Collomia v0.1.9

What's Changed

Collomia v0.1.9 gives the agent the current web — web_search and web_fetch, built in, with no API key, no account, and no configuration — and fixes a Windows installer that could not complete on a stock machine.

Configuration stays at schema_version: 1. No config file is rewritten by upgrading. Unlike the last two releases, this one does change a default: two new tools are visible to the model out of the box. They are classified external risk, so they prompt like any other external action and autopilot never approves them silently, but they are present unless you remove them.

Web search and fetch

No key, no account, no configuration. A web lookup that requires finding an integration, creating an account, and holding a billing relationship is a capability most users never turn on. web_search and web_fetch are built in and work on a fresh install. The backend is DuckDuckGo's no-JavaScript endpoints — the only major search interface that answers a plain query with no key and no quota.

Pages arrive as text, not markup. HTML is reduced structurally: drop what is never content, prefer a <main> or <article> that actually holds the article, and keep headings, lists, code blocks, and tables. Deliberately not a readability score, which would let a page fall on the wrong side of a threshold and lose its own text. Raw HTML is still available when you want it.

The public internet, and nothing else. The address check runs on the resolved IP at connect time, inside the dialer, so it covers DNS rebinding, every redirect hop, and IPv4-mapped and NAT64 spellings of a private address alike. Loopback, private, link-local (cloud metadata), CGNAT, multicast, benchmark, documentation, and reserved ranges are all refused. No configuration key can turn this off — a switch to disable it is exactly what a prompt injection would ask you to add. The practical consequence: these tools cannot reach your local dev server, your intranet, or a metadata endpoint, and that is the point.

Inherited proxy variables are ignored, URL credentials are stripped, no cookie jar is kept, and the transport is not shared with the provider client. Each of those is otherwise a way a model-chosen request reaches a host the guard never inspected, or carries state that was never meant for it.

A redirect that leaves the site is reported, not followed. web_fetch declares the host of the URL it was given, so approving that host must not become approval for wherever a redirector points. Moves within one site are followed normally. web_search symmetrically declares every endpoint it may fail over to, because a rule covering only the primary endpoint would cover nothing.

A dead search engine looks dead. Both endpoints are tried in order, and a 200 that parses to zero results is treated as an engine failure rather than as "no results". Scraping breaks eventually; the failure that matters is the silent one that tells you the web has nothing on your question. Separately, DuckDuckGo answers a throttled client with HTTP 202 and a challenge page rather than a 429 — reported verbatim that reads like a Collomia bug, so it is named as rate limiting instead.

Why the client looks like a browser. A great many sites reject non-browser clients by default CDN rule, and a page you can read but the agent cannot is the capability failing at its own premise. Two things fix that, and only two: HTTP/1.1 instead of HTTP/2, whose Go client sends a SETTINGS frame that bot-management products fingerprint — holding everything else constant, Stack Overflow returned 403 with cf-mitigated: challenge on every HTTP/2 request and 200 on every HTTP/1.1 one — and one fixed desktop Chrome identity. Deliberately not a rotating pool: rotation only defends against a blocklist naming one exact string, which no operator applies to mainstream Chrome, while turning any site that did refuse one entry into a failure that reproduces a fraction of the time. Nothing beyond the header. No TLS fingerprint forgery, no challenge solving, no address rotation, no retrying a refusal.

Web content is framed as external data, through the same implementation MCP results use rather than a second weaker copy of it. Pages are written by whoever the search ranked, not by a server you chose to trust.

Windows install

The documented Windows instructions did not work. Four separate defects, each sufficient on its own to stop an install, and three of them predate this release.

One command, and the execution policy no longer matters.

irm https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.ps1 | iex

The execution policy governs script files. Evaluating the installer from memory is unaffected by Restricted or AllSigned, so there is no Set-ExecutionPolicy, no Unblock-File, and no elevation. Saving the script and running it as a file is still documented, with the bypass scoped to that one invocation rather than changed machine-wide.

ARM64 installs. Detection used a .NET API that Windows PowerShell 5.1 does not have on ARM64 — 5.1 is a .NET Framework host with no native ARM64 build, so it runs emulated and the property is simply missing, which strict mode turned into a hard failure before anything downloaded. The machine's own registry value is read first now: it reports the real hardware even when PowerShell is emulated.

Two failures that looked like nothing. The installer verifies the downloaded binary by running it, and that check failed silently in two different ways. It read $LASTEXITCODE, a global that a fresh PowerShell window has never set, so on a first command in a new terminal it died complaining about a variable instead of naming the real problem. And it staged the download under a filename containing the word "install" — which makes Windows apply its UAC installer-detection heuristic to an unsigned binary and interpose an elevation prompt instead of running it, invisibly from PowerShell's side: no output, no error, no exit code. Administrators never see that prompt, which is exactly why it shipped. Both are fixed, and a failed version check now quotes what the binary actually printed.

PATH is set up for you. %LocalAppData%\Programs\Collomia is added to your user PATH unless you pass -NoPathUpdate. Open a new terminal to pick it up. The registry value is written directly so that a PATH containing %USERPROFILE%\bin keeps working — the obvious .NET call rewrites the whole variable in a form that permanently breaks entries like that.

Downloads finish in seconds. Windows PowerShell draws its progress bar once per network buffer, which turned a 25 MB download into minutes. It is suppressed.

-Version, -InstallDir, -Repository, -Architecture, and -NoPathUpdate all have COLLO_* environment equivalents, since piping into iex cannot pass parameters. -AddToPath is still accepted so older instructions keep working.

Upgrade notes

1. Two new tools are available to the model. web_search and web_fetch are visible by default and usable in planning mode. They require approval like any other external action; options.disabled_tools removes them, and permissions.network: "scoped" governs them as it does anything else that reaches the network.
2. On Windows, the installer now edits your user PATH. This is new. Pass -NoPathUpdate, or set COLLO_NO_PATH_UPDATE=1, to keep the old behavior.
3. Nothing else changes by default. No sandbox, permission, provider, session, or TUI default moves in this release.

Also in this release

The capability matrix carries a web_search / web_fetch row describing what the tools actually enforce rather than what they accept, and the evaluation row now names external-injection coverage from fetched web pages alongside MCP. docs/BETA.md was corrected on several points that had drifted: Windows has no ConPTY backend (so pty: true is Unix-only and collo --web does not run there), LSP code actions are the only missing piece rather than definitions and formatting, and the endpoint-scoped egress entry now distinguishes what commands can be held to from what the built-in web tools enforce directly.

docs/RELEASING.md gained a step to refresh the browser identity in internal/web/client.go when it falls a few major versions behind — a version old enough to look implausible starts attracting the same CDN rules it exists to satisfy. An opt-in live web suite (COLLO_LIVE_WEB_TESTS=1) exercises each search endpoint on its own, so a working fallback cannot hide a primary that has stopped parsing; the ordinary suite stays offline and credential-free.

The PowerShell installer tests grew coverage for architecture aliases, on-host detection, the version check across its failure modes, the fresh-session state that broke $LASTEXITCODE, and the filename rule that keeps UAC out of the way. That last one is asserted rather than exercised, because CI runs elevated and structurally cannot observe the failure it guards against.

Install

macOS and Linux:

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh |
  COLLO_VERSION=v0.1.9 sh

Windows 11, AMD64 or ARM64:

$env:COLLO_VERSION = 'v0.1.9'
irm https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.ps1 | iex

See INSTALLING.md for per-user directories, pinning, reviewing the installer before running it, and upgrade behavior.

Full changelog: v0.1.8...v0.1.9