Chutes Build 0.4.3

Added

• The browser tool gained the actions its workflow was missing: wait
  (until a selector is visible or page text appears), key (Enter, Tab,
  Escape, arrows, Home/End, PageUp/PageDown), scroll, select,
  back, reload, text (full visible page text), and console / network,
  which report the session's browser logs, uncaught errors, and requests.
• Documented desktop control as an opt-in MCP integration, including what
  enabling it gives away, since no built-in tool captures the screen or
  synthesizes input.
• --output-format streaming-messages-json emits headless output in the
  Anthropic Messages API wire shape: a system/init line, assistant lines
  whose content[] carries thinking, text and tool_use blocks, user lines
  carrying each tool_result, and a final result. Ported from upstream.
• streaming-json now reports tool activity as tool_call and
  tool_call_update lines. The headless runner ignored ACP tool-call updates
  entirely, so a consumer could see the agent's prose but never what it did.
• CHUTES_EXTRA_CA_BUNDLE adds extra TLS roots from a PEM bundle, for networks
  where a proxy terminates TLS with its own root. Opt-in and additive: unset by
  default, never replaces the built-in roots, and never disables verification.
  A bundle that is oversized, unreadable, or unparseable is reported and
  ignored instead of breaking every request. Ported from upstream, reworked to
  use reqwest's own PEM bundle parsing rather than adding a crate to the
  generated workspace root.

Fixed

• browser click now focuses the element before clicking, matching a real
  pointer click. Without it a click on a field left focus on the body, so a
  following key went nowhere.
• Cancelling now stops an in-flight /compact. Compaction runs as a command
  rather than a turn, so the cancel path returned early and left a long
  compaction running with no way to stop it. Other commands are unaffected.
  Ported from upstream.
• Saving MCP settings no longer discards the rest of config.toml. Every MCP
  writer parsed the file with a fallback to an empty table, so one syntax error
  turned the next save into a full rewrite containing only what that call was
  persisting. Unparseable configs are now refused, the user-config write lock
  covers the whole read-modify-write so concurrent saves cannot erase each
  other, and writes go through the shared atomic helper instead of a fixed
  temporary filename two writers could collide on. Ported from upstream.
• The encrypted prompt templates no longer depend on how the repository was
  checked out. Generator and staleness test compared raw include_str! bytes,
  so arrays built on a CRLF working tree matched only on Windows; both sides
  now fold line endings first, which also makes the decrypted prompt
  byte-identical on every platform.
• Two pager tests no longer depend on the machine they run on: one budgeted its
  wait in poll counts rather than elapsed time, and two built past instants by
  subtracting more than the machine's uptime, which panics on a recently booted
  box or a fresh CI runner.
• /advisor now spawns. Its curated toolset already declares memory_search,
  memory_get and web_fetch, and session-level injection appended a second
  copy of each; both entries resolved to one client-facing name, so toolset
  validation rejected the agent with duplicate client_name on every attempt.
  Injection now skips tools the agent already declares.
• Bundled skills cited tool names the model is never shown (task is exposed
  as spawn_subagent, run_in_background as background), sending it after
  tools absent from its schema. Names corrected in /best-of-n and
  /check-work, with a test tying skill text to the advertised names.
• Repaired the nine stale xai-grok-agent tests: two asserted behavior the
  code no longer has (retired grok_* toolset presets, web_search before it
  became a default-on native provider), three compared prompt budgets against
  raw include_str! output that a CRLF checkout inflates, two compared paths
  with hardcoded forward slashes, and two staged a fake home through $HOME,
  which dirs::home_dir honours only on Unix. The two home-dependent rules are
  now split into injectable helpers covered on every platform, and their
  environment-driven integration tests are marked Unix-only.
• The CI Rust job now runs the xai-grok-agent library tests and the bundled
  skill checks, which were previously never executed by any workflow.

Changed

• generate_media is self-contained: it resolves a plain model name against
  the catalog and places the new top-level prompt into whatever text field
  the selected cord declares, so {model, kind, prompt} is a complete call.
  params is now optional and only needed for non-default settings or input
  assets, and schema-mismatch errors list the accepted fields instead of
  directing the caller back to describe_media_model. The /imagine,
  /imagine-video and imagine skill instructions no longer mandate the
  three-call list → describe → generate sequence.
• Updated the pinned actions/checkout workflow dependency to v7.0.1,
  including its Git argument escaping and pull-request safety fixes.

Security

• Marked the three synthetic secret-detection fixtures explicitly so both
  worktree and full-history Gitleaks scans pass without weakening real-secret
  detection.

Documentation

• Recorded the CodeQL static-analysis triage in the security review: current
  alert counts, the disposition of each query, and the reachability argument
  showing the retained upstream backend client cannot run while
  REMOTE_SESSION_REGISTRY is false.
• Documented the pinned Rust/Node toolchain, the single supported package
  manager, the artifacts the project actually produces, the protected assets
  and generated files, and the repository-visibility rules in AGENTS.md.
• Described the advisor's actual read-only toolset and the /advisor controls
  in the subagents guide, and recorded the self-contained generate_media
  workflow in the Chutes ecosystem and MCP guides.
• Listed the browser tool's full action set — what each reading action reports
  and how elements are addressed — in the web and browser guide, and documented
  CHUTES_EXTRA_CA_BUNDLE alongside the endpoint settings.
• Documented both headless streaming formats and what each line carries in the
  CLI reference, and noted in the slash-command list that /compact can now be
  stopped while it runs.