v1.4.1 bump

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.4.1
+
+### Fixed — baked credentials now win unconditionally
+
+A per-user baked artifact could still be prompted for credentials on install. The
+baked `DEFAULT_*` tier was lowest priority, so a stale `ECHO_*` env var or a
+leftover/placeholder `~/.claude/echo-memory/config.json` shadowed the baked key —
+even an unedited `"<placeholder>"` value won over it, flipping `is_configured()` to
+false and triggering the first-run "ask the operator" flow despite valid baked creds.
+
+- `echo_config.load()` now treats a **complete** baked set (endpoint + key both
+  present) as authoritative: it wins over env vars and the config file and cannot be
+  shadowed. The generic (unbaked) plugin keeps its env → file → first-run flow.
+- Added `baked_complete()`; `source()` reports `baked-in (plugin)` for that tier.
+
+### Security — untracked leaked baked artifacts
+
+- Two labeled baked artifacts (`echo-memory-1.4.0-jason.plugin`,
+  `echo-memory-1.4.0-gretchen.plugin`), each carrying a live vault bearer token, had
+  been committed at the repo root. They are now `git rm --cached`-removed and
+  `.gitignore` gains `echo-memory-*-*.plugin` so labeled builds can't be re-committed
+  (the version-only pointer `echo-memory.plugin` and `echo-memory-<ver>.plugin` stay
+  tracked). Tokens remain in prior history — rotate if the repo was ever shared.
+
 ## 1.4.0
 
 ### Added — per-user baked-key builds (CoWork zero-touch)
@@ -22,9 +46,11 @@ the committed tree still ships zero credentials.
 
 ### Changed — artifact hygiene
 
-- `.gitignore` now excludes `*.plugin` and `dist/`; previously-tracked `.plugin`
-  artifacts were untracked. A baked artifact carries a vault key and must be
-  **delivered directly to that one user, never committed, pushed, or published.**
+- `.gitignore` excludes `dist/` and the filled-in `echo-memory.config.json`, where
+  baked builds and the key file are meant to live. A baked artifact carries a vault
+  key and must be **delivered directly to that one user, never committed, pushed, or
+  published.** (Note: labeled baked artifacts built at the repo *root* were not yet
+  guarded — see 1.4.1.)
 
 ### Resolution order (unchanged for hosts)