v0.48.0 — gated shell/exec tool for venice chat (#33)

venice chat --shell — gated shell/exec tool (#33)

venice chat --shell (alias --exec, default OFF) adds a confirm-gated shell tool so the agent can drive gh/git/curl/build/test commands — the same /bin/sh -c rail venice code's run uses (cwd-forced, timeout, size-capped output, VENICE_API_KEY scrubbed from the child env). --shell implies --tools.

Allow/deny policy

Scope it with a single top-level shell config section (shell.allow / shell.deny) — the shared source of truth for both venice chat --shell and venice code's run. --shell-allow / --shell-deny append to it.

• Deny globs match the whole line and each token, are always enforced, and win over allow.
• A non-empty allowlist requires a single simple command (no ; | & < > ( ) \ $) whose leading command is allowlisted — blocks allowed && rm -rf ~`.
• Empty allowlist = unrestricted (confirm gate + deny only); combining that with --yes needs an explicit --shell-unrestricted.
• Not exposed over venice mcp-serve.

Internals

• Exec rails extracted to commands/_exec.py (shared, stdlib-only); venice code's run/git behavior unchanged.
• venice code gains --shell-allow/--shell-deny and honors the same policy, without the auto-run guard (autonomous runs stay non-breaking).

667 tests green.

v0.47.0 — /persona local system-prompt files (#68)

venice chat: local personas (#68)

Keep a library of your own reusable system prompts as plain .md/.txt files under ~/.config/venice/personas/ — private, version-controllable, offline, and complementary to Venice's server-side --character slugs.

• /persona [name] in the REPL — no arg lists available personas (name + first line); /persona <name> loads personas/<name>.md|.txt as the system prompt, keeping conversation history (like /system). Tab-completes persona names.
• --persona NAME flag and defaults.chat.persona config key seed the system prompt at launch. An explicit --system / defaults.chat.system takes precedence.
• Safety: bare-name-only resolution (path separators and .. rejected) plus a realpath containment check, and listing enumerates only the personas/ subdir — a persona can never read the neighbouring credentials file.

venice chat only for now. Structured presets (frontmatter with model:/temperature:/character:) remain deferred.

632 tests green.

v0.46.0 — apply_patch cross-file atomicity + dry-run preview (#67)

Follow-up to #63. Two improvements to the apply_patch coding tool (venice code):

• Cross-file atomicity. A multi-file patch is now all-or-nothing. Every file's new text is staged to a temp file first, and the files are committed (os.replace) only once every stage succeeds — so an I/O failure part-way through no longer leaves some files written and others not. (Previously each file was written as it went, so a failed write of file 2 stranded file 1.)
• Dry-run preview. A new dry_run: true argument validates the hunks as usual but writes nothing and needs no confirmation, returning a per-hunk old→new preview for every file. Lets a human — or an agent self-checking — see exactly what a patch will change before applying it.

Docstring, tool schema, and tool description updated; three new tests cover the preview, dry-run validation errors, and cross-file write-failure atomicity. 607 tests green.

Closes #67.

v0.45.0 — multi-line REPL input

Multi-line input for the chat/code REPL (#65)

The venice chat / venice code REPL read one line per turn, so a pasted multi-line prompt was submitted at the first Enter and everything after the first newline was lost. Two new composition commands fix this (both venice chat and venice code, via the shared REPL loop):

• /paste … /end — block mode: type or paste as many lines as you like (indentation preserved), then /end to send or /cancel to abort.
• /edit [text] — compose your next message in $EDITOR (like git commit); optional inline text pre-seeds the buffer. Empty buffer, non-zero editor exit, or a missing editor all abort cleanly.

No new CLI flags or config — purely REPL slash commands. Tab-completion and /help updated.

v0.44.0 — async job status/result tools + background media renders (#62)

Closes the last open sub-issue of epic #59 (kimi-k3 agent-toolset field feedback). The agent's media tools blocked with a capped wait; now a long render can be kicked off in the background and collected later.

What's new

• background: true on venice_sfx / venice_music / venice_video — still gates on spend + queues (the charge lands up front), then returns a stateless job handle {status: "queued", queue_id, type, model, download_url?} before polling.
• venice_job_status (free) — one non-blocking probe of the render's retrieve route → processing / done / failed / not_found.
• venice_job_result (free) — fetches and writes the file once ready. max_wait=0 (default) makes a single non-blocking attempt (returns processing if not ready); a larger max_wait block-polls, clamped to the server ceiling (300s audio / 900s video). Best-effort /complete cleanup.

Notes

• Routing is keyed on type: sfx/music → /audio/*, video → /video/* (+ the VPS download_url).
• Wired into venice chat --tools (built-ins 11 → 13) and venice code's free tool set. mcp-serve exposure deferred (matching the venice_vision/venice_models precedent).
• Stateless handle — the agent holds the queue_id; no on-disk job registry.

593 tests + lint green.

v0.43.0 — venice_vision: the agent can see its images (#60)

venice_vision — image understanding for the agent (#60, epic #59)

The agent could generate images but never see them — kimi-k3's #1 gap: no way to verify watermarks, character consistency across generation stages, or anatomical glitches without a human in the loop. This release closes it.

New free tool venice_vision (in venice chat --tools and venice code):

• Pass a local input_path (sent as a base64 data: URL, 25 MB cap) or an image_url; optional prompt directs the question (default: "Describe this image in detail."), plus optional model / max_tokens.
• Rides the [openai] extra through a multimodal /chat/completions call — no new dependency, not spend-gated.
• Vision-capability guard: an explicit model that advertises supportsVision: false is rejected client-side with a message naming the fix; unknown capabilities proceed. When model is omitted, the default-trait text model is used if vision-capable, else the first supportsVision model in the catalog.
• New _models.supports_capability generalizes the capability reader (supports_function_calling now delegates to it).
• Not exposed in venice mcp-serve (same as venice_models / venice_model_details).

Tests: 576 green (10 new TestVisionTool cases + tri-state capability-reader coverage).

v0.42.0 — session spend cap for chat/code completions + /cost

Cost control for agent runs (#66): the chat completions themselves are now metered, not just paid asset tools. With DIEM on a use-or-lose Epoch cycle, an agent loop (chat --tools, code) can no longer run unbounded.

• --session-max-spend USD — caps total chat-completion spend for the session/run. Each turn's server-reported usage is priced against the session model's per-1M-token catalog rate; at the cap the loop stops starting new turns and forces a final answer (chat has no pre-call quote, so it bounds further spend, not a turn in flight). Config-backable via defaults.chat.session_max_spend / defaults.code.session_max_spend.
• Distinct from --max-spend, which stays the per-call auto-approve cap for paid tools — the two are deliberately not conflated.
• /cost — REPL command to peek the session's running spend (tokens + USD when the model's price is known).
• Graceful — a model with unknown pricing is token-counted, not charged; 0/negative = uncapped.

Works across chat --tools, the chat -i REPL (tool + streamed turns), and code one-shot + REPL. Prereq for the multi-agent epic (#52), whose listed risk is cost multiplication.

Closes #66. 563 tests green.

v0.41.0 — apply_patch multi-edit tool for venice code

Continues the #59 agent-toolset epic (kimi-k3 field feedback): edit_file fails on non-unique strings and can't batch edits — the #1 retry-loop for an LLM editing code.

• apply_patch (confirm-gated) takes {patches: [{path, edits: [{old, new, occurrence?}, ...]}, ...]} and applies them atomically per file — all hunks validate + apply in-memory (in order), and the file writes only if every hunk succeeds, so no half-edited files.
• Non-unique solved — occurrence=N (1-based) picks which match to replace; without it a non-unique old errors with a pointer to occurrence or more context.
• Surgical errors — failures name file + hunk index + reason, so the model retries one hunk instead of the whole batch.
• Same sandbox + atomic write as the other coding tools; schema steers the model (apply_patch for multi-hunk/non-unique, edit_file for a single unique change).

Closes #63. 549 tests green.

v0.40.0 — context compaction for long chat/code sessions (#48)

Adds context-window compaction so long venice chat/venice code sessions stay in-context instead of dying on an over-long prompt.

• /compact [N] — manual REPL command: summarize the older prefix into one synthetic system message, keeping the last N turns verbatim.
• --auto-compact (+ --compact-threshold, --compact-keep-turns) on both chat and code, config-backable via defaults.<cmd>.*. Fires once the prompt crosses the token budget (server usage.prompt_tokens when available, char estimate otherwise).
• Best-effort and non-destructive: a failed/empty summary leaves history untouched; never orphans a tool result from its assistant turn.

Closes #48.

v0.39.0 — per-call image safety flags + TTS voices

Continues the #59 agent-toolset epic (kimi-k3 field feedback).

• #61 — venice_image now exposes safe_mode and hide_watermark on its tool schema, so an agent can toggle them per generation (parity with venice_image_edit's no_safe_mode). Precedence: model arg > defaults.image.* config (#58) > hardcoded default.
• #64 — venice_model_details now returns a curated voices field (model_spec.voices, the TTS voice-id list; null for non-voice models), so an agent can pick a valid venice_tts voice without guessing.

Closes #61, #64. 504 tests green.