Collomia v0.1.7

Collomia v0.1.7 makes the permission layer describe what an action reaches — which endpoints, which executables, which files — rather than only which tool asked for it, and rebuilds the parts of the terminal UI you look at most.

Configuration stays at schema_version: 1. No config file is rewritten by upgrading.

Permissions and safety

Endpoint-scoped policy. Rules with a host field now actually take effect. Endpoints are read out of command text (URL arguments, ssh destinations, Git remote URLs) and from HTTP-transport MCP servers. An endpoint that resolves somewhere Collomia cannot see — a named Git remote, a configured registry — is reported as explicitly undetermined and can never be covered by an allow rule. This is a policy layer, not egress enforcement.

Credential files are their own decision. Reaching an SSH or GPG private key, a cloud CLI token cache, a registry auth file, a .env, or Collomia's own provider config now stops for its own approval, with its own prompt. A blanket allow rule, a tool-wide "always", and autopilot never cover one — only a rule naming the path, or a session grant scoped to the exact file shown. Public keys, known_hosts, and .env.example are excluded. Controlled by permissions.protect_credentials (off / prompt / deny, default prompt).

Containment presets. permissions.preset — frictionless, standard, or hardened — sets a coherent policy in one line instead of eight separate decisions. Explicit fields still win within a layer, no preset changes the autonomy mode, and collo config show attributes every expanded value to where it came from.

One containment rule. A project .collomia.json can tighten containment but can never weaken it. A repository asking for "sandbox": "off", "command_env": "full", or a weaker preset is refused and reported rather than applied; the escape hatch lives in your global config only.

Two optional postures. permissions.network: "scoped" and permissions.commands: "allowlist" withhold automatic approval unless a rule or session grant covers every endpoint or executable. Both default to the previous open behavior and can only ever add a prompt.

Per-capability approval. The approval dialog shows what an action reaches one dimension at a time, and g grants exactly that reach for the session — nothing more. Nothing is grantable for a command Collomia cannot inspect or an endpoint it cannot read.

Better redaction. PEM private key blocks are removed whole (public keys and certificates are preserved), plus GitLab, Google, npm, Stripe, and the GitHub token types beyond ghp_.

Always-visible stance. A containment mark on the autonomy badge, a grouped Security block in the Session tab, and the permission stance in collo doctor — which also tells you when a project's attempt to weaken containment was refused.

Terminal UI

A first screen that orients you. A new session opens with where you are and what it will cost — workspace, branch, model, autonomy, containment — plus a few openers, instead of a logo over blank rows.

Context rail. alt+r shows a persistent side panel with the workspace, the current plan, running agents, changed files, and background processes. It appears on its own at 146 columns and is unavailable below 116.

A composer that behaves like an editor. It grows with your draft. A draft ending in a backslash, or sitting inside an unclosed ``` fence, gains a line instead of sending. ctrl+j inserts a newline in every terminal (`alt+enter` still works outside macOS Terminal.app's defaults; terminals speaking the Kitty protocol or `modifyOtherKeys` also get `shift+enter` and `ctrl+enter`), and a hint tells you why Enter is inserting rather than sending. `alt+e` opens the draft in `$EDITOR` and brings it back.

Mouse support. Wheel scrolling in the transcript and click-to-select on the tab bar. Only the wheel and a plain left click are consumed — drags and modifiers stay with the terminal.

Syntax-highlighted diff approvals. A change you are asked to approve is rendered the way an editor would show it: added and removed rows carry a tinted wash to the right margin, with the code inside them highlighted.

Scannable tool output. Each tool call gets a one-line record — outcome glyph, name, summary, and elapsed time in a straight right-hand column. Timings too short to mean anything are omitted, and a cancelled turn no longer leaves a spinner claiming work is in flight.

Upgrade notes

Four changes can alter behavior on an existing setup:

1. Host rules now fire. They previously matched nothing. Any existing allow / deny / prompt rule with a host field starts taking effect. Worth re-reading a config that has one.
2. Credential files prompt by default. Under autopilot a command naming a credential file now stops for approval, and a headless run fails closed. If scheduled automation reads a .env or a deploy key, either set protect_credentials: "off" for that environment or add a rule naming the file — and check it with collo policy check first.
3. Project containment weakening is refused. Run collo config show after upgrading to see whether anything in a project config was dropped.
4. Mouse reporting is on by default. While it is on, the terminal routes drags to Collomia rather than to its own selection. If you copy text with the mouse more than you scroll, set options.mouse to false; most terminals still offer native selection under shift-drag.

Also in this release

New keybindings context_rail (alt+r) and compose_editor (alt+e), both remappable. collo doctor reports the permission stance. Documentation now lists the command_env: minimal allowlist, the per-platform read-confinement roots, and every protected credential location verbatim — each bound to the code by a test, so they cannot drift. Repository checkouts are pinned to LF, which fixes builds and formatting in Windows working copies. Release workflow fixes from v0.1.6 are included.

Install

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh |
  COLLO_VERSION=v0.1.7 sh

See INSTALLING.md for Windows, per-user directories, and upgrade behavior.

Full changelog: v0.1.6...v0.1.7