ver 1.4.0 - baked in values

CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+## 1.4.0
+
+### Added — per-user baked-key builds (CoWork zero-touch)
+
+The plugin is the only thing reliably mounted into a CoWork session (the sandbox's
+`~/.claude` is synthetic, not your real one), so the config now *can* travel inside
+the artifact. `echo_config` gains a lowest-priority fallback tier — the
+`DEFAULT_OWNER` / `DEFAULT_BASE` / `DEFAULT_KEY` constants — **empty in source**, so
+the committed tree still ships zero credentials.
+
+- `build.py --bake-key --from <config.json> [--label <name>]` substitutes a single
+  user's owner/endpoint/key into those constants, producing a per-user artifact that
+  needs **no config file and no per-session paste**. Values may also come from
+  `--owner/--endpoint/--key` or `ECHO_OWNER/ECHO_BASE/ECHO_KEY`.
+- Baked builds default to `dist/` (gitignored) and never touch the shared
+  `echo-memory.plugin` pointer.
+- `build.py --strip-key` now force-blanks the same constants (guaranteed token-free).
+- `config show` / `doctor` report `[baked-in default]` when a field resolves from the
+  baked tier.
+
+### Changed — artifact hygiene
+
+- `.gitignore` now excludes `*.plugin` and `dist/`; previously-tracked `.plugin`
+  artifacts were untracked. A baked artifact carries a vault key and must be
+  **delivered directly to that one user, never committed, pushed, or published.**
+
+### Resolution order (unchanged for hosts)
+
+`env` → `$ECHO_CONFIG` file → canonical `~/.claude/echo-memory/config.json` →
+**baked `DEFAULT_*`**. On a normal desktop the empty defaults mean behaviour is
+identical to 1.3.x; the baked tier only matters in per-user artifacts.