@dreb/coding-agent 2.42.0 → 2.43.2

package/README.md

@@ -81,7 +81,7 @@ Or use a custom provider (corporate proxy, Bedrock, etc.) — see [Custom provid
 
 Then just talk to dreb. All 11 built-in tools are enabled by default: `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, `web_search`, `web_fetch`, `subagent`, and `wait`. Use `--tools` to restrict to a subset (e.g., `--tools read,grep,find,ls` for read-only). Three additional tools — `search`, `skill`, and `tasks_update` — are always active regardless of `--tools`. `suggest_next` is active by default but excluded when `--tools` is specified. The model uses these to fulfill your requests. Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [packages](#packages).
 
-**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, subagent observability, host file browser, and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)). Its top bar and persistent session header indicators report connecting, connected, retrying, resyncing, disconnected, or auth failed; bounded SSE replay plus an explicit snapshot barrier restores session state and tasks after a reload, restart, gap, backpressure disconnect, or stalled stream.
+**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, subagent observability, host file browser, curated appearance themes (per-browser light/dark), and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)). Its top bar and persistent session header indicators report connecting, connected, retrying, resyncing, disconnected, or auth failed; bounded SSE replay plus an explicit snapshot barrier restores session state and tasks after a reload, restart, gap, backpressure disconnect, or stalled stream.
 
 **Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
 

package/docs/custom-provider.md

@@ -608,7 +608,7 @@ interface ProviderModelConfig {
     requiresToolResultName?: boolean;
     requiresAssistantAfterToolResult?: boolean;
     requiresThinkingAsText?: boolean;
-    thinkingFormat?: "openai" | "openrouter" | "zai" | "qwen" | "qwen-chat-template";
+    thinkingFormat?: "openai" | "openrouter" | "zai" | "qwen" | "qwen-chat-template" | "kimi";
     openRouterRouting?: OpenRouterRouting;
     vercelGatewayRouting?: VercelGatewayRouting;
     supportsStrictMode?: boolean;

package/docs/dashboard.md

@@ -123,7 +123,7 @@ networking window above.
 | **Session view** | Full chat drill-in. Markdown streaming transcript (text, thinking blocks with expand preference, agent-result cards, tool cards with bespoke read/write/edit/bash bodies plus full expandable inputs and markdown-rendered results for markdown-contract tools like subagent/skill/web_fetch/suggest_next, compaction/branch summaries, custom messages), per-message copy, tasks panel, subagent strip, status line with elapsed time plus ■ stop and compaction/retry aborts, a persistent session-header live indicator, and an info bar with cwd, branch, session name, token breakdown, cost/(sub)/daily rollup, ctx%, median tok/s, and a stats popover. Composer supports auto-grow, history, `/` autocomplete from `get_commands`, image attach/paste, queued-message chips with restore-all, steer/follow-up modes, and suggest-next. The ⋯ menu covers export HTML, compact, rename, fork-from-message, loaded context, and tool expand/collapse. Session names update live from manual rename or auto-naming. Extension UI requests (select/confirm/input/editor) render as modals; notifications as toasts. |
 | **Subagent view** | Read-only transcript of a background agent: live events via the RPC relay, hydrated from the agent's on-disk session log (`/subagents/:agentId/messages`) so the view survives browser reloads. Shows the task, streaming output, and tool activity. No composer — subagents can't be steered yet; the parent session controls them. |
 | **Files** | Host-wide browser with places shortcuts (home, /tmp, project roots), breadcrumbs to `/`, new-folder, download, drop-zone/picker upload with explicit collision prompts, and "new session here" on any directory. It also shows the **effective global nested-context trust** for the displayed canonical directory: untrusted, trusted by that root, inherited from a granting root, or global expert trust-all. You can trust the displayed folder and descendants, or untrust the actual granting root; untrusting an inherited folder removes that root's trust for all descendants. |
-| **Settings** | Persistent defaults (default model, thinking level, steering/follow-up queue modes, auto-compaction, auto-retry) via `get_settings`/`set_settings` — validation errors are shown verbatim. Entering Settings flushes pending writes and reloads durable global + project settings, so external edits appear; read, parse, or write failures fail loudly instead of showing stale settings. The global-only nested-context policy lists every explicit trusted root for audit and revoke, offers a simple add-by-path control, and includes a prominently warned expert trust-all toggle; the Files view remains the primary place to grant trust while browsing. Most defaults seed new sessions; context-trust changes are observed by active main/subagent processes for future lazy loads, but cannot remove already injected content. Dashboard-local preferences (always expand thinking, needs-attention notification permission) live in the browser. Shows the current rotating pairing code on the host/local dashboard, plus the paired-devices list with unpair. |
+| **Settings** | Persistent defaults (default model, thinking level, steering/follow-up queue modes, auto-compaction, auto-retry) via `get_settings`/`set_settings` — validation errors are shown verbatim. Entering Settings flushes pending writes and reloads durable global + project settings, so external edits appear; read, parse, or write failures fail loudly instead of showing stale settings. The global-only nested-context policy lists every explicit trusted root for audit and revoke, offers a simple add-by-path control, and includes a prominently warned expert trust-all toggle; the Files view remains the primary place to grant trust while browsing. Most defaults seed new sessions; context-trust changes are observed by active main/subagent processes for future lazy loads, but cannot remove already injected content. Dashboard-local preferences (always expand thinking, needs-attention notification permission) live in the browser, alongside an appearance section: a theme gallery of eight curated themes (entropist.ca, Dim, Solarized, Gruvbox, Caves of Qud, Van Gogh, and the colorblind-safe Okabe-Ito and Paul Tol) with live preview cards and a system/light/dark mode selector, saved per browser. Shows the current rotating pairing code on the host/local dashboard, plus the paired-devices list with unpair. |
 | **Pairing** | Remote first-login: identity echo, rotating-code entry, and the security copy explaining what pairing grants. |
 
 ## Live connection and recovery
@@ -305,8 +305,42 @@ Browser dashboard (SolidJS + Vite, tokens.css design system)
   RPC sessions get the same LLM-generated session names as the TUI and update
   live via `session_name_changed`.
 - **Visual language**: `tokens.css` (`packages/dashboard/src/client/styles/`),
-  the dashboard's design system — IBM Plex Mono, light + dark via
-  `prefers-color-scheme`.
+  the dashboard's design system, with `themes.css` as an additive layer on top.
+  The pristine default (the entropist.ca theme + system mode) renders exactly as
+  the `tokens.css` baseline; a curated theme or a forced mode overrides the design
+  tokens. See the appearance system below.
+
+## Appearance system
+
+The dashboard owns its own palette surface, deliberately **independent of the
+TUI theme system** — dashboard themes intentionally do not map to TUI themes.
+
+- **Curated themes.** Eight themes — entropist.ca (the default baseline), Dim,
+  Solarized, Gruvbox, Caves of Qud, Van Gogh, and the colorblind-safe Okabe-Ito
+  and Paul Tol palettes — each a *family* with its own light and dark palette.
+  The two CVD-safe themes keep running/error on a blue/teal-vs-vermillion/red
+  axis (never green-vs-red) so status stays legible under deutan/protan/tritan
+  color vision. A separate mode toggle (system / light / dark) picks which
+  variant renders; forced light/dark works for every theme, including
+  entropist.ca. `system` follows the OS via `prefers-color-scheme`.
+- **Theme gallery.** The settings appearance section shows a mode selector plus
+  a grid of live preview cards (one per theme). Each card previews its palette
+  locally without touching the page until you commit by clicking it.
+- **Per-browser persistence.** Selections are stored in per-browser
+  `localStorage` (`dreb.dashboard.theme` / `dreb.dashboard.colorMode`), with a
+  cross-tab sync listener; a pristine install (entropist.ca + system) leaves no keys
+  behind and renders byte-for-byte identically to the `tokens.css` baseline. No
+  server/RPC involvement, no runtime dependencies.
+- **No wrong-theme flash.** A synchronous bootstrap in `index.html` paints the
+  correct theme before any CSS loads, and keeps a live `theme-color` meta in
+  sync with the active background.
+- **Self-hosted fonts.** Most themes use IBM Plex Mono; Gruvbox uses
+  self-hosted JetBrains Mono (OFL, provenance in
+  `src/client/assets/fonts/`), lazy-loaded by the browser only when Gruvbox is
+  active. No `light-dark()` is used, keeping an iOS Safari 16.4 floor.
+- **PWA launch colors.** The static `manifest.webmanifest` keeps white
+  (default-light) launch colors as the fallback; the live `theme-color` meta
+  follows the active appearance once the app loads.
 
 ## Limitations (deliberate, sequenced later)
 
@@ -314,4 +348,3 @@ Browser dashboard (SolidJS + Vite, tokens.css design system)
   loop; the tree design and RPC are ready).
 - No shell passthrough from the browser.
 - No subagent steering (the drill-in view is read-only).
-- Fixed light/dark via `prefers-color-scheme` — no TUI-theme following.

package/docs/models.md

@@ -270,7 +270,7 @@ For providers with partial OpenAI compatibility, use the `compat` field.
 | `requiresToolResultName` | Include `name` on tool result messages |
 | `requiresAssistantAfterToolResult` | Insert an assistant message before a user message after tool results |
 | `requiresThinkingAsText` | Convert thinking blocks to plain text |
-| `thinkingFormat` | Use `reasoning_effort`, `zai`, `qwen`, or `qwen-chat-template` thinking parameters |
+| `thinkingFormat` | Use `reasoning_effort`, `reasoning: { effort }`, `zai`, `qwen`, `qwen-chat-template`, or nested `thinking: { type, effort? }` parameters |
 | `supportsStrictMode` | Include the `strict` field in tool definitions |
 | `openRouterRouting` | OpenRouter routing config passed to OpenRouter for model/provider selection |
 | `vercelGatewayRouting` | Vercel AI Gateway routing config for provider selection (`only`, `order`) |

package/docs/providers.md

@@ -51,8 +51,10 @@ Use `/logout` to clear credentials. Tokens are stored in `~/.dreb/agent/auth.jso
 
 - `/login` uses the Kimi Code OAuth subscription endpoint at `https://api.kimi.com/coding/v1`.
 - `KIMI_API_KEY` uses Kimi For Coding's Anthropic-compatible API at `https://api.kimi.com/coding`.
-- The OAuth coding endpoint has been verified to accept OpenAI-style multimodal content arrays with base64 `image_url` data URLs for `kimi-for-coding`.
-- Moonshot Open Platform vision docs use a different base URL (`https://api.moonshot.ai/v1`), and the first-party Kimi CLI may have its own media handling; don't assume all Kimi routes expose identical media behavior.
+- Built-in OAuth models are `kimi-for-coding` (default, 262k context), `k3` (1M context), and `kimi-for-coding-highspeed` (262k context). Model availability is plan-dependent: the `k3` 1M-context ID and the `kimi-for-coding-highspeed` ID are only exposed when the subscription includes them, and `kimi-for-coding-highspeed` runs at roughly 6× speed for 3× quota usage. On login/refresh, dreb asks the Kimi API which models the subscription is entitled to and updates context, reasoning, image, tool-use, protocol, and thinking-effort metadata. Compatible newly discovered IDs are templated conservatively; if discovery fails, the static list remains available.
+- OAuth requests use the current Kimi Code device identity contract and share its stable `~/.kimi-code/device_id`. Extra low-precedence headers can be supplied with newline-separated `KIMI_CODE_CUSTOM_HEADERS` values.
+- The OAuth coding endpoint accepts OpenAI-style multimodal content arrays with base64 `image_url` data URLs. dreb keeps a conservative 32k output-token cap because the managed model catalog does not currently advertise a per-model output limit.
+- Moonshot Open Platform uses a different base URL (`https://api.moonshot.ai/v1`); don't assume both routes expose identical behavior.
 
 ## API Keys
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@dreb/coding-agent",
-	"version": "2.42.0",
+	"version": "2.43.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"drebConfig": {