Skip to content

Koder v0.3.0

Choose a tag to compare

View all tags
@Abdul-Omira Abdul-Omira released this 25 Aug 22:30
· 72 commits to main since this release
v0.3.0
37e80a4

Koder v0.3.0 — 147 commits since v0.2.4.

This release is mostly about limits you can verify: what the agent is allowed to touch, what it actually did, and where your data goes. Alongside that, local models now work without configuration, and long-running work has real structure.

Install

curl -fsSL https://github.com/aixplain/koder/releases/latest/download/install | bash

Already installed? koder upgrade

Highlights

Local models work out of the box

If Ollama is running, Koder finds it — no config. It asks Ollama which models can hold a conversation, call tools and accept images, and how much context each has, instead of guessing. Embedding models are left out of the picker rather than offered and failing.

koder run --model ollama/qwen3.5:latest "explain this repo"

Set OLLAMA_HOST if yours is not on the default port; a bare host or host:port is read the same way Ollama reads it.

Work that outlives a single turn

  • Specs (koder spec) — turn a request into requirements, a plan and tasks, then run those tasks in concurrent waves.
  • Workflows (/workflows) — model-authored orchestration scripts, as named runs you can pause, resume and stop.
  • /loop — schedule a recurring prompt; list what is scheduled and cancel by number.
  • Memory and lessons — /memory, /dream and /flush; corrections you make are recorded and re-applied in later sessions.

Powers, and a bigger toolbox that costs nothing idle

MCP servers can stay dormant until a keyword in the conversation wakes them, so connecting many tools no longer means paying for all of them at startup. Koder also reads Claude Code agents, hooks, plugin manifests and marketplaces.

Browser automation

Drive a real browser over CDP: navigate, snapshot the accessibility tree, manage tabs, detect login walls, and record sessions for replay. Opt-in with KODER_EXPERIMENTAL_BROWSER=1.

Controls that are actually enforced
koder inspect what this configuration permits — including where a policy is silently doing nothing
koder trust which directories may contribute config
koder compliance the effective privacy profile, and every network destination the configuration permits
koder audit a tamper-evident record of permission decisions, with verify to check the chain

sandbox.deny globs now cover the file-writing tools as well as shell commands, sandbox profiles support extends, and an administrator can pin policy that a project config cannot reopen.

Security fixes

Several of these are worth calling out plainly:

  • An untrusted repository could disable the sandbox by being opened. sandbox was not in the workspace-trust strip list, so a hostile koder.json saying {"sandbox": {"mode": "danger-full-access"}} turned off OS confinement for every command — with no prompt and nothing to refuse. share, autoupdate and memories were ungated the same way.
  • Model output could navigate the desktop renderer into an RCE. There was no will-navigate handler and no setWindowOpenHandler, and the GUI renders model output directly, so a link in a reply was one click from replacing the trusted page in a window holding the IPC bridge.
  • POST /global/upgrade was CSRF-able into installing an arbitrary package. The route took an unconstrained target interpolated into npm install -g, and a cross-origin POST with Content-Type: text/plain needs no preflight — the browser blocks only the response, after the install has run.
  • Sessions, cron schedules and workflow runs were addressable across projects. A caller in one workspace could read another's sessions and prompts, and pause, resume or stop its workflows.
  • A managed deny had four ordinary ways around it — a per-agent block, a session permission, a persisted "always" grant, and an empty ruleset. Policy is now folded in where decisions are evaluated.
  • Denied tools were pre-approved to a remote workflow engine. An inverted check meant an administrator's explicit deny was forwarded as preapproved_tools.

Also fixed

  • koder run exits non-zero when a turn fails — previously it printed the error and exited 0, so scripts could not tell a finished turn from a failed one.
  • Permission decisions record which agent made them, so a subagent's work is attributable.
  • Plan mode no longer lets bash write files unprompted, while still allowing read-only inspection without a prompt per command.
  • GEMINI_API_KEY is used when it is set, instead of being advertised and ignored.
  • Reverting a queued message no longer aborts the turn already in flight.

Platforms

macOS (Apple Silicon, Intel), Linux (x64, arm64), Windows (x64). macOS builds are signed with aiXplain's Developer ID and notarized:

spctl --assess --type install -vv ~/.koder/bin/koder
# koder: accepted
# source=Notarized Developer ID

Notes

  • The desktop app is not part of this release. It is built but not published while Windows code signing is being set up.
  • Both koder-* and legacy aixplain-code-* archives ship, so existing installs keep upgrading.

Full changelog: https://github.com/aixplain/aixplainCode/blob/main/CHANGELOG.md

Assets 14
Loading