Every version, and what it changed for you.

Archis runs where there is nobody to log in. A machine token authenticates a container, a CI runner or a Codespace with no browser and no keychain, and a machine that never reaches the network gets its licence by hand — requested on the machine, issued in the portal, imported back. Agents can ask what moved across the whole repository since they last looked, and reads on large repositories got materially faster.

Before you upgrade — Update. Nothing to rebuild: this release reads the index you already have.

• NewA machine token authenticates a machine with nobody in front of it. Create one in the portal with a name and an expiry, present it in CHI_TOKEN — or in CHI_TOKEN_FILE, for the Docker and Kubernetes secrets that arrive mounted as a file rather than as a variable — and a container, a CI runner or a Codespace works without a browser to open, without a keychain to unlock, and without a state directory that has to survive the process. Nothing is written back, so an image built on that layer carries nobody's credential inside it.
• NewA rejected machine token says which token was rejected and why, by name, instead of sending a container to a browser that does not exist. chi auth status and chi doctor name the credential in use, which of the two variables it came from, and when it expires; chi doctor also tells apart the failure that looks exactly like "you are not signed in" — a CHI_TOKEN_FILE pointing at a secret that was not mounted.
• NewAn air-gapped machine can be licensed end to end. chi auth request prints one line on the isolated machine, an administrator hands it to the portal, and the file that comes back is installed with chi auth import. The portal lists what an organisation has issued and until when, because revoking cannot reach a machine with no network and the expiry is what ends that licence. Both sides print a fingerprint to compare out of band. Enterprise.
• NewAn agent can ask what changed in the repository since it last looked, instead of re-reading files to find out. session_invalidate now answers three things at once: what it was given that no longer holds, what is identical byte for byte but has gained callers, and what moved across the whole tree — files and declarations added, changed and removed. A file that appears without a declaration of its own changed its text and moved nothing: a comment, a reformat, a string.
• ImprovedAn incremental chi index now reports what the pass did to declarations, not only to files, so a reformat that rewrote every line and moved nothing is told apart from a change to a signature.
• ImprovedReads on large repositories got faster, and the gain is one a large repository sees rather than a small one. Measured on 0.46.0 against Angular: chi context scoped to twenty files went from 512 ms to 442 ms with byte-for-byte identical output, and resolving a name — which a session with symbols in hand pays once per symbol — stopped being a scan of the repository. Twenty-six commands across three repositories, no regression above the noise.
• Improvedchi index --json describes the pass it actually made instead of forcing a full rebuild to produce machine-readable output. Asking for the whole tree is still --full, which is the flag that has always meant it.
• Improvedchi session cost and the session report break the saving down by what was actually served — a file outline against a single symbol view — and say so when most of the headline figure rests on an assumption about what would otherwise have been read.
• ImprovedMCP responses stop carrying padding: empty fields, over-precise confidences and a repeated hint on every pointer in a list. get_relations returns only the far end of each edge, rather than repeating the symbol you asked about on every one of them.
• FixedRenewing your licence no longer raises a macOS keychain prompt every twelve hours. "Always allow" never made it stop, and the prompt outlived the fix that closed the parallel-renewal half of the problem.
• FixedLooking no longer leaves a trace. Read-only commands do not create .chi, and a directory that nothing marks as a project is not indexed on its own.
• FixedAn index written by an older version of Archis is set aside for a day instead of being deleted, so a version mismatch no longer costs you every branch and the version history with it.
• FixedThe freshness scan says what it could not read and what it had to ignore, instead of serving a stale answer as though it were current.
• FixedA byte that is not UTF-8 on standard input no longer kills the MCP server, and a line that is not JSON is answered rather than fatal.
• Fixedchi agents and chi doctor agents no longer take three seconds to ask an agent what it has registered, apply_patch replaces a file atomically, reading a session report no longer alters it, deleted files leave the graph in one pass, and chi index --no-prune is no longer undone by the next sync.