Every version, and what it changed for you.

Federated workspaces are locked down: each one belongs to its organisation, answers only to the machine and account its lease was issued to, and keeps credentials out of everything it stores, prints or exports.

Before you upgrade — Scripts that run chi repo fork, chi registry server clear or chi workspace evict --mode destroy need --yes added. On Windows, run chi auth login once after updating.

• Breakingchi repo fork, chi registry server clear and chi workspace evict --mode destroy now ask before they act, and fail without --yes when nobody is at a terminal. chi registry verify-export requires a signature whenever it knows a trusted key; pass --allow-unsigned for exports made before this release.
• ImprovedWorkspaces and features belong to an organisation, a lease names its member only on the machine and account it was issued to, and the read policy’s per-user rules follow that lease. chi auth status says when a lease was issued elsewhere, and chi workspace bind manages a workspace’s binding, which a renamed or copied workspace now keeps.
• ImprovedFederation is harder to misuse: compliance exports are signed, federated answers are marked untrusted and audited, tokens are never sent over cleartext http:// or to a server you did not approve, stored remote URLs carry no credentials, and a repository’s own git configuration can no longer run a program.
• ImprovedRedaction finds more credential formats, including compose and Dockerfile values, and a slice of a key file never shows the key’s body. Editing a line that holds a credential with apply_patch works again.
• FixedSetup writes through a symlinked CLAUDE.md, settings.json or skill file instead of replacing the link with a frozen copy, so a CLAUDE.md linked to AGENTS.md keeps following it.
• Fixedchi index <file> refuses a file the full index excludes instead of adding it.