echo/CHANGELOG.md

Changelog

1.4.0

Added — per-user baked-key builds (CoWork zero-touch)

The plugin is the only thing reliably mounted into a CoWork session (the sandbox's ~/.claude is synthetic, not your real one), so the config now can travel inside the artifact. echo_config gains a lowest-priority fallback tier — the DEFAULT_OWNER / DEFAULT_BASE / DEFAULT_KEY constants — empty in source, so the committed tree still ships zero credentials.

• build.py --bake-key --from <config.json> [--label <name>] substitutes a single user's owner/endpoint/key into those constants, producing a per-user artifact that needs no config file and no per-session paste. Values may also come from --owner/--endpoint/--key or ECHO_OWNER/ECHO_BASE/ECHO_KEY.
• Baked builds default to dist/ (gitignored) and never touch the shared echo-memory.plugin pointer.
• build.py --strip-key now force-blanks the same constants (guaranteed token-free).
• config show / doctor report [baked-in default] when a field resolves from the baked tier.

Changed — artifact hygiene

• .gitignore now excludes *.plugin and dist/; previously-tracked .plugin artifacts were untracked. A baked artifact carries a vault key and must be delivered directly to that one user, never committed, pushed, or published.

Resolution order (unchanged for hosts)

env → $ECHO_CONFIG file → canonical ~/.claude/echo-memory/config.json → baked DEFAULT_*. On a normal desktop the empty defaults mean behaviour is identical to 1.3.x; the baked tier only matters in per-user artifacts.