Collomia v0.5.1

Changes

Added

• Live, collapsible thinking summaries for reasoning events emitted by provider
  adapters. Provider-side enablement and reasoning display in reopened sessions
  remain separate follow-up work.
• Retained task notes, original-request previews and session evidence retrieval
  across compaction/resume. See Task context.
• Durable Standard completion obligations, bounded workspace checkpoints and
  /recovery inspection/reconciliation. Interrupted actions require inspection;
  external effects cannot be rolled back or automatically replayed. See
  Recovery.
• Opt-in collo eval with 12 balanced coding/Work tasks, contained workspaces,
  budgets, traces, independent checks, human review and matched comparisons.
  An initial 24-trial baseline is recorded separately from prose-quality review.
  See Quality evaluations.
• Task-specific run_command.verification in Standard Developer and Work.
  Supported plain project builds automatically capture input scope when explicit
  verification metadata is absent. Explicit scopes remain authoritative, and
  passing checks certify only their recorded scope. See Completion.
• General-purpose local PNG/JPEG/GIF inspection with view_image, and bounded
  XLSX/Open XML structural validation. Pixel delivery depends on model support;
  structural checks do not prove calculation or visual correctness.
• Separate total-turn and no-progress limits, --max-turns, --max-no-progress
  and live /limits controls. Standard execution defaults to 256 total turns.

Fixed

• Standard completion distinguishes requested deliverables from disposable
  helpers, accepts scoped project evidence, and preserves receipts across
  unrelated edits. Final bytes, target identity and input freshness remain
  checked. HTML/source validation checks text rather than claiming execution.
• Verification-only gaps report “Verification incomplete”; final success text
  is held until accepted. Diagnostics identify uncovered paths and narrower
  receipts, and routine verification details are collapsed in the TUI.
• Observed ordinary native shell exits allow diagnosis and repair without manual
  recovery acknowledgement. Actual failed work still needs resolution;
  interruptions and opaque external-tool failures retain uncertainty guards.
• Housekeeping errors and native input rejected before execution no longer
  create task-failure obligations. Malformed file replacements are rejected
  before mutation, including patch-batch preflight.
• Recovery uses exact operation arguments or supported alternative evidence.
  Verification guidance preserves working directories and environment context;
  non-signal exit statuses such as npm's 254 are classified correctly.
• Output/context limits allow up to two bounded continuations per turn; incomplete
  tool calls are discarded without execution. Persistent limits pause resumably.
  Empty completed responses receive bounded retries. Refused or failed responses
  cannot become successful completion, and incomplete compaction cannot replace
  conversation context.
• Native command execution inherits the caller's PATH through a non-login shell;
  executable discovery and Orchestrated Goal scheduling, wall accounting and
  explicit budget continuation are repaired.
• Partial plan updates preserve omitted steps. Terminal output stalls and UI
  teardown are bounded; real-PTY startup and resize regressions are covered.
  Context reporting distinguishes current input occupancy from cumulative usage.
• read_file pagination reaches beyond the first MiB with bounded pages,
  EOF/continuation metadata and guidance for oversized lines.
• Evaluation failure traces include classification/correlation metadata, and
  scorecards distinguish task passes from individual artifact checks.

Full Changelog: v0.4.1...v0.5.1

Collomia v0.4.1

Collomia v0.4.1

Collomia v0.4.1 introduces a general-purpose Work mode, improves completion and recovery behavior across both task profiles, and makes Standard mode verification more actionable and less wasteful.

Developer remains the default task profile, Standard remains the default execution strategy, and upgrading does not expand permissions or weaken sandboxing.

---

Highlights

General-purpose Work mode

Collomia can now handle non-software work without requiring a Git repository or pretending every result should be verified by a development test suite.

Select Work mode at startup, during an interactive session, or in headless automation:

collo --mode work
collo run --mode work "Create and validate a status report"
/mode work

Work mode is designed for:

• Research and knowledge retrieval
• Data analysis and reporting
• Automation
• Document and data artifact creation
• Governed external actions
• Direct questions and answers
• Other tasks where code may be an implementation detail rather than the deliverable

The selected profile is persisted with the session. Existing and legacy sessions continue to use Developer mode unless explicitly changed.

Switching profiles changes the task and evidence assumptions only. It does not change the provider, model, autonomy, permissions, sandbox, hooks, trust settings, redaction, or audit behavior.

Task-appropriate evidence

Work mode matches validation to the requested result instead of forcing everything through a software test framework.

The new validate_artifact tool creates a path- and SHA-256-bound receipt after inspecting a completed artifact. It supports bounded validation of:

• Text and Markdown
• JSON
• CSV and TSV
• DOCX
• PPTX
• PDF
• Unknown binary files

Validation checks the structure and inspectable content appropriate to the format. It does not claim factual correctness, source quality, accessibility, visual polish, or fitness for a human decision.

Other Work outcomes use evidence appropriate to the task:

• Analysis retains identified inputs, reproducible calculations, and caveats.
• Research identifies consulted sources and distinguishes sourced facts from inference.
• External actions retain returned identifiers and safely read back results when possible.
• Direct Q&A can complete without manufacturing a plan, artifact, or verification ceremony.
• A model-authored validation_note documents subjective checks when no meaningful machine validation applies.

See the complete [Work mode contract](https://github.com/robert-mcdermott/collomia/blob/v0.4.1/docs/WORK_MODE.md).

Clearer Work completion guidance

When several files were changed but only some were validated, previous completion notices could say only that “one or more artifacts” still needed evidence. This encouraged the model to revalidate an artifact that had already passed.

Completion notices now:

• Name the exact workspace-relative paths still missing current validation
• Omit artifacts whose latest contents already have accepted receipts
• Track genuine progress independently for each outstanding artifact
• Preserve a separate fail-closed warning when a mutating tool did not report which paths changed

---

More reliable completion recovery

Failed tool calls now have controller-visible IDs and structured recovery records.

For a failed call, the agent can record that it was:

• Recovered by retry
• Recovered by an alternative
• Skipped because it proved unnecessary
• Genuinely blocked

Retries and alternatives must reference the exact successful current-turn tool-call receipt. Prose or a merely similar command is not accepted as proof.

Completion notices now list valid receipt candidates and distinguish provider-envelope call IDs from identifiers embedded inside tool output. This prevents web provenance markers and other opaque output IDs from being mistaken for recovery receipts.

Changing one invalid guessed ID into another no longer resets the bounded intervention allowance. The allowance renews only when the number of real completion gaps decreases.

When the final answer was already complete and only recovery metadata needed correction, Collomia now returns the original answer instead of paying the provider to generate it again. Any substantive follow-up tool use still invalidates that reuse so the final response can incorporate new information.

Sandbox recovery guidance was also improved, including a concrete workspace-local cache pattern for uv:

UV_CACHE_DIR="$PWD/.uv-cache" uv run ...

---

Better Standard mode verification

Standard mode now explains why a successful command was not accepted as completion evidence.

When verification is outstanding:

• Ineligible heredocs, shell compounds, and unrecognized checks explain why they did not qualify.
• Detected direct verification commands are suggested when available.
• A successful recognized verifier emits an explicit receipt bound to the current tracked-write state.
• A fresh verification_note remains available when no meaningful automated check exists.

If the work appears complete and verification is the only remaining gap after the bounded recovery attempts, the outcome is now:

needs_verification

This replaces the misleading blocked outcome for work that is finished but still lacks accepted proof. blocked remains reserved for a genuine inability to complete the task or another unresolved completion failure.

Productive turns can continue past cycle 24

max_iterations now measures consecutive provider cycles without novel progress in Standard mode rather than total cycles.

Successful new tool results, plan revisions, fresh verification, or resolution of a recoverable failure renew the lease. Repeated equivalent evidence does not.

A non-renewable hard ceiling of twice max_iterations still bounds continuous churn—48 provider cycles with the default configuration. Token and cost budgets remain tighter limits when configured.

---

Platform and security fixes

Go 1.26.6 security baseline

Source and release builds now require Go 1.26.6. This resolves six reachable govulncheck findings in the Go standard library affecting:

• net/url
• crypto/tls
• net/http
• encoding/xml
• encoding/asn1

CI and release builds derive their Go version from go.mod, keeping the quality gate and shipped binaries on the same patched standard library.

Windows sandbox toolchain discovery

Windows AppContainer commands can now execute toolchains exposed through directory junctions.

GitHub Actions places Go behind a C: path whose contents may physically reside on D:. The sandbox granted access to the resolved SDK target but previously left the inaccessible alias on PATH, causing nested commands to report that go was not installed.

Absolute PATH entries are now resolved before launch so executable discovery and the existing read-only sandbox ACL use the same canonical path. No additional filesystem root is granted.

---

Automation and compatibility

This release makes additive updates to existing session and event formats:

• Session metadata may contain task_mode: "developer" | "work".
• Headless run.result events may contain mode.
• run.result.outcome now includes needs_verification.
• Evidence-producing tool.result events may contain typed evidence with a subject, digest, and bounded detail.
• Tracked file operations and /undo emit durable file.change path manifests.
• Structured plans may contain Work mode’s validation_note.

No new event kind was introduced. Older sessions without task-profile metadata load as Developer.

Consumers that enumerate outcomes should recognize needs_verification. It retains the established error-status and non-zero-process-exit behavior of an unproven completion.

---

Current Work mode boundaries

The initial Work profile uses Standard execution.

Orchestrated Goal and write-capable delegation remain Developer-only because their state, isolation, recovery, and publication contracts depend on Git state tokens and isolated Git worktrees. Collomia rejects unsupported combinations explicitly rather than weakening those guarantees for non-Git folders.

---

Notes for upgraders

• No permission or autonomy migration is required.

• Developer and Standard remain the defaults.

• Existing sessions remain compatible and default to Developer when task-profile metadata is absent.

• Source builds require an actual Go 1.26.6 installation. Verify the base toolchain with:

  GOTOOLCHAIN=local go version

• Headless consumers that enumerate run.result.outcome should add needs_verification.

• Structural artifact validation is not a substitute for rendering or human visual review when layout is part of acceptance.

Full changelog: v0.3.1...v0.4.1

One repository correction is worth making separately: the current CHANGELOG.md places several already-released v0.3.1 changes under v0.4.0. I excluded those duplicates from these notes so they reflect only the actual v0.3.1...v0.4.1 diff.

Collomia v0.3.1

Collomia v0.3.1

A patch release. One new command and four fixes — every one of them a case where
a run that had finished its work described that work as a failure. A completion
message is what you act on, so these are treated as defects rather than rough
edges.

Standard mode remains the default. Nothing here changes configuration, session,
or graph schemas, and no action is required on upgrade.

---

Change

An active skill's own directory is now readable by the built-in read tools.

load_skill tells the model that a skill's references are read with read_file
and lists their paths — and the read was then refused for being outside the
workspace. Collomia was contradicting its own tool description, and any skill
that shipped reference files was unusable.

read_file, list_files, and search_files may now open an active skill's
directory regardless of allow_outside_workspace. The allowance is deliberately
narrow:

• Reads only. Writes still resolve through the strict workspace path, so no
  tool can modify a skill bundle.
• Contained against the resolved path, so a symlink planted in a bundle
  cannot leave it.
• Excludes disabled skills and untrusted project skills, leaving the
  project-trust quarantine unchanged.

If you run with allow_outside_workspace off specifically to bound what the
read tools can open, this widens that boundary by the directory of each skill
you have already enabled.

---

Added

/orchestrate done ends a goal that has finished.

A terminal graph stays attached so it remains inspectable, which also means it
keeps owning the session until something releases it. Until now the only command
that did so was /orchestrate cancel, which on a terminal graph had always
archived rather than cancelled — so finishing successfully and abandoning work in
flight shared one word, and the word was the wrong one.

/orchestrate done (also spelled release) returns the session to Standard mode
and deletes nothing: the transcript, evidence, and graph snapshots stay in the
session log.

Mostly you will not type it. A graph that finished with nothing left to run is
released by your next ordinary prompt, which then runs. /orchestrate cancel on
a terminal graph still releases it, so nothing that worked before stops working.

Release is narrower than cancellation on purpose. It refuses a running graph, it
refuses one stopped at awaiting_review or awaiting_verification because each
is holding a decision that is yours to make, and it still refuses any graph that
is the only record of a worktree nobody has reconciled.

Fixed

• A finished run could report itself as blocked. The completion controller
  offered exactly one way to record an unfinished step — mark it blocked — and
  any blocked step ends the turn as blocked. A run that built and verified its
  deliverable therefore came back as a failure because the agent had abandoned a
  side attempt (a reference it turned out not to need, a tool call it replaced
  with a better one) and had only that one word to record it with. skipped —
  the action proved unnecessary or was accomplished another way — is now
  distinct from blocked, which is for work that genuinely cannot be completed.
• A skill's reference files could not be read. See above.
• Orchestrated Goal could not verify a Node project that had no
  package.json. node was missing from the verification recognizer, while
  the proposal contract requires the first mutating node to create a focused test
  exactly when a project has no test surface. A node could be required to write a
  test and then refused every way of running it — blocking with its own passing
  suite sitting in evidence. Node's entry points are now recognized, by entry
  point rather than by interpreter: node --test and a script in a conventional
  test location qualify; node index.js and node -e "..." do not.
• A passing command the recognizer does not cover is no longer silent. While
  a node is waiting on verification, a declined command's tool result now names
  it and gives either the project's detected verification commands or, if the
  project has no recognized manifest, what declaring a test entry point would
  achieve. The blocker names it too, instead of reporting that no verification
  exists directly beneath a check you watched pass.

Changed

Terminal Orchestrated Goal messages name the commands that apply to their own
outcome. A completed graph pointed at /new, which ends the whole session rather
than the goal; blocked and budget-exhausted graphs named no exit at all. They now
name /orchestrate status, retry, extend, and the release as applicable.

Notes for upgraders

• No configuration, session, or graph schema changes. Sessions and saved graphs
  written by v0.3.0 load unchanged.
• If you maintain skills with reference files, they work now without granting
  allow_outside_workspace — see the callout above for what that allowance does
  and does not cover.
• Full changelog: v0.3.0...v0.3.1

• v0.3.1 — stop finished work from being reported as failure by @robert-mcdermott in #32

Full Changelog: v0.3.0...v0.3.1

Collomia v0.3.0

Collomia v0.3.0

Adds Orchestrated Goal, an opt-in execution mode for evidence-gated durable
execution, and closes an integration permission gap that affects everyone.

Standard mode remains the default and always will be — that is a recorded
decision, not a staging state.

---

⚠️ Read this first

One change affects you even if you never use the new mode.

Delegate integration is now authorized against the same resolved path the write
tools are judged against. This sits in the shared apply helper, so /agents apply and the delegate integration tool are covered.

On a workspace reached through a symlink — on macOS anything under /tmp or
/var, and generally any symlinked checkout — a scoped deny rule written in
the resolved form the configuration documents stopped write_file but did
not match at integration. Publishing a delegate's candidate was a way around
a rule that had already been obeyed.

If you have such a rule and a symlinked workspace, an integration that
previously succeeded is now refused, and the refusal names the rule. That is the
defect being fixed. With no symlink in your workspace path, nothing changes.

---

Orchestrated Goal

The model proposes a bounded dependency graph; the runtime owns readiness,
attempts, evidence freshness, recovery, budgets, and the terminal outcome. You
select it per session — it is never entered on your behalf.

Two shapes, with different maturity:

• End-to-end graphs with governed read fan-out — supported. At most two
  read-only workers run for independently ready nodes before the serial primary
  lane. Measured: roughly half the critical path on substantive independent
  reads, for about twice the tokens.
• Isolated-writer candidate waves — still experimental. Writers work in
  separate Git worktrees, each candidate is verified in its own tree, and the
  run stops with your workspace byte-for-byte unchanged until you publish a
  candidate yourself.

New commands:

/orchestrate [goal | approve | status [node] | pause | resume | retry <node> |
              extend | integrate <node> | verify | waive <reason> |
              reconcile | discard <node> [confirm] | cancel]
/restore integration [<id> [keep]]

The user guide covers when to reach for it and when not to — every case it
names cites the evaluation that measured it. In short: it buys containment and a
review boundary, and pays for them in repeated verification and in steps you take
yourself. A good trade when a change might be wrong; a bad one when it probably
is not, and a bad one for steps that touch the same files.

Also added

• Evidence-gated goal completion in Standard mode: a tool-free response is
  checked against the active plan, terminal-step evidence, successful
  conventional verification after tracked writes, and unresolved tool failures.
• First launch continues into a verified session rather than ending at setup.
• A provider is no longer assumed as a built-in default. A fresh install enters
  verified provider setup instead of presuming a local Ollama is running.

Fixed

Most of these are ways a run could report something untrue about its own result.
A completion message is what you act on, so they are treated as defects.

• A graph that had integrated a candidate could not be reopened after a
  restart. Two evidence statuses were missing from the snapshot validator, so
  resuming or archiving such a session reported it as structurally false. Any
  session left in that state can now be read again with no action from you.
• A completed graph no longer claims every required node passed its acceptance
  gates when that is not what happened — it says so when a revision retired an
  unfinished node, when nodes finished on your written waiver rather than
  machine-observed verification, and when an earlier node's passing checks were
  superseded by later work.
• A candidate wave that could not take every approved node reports which ones it
  never started, says they are waiting on your review rather than blocked, and
  warns that releasing the graph would abandon them. It previously called itself
  finished.
• Blocked nodes name the check that failed rather than reporting an exit code.
• A candidate rejected because the workspace or its Git base moved names which of
  the two changed, and says the candidate survived and where — it previously read
  as though the work had been lost.
• Integration refused because its retained worktree no longer exists says so,
  rather than reusing the wording for a genuine path mismatch.
• Integration, verification, and waiver all refuse while an earlier publication
  into the workspace never recorded an outcome, naming the checkpoint and both
  ways to resolve it.

Notes for upgraders

• Orchestrated Goal persists under graph schema 1 with additive fields only.
  Sessions written by earlier versions load unchanged.
• The candidate wave runs your repository's detected verification set once per
  candidate worktree and again over the combined result — three rounds against
  one. That cost scales with your suite, not with the size of the change.
• Full changelog: v0.2.2...v0.3.0

Collomia v0.2.2

Collomia v0.2.2

Collomia v0.2.2 adds safer Git write tooling, self-documenting configuration, smarter model-limit handling, and substantial shutdown and persistence hardening.

Highlights

Safer Git writes

• Added git_commit, which commits exactly the files explicitly named—without sweeping in unrelated edits, staged work, untracked files, or build output.
• Commit previews flow through the existing permission system, allowing credential-sensitive paths such as .env files and private keys to be caught before entering history.
• Added git_branch for creating and switching to a new branch without modifying the working tree.
• Neither tool pushes. Remote publication remains governed separately through run_command and permissions.publication.
• Both tools can be hidden with options.disabled_tools and are unavailable in planning mode.

Self-documenting configuration

• Added collo schema config, which generates a JSON Schema 2020-12 contract directly from Collomia’s configuration types.
• collo init and collo setup now create collomia.schema.json and add a corresponding $schema reference.
• Compatible editors now provide field completion, documentation on hover, valid-value suggestions, and inline validation.
• collo doctor detects missing or stale schema files.
• /config now shows applied configuration layers, effective safety settings, their origins, and any project-level weakening that was refused.
• /config all displays every effective setting while structurally redacting credentials.

Smarter provider setup and token limits

• Added collo setup --provider <name> to reverify an existing provider without replacing its credential.
• Setup now resolves both context_window and max_tokens, preferring endpoint-reported values, then conservative published limits, and clearly labeling assumptions.
• collo doctor warns when either limit is absent and explains the resulting behavior.
• collo config validate now rejects configurations where max_tokens >= context_window.
• OpenAI-compatible and Anthropic providers now recognize output-ceiling errors, retry at the provider-stated limit, warn, and remember that ceiling for the session.

Shutdown and durability hardening

• SIGHUP now triggers an orderly shutdown, covering closed terminal windows and dropped SSH connections.
• Background processes are stopped instead of being orphaned when the terminal disappears.
• Completed session turns are flushed to stable storage, with an additional flush during orderly shutdown.
• Audit entries are flushed individually so recent permission decisions survive a crash or power loss.
• Sync failures are latched like write failures, preventing later activity from making an incomplete record appear valid.
• Session recovery is now tested at every possible truncation point, including torn final records and lost trailing newlines.

Usability and observability

• Shell completion for Bash, Zsh, Fish, and PowerShell now derives from one validated command vocabulary and covers all supported subcommands.
• /context now explains that automatic compaction is disabled when context_window is missing.
• /context and the Session tab can report request gaps that exceeded the five-minute prompt-cache lifetime. This is measurement only; the cache lifetime remains unchanged.
• Debug-log redaction now covers errors, structs, slices, and other text-bearing values—not only plain strings.
• macOS credential operations now fail safely in service, container, or unusual HOME environments where no Keychain can be resolved, avoiding the system’s potentially destructive “Reset To Defaults” dialog.

Quality and platform improvements

• Added full-filesystem durability testing on macOS.
• Increased interruption and cancellation stress coverage from 5 to 20 iterations.
• Added dedicated durability and session-truncation sweeps to release CI.
• Fixed Windows test portability involving build tags, open file handles, Git autocrlf warnings, and clean-runner Git identity.
• Fixed a timing race in the macOS SIGHUP integration test.

Upgrade notes

No configuration migration is required. However:

• Configurations with max_tokens greater than or equal to context_window must be corrected before strict validation will pass.

• Regenerate an existing editor schema after upgrading:

  collo schema config > collomia.schema.json

  Re-running collo setup also refreshes the generated schema.

• /config has a new human-readable output format. Scripts should continue using collo config show, whose interface is unchanged.

• New Git tools are enabled by default but may be disabled through options.disabled_tools.

Full changelog: [v0.2.1...v0.2.2](v0.2.1...v0.2.2)

Collomia v0.2.1

Highlights

collo setup — configure a provider without hand-writing JSON. Collomia now finds the model runtimes actually running on your machine, reads their model catalogs, and proves the configuration works before writing it.

Publishing and deploying now ask before they run. terraform apply, kubectl apply, npm publish, docker push, git push, and remote-host execution are recognized as their own kind of action rather than being treated as ordinary commands.

Your permission history is readable. collo audit reports what was decided and what happened, and says so when the record is incomplete.

Windows gets a real terminal. run_command with pty: true and collo --web now work on Windows as they do on macOS and Linux.

---

collo setup

The first-run path used to be: read the README, hand-write JSONC, set a credential, run collo doctor, and work out which of the four steps was wrong. collo init wrote a fixed starter file naming ollama / qwen3-coder / 127.0.0.1:11434 whether or not any of that was true on your machine.

collo setup

• Finds what is actually there. Probes Ollama, LM Studio, and vLLM concurrently, distinguishing "running", "something else is on that port", and "nothing there". Offers Anthropic, OpenAI, and OpenRouter when their API key is already in your environment. Models come from the endpoint's own catalog rather than a hard-coded list.
• Azure and Bedrock via a short form, because neither can be reached from a name and a key alone — Azure addresses a deployment inside a resource you name, and Bedrock resolves an identity through the AWS credential chain with model access granted per region.
• Verifies before writing. Two real requests: a short completion, and the same prompt carrying a tool definition. The second matters — plenty of local models answer ordinary prompts perfectly and reject anything carrying tools, and without that check such a model configures cleanly and then fails your first real prompt.
• Explains failures. Nothing is written unless both requests pass. On failure it names whether the endpoint, the credential, or the model is at fault and prints the model list it just read. For Bedrock it also reports which identity your credential chain actually resolved to, via sts:GetCallerIdentity.
• Never writes an API key into a config file. Keys go to the OS credential manager (macOS/Windows) or are referenced by environment-variable name. Authentication modes with nothing to store — Entra, and the AWS SigV4 chain — are never asked for a key.
• Safe to re-run. It shows your current default, marks a provider it would replace, asks before repointing default_provider, and preserves settings it does not manage.

To skip the key prompt entirely, export the credential first:

export AWS_BEARER_TOKEN_BEDROCK='…' && collo setup

Publication and deployment protection

New setting permissions.publication (off | prompt | deny), default prompt.

Collomia's risk model previously only understood commands that destroy. Measured on a stock configuration in autopilot: terraform destroy asked for confirmation but terraform apply -auto-approve ran; kubectl delete asked but kubectl apply ran; helm uninstall asked but helm upgrade ran.

Publishing is now its own decision, covering package and container registries, source remotes, code-forge writes, infrastructure applies, and commands run on another host. Read-only verbs and --dry-run rehearsals are excluded. Autonomy mode, a tool-wide "always", and an allow rule naming only an executable never cover a publication — a rule naming the operation (npm publish, gh pr create) or a session grant scoped to that exact operation does.

This changes behavior. See Upgrading below.

An audit ledger you can read

The audit ledger recorded permission decisions and execution outcomes, but nothing in Collomia could read it back and a failed write left a file that still looked complete.

• collo audit [show|path] with filters: --session, --actor, --tool, --since, --denied, --limit, and --jsonl for external tooling.
• Every entry names its session and actor — primary, or agent:<profile> with the delegated task — so one workspace ledger written by several concurrent agents can be separated again.
• A failed write is never silent. Failures are counted, reported to the session once, and declared in the file as a gap entry stating how many entries were lost, since when, and why. collo audit and collo doctor report that gap before anything else, so an incomplete record is never read as a complete one.
• Bounded by rotation at 64 MiB with one retained generation; a rotation that discarded history says so.

Audit remains fail-visible, not fail-stop: a ledger that cannot be written does not block work you already authorized.

Windows terminal support

run_command with pty: true and collo --web now work on Windows, using a pseudoconsole (ConPTY). Requires Windows 10 1809 or later; on older builds the command reports that rather than silently running without terminal semantics.

Windows has no SIGTERM equivalent, so cancelling a pseudoconsole session closes the child's console input and then terminates the job after a short grace period rather than asking politely first.

Provider fixes

• LM Studio tool calling. A single built-in tool that took no arguments declared {"type":"object","additionalProperties":false} — complete JSON Schema, which LM Studio rejects for omitting properties. Because it rejects the whole request rather than the one tool, this made every prompt fail against LM Studio. Fixed at the source, and tool schemas are now normalized before they go on the wire so a tool supplied by an MCP server cannot reintroduce it.
• Reasoning models during setup. Verification allowed 32 tokens, which a model that thinks before answering spends before its first visible word — qwen/qwen3.5-9b needs about 170 to reach "ok". Setup reported models that LM Studio was actively serving as not served at all. The budget now accommodates reasoning, and an empty answer is diagnosed rather than assumed: reasoning present proves the endpoint, truncation is reported as a limit, and only a genuinely empty response is treated as a missing model.
• Clearer setup diagnostics. A local endpoint no longer receives Azure deployment-name advice, and an embedding model chosen for chat is named as such — local catalogs list embedding and chat models together with nothing to distinguish them.
• AWS SigV4. A failure to resolve AWS credentials no longer produces advice about a rejected API key. It names the IAM variables, profiles, aws sso login for an expired Identity Center session, and aws sts get-caller-identity.

Also in this release

• collo doctor and collo policy check are now in the generated capability matrix, alongside the new first-run setup entry.
• docs/INSTALLING.md first-run instructions lead with collo setup.
• Documentation guards that could pass against deleted documentation were repaired and are now verified by mutation; the recipe is written down in docs/TESTING.md.

---

Upgrading

One behavior change. permissions.publication defaults to prompt, so a publishing or deploying command that previously ran unattended under autopilot now asks first. If you have automation that publishes or deploys, either set it to off:

{ "permissions": { "publication": "off" } }

…which restores the previous behavior exactly, or add an allow rule naming the specific operation. See docs/COMPATIBILITY.md.

No configuration, session, or event schema changes. Existing configurations load unchanged, and collo setup is entirely optional — hand-written configuration files remain fully supported.

Known limitations

collo setup verifies that an endpoint answers and accepts tools; it does not judge whether a model is strong enough to drive an agent well. Azure and Bedrock are configured by naming their fields rather than by enumerating deployments or models. Credential storage uses the OS credential manager on macOS and Windows; on Linux a key is referenced by environment-variable name instead. Publication protection reads what a command's text says it will do, so a script that uploads without naming the operation is outside its view.

Full list: docs/BETA.md.

What's Changed

• First-run setup, publication protection, a readable audit ledger, and Windows ConPTY by @robert-mcdermott in #29

Full Changelog: v0.2.0...v0.2.1

Collomia v0.2.0

What's Changed

Collomia v0.2.0 brings prompt caching for Anthropic and the ability to steer a turn while it runs instead of waiting it out or killing it. It also adds /restore, an undo that moves the files as well as the conversation.

Configuration stays at schema_version: 1 and the event schema stays at v1. No config file is rewritten by upgrading. Two behavior changes: pressing enter during a running turn now steers the agent rather than holding the draft, and input_tokens on the Anthropic routes now counts the whole prompt where it previously excluded the cached portion. Both are covered under Upgrade notes.

The minor version moves rather than the patch version because a reported field changed meaning. The project's compatibility policy treats that as requiring a version decision, and a patch release would have implied nothing observable changed.

Prompt caching

Collomia was reporting cache hits it never asked for. Both Anthropic adapters parsed cache_read_input_tokens, cost estimation priced it at a cached rate, and the capability matrix listed prompt caching as a tracked dimension — but no request ever carried a cache_control breakpoint, and Anthropic caches only on explicit opt-in. The number was structurally always zero. OpenAI-family endpoints cache implicitly above about 1024 tokens, which is why this went unnoticed for as long as it did.

Why it matters more than it sounds. A turn with ten tool calls is eleven provider requests over the same growing prompt, and every one of them resent the entire stable prefix at full price and full time-to-first-token. That prefix is 13.3 KB on a default install — 11.5 KB of tool schemas across 23 built-in tools, plus the system prompt. Measured across a turn, the share of prompt bytes that are pure retransmission is 33% at one tool call, 71% at five, and 83% at ten.

Two breakpoints, placed deliberately. One on the system block, which also covers the tool definitions ahead of it in the prefix, and one rolling breakpoint on the last message that will still be there next request. A cache write costs more than ordinary input, so a breakpoint placed where the prefix will not be read back is worse than no caching at all.

The prerequisite was moving the plan out of the system prompt. update_plan rendered the structured plan into the system block, so the front of every request changed during exactly the multi-step work caching exists for. The plan now rides a trailing message regenerated per request and never retained in the conversation, so the board stays the single source of truth and no stale copy accumulates in the history.

Measured against a live endpoint, not argued from structure:

first  request: input=9629 cache_read=0    cache_write=9627
second request: input=9629 cache_read=9627 cache_write=0

100% of the second prompt served from cache, with two tokens falling outside the cached prefix — which confirms the rolling conversation breakpoint is honored and not only the system one. A write costs 1.25x and a read 0.1x, so the one-time write premium is repaid by the first read; every turn that uses a tool makes at least two requests, so there is no crossover to plan around.

Anthropic routes only, and honestly declared. OpenAI-family endpoints need nothing. Bedrock is declared without cache support on purpose: its cache points vary by model and region and fail the entire request with a hard ValidationException rather than being ignored, so support waits until it can be qualified against a real deployment rather than shipped on an assumption. An endpoint that rejects a breakpoint disables caching for the life of the process after one wasted request. The lifetime is the provider's five-minute default; the one-hour extension needs a beta header, and sending an unrecognized beta header to an arbitrary compatible endpoint is a compatibility risk taken for a saving nobody has measured yet.

Steering a running turn

Type and press enter while the agent is working. Watching a turn head down the wrong path previously left two options: wait for it to finish, or press esc and lose the whole turn. The composer refused mid-turn input with a message explaining the draft would be sent afterwards.

It lands at a boundary, never mid-action. Guidance is delivered at the next iteration boundary — never inside an in-flight provider call, an executing tool, or a pending approval. The machinery is the same drain-once queue that has governed delegated agents since v0.1.x; what changed is that the primary session now uses it.

It grants nothing. Steering arrives as an ordinary user message that carries no authority: an action that would have prompted for approval before the guidance arrived still prompts after it. Telling the agent to go faster is not a way to tell the permission layer to stand down.

Undelivered guidance is discarded and reported. A turn that ends or is cancelled before the queue drains throws the text away rather than holding it against unrelated later work — a cancelled turn is the common case, and resurfacing that text three prompts later would be worse than losing it.

Delegated agents are still steered separately through /agents steer and alt+a. Headless runs and the JSONL event stream are unaffected.

Restore: an undo that moves the files too

/restore [turn] branches the conversation the way /rewind does and reverses every file mutation recorded after that turn. Both halves already existed and were independently solid; nothing connected them, so rewinding a turn left the files it wrote in place and a transcript describing a tree that no longer matched.

It refuses rather than half-applies. The whole workspace is verified before anything is written, and if any file changed outside Collomia the entire operation is refused, naming every affected file rather than the first one found. The check runs before the conversation branches — a drifted file discovered afterwards would leave a conversation that moved alone, which is the exact split this feature exists to close.

Two limits stated rather than papered over. Change tracking is in memory, so restoring to a turn from a resumed session reports that no tracked changes needed reversing instead of implying it rewound writes it never observed. External effects — commands, installs, network calls, deployments, MCP effects — are never reversed.

Each entry in the checkpoint picker carries how many changes across how many files restoring to it would reverse, because a turn number conveys none of that. /rewind, /undo, and collo sessions rewind are unchanged.

Upgrade notes

1. enter during a running turn now steers. It previously held the draft until the turn ended. This is an interactive change only; nothing about permissions moved, and headless behavior is identical.
2. input_tokens on the Anthropic routes now includes cached tokens. The Messages API reports that field net of both cache counters, so passing it through would have understated the prompt by whatever the cache served — a live request reported a raw input_tokens of 2 for a 9,629-token prompt, which would have collapsed the context gauge exactly when the context was fullest. Comparing this field across the upgrade shows an apparent increase that is a correction, not new consumption. Recompute spend from cost_usd, which accounts for cache reads and writes at their own rates. See the compatibility note.
3. cache_write_tokens is new and optional. Additive under schema v1; consumers that tolerate unknown fields, as automation consumers are asked to, need no change. The event schema deliberately stays at v1 — bumping it would force every strict client to update in order to receive a correction.
4. Nothing else changes by default. No sandbox, permission, provider, or configuration default moves in this release.

Also in this release

The status bar was hiding its own cancel key. Below roughly 100 columns the entire right-hand segment was dropped, taking esc cancel with it — so the control that stops a runaway turn was invisible in a split pane or a narrow tmux pane, which is where it is needed most. Segments are now shortened and dropped by priority, with the cancel key last to go. The golden screens had recorded the empty bar as expected output; coverage now spans three widths instead of one.

Build provenance in run traces. run.result carries the version and commit of the binary that produced it, and replay --check reports that against the running binary. Since prompts, tool descriptions, and agent logic are all compiled in with no runtime override, identical build means identical instructions — so build identity answers "would this binary have behaved the same?" without a partial prompt-only signal. Additive under schema v1; traces predating the field stay valid.

Agent prose moved out of Go string literals into embedded templates under internal/prompts, leaving only the conditional composition in code.

The capability matrix is now enforced. docs/CAPABILITIES.md had gone stale — the build-identity detail never reached it, and the full suite stayed green for an entire release window with the published matrix understating what the binary did. A test now diffs the committed file against its generator. Two rows describe what the host platform can actually enforce and vary by operating system on purpose, so those are checked for presence and status rather than byte equality.

docs/COMPATIBILITY.md gained sections for both behavior changes, docs/AUTOMATION.md documents the full usage object with the meaning change called out inline, and docs/BETA.md records the caching limits.

Install

macO...

Collomia v0.1.9

What's Changed

Collomia v0.1.9 gives the agent the current web — web_search and web_fetch, built in, with no API key, no account, and no configuration — and fixes a Windows installer that could not complete on a stock machine.

Configuration stays at schema_version: 1. No config file is rewritten by upgrading. Unlike the last two releases, this one does change a default: two new tools are visible to the model out of the box. They are classified external risk, so they prompt like any other external action and autopilot never approves them silently, but they are present unless you remove them.

Web search and fetch

No key, no account, no configuration. A web lookup that requires finding an integration, creating an account, and holding a billing relationship is a capability most users never turn on. web_search and web_fetch are built in and work on a fresh install. The backend is DuckDuckGo's no-JavaScript endpoints — the only major search interface that answers a plain query with no key and no quota.

Pages arrive as text, not markup. HTML is reduced structurally: drop what is never content, prefer a <main> or <article> that actually holds the article, and keep headings, lists, code blocks, and tables. Deliberately not a readability score, which would let a page fall on the wrong side of a threshold and lose its own text. Raw HTML is still available when you want it.

The public internet, and nothing else. The address check runs on the resolved IP at connect time, inside the dialer, so it covers DNS rebinding, every redirect hop, and IPv4-mapped and NAT64 spellings of a private address alike. Loopback, private, link-local (cloud metadata), CGNAT, multicast, benchmark, documentation, and reserved ranges are all refused. No configuration key can turn this off — a switch to disable it is exactly what a prompt injection would ask you to add. The practical consequence: these tools cannot reach your local dev server, your intranet, or a metadata endpoint, and that is the point.

Inherited proxy variables are ignored, URL credentials are stripped, no cookie jar is kept, and the transport is not shared with the provider client. Each of those is otherwise a way a model-chosen request reaches a host the guard never inspected, or carries state that was never meant for it.

A redirect that leaves the site is reported, not followed. web_fetch declares the host of the URL it was given, so approving that host must not become approval for wherever a redirector points. Moves within one site are followed normally. web_search symmetrically declares every endpoint it may fail over to, because a rule covering only the primary endpoint would cover nothing.

A dead search engine looks dead. Both endpoints are tried in order, and a 200 that parses to zero results is treated as an engine failure rather than as "no results". Scraping breaks eventually; the failure that matters is the silent one that tells you the web has nothing on your question. Separately, DuckDuckGo answers a throttled client with HTTP 202 and a challenge page rather than a 429 — reported verbatim that reads like a Collomia bug, so it is named as rate limiting instead.

Why the client looks like a browser. A great many sites reject non-browser clients by default CDN rule, and a page you can read but the agent cannot is the capability failing at its own premise. Two things fix that, and only two: HTTP/1.1 instead of HTTP/2, whose Go client sends a SETTINGS frame that bot-management products fingerprint — holding everything else constant, Stack Overflow returned 403 with cf-mitigated: challenge on every HTTP/2 request and 200 on every HTTP/1.1 one — and one fixed desktop Chrome identity. Deliberately not a rotating pool: rotation only defends against a blocklist naming one exact string, which no operator applies to mainstream Chrome, while turning any site that did refuse one entry into a failure that reproduces a fraction of the time. Nothing beyond the header. No TLS fingerprint forgery, no challenge solving, no address rotation, no retrying a refusal.

Web content is framed as external data, through the same implementation MCP results use rather than a second weaker copy of it. Pages are written by whoever the search ranked, not by a server you chose to trust.

Windows install

The documented Windows instructions did not work. Four separate defects, each sufficient on its own to stop an install, and three of them predate this release.

One command, and the execution policy no longer matters.

irm https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.ps1 | iex

The execution policy governs script files. Evaluating the installer from memory is unaffected by Restricted or AllSigned, so there is no Set-ExecutionPolicy, no Unblock-File, and no elevation. Saving the script and running it as a file is still documented, with the bypass scoped to that one invocation rather than changed machine-wide.

ARM64 installs. Detection used a .NET API that Windows PowerShell 5.1 does not have on ARM64 — 5.1 is a .NET Framework host with no native ARM64 build, so it runs emulated and the property is simply missing, which strict mode turned into a hard failure before anything downloaded. The machine's own registry value is read first now: it reports the real hardware even when PowerShell is emulated.

Two failures that looked like nothing. The installer verifies the downloaded binary by running it, and that check failed silently in two different ways. It read $LASTEXITCODE, a global that a fresh PowerShell window has never set, so on a first command in a new terminal it died complaining about a variable instead of naming the real problem. And it staged the download under a filename containing the word "install" — which makes Windows apply its UAC installer-detection heuristic to an unsigned binary and interpose an elevation prompt instead of running it, invisibly from PowerShell's side: no output, no error, no exit code. Administrators never see that prompt, which is exactly why it shipped. Both are fixed, and a failed version check now quotes what the binary actually printed.

PATH is set up for you. %LocalAppData%\Programs\Collomia is added to your user PATH unless you pass -NoPathUpdate. Open a new terminal to pick it up. The registry value is written directly so that a PATH containing %USERPROFILE%\bin keeps working — the obvious .NET call rewrites the whole variable in a form that permanently breaks entries like that.

Downloads finish in seconds. Windows PowerShell draws its progress bar once per network buffer, which turned a 25 MB download into minutes. It is suppressed.

-Version, -InstallDir, -Repository, -Architecture, and -NoPathUpdate all have COLLO_* environment equivalents, since piping into iex cannot pass parameters. -AddToPath is still accepted so older instructions keep working.

Upgrade notes

1. Two new tools are available to the model. web_search and web_fetch are visible by default and usable in planning mode. They require approval like any other external action; options.disabled_tools removes them, and permissions.network: "scoped" governs them as it does anything else that reaches the network.
2. On Windows, the installer now edits your user PATH. This is new. Pass -NoPathUpdate, or set COLLO_NO_PATH_UPDATE=1, to keep the old behavior.
3. Nothing else changes by default. No sandbox, permission, provider, session, or TUI default moves in this release.

Also in this release

The capability matrix carries a web_search / web_fetch row describing what the tools actually enforce rather than what they accept, and the evaluation row now names external-injection coverage from fetched web pages alongside MCP. docs/BETA.md was corrected on several points that had drifted: Windows has no ConPTY backend (so pty: true is Unix-only and collo --web does not run there), LSP code actions are the only missing piece rather than definitions and formatting, and the endpoint-scoped egress entry now distinguishes what commands can be held to from what the built-in web tools enforce directly.

docs/RELEASING.md gained a step to refresh the browser identity in internal/web/client.go when it falls a few major versions behind — a version old enough to look implausible starts attracting the same CDN rules it exists to satisfy. An opt-in live web suite (COLLO_LIVE_WEB_TESTS=1) exercises each search endpoint on its own, so a working fallback cannot hide a primary that has stopped parsing; the ordinary suite stays offline and credential-free.

The PowerShell installer tests grew coverage for architecture aliases, on-host detection, the version check across its failure modes, the fresh-session state that broke $LASTEXITCODE, and the filename rule that keeps UAC out of the way. That last one is asserted rather than exercised, because CI runs elevated and structurally cannot observe the failure it guards against.

Install

macOS and Linux:

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh |
  COLLO_VERSION=v0.1.9 sh

Windows 11, AMD64 or ARM64:

$env:COLLO_VERSION = 'v0.1.9'
irm https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.ps1 | iex

See INSTALLING.md for per-user directories, pinning, reviewing the installer before running it, and upgrade behavior.

Full changelog: v0.1.8...v0.1.9

Collomia v0.1.8

What's Changed

Collomia v0.1.8 narrows the command sandbox's network boundary from a single all-or-nothing switch to a per-host allowlist on macOS, and removes the two things that most often make a first session go badly: a provider key that has to live in a dotfile, and an agent that reads your code by grepping for names.

Configuration stays at schema_version: 1. No config file is rewritten by upgrading, and nothing in this release changes behavior by default — the one new containment setting ships off and no preset selects it.

Scoped egress (macOS)

Per-host command networking. sandbox_allow_network is all-or-nothing, which makes it the first thing you turn off the moment a build needs a package registry. permissions.sandbox_egress: "scoped" is the narrower alternative: the OS sandbox denies direct remote traffic while leaving loopback reachable, and commands are routed through a Collomia-owned loopback proxy that dials only the hosts your allow rules name.

{
  "permissions": {
    "sandbox": "auto",
    "sandbox_egress": "scoped",
    "rules": [
      { "action": "allow", "host": "proxy.golang.org", "reason": "Go module proxy" },
      { "action": "allow", "host": "*.githubusercontent.com", "reason": "raw file fetches" }
    ]
  }
}

No second list to maintain. The allowlist is built from the same host rules the permission layer already matches, through the same matcher — so a host a rule allows and a host a command can reach cannot drift apart.

No TLS interception. An approved tunnel is spliced byte for byte. No certificate is substituted and nothing decrypts your traffic. It is also why no SNI inspection is involved: the broker dials the host it was handed, so a command cannot name one destination and reach another.

It covers everything, including background processes. Foreground commands, start_process, and delegated-agent verification are brokered on the same terms, with a background process's broker living as long as the process rather than the tool call that started it.

Refusals tell you what to add. A blocked connection fails with the host and the exact rule that would permit it, and collo policy check forecasts which of a command's endpoints would be allowed before you rely on a run. collo doctor and the Session tab show the effective posture and allowlist size, and warn when scoped is on with no host rule — a valid but almost always accidental state where every connection is refused.

macOS only, and deliberately so. This is enforcement only where the sandbox can deny remote traffic while keeping loopback reachable. Seatbelt can; the other two genuinely cannot, for different reasons:

• Linux (Landlock) filters TCP by port and never by address. Allowing the broker's port would allow every remote host on that port — and the exfiltration adversary this exists to stop picks its own port. Rather than ship an allowlist that the thing it guards against can step around, Collomia ships none and says why.
• Windows (AppContainer) blocks loopback to unpackaged local services, so a sandboxed command cannot reach the broker at all. The documented workaround needs administrator rights and leaves persistent machine state, which the no-install Windows backend deliberately does not take.

On both, scoped is refused under "sandbox": "require" and degrades visibly under "auto", leaving sandbox_allow_network in charge — which AppContainer in particular enforces more completely than either Unix backend, covering UDP and DNS. With "sandbox": "off" no broker starts anywhere: without OS-level denial a proxy is a convention any program can ignore, and Collomia will not present that as a boundary.

Provider credentials in the OS keychain

collo auth set | list | status | rm | import keeps provider API keys in the macOS Keychain or Windows Credential Manager instead of a dotfile. Keys are prompted for without echo, never placed in an argument or your shell history, and never printed back.

Your environment still wins. The store is consulted only after api_key, api_key_env, and a provider family's own variable, so an exported variable keeps working exactly as before and no existing configuration changes meaning.

No keychain dialog if you don't use it. A machine that has never stored a credential makes no credential-manager call at all — a local name index is checked first, and its absence ends the lookup.

No Linux backend, by design. Secret Service needs a desktop session headless hosts don't have, and a passphrase-protected file would only move the problem. collo auth and collo doctor state the absence rather than degrading quietly; Linux hosts use api_key_env.

collo auth status and collo doctor report where each provider's credential came from, and mark an entry the OS no longer holds as missing rather than implying it works.

Code intelligence

find_definition and find_references on the existing language-server client — real type-aware navigation instead of lexical search. Located by file, line, and the symbol's own text, because the protocol counts columns in UTF-16 code units and asking a model to count them buys confident answers about the wrong token.

format_file applies the language server's own formatting as an ordinary tracked, undoable write, and refuses to write if the file changed while the server was formatting it.

Missing capabilities are explained, not relayed. format_file used to fail with the raw string Unhandled method textDocument/formatting. A method-not-found answer is now a configuration answer naming the server, the missing capability, and the setting to change.

You can tell a slow index from a hang. The four language-server tools stream starting <server>… and <server> ready in <time>, so a cold server indexing a large repository no longer looks identical to a stall.

Code actions are deliberately not implemented yet: organize-imports and quick fixes need codeAction/resolve round trips and workspace edits spanning files, and a half-working mutation path is worse than an absent one.

Terminal UI

Word wrap is fixed when the context rail is open. The rail is composited over the transcript row by row, so any line wider than the body was being cut at the rail's left edge instead of wrapped — answers, prompts, system and error lines, tool output, and panels all measured themselves against the terminal rather than the space they actually had. They now measure against the body width, prose word-wrapped and tool output hard-wrapped inside its gutter.

alt+m releases and reclaims the mouse mid-session. Mouse reporting and your terminal's own drag-selection are mutually exclusive by protocol, so copying text used to mean restarting with options.mouse off.

options.dim_background makes the modal scrim optional. Dropping color behind a dialog is right for using the tool and wrong for photographing it, and product documentation is made of screenshots. The cleared gutter around a dialog is deliberately not part of the option — reading a modal must never depend on the dimming.

A composed first screen. The identity line under the logo ran past a hundred columns, and because a centred block is centred by its widest line, that one line dragged the whole header off-axis and left the wordmark hanging. It is now two short centred lines, with a five-row wordmark and the blossom beside it. Build detail moved to the Session tab and collo version.

Upgrade notes

This is a quiet upgrade — there is no behavior change to absorb. Two things are worth knowing:

1. Three new tools are available to the model. find_definition, find_references, and format_file. format_file writes, so it goes through the normal approval path and is tracked and undoable like any other write. Note that pyright — the auto-detected Python default — navigates but cannot format; pylsp does all three and type-checks less well.
2. Adopting sandbox_egress: "scoped" needs an allowlist first. A build that fetches from a registry no rule names will fail until you add one. Run collo policy check "<your command>" to see which endpoints would be refused before relying on it, and remember that a project .collomia.json does nothing until collo trust.

Also in this release

collo policy check gained a sandbox_egress posture line and a per-endpoint egress forecast. collo doctor and the Session tab report the effective egress stance. The capability matrix carries a scoped-egress row reflecting what the current platform can actually enforce rather than what the setting accepts.

Internally, command-runner construction was collapsed to a single site — delegated verification previously built its own, which is how a containment setting ends up applied in your main session and silently absent for delegated agents — with a test that now fails on a second one. Install documentation uses vX.Y.Z placeholders instead of concrete versions, so install examples can no longer go stale, enforced by an inverted guard that fails on an ordinary push rather than mid-release.

The roadmap's last remaining P0 outside Phase 8 was reclassified to P1 on the evidence that the enforced network boundary it was meant to add already existed on all three platforms; scoped egress is a usability improvement over that enforced control, not a hole being closed. See ROADMAP.md.

Install

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh |
  COLLO_VERSION=v0.1.8 sh

See INSTALLING.md for Windows, per-user directories, and upgrade behavior.

Full changelog: v0.1.7...v0.1.8

Collomia v0.1.7

Collomia v0.1.7 makes the permission layer describe what an action reaches — which endpoints, which executables, which files — rather than only which tool asked for it, and rebuilds the parts of the terminal UI you look at most.

Configuration stays at schema_version: 1. No config file is rewritten by upgrading.

Permissions and safety

Endpoint-scoped policy. Rules with a host field now actually take effect. Endpoints are read out of command text (URL arguments, ssh destinations, Git remote URLs) and from HTTP-transport MCP servers. An endpoint that resolves somewhere Collomia cannot see — a named Git remote, a configured registry — is reported as explicitly undetermined and can never be covered by an allow rule. This is a policy layer, not egress enforcement.

Credential files are their own decision. Reaching an SSH or GPG private key, a cloud CLI token cache, a registry auth file, a .env, or Collomia's own provider config now stops for its own approval, with its own prompt. A blanket allow rule, a tool-wide "always", and autopilot never cover one — only a rule naming the path, or a session grant scoped to the exact file shown. Public keys, known_hosts, and .env.example are excluded. Controlled by permissions.protect_credentials (off / prompt / deny, default prompt).

Containment presets. permissions.preset — frictionless, standard, or hardened — sets a coherent policy in one line instead of eight separate decisions. Explicit fields still win within a layer, no preset changes the autonomy mode, and collo config show attributes every expanded value to where it came from.

One containment rule. A project .collomia.json can tighten containment but can never weaken it. A repository asking for "sandbox": "off", "command_env": "full", or a weaker preset is refused and reported rather than applied; the escape hatch lives in your global config only.

Two optional postures. permissions.network: "scoped" and permissions.commands: "allowlist" withhold automatic approval unless a rule or session grant covers every endpoint or executable. Both default to the previous open behavior and can only ever add a prompt.

Per-capability approval. The approval dialog shows what an action reaches one dimension at a time, and g grants exactly that reach for the session — nothing more. Nothing is grantable for a command Collomia cannot inspect or an endpoint it cannot read.

Better redaction. PEM private key blocks are removed whole (public keys and certificates are preserved), plus GitLab, Google, npm, Stripe, and the GitHub token types beyond ghp_.

Always-visible stance. A containment mark on the autonomy badge, a grouped Security block in the Session tab, and the permission stance in collo doctor — which also tells you when a project's attempt to weaken containment was refused.

Terminal UI

A first screen that orients you. A new session opens with where you are and what it will cost — workspace, branch, model, autonomy, containment — plus a few openers, instead of a logo over blank rows.

Context rail. alt+r shows a persistent side panel with the workspace, the current plan, running agents, changed files, and background processes. It appears on its own at 146 columns and is unavailable below 116.

A composer that behaves like an editor. It grows with your draft. A draft ending in a backslash, or sitting inside an unclosed ``` fence, gains a line instead of sending. ctrl+j inserts a newline in every terminal (`alt+enter` still works outside macOS Terminal.app's defaults; terminals speaking the Kitty protocol or `modifyOtherKeys` also get `shift+enter` and `ctrl+enter`), and a hint tells you why Enter is inserting rather than sending. `alt+e` opens the draft in `$EDITOR` and brings it back.

Mouse support. Wheel scrolling in the transcript and click-to-select on the tab bar. Only the wheel and a plain left click are consumed — drags and modifiers stay with the terminal.

Syntax-highlighted diff approvals. A change you are asked to approve is rendered the way an editor would show it: added and removed rows carry a tinted wash to the right margin, with the code inside them highlighted.

Scannable tool output. Each tool call gets a one-line record — outcome glyph, name, summary, and elapsed time in a straight right-hand column. Timings too short to mean anything are omitted, and a cancelled turn no longer leaves a spinner claiming work is in flight.

Upgrade notes

Four changes can alter behavior on an existing setup:

1. Host rules now fire. They previously matched nothing. Any existing allow / deny / prompt rule with a host field starts taking effect. Worth re-reading a config that has one.
2. Credential files prompt by default. Under autopilot a command naming a credential file now stops for approval, and a headless run fails closed. If scheduled automation reads a .env or a deploy key, either set protect_credentials: "off" for that environment or add a rule naming the file — and check it with collo policy check first.
3. Project containment weakening is refused. Run collo config show after upgrading to see whether anything in a project config was dropped.
4. Mouse reporting is on by default. While it is on, the terminal routes drags to Collomia rather than to its own selection. If you copy text with the mouse more than you scroll, set options.mouse to false; most terminals still offer native selection under shift-drag.

Also in this release

New keybindings context_rail (alt+r) and compose_editor (alt+e), both remappable. collo doctor reports the permission stance. Documentation now lists the command_env: minimal allowlist, the per-platform read-confinement roots, and every protected credential location verbatim — each bound to the code by a test, so they cannot drift. Repository checkouts are pinned to LF, which fixes builds and formatting in Windows working copies. Release workflow fixes from v0.1.6 are included.

Install

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh |
  COLLO_VERSION=v0.1.7 sh

See INSTALLING.md for Windows, per-user directories, and upgrade behavior.

Full changelog: v0.1.6...v0.1.7