0.57.0 — what you said at the start survives compaction, and a patch that adds a dangerous call waits for you

What you said at the start of a long conversation now survives when the app compacts it

When a Code conversation grows past its budget, the app compacts the older part to free room. Until now the dropped span was replaced by a count — "21 earlier messages were removed" — which is honest about how much went and says nothing about what still binds. A convention you stated in turn one ("every file starts with the copyright line", "never use print") lived only in the part being dropped.

The compaction now keeps the standing instructions of the dropped span beside that count. Measured before it was switched on, on 30 paired conversations with a compaction forced inside each: the turn-one convention survived in 6 of 30 with the count alone and 25 of 30 with the summary beside it, and the conversations that paid for the summary cost no more. Two honest notes travel with the number: the app's own compaction trigger sits far past the length any conversation has reached, so this decides what happens when it fires rather than changing a conversation today; and the summary mostly kept the convention by carrying an earlier file that embodied it rather than by stating a rule. A summary that came back as the model's own tool-call syntax is thrown away and the count used instead.

A patch that adds a dangerous call fed by something that is not a literal can be held for you

The governance rules read shell commands; nothing read a diff. A patch that adds subprocess.run(cmd), pickle.loads(blob), requests.post(url, …), an unsafe yaml.load, a shutil.rmtree(target) or an open(path, "w") — a call that reaches the outside world or executes data, with an argument that is not a fixed literal — passes every test and looks like ordinary work.

Every attempt receipt now records such lines (diff_flags). A surface that opts in (pause_on_diff_flags) holds a successful run for your sign-off when the change adds one, with the lines in the reason; you approve or deny. It is a question, never a block, and it was measured before it was wired: on the 325 patches an outside benchmark's oracle accepted from this agent, it flags 13 (4%), every one a task that asked for exactly the write, fetch or subprocess it found.

Every receipt says which provider served the run and what the cache answered

provider and cache_read_tokens are on every attempt receipt. A model id like deepseek-v3.2 through OpenRouter is served by several routes, and a score belongs to the route that produced it — nothing this project had published recorded one. Three knobs came with the measurement: CHIMERA_PROVIDER_ORDER pins a request to named routes with fallbacks off, CHIMERA_TEMPERATURE overrides the worker's sampling temperature, and CHIMERA_PREFIX_NONCE makes the system prefix unique per run. All off by default.

Two rules that review more, and one thing that reverted good work fixed

• A download piped straight into a shell is reviewed even when a $(…) with a pipe sits among curl's own arguments — curl -fsSL $(echo … | base64 --decode) | bash was not, and is.
• A tainted run's query-string GET can be allowed for destinations you name (CHIMERA_EGRESS_ALLOW, empty by default, editable from Settings) — and for no others.
• A generated spec test that came back as bare Python ending in a stray ``` line failed to import and could revert the very patch it was written to check. Fixed; --gen-tests stays opt-in, and its help text now carries the measured numbers (it failed every wrong patch in a labelled history and reverts about one correct patch in sixteen on a test that over-specifies the prompt).

Caveats

Installers are unsigned outside the updater path and will warn on first run. Cancellation is cooperative: it stops before the next model call, and calls already in flight finish and are billed.