Collomia v0.2.1

Highlights

collo setup — configure a provider without hand-writing JSON. Collomia now finds the model runtimes actually running on your machine, reads their model catalogs, and proves the configuration works before writing it.

Publishing and deploying now ask before they run. terraform apply, kubectl apply, npm publish, docker push, git push, and remote-host execution are recognized as their own kind of action rather than being treated as ordinary commands.

Your permission history is readable. collo audit reports what was decided and what happened, and says so when the record is incomplete.

Windows gets a real terminal. run_command with pty: true and collo --web now work on Windows as they do on macOS and Linux.

---

collo setup

The first-run path used to be: read the README, hand-write JSONC, set a credential, run collo doctor, and work out which of the four steps was wrong. collo init wrote a fixed starter file naming ollama / qwen3-coder / 127.0.0.1:11434 whether or not any of that was true on your machine.

collo setup

• Finds what is actually there. Probes Ollama, LM Studio, and vLLM concurrently, distinguishing "running", "something else is on that port", and "nothing there". Offers Anthropic, OpenAI, and OpenRouter when their API key is already in your environment. Models come from the endpoint's own catalog rather than a hard-coded list.
• Azure and Bedrock via a short form, because neither can be reached from a name and a key alone — Azure addresses a deployment inside a resource you name, and Bedrock resolves an identity through the AWS credential chain with model access granted per region.
• Verifies before writing. Two real requests: a short completion, and the same prompt carrying a tool definition. The second matters — plenty of local models answer ordinary prompts perfectly and reject anything carrying tools, and without that check such a model configures cleanly and then fails your first real prompt.
• Explains failures. Nothing is written unless both requests pass. On failure it names whether the endpoint, the credential, or the model is at fault and prints the model list it just read. For Bedrock it also reports which identity your credential chain actually resolved to, via sts:GetCallerIdentity.
• Never writes an API key into a config file. Keys go to the OS credential manager (macOS/Windows) or are referenced by environment-variable name. Authentication modes with nothing to store — Entra, and the AWS SigV4 chain — are never asked for a key.
• Safe to re-run. It shows your current default, marks a provider it would replace, asks before repointing default_provider, and preserves settings it does not manage.

To skip the key prompt entirely, export the credential first:

export AWS_BEARER_TOKEN_BEDROCK='…' && collo setup

Publication and deployment protection

New setting permissions.publication (off | prompt | deny), default prompt.

Collomia's risk model previously only understood commands that destroy. Measured on a stock configuration in autopilot: terraform destroy asked for confirmation but terraform apply -auto-approve ran; kubectl delete asked but kubectl apply ran; helm uninstall asked but helm upgrade ran.

Publishing is now its own decision, covering package and container registries, source remotes, code-forge writes, infrastructure applies, and commands run on another host. Read-only verbs and --dry-run rehearsals are excluded. Autonomy mode, a tool-wide "always", and an allow rule naming only an executable never cover a publication — a rule naming the operation (npm publish, gh pr create) or a session grant scoped to that exact operation does.

This changes behavior. See Upgrading below.

An audit ledger you can read

The audit ledger recorded permission decisions and execution outcomes, but nothing in Collomia could read it back and a failed write left a file that still looked complete.

• collo audit [show|path] with filters: --session, --actor, --tool, --since, --denied, --limit, and --jsonl for external tooling.
• Every entry names its session and actor — primary, or agent:<profile> with the delegated task — so one workspace ledger written by several concurrent agents can be separated again.
• A failed write is never silent. Failures are counted, reported to the session once, and declared in the file as a gap entry stating how many entries were lost, since when, and why. collo audit and collo doctor report that gap before anything else, so an incomplete record is never read as a complete one.
• Bounded by rotation at 64 MiB with one retained generation; a rotation that discarded history says so.

Audit remains fail-visible, not fail-stop: a ledger that cannot be written does not block work you already authorized.

Windows terminal support

run_command with pty: true and collo --web now work on Windows, using a pseudoconsole (ConPTY). Requires Windows 10 1809 or later; on older builds the command reports that rather than silently running without terminal semantics.

Windows has no SIGTERM equivalent, so cancelling a pseudoconsole session closes the child's console input and then terminates the job after a short grace period rather than asking politely first.

Provider fixes

• LM Studio tool calling. A single built-in tool that took no arguments declared {"type":"object","additionalProperties":false} — complete JSON Schema, which LM Studio rejects for omitting properties. Because it rejects the whole request rather than the one tool, this made every prompt fail against LM Studio. Fixed at the source, and tool schemas are now normalized before they go on the wire so a tool supplied by an MCP server cannot reintroduce it.
• Reasoning models during setup. Verification allowed 32 tokens, which a model that thinks before answering spends before its first visible word — qwen/qwen3.5-9b needs about 170 to reach "ok". Setup reported models that LM Studio was actively serving as not served at all. The budget now accommodates reasoning, and an empty answer is diagnosed rather than assumed: reasoning present proves the endpoint, truncation is reported as a limit, and only a genuinely empty response is treated as a missing model.
• Clearer setup diagnostics. A local endpoint no longer receives Azure deployment-name advice, and an embedding model chosen for chat is named as such — local catalogs list embedding and chat models together with nothing to distinguish them.
• AWS SigV4. A failure to resolve AWS credentials no longer produces advice about a rejected API key. It names the IAM variables, profiles, aws sso login for an expired Identity Center session, and aws sts get-caller-identity.

Also in this release

• collo doctor and collo policy check are now in the generated capability matrix, alongside the new first-run setup entry.
• docs/INSTALLING.md first-run instructions lead with collo setup.
• Documentation guards that could pass against deleted documentation were repaired and are now verified by mutation; the recipe is written down in docs/TESTING.md.

---

Upgrading

One behavior change. permissions.publication defaults to prompt, so a publishing or deploying command that previously ran unattended under autopilot now asks first. If you have automation that publishes or deploys, either set it to off:

{ "permissions": { "publication": "off" } }

…which restores the previous behavior exactly, or add an allow rule naming the specific operation. See docs/COMPATIBILITY.md.

No configuration, session, or event schema changes. Existing configurations load unchanged, and collo setup is entirely optional — hand-written configuration files remain fully supported.

Known limitations

collo setup verifies that an endpoint answers and accepts tools; it does not judge whether a model is strong enough to drive an agent well. Azure and Bedrock are configured by naming their fields rather than by enumerating deployments or models. Credential storage uses the OS credential manager on macOS and Windows; on Linux a key is referenced by environment-variable name instead. Publication protection reads what a command's text says it will do, so a script that uploads without naming the operation is outside its view.

Full list: docs/BETA.md.

What's Changed

• First-run setup, publication protection, a readable audit ledger, and Windows ConPTY by @robert-mcdermott in #29

Full Changelog: v0.2.0...v0.2.1