the worktree abandoned. No product change. (#1055)

Security

• Pairing Chrome is a six-digit code from your screen, and the key no longer reaches the agent's shell. Settings → Browser shows a one-time code (two minutes, five tries) that you type in the extension's popup. The key goes to the operating system's vault, never into the environment of the commands Chimera runs, and is masked if it ever appears. On Windows the local pipe accepts only your user and the host checks it is talking to the installed Chimera before answering. Unpairing reopens pairing at once. What it does not do, and the docs say so: a malicious program already running as your Windows user can still take the key. (#1057)