# Changelog

## 1.4.0

### Added — per-user baked-key builds (CoWork zero-touch)

The plugin is the only thing reliably mounted into a CoWork session (the sandbox's
`~/.claude` is synthetic, not your real one), so the config now *can* travel inside
the artifact. `echo_config` gains a lowest-priority fallback tier — the
`DEFAULT_OWNER` / `DEFAULT_BASE` / `DEFAULT_KEY` constants — **empty in source**, so
the committed tree still ships zero credentials.

- `build.py --bake-key --from <config.json> [--label <name>]` substitutes a single
  user's owner/endpoint/key into those constants, producing a per-user artifact that
  needs **no config file and no per-session paste**. Values may also come from
  `--owner/--endpoint/--key` or `ECHO_OWNER/ECHO_BASE/ECHO_KEY`.
- Baked builds default to `dist/` (gitignored) and never touch the shared
  `echo-memory.plugin` pointer.
- `build.py --strip-key` now force-blanks the same constants (guaranteed token-free).
- `config show` / `doctor` report `[baked-in default]` when a field resolves from the
  baked tier.

### Changed — artifact hygiene

- `.gitignore` now excludes `*.plugin` and `dist/`; previously-tracked `.plugin`
  artifacts were untracked. A baked artifact carries a vault key and must be
  **delivered directly to that one user, never committed, pushed, or published.**

### Resolution order (unchanged for hosts)

`env` → `$ECHO_CONFIG` file → canonical `~/.claude/echo-memory/config.json` →
**baked `DEFAULT_*`**. On a normal desktop the empty defaults mean behaviour is
identical to 1.3.x; the baked tier only matters in per-user artifacts.