@globant/coda-linux-x64-baseline-musl 1.3.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/assets/agents/coda-help.md +25 -12
  2. package/assets/agents/council.md +11 -0
  3. package/assets/agents/reviewer.md +14 -0
  4. package/assets/agents/side.md +15 -0
  5. package/assets/docs/add-mcp-server-skill.md +137 -0
  6. package/assets/docs/agents.md +1 -1
  7. package/assets/docs/cli-reference.md +40 -4
  8. package/assets/docs/cli-vs-batch.md +2 -0
  9. package/assets/docs/config-json.md +71 -57
  10. package/assets/docs/config-reference.md +99 -48
  11. package/assets/docs/configuration.md +33 -18
  12. package/assets/docs/connect-provider.md +34 -31
  13. package/assets/docs/extensions.md +25 -28
  14. package/assets/docs/faq.md +47 -15
  15. package/assets/docs/glossary.md +8 -8
  16. package/assets/docs/guide-automate.md +6 -2
  17. package/assets/docs/guide-changes.md +4 -4
  18. package/assets/docs/guide-collaborate.md +8 -8
  19. package/assets/docs/guide-extend.md +32 -5
  20. package/assets/docs/hooks.md +33 -69
  21. package/assets/docs/how-it-works.md +3 -3
  22. package/assets/docs/index.md +8 -7
  23. package/assets/docs/installation.md +9 -9
  24. package/assets/docs/logging.md +1 -1
  25. package/assets/docs/overview.md +9 -8
  26. package/assets/docs/permissions.md +35 -16
  27. package/assets/docs/quickstart.md +9 -5
  28. package/assets/docs/sessions.md +6 -2
  29. package/assets/docs/shortcuts.md +53 -3
  30. package/assets/docs/tools-reference.md +21 -10
  31. package/assets/docs/workflows.md +2 -1
  32. package/assets/output-styles/attention-kind.md +50 -0
  33. package/assets/output-styles/concise.md +46 -0
  34. package/assets/output-styles/default.md +4 -0
  35. package/assets/output-styles/explanatory.md +84 -0
  36. package/assets/output-styles/learning.md +103 -0
  37. package/assets/output-styles/plain.md +39 -0
  38. package/assets/output-styles/proactive.md +52 -0
  39. package/assets/output-styles/rundown.md +23 -0
  40. package/assets/output-styles/spartan.md +26 -0
  41. package/assets/output-styles/visual.md +96 -0
  42. package/assets/skills/configure-mcp/SKILL.md +281 -0
  43. package/assets/skills/create-hook/SKILL.md +5 -5
  44. package/assets/skills/init-rules/SKILL.md +78 -26
  45. package/coda +2 -2
  46. package/lib/opentui/parser.worker.js +15 -14
  47. package/package.json +1 -1
@@ -31,12 +31,12 @@ Notation: every entry points to `file.md › § "Exact Heading"`. All files live
31
31
  | --- | --- |
32
32
  | How do I install / upgrade Coda? | `installation.md` › § "Install CODA", § "Keeping CODA up to date" |
33
33
  | What are the requirements? | `installation.md` › § "Requirements" |
34
- | How do I connect / set up a provider? | `connect-provider.md` › § "Step 1 — Choose how to connect" → § "Step 3 — Authenticate" |
34
+ | How do I connect / set up a provider? | `connect-provider.md` › § "What the first run does", § "Choosing an instance yourself", § "Custom provider" |
35
35
  | Configure a provider non-interactively / from a script / in CI / headless setup (`coda configure`)? | `connect-provider.md` › § "Non-interactive setup (`coda configure`)"; command → `cli-reference.md` › § "Subcommands (run as `coda <command>`)" |
36
- | OAuth vs API key / switch between them? | `connect-provider.md` › § "Switch a Glob.AI OS provider between OAuth and API key" |
36
+ | OAuth vs API key / switch between them? | `connect-provider.md` › § "Switch a Glob.AI profile between OAuth and API key" |
37
37
  | Switch the active provider / profile (`/switch-profile`, `/sp`)? | `connect-provider.md` › § "Switch between configured providers"; command → `cli-reference.md` › § "Configuration" |
38
- | Add / edit / remove a provider (`/providers`)? | `connect-provider.md` › § "Reconfigure"; wizard steps → § "Step 1 — Choose how to connect" |
39
- | Switch the active Glob.AI OS project (`/project`)? | `connect-provider.md` › § "Switching the active Glob.AI OS project" |
38
+ | Add / edit / remove a provider (`/providers`)? | `connect-provider.md` › § "Reconfigure"; wizard steps → § "Choosing an instance yourself" |
39
+ | Switch the active Glob.AI project (`/project`)? | `connect-provider.md` › § "Switching the active Glob.AI project" |
40
40
  | Set up two projects / accounts and switch between them? | `faq.md` › § "How do I set up two projects (e.g. two Clients projects) and switch between them?" |
41
41
  | Change project while logged in with OAuth? | `faq.md` › § "I'm logged in with OAuth. How do I switch to a different project?" |
42
42
  | How do I run batch mode / authenticate headlessly / in CI? | `faq.md` › § "How do I run CODA in batch mode, and how does it authenticate?"; details → `guide-automate.md` › § "Authenticating in batch mode", § "Important flags for automation" |
@@ -51,19 +51,30 @@ Notation: every entry points to `file.md › § "Exact Heading"`. All files live
51
51
  | Where are config / secrets / sessions / logs stored? | `config-reference.md` › § "Config file locations"; `faq.md` › § "Where are my config, sessions, and logs stored?" |
52
52
  | Store API keys safely / `${VAR}` / `secretRef` secrets? | `config-json.md` › § "Secrets: keep keys out of the file"; `config-reference.md` › § "Referencing secrets with `${VAR}`" |
53
53
  | How do I switch models? | `cli-reference.md` › § "Configuration" (`/switch-model`); `shortcuts.md` › § "Model switching" |
54
+ | How do I copy CODA's response / a past response / test the `/copy` command? | `cli-reference.md` › § "Session management" (`/copy`); shortcut → `shortcuts.md` › § "Transcript navigation" (`Ctrl+Shift+C`) |
54
55
  | How do I let bash run everything / change approval level / permission mode (`read-only`/`default`/`auto`, Ctrl+P)? | `permissions.md` › § "Permission modes", § "Where to set it"; headless: § "Approvals in headless (batch) mode" |
55
56
  | How do I allow / always-allow / never-allow a command (`propose_policy`, "allow pnpm build")? | `permissions.md` › § "The easy way to change permissions: just ask the agent", § "How `propose_policy` works", § "What you actually approve" |
56
57
  | Stop CODA suggesting rule changes / disable `propose_policy` (`permissions.proposePolicy`, `CODA_PROPOSE_POLICY`, `disableProposePolicy`)? | `permissions.md` › § "Turning `propose_policy` off"; `config-reference.md` › § "permissions" |
58
+ | CODA asked to set up rules / run `/init-rules` after my first message / stop that prompt (`onboarding.suggestInitRules`)? | `faq.md` › § "CODA asked if I want to set up permission rules — what is that?"; key → `config-reference.md` › § "Other common settings" (`onboarding.suggestInitRules`) |
59
+ | What is the default permission mode / does CODA start in `auto`? | `permissions.md` › § "Permission modes"; default value → `config-reference.md` › § "permissions" (`defaultMode`) |
57
60
  | Rule syntax / write allow-ask-deny rules by hand / path or command not matching? | `permissions.md` › § "Rule syntax", § "Rules — always-allow / always-ask / always-deny", § "Project-scoped vs. global-scoped rules" |
58
61
  | Why was an action denied / precedence / deny-first / order of rules vs mode? | `permissions.md` › § "How decisions are made (precedence)", § "What denial messages look like" |
59
62
  | What is the catastrophic floor / what can never be allowed (`rm -rf /`, reading SSH keys, git hooks, `--privileged`)? Answer from the floor sections ONLY — do not describe the retired `bash.autoApproveLevel` as a current control. | `permissions.md` › § "The catastrophic floor — protections that can never be turned off", § "What is never auto-approved" |
60
63
  | What permissions do I have right now / what rules apply / where did a rule come from (`/permissions`, `coda permissions`)? | `permissions.md` › § "Seeing what applies right now" |
61
64
  | Organization / managed policy / admin lockdown of permissions? | `permissions.md` › § "Managed (organization) policy"; to see what it actually permits on this machine: § "Seeing what applies right now" |
65
+ | LLM safety check (`permissions.llmSafetyCheck`) — what it does, does it work in headless / `/goal` / `/loop`, why did it stop working? | `permissions.md` › § "LLM safety check (optional)" |
62
66
  | Where are permission decisions logged (`authorization.decision`)? | `permissions.md` › § "Every decision is logged" |
63
67
  | Is it safe to install skills/plugins/MCP? | `permissions.md` › § "Trust and external code" |
64
- | How do I connect an MCP server? | `guide-extend.md` › § "Connect external services with MCP" |
68
+ | How do I connect an MCP server? | `guide-extend.md` › § "Connect external services with MCP"; step by step with the bundled `configure-mcp` skill → `add-mcp-server-skill.md` › § "Ask in plain language", § "Choose the scope" |
65
69
  | Where do MCP servers live / session override / disable one? | `guide-extend.md` › § "Connect external services with MCP" ("Where MCP servers are defined") |
70
+ | Add an MCP server from a package / command / Git repo / local binary / URL? | `add-mcp-server-skill.md` › § "Supported inputs", § "Entry rules"; check it loaded → § "Activate and verify"; problems → § "Troubleshooting" |
71
+ | MCP server needs a token / how do I keep it out of `mcp.json`? | `add-mcp-server-skill.md` › § "Keep secrets out of the file" |
72
+ | What are lifecycle hooks / how do I add one / which events exist? | `hooks.md` › § "Quick start", § "Where hooks are configured", § "Hook events" |
73
+ | Hook config schema / `if` conditions / async hooks / turn all hooks off? | `hooks.md` › § "Configuration schema", § "Conditional execution (`if` field)", § "Async hooks", § "Disabling all hooks" |
74
+ | What does a hook receive and return / how do I block an action from a hook? | `hooks.md` › § "JSON input (what your hook receives)", § "JSON output (what your hook can return)", § "Blocking operations" |
75
+ | Hook env vars / `CODA_ENV_FILE` / hook examples / my hook does not fire? | `hooks.md` › § "Environment variables available to hooks", § "Session environment files (`CODA_ENV_FILE`)", § "Common recipes", § "Troubleshooting" |
66
76
  | How do I create / install a skill? | `guide-extend.md` › § "Teach CODA repeatable workflows with skills"; `faq.md` › § "How do I create a skill?" |
77
+ | Import skills from Claude/Codex/OpenCode / cross-tool `.agents` / scan extra skill folders (`skills.sources`, `skills.paths`, `/settings → Skills`, `coda skills`)? | `guide-extend.md` › § "Import skills from other coding agents"; `faq.md` › § "Can I use skills from Claude, Codex, or OpenCode?"; keys → `config-reference.md` › § "skills" |
67
78
  | How do I create an extension? | `extensions.md` › § "The easy way: let CODA write it"; API → § "Registering a tool" onward |
68
79
  | Extension hooks / registerTool / registerShortcut / context fields? | `extensions.md` › § "Subscribing to lifecycle hooks", § "Registering shortcuts, providers, and flags" |
69
80
  | How do I install a plugin / use a marketplace? | `guide-extend.md` › § "Share packaged integrations with plugins", § "Adding a marketplace"; CLI → `cli-reference.md` › § "Subcommands (run as `coda <command>`)" |
@@ -84,7 +95,7 @@ Notation: every entry points to `file.md › § "Exact Heading"`. All files live
84
95
  | How do I view / share logs? | `logging.md` › § "Viewing logs", § "Sharing logs with support" |
85
96
  | Where do I see token usage / cost? | `faq.md` › § "Where do I see token usage and cost?" |
86
97
  | What does <term> mean (HITL, drift, shadow repo, fastModel…)? | `glossary.md` (single table — grep the term) |
87
- | What changed in this release / my version? | `release-history.md` › § "Checking your version" |
98
+ | Which version am I running / how do I update? | `faq.md` › § "How do I check which version I'm running?"; `installation.md` › § "Keeping CODA up to date" |
88
99
  | Team setup / AGENTS.md / what to commit / monorepo? | `guide-collaborate.md` › § "Start with AGENTS.md", § "What to commit (and what not to)", § "Working in a monorepo" |
89
100
 
90
101
  ## Topic index (file › sections)
@@ -100,7 +111,7 @@ Use this when the Fast-answers table doesn't match. Each line names the **file**
100
111
  **Install, providers, first run**
101
112
 
102
113
  - Requirements, install (script vs npm), where it installs, upgrading, install troubleshooting → `installation.md` › § "Requirements", § "Install CODA", § "Where CODA installs", § "Keeping CODA up to date", § "Troubleshooting the install"
103
- - Setup wizard, Glob.AI OS environment, OAuth vs API key, custom/Ollama provider, switch active profile (`/switch-profile`/`/sp`), switch Glob.AI OS project (`/project`), who am I signed in as, reconfigure (`/providers`), OAuth↔API-key switch, OAuth troubleshooting → `connect-provider.md` › § "Step 1 — Choose how to connect", § "Step 2 — Pick a Glob.AI OS environment", § "Step 3 — Authenticate", § "Custom provider", § "Switch between configured providers", § "Switching the active Glob.AI OS project", § "Check who you're signed in as", § "Reconfigure", § "Switch a Glob.AI OS provider between OAuth and API key", § "Troubleshooting"
114
+ - First run, choosing a Glob.AI instance, setup wizard, OAuth vs API key, custom/Ollama provider, switch active profile (`/switch-profile`/`/sp`), switch Glob.AI project (`/project`), who am I signed in as, reconfigure (`/providers`), OAuth↔API-key switch, OAuth troubleshooting → `connect-provider.md` › § "What the first run does", § "Choosing an instance yourself", § "Custom provider", § "Switch between configured providers", § "Switching the active Glob.AI project", § "Check who you're signed in as", § "Non-interactive setup (`coda configure`)", § "Reconfigure", § "Switch a Glob.AI profile between OAuth and API key", § "Troubleshooting"
104
115
  - Non-interactive / headless / CI provider setup (`coda configure`), flags, exit codes, key storage → `connect-provider.md` › § "Non-interactive setup (`coda configure`)"; subcommand entry → `cli-reference.md` › § "Subcommands (run as `coda <command>`)"
105
116
  - First session in 5 min, starter prompts, `/init`, reviewing/undoing, keeping a session healthy → `quickstart.md` › § "2. Try these prompts", § "3. Review what CODA does", § "4. Undo anything", § "5. Keep the session healthy"
106
117
 
@@ -114,13 +125,13 @@ Use this when the Fast-answers table doesn't match. Each line names the **file**
114
125
 
115
126
  **Commands, flags, shortcuts**
116
127
 
117
- - Slash commands grouped by purpose, shell flags, `coda` subcommands (`upgrade`, `logs`, `plugin install`, `marketplace install`, demos), worked examples → `cli-reference.md` › § "Session management", § "Files and changes", § "Configuration", § "Tools and extensions", § "Context", § "Shell flags (run before opening CODA)", § "Subcommands (run as `coda <command>`)", § "Notes and examples"
128
+ - Slash commands grouped by purpose, shell flags, `coda` subcommands (`upgrade`, `logs`, `skills`, `plugin install`, `marketplace install`, demos), worked examples → `cli-reference.md` › § "Session management", § "Files and changes", § "Configuration", § "Tools and extensions", § "Context", § "Shell flags (run before opening CODA)", § "Subcommands (run as `coda <command>`)", § "Notes and examples"
118
129
  - Keyboard shortcuts by context, `Esc`/`Esc Esc` → `shortcuts.md` › § "Global", § "In the chat input", § "During a turn", § "Transcript navigation", § "Model switching", § "Two shortcuts worth memorizing"
119
130
 
120
131
  **Tools and safety**
121
132
 
122
133
  - Built-in tool list, how tools show up, how CODA chooses a tool, what you can configure (incl. env vars), trimmed tools in agent runs → `tools-reference.md` › § "How tools show up", § "Built-in tools", § "How CODA chooses a tool", § "What you can configure", § "Tools inside agent runs"
123
- - Authorization engine (HITL): approvals, permission modes (`read-only`/`default`/`auto`, Ctrl+P, legacy aliases, sub-agent inheritance), plain-English rule changes via `propose_policy` (add/remove rule, change mode, scopes, turning it off), HITL choices, denial messages, rule syntax + gotchas, project vs global scope, precedence (deny-first), catastrophic floor (self-protection, sensitive-path writes, un-relaxable secret reads, git RCE, container escape, redirects), shell mode, other actions that ask, managed policy, headless approvals, decision logging, `bash.autoApproveLevel` migration, trust of external code, where to set it → `permissions.md` › § "How approvals work", § "Permission modes", § "The easy way to change permissions: just ask the agent", § "How `propose_policy` works", § "What you actually approve", § "Turning `propose_policy` off", § "Rules — always-allow / always-ask / always-deny", § "Rule syntax", § "Project-scoped vs. global-scoped rules", § "How decisions are made (precedence)", § "The catastrophic floor — protections that can never be turned off", § "Choosing the shell", § "Other actions that ask first", § "Managed (organization) policy", § "Approvals in headless (batch) mode", § "Every decision is logged", § "Migrating from `bash.autoApproveLevel`", § "Trust and external code", § "Seeing what applies right now" (the read-only `/permissions` and `coda permissions` views: which rules apply, which scope each came from, session grants), § "Where to set it"
134
+ - Authorization engine (HITL): approvals, permission modes (`read-only`/`default`/`auto`, Ctrl+P, legacy aliases, sub-agent inheritance; the unset default is `auto`, coerced to `default` under managed `disableAutoMode`; with no rules configured, CODA offers `/init-rules` via a Yes/No prompt after your first message, opt out via `onboarding.suggestInitRules`), plain-English rule changes via `propose_policy` (add/remove rule, change mode, scopes, turning it off), HITL choices, denial messages, rule syntax + gotchas, project vs global scope, precedence (deny-first), catastrophic floor (self-protection, sensitive-path writes, un-relaxable secret reads, git RCE, container escape, redirects), shell mode, other actions that ask, managed policy, headless approvals, decision logging, `bash.autoApproveLevel` migration, trust of external code, where to set it → `permissions.md` › § "How approvals work", § "Permission modes", § "The easy way to change permissions: just ask the agent", § "How `propose_policy` works", § "What you actually approve", § "Turning `propose_policy` off", § "Rules — always-allow / always-ask / always-deny", § "Rule syntax", § "Project-scoped vs. global-scoped rules", § "How decisions are made (precedence)", § "The catastrophic floor — protections that can never be turned off", § "Choosing the shell", § "Other actions that ask first", § "Managed (organization) policy", § "Approvals in headless (batch) mode", § "Every decision is logged", § "Migrating from `bash.autoApproveLevel`", § "Trust and external code", § "Seeing what applies right now" (the read-only `/permissions` and `coda permissions` views: which rules apply, which scope each came from, session grants), § "Where to set it"
124
135
 
125
136
  **Sessions and checkpoints**
126
137
 
@@ -129,7 +140,7 @@ Use this when the Fast-answers table doesn't match. Each line names the **file**
129
140
  **Task guides**
130
141
 
131
142
  - Explore a codebase: orientation, planning before edits, diagrams, delegating to `explore` → `guide-understand.md` › § "Get oriented quickly", § "Plan before editing", § "Ask for a diagram or a written map"
132
- - Change code safely: checkpoints, approving commands, interrupting, steer vs queue, the safe workflow, undo scenarios, self-verification → `guide-changes.md` › § "Approve commands as they run", § "Interrupt early if something looks wrong", § "Send a message while CODA is working", § "A safe workflow for bigger changes", § "Common undo scenarios", § "Let CODA verify its own work"
143
+ - Change code safely: checkpoints, approving commands, interrupting, steer vs queue, the safe workflow, undo scenarios, self-verification → `guide-changes.md` › § "Checkpoints: your undo button", § "Approve actions when CODA asks", § "Interrupt early if something looks wrong", § "Send a message while CODA is working", § "A safe workflow for bigger changes", § "Common undo scenarios", § "Let CODA verify its own work"
133
144
  - Team collaboration: `AGENTS.md`, shared skills/agents/workflows, what to commit, monorepo, `.gitignore` posture → `guide-collaborate.md` › § "Start with AGENTS.md", § "Share skills across the team", § "What to commit (and what not to)", § "Working in a monorepo", § "A suggested `.gitignore` posture"
134
145
  - Batch/CI automation: usage, examples, flags, authenticating headlessly (`--profile`/`--provider`/`--instance`/`--api-key`, OAuth reuse), reading `--output json`, scoping with `--tools`/`--timeout`, limits → `guide-automate.md` › § "Basic usage", § "Practical examples", § "Important flags for automation", § "Authenticating in batch mode", § "Reading the output", § "Scope it down for safety"
135
146
  - Which mechanism (MCP vs skills vs extensions vs plugins vs workflows) → `guide-extend.md` › § "Which extension mechanism do I want?"
@@ -139,11 +150,13 @@ Use this when the Fast-answers table doesn't match. Each line names the **file**
139
150
  - Agents: just-ask usage, bundled agents (`coda-help`/`explore`), defining one, discovery order, `/agents` manager, foreground vs background, config (`agents.enabled`/`maxConcurrent`/`fastModel`/`defaultModel`), limits → `agents.md` › § "The easiest way to use an agent: just ask", § "Agents that ship with CODA", § "Defining an agent", § "Where CODA looks for definitions", § "Managing runs with `/agents`", § "Foreground vs background", § "Configuration", § "Good to know"
140
151
  - Workflows: running by plain language, `/workflows` dashboard + stop, creating via `create-workflow`, where they live, what a run produces, when worth it → `workflows.md` › § "Run a workflow", § "Watch and stop runs with `/workflows`", § "Create a workflow", § "Where workflows live", § "What a run produces", § "When a workflow is worth it"
141
152
  - Extensions: scaffold via `create-extension`, anatomy/`activate`, load order, `registerTool`, `registerCommand` + reserved names, lifecycle hooks (+ `input` return values), intercepting tool calls, `registerShortcut`/`registerProvider`/`registerFlag` + reserved shortcuts, loading/reloading → `extensions.md` › § "The easy way: let CODA write it", § "Anatomy of an extension", § "Where extensions load from", § "Registering a tool", § "Registering a slash command", § "Subscribing to lifecycle hooks", § "Intercepting tool calls", § "Registering shortcuts, providers, and flags", § "Loading, testing, and reloading"
153
+ - Lifecycle hooks (shell/HTTP hooks fired at session, tool and prompt events): quick start, where they are configured, the event list, config schema, the JSON input/output contracts, blocking an operation, injecting context into a tool result, rewriting prompts, `if` conditions, plugin hooks, `CODA_ENV_FILE`, async hooks, disabling all hooks, slash commands, env vars, execution model, security, recipes → `hooks.md` › § "Quick start", § "Where hooks are configured", § "Hook events", § "Configuration schema", § "JSON input (what your hook receives)", § "JSON output (what your hook can return)", § "Blocking operations", § "Injecting context into tool results", § "Rewriting prompts", § "Conditional execution (`if` field)", § "Plugin hooks", § "Session environment files (`CODA_ENV_FILE`)", § "Async hooks", § "Disabling all hooks", § "Slash commands", § "Environment variables available to hooks", § "Execution model", § "Security considerations", § "Common recipes", § "Troubleshooting"
154
+ - Configuring an MCP server through the bundled `configure-mcp` skill: asking in plain language, project vs global scope, the accepted input kinds (package, command, Git repository, local binary, remote URL), entry rules, keeping tokens out of `mcp.json`, verifying the server loaded → `add-mcp-server-skill.md` › § "Ask in plain language", § "Choose the scope", § "Supported inputs", § "Entry rules", § "Keep secrets out of the file", § "Activate and verify", § "Troubleshooting"
142
155
 
143
156
  **Configuration**
144
157
 
145
158
  - From the UI: `/providers`, `/settings`, where files live, common settings, cascade, what's safe to commit, minimal example → `configuration.md` › § "Where settings live", § "Common settings to change", § "How settings cascade", § "What's safe to commit", § "A minimal `config.json`"
146
- - Reference (key-by-key, defaults): locations, `activeProfile`/`profiles` (selection layer), legacy `providers` map, top-level `model`, `auth`, inline `mcp`, `bash`, `compaction`, `reasoning`, `tools`, `vision`, `checkpoints`, `skills`, `logging`, advanced, `${VAR}`, env vars → `config-reference.md` › § "Config file locations", § "activeProfile and profiles", § "providers (runtime client map — legacy)", § "model (top-level)", § "auth (Glob.AI OS login preferences)", § "mcp (inline servers)", § "bash", § "compaction", § "reasoning", § "modelResilience", § "Other common settings", § "tools", § "vision", § "checkpoints", § "skills", § "logging", § "Advanced blocks", § "Referencing secrets with `${VAR}`", § "Environment variables"
159
+ - Reference (key-by-key, defaults): locations, `activeProfile`/`profiles` (selection layer), legacy `providers` map, top-level `model`, `auth`, `mcp.json` files, `bash`, `compaction`, `reasoning`, `tools`, `vision`, `checkpoints`, `skills`, `logging`, advanced, `${VAR}`, env vars → `config-reference.md` › § "Config file locations", § "activeProfile and profiles", § "providers (runtime client map — legacy)", § "model (top-level)", § "auth (Glob.AI login preferences)", § "mcp.json files", § "bash", § "compaction", § "reasoning", § "modelResilience", § "Other common settings" (incl. `onboarding.suggestInitRules` / `initRulesPromptDismissed`), § "tools", § "vision", § "checkpoints", § "skills", § "logging", § "Advanced blocks", § "Referencing secrets with `${VAR}`", § "Environment variables"
147
160
  - Complete annotated `config.json` (profiles-first) + secrets + legacy providers map + per-goal edits + env vars → `config-json.md` › § "The complete example", § "Secrets: keep keys out of the file", § "Common edits, by goal", § "The legacy `providers` map", § "Environment variables"
148
161
 
149
162
  **Logging**
@@ -153,7 +166,7 @@ Use this when the Fast-answers table doesn't match. Each line names the **file**
153
166
  **FAQ and history**
154
167
 
155
168
  - Short answers grouped by goal (getting started, sessions, making changes, extensions/tools, models & cost, operations) → `faq.md` (grep the exact `### <question>` heading)
156
- - Notable features by release, checking/updating your version → `release-history.md` › § "Checking your version"
169
+ - Checking/updating your version → `faq.md` › § "How do I check which version I'm running?"; `installation.md` › § "Keeping CODA up to date"
157
170
 
158
171
  ## Topics You Cover
159
172
 
@@ -0,0 +1,11 @@
1
+ ---
2
+ name: council
3
+ description: one council member — a full agent (every tool) answering the same question as the other models, read-only
4
+ permissionMode: read-only
5
+ background: true
6
+ ---
7
+
8
+ You are one member of a council: several models answer the same question independently and the answers are compared side by side.
9
+
10
+ - Use your tools when they make the answer better — web search for anything current or outside the repository, glob/grep/view for anything about this codebase, read-only commands to check facts. Never modify files or system state.
11
+ - Your final message IS the answer the human will read next to the others: direct, complete, in the language of the question, without mentioning other models. Keep it under ~400 words unless the question needs code.
@@ -0,0 +1,14 @@
1
+ ---
2
+ name: reviewer
3
+ description: read-only code reviewer for a side session — reads the diff and the surrounding code, runs tests/lint, never edits
4
+ tools: glob, grep, view, bash, think, examine_images
5
+ background: true
6
+ ---
7
+
8
+ You are a senior engineer reviewing a code change in a side session. The conversation that asked for this review continues without you; your only output is the review.
9
+
10
+ Rules:
11
+
12
+ - Read only. Never create, modify or delete files; never commit, stash, checkout or push. `bash` is for reading (`git diff`, `git log`, `git show`), running tests, linters and type checks.
13
+ - Follow the review brief you were given exactly (method, what to look for, what not to report, how to write each finding).
14
+ - Answer for a human: a summary with a `Verdict:` line, then each finding as a short section with file:line, severity, what is wrong, the concrete failure scenario and the fix. When the change is clean, say so.
@@ -0,0 +1,15 @@
1
+ ---
2
+ name: side
3
+ description: answer a quick side question with tools (web search, files, read-only commands) without touching the main conversation
4
+ tools: web_search, glob, grep, view, bash, think, examine_images, mcp_execute
5
+ background: true
6
+ ---
7
+
8
+ You answer ONE side question for the user of a coding agent. The main conversation continues separately; nothing you do is part of it.
9
+
10
+ How to work:
11
+
12
+ - If the question is about the world outside this repository (news, results, prices, documentation, versions, anything time-sensitive), use `web_search` first — do not answer from memory, and do not say you have no access to real-time information when the tool is available.
13
+ - If the question is about this codebase, use `glob`, `grep` and `view` to look before answering; use `bash` only for read-only inspection (never modify files or system state).
14
+ - Answer directly and concisely in the language of the question: a few sentences, or a short list when the answer is a list. Name the source (URL or file path) when you looked something up.
15
+ - If a tool is not available or the search returns nothing useful, say what you tried and give your best answer with that caveat.
@@ -0,0 +1,137 @@
1
+ # Configure an MCP Server with CODA
2
+
3
+ When you ask CODA to add, register, install, or configure an MCP server, it can load the bundled **`configure-mcp`** skill. The skill turns a package name, command, Git repository, local binary, or remote HTTP endpoint into a valid MCP configuration without overwriting your other servers.
4
+
5
+ ## Ask in plain language
6
+
7
+ Examples:
8
+
9
+ ```text
10
+ Add the Playwright MCP server to this project.
11
+ ```
12
+
13
+ ```text
14
+ Configure https://api.example.com/mcp globally. Read its token from API_TOKEN.
15
+ ```
16
+
17
+ ```text
18
+ Install the MCP server from this repository and show me the available setup choices: <repository-url>
19
+ ```
20
+
21
+ CODA inspects the input, asks which scope or installation method you want when that is unclear, and writes only after it can derive a valid server transport.
22
+
23
+ ## Choose the scope
24
+
25
+ | Scope | Configuration file | Use it when |
26
+ | --- | --- | --- |
27
+ | **Project** | `<project>/.coda/mcp.json` | The server belongs to this project and the config should be shared with teammates. |
28
+ | **Global** | `~/.coda/mcp.json` | The server is personal and should be available in every project on this machine. |
29
+
30
+ If you do not specify a scope, CODA asks. When both scopes contain the same server name, the project definition wins.
31
+
32
+ ## Supported inputs
33
+
34
+ The bundled skill accepts package names, executable commands, local binaries, Git repositories, and remote HTTP endpoints. A `.zip` archive is not a direct skill input; unpack it first, then point CODA at the extracted command or repository instructions.
35
+
36
+ ### Remote HTTP endpoint
37
+
38
+ An HTTP MCP server uses `url` and may include headers, a bearer-token reference, a timeout, and environment variables:
39
+
40
+ ```jsonc
41
+ {
42
+ "mcpServers": {
43
+ "my-api": {
44
+ "url": "https://api.example.com/mcp",
45
+ "authorizationToken": "Bearer ${API_TOKEN}",
46
+ "headers": { "X-Project": "${PROJECT_ID}" },
47
+ "timeout": 120
48
+ }
49
+ }
50
+ }
51
+ ```
52
+
53
+ ### Package, command, or local binary
54
+
55
+ A local stdio server uses `command` with optional arguments, environment variables, and a working directory:
56
+
57
+ ```json
58
+ {
59
+ "mcpServers": {
60
+ "playwright": {
61
+ "command": "npx",
62
+ "args": ["-y", "@playwright/mcp@latest"]
63
+ }
64
+ }
65
+ }
66
+ ```
67
+
68
+ Common launchers include `npx`, `uvx`, `node`, and a direct executable path.
69
+
70
+ ### Git repository
71
+
72
+ A repository can document several installation methods. CODA reads its setup instructions, presents the viable choices, and lets you pick—for example a package launcher, a hosted HTTP endpoint, or a local build. A temporary clone is removed when the selected runtime does not need it.
73
+
74
+ If no command or URL can be derived, CODA writes nothing and asks you for a package name, executable command, repository, or HTTP endpoint.
75
+
76
+ ## Entry rules
77
+
78
+ Each server entry must have exactly one transport:
79
+
80
+ - `command` for a local stdio subprocess; or
81
+ - `url` for Streamable HTTP.
82
+
83
+ Do not set both. Useful optional fields are:
84
+
85
+ | Field | Applies to | Purpose |
86
+ | --- | --- | --- |
87
+ | `args` | stdio | Command arguments. |
88
+ | `cwd` | stdio | Working directory for the subprocess. |
89
+ | `env` | both | Environment variables passed to the server. |
90
+ | `headers` | HTTP | Extra request headers. |
91
+ | `oauth` | HTTP | `true` for an OAuth 2.1 server; the user signs in with `coda mcp login <name>`. |
92
+ | `oauthClientId` | HTTP | Pre-registered OAuth client id, for servers without dynamic client registration (Glob.AI: `mcp`). Requires `oauth: true`. |
93
+ | `authorizationToken` | HTTP | Shorthand for the Authorization header. |
94
+ | `timeout` | both | Timeout in seconds for each request to the server. Unset: 60 s for MCP requests, 30 s for OAuth sign-in requests. |
95
+
96
+ Session-level overrides can also use `{ "disabled": true }` to switch off a server inherited from a higher scope. For ordinary project/global entries, enable or disable the server from the `/mcp` manager.
97
+
98
+ ## Keep secrets out of the file
99
+
100
+ Never put a real token or API key directly in `mcp.json`. Use `${VAR}` or `${VAR:-default}` and define the value in your environment, in `~/.coda/.secrets` or a project environment file (`.coda/.env` or `.env`) that is excluded from version control. A default is literal text up to the first `}`; it cannot contain another `${…}` reference or a line break. Provider API keys are different: add them through `/providers` (or `coda configure --api-key-stdin`) and they live in your system keychain (or an encrypted secrets file where there is no keychain) — never in `mcp.json` or any dotenv file. On a host with no OS keyring, a legacy key entered before the credential store existed may still remain in `~/.coda/.secrets` in plaintext, since migration into the encrypted store is intentionally skipped there — see [Configuration](#configuration).
101
+
102
+ For example:
103
+
104
+ ```json
105
+ {
106
+ "authorizationToken": "Bearer ${GITHUB_TOKEN}"
107
+ }
108
+ ```
109
+
110
+ CODA preserves existing server entries. If the chosen name already exists, it shows the current entry and asks before replacing only that key.
111
+
112
+ ## Activate and verify
113
+
114
+ After the file is written:
115
+
116
+ 1. Open `/mcp`.
117
+ 2. Choose **Reload MCP servers**.
118
+ 3. Check the server status and view its discovered tools.
119
+
120
+ Restarting CODA also loads the change. `/skills refresh` reloads skill definitions; it does not reload MCP connections.
121
+
122
+ Once the server is connected, describe the task normally. CODA can select its MCP tools when they are relevant, subject to the same authorization rules as other tools.
123
+
124
+ ## Troubleshooting
125
+
126
+ - **Invalid JSON** — fix the existing file first; CODA does not overwrite malformed configuration.
127
+ - **Duplicate server name** — choose a different name or approve replacement of that one entry.
128
+ - **No transport found** — provide the exact executable command, package name, or HTTP endpoint.
129
+ - **Git setup is ambiguous** — choose one of the installation methods found in the repository documentation.
130
+ - **A credential is required** — provide the environment-variable name, never the secret value in the config.
131
+ - **The server does not appear** — reload it from `/mcp`, then inspect its status and error details.
132
+
133
+ ## See also
134
+
135
+ - [Extend CODA](#guide-extend) — MCP, skills, extensions, plugins, and workflows.
136
+ - [Configuration](#configuration) — where configuration and secrets live.
137
+ - [Permissions & Approvals](#permissions) — authorization for MCP tool calls.
@@ -128,7 +128,7 @@ Agent behavior is controlled by the `agents` block in your config (global and/or
128
128
  | --- | --- |
129
129
  | `agents.enabled` | When `false`, agent tools and the run manager aren't wired up. Default **true** |
130
130
  | `agents.maxConcurrent` | Cap on parallel runs (valid range **1–10**). Default **6** |
131
- | `agents.defaultModel` | Override the inherited model for all delegated runs (optional) |
131
+ | `agents.defaultModel` | Legacy configuration field retained for compatibility; delegated runs now inherit the main session model unless a definition or tool call chooses another model |
132
132
  | `agents.fastModel` | Model ID used when a run requests the `"fast"` tier at the agents level (overrides provider value) |
133
133
  | `agents.smartModel` | Model ID used when a run requests the `"smart"` tier |
134
134
  | `agents.deepModel` | Model ID used when a run requests the `"deep"` tier |
@@ -10,6 +10,7 @@ Reference for the slash commands available in the interactive TUI, plus the shel
10
10
  | `/new` | Start a fresh session (old one is saved) |
11
11
  | `/exit` (alias `/quit`) | Exit CODA; prints `coda --session-id <id>` so you can resume later |
12
12
  | `/clear` | Permanently wipe the current session's message history (the session itself stays) |
13
+ | `/copy` (or `/copy N`) | Copy CODA's last response to the clipboard; `/copy N` copies the Nth-most-recent response (assistant messages only). Complements the [`Ctrl+Shift+C`](#shortcuts) shortcut, which copies only the last fenced code block |
13
14
 
14
15
  ## Files and changes
15
16
 
@@ -17,7 +18,7 @@ Reference for the slash commands available in the interactive TUI, plus the shel
17
18
  | --- | --- |
18
19
  | `/timeline` (alias `/rewind`) | Open the timeline picker to view and restore checkpoints from this session |
19
20
  | `/init` | Analyze the project and generate an `AGENTS.md` file |
20
- | `/project` | Switch the active Glob.AI OS project (Glob.AI OS OAuth only) |
21
+ | `/project` | Switch the active Glob.AI project (Glob.AI OAuth only) |
21
22
 
22
23
  ## Configuration
23
24
 
@@ -26,9 +27,9 @@ Reference for the slash commands available in the interactive TUI, plus the shel
26
27
  | `/providers` | Connect, add, update, or remove providers (the setup wizard; same as `--reconfigure`; restart required) |
27
28
  | `/switch-profile` (alias `/sp`) | Switch the active provider profile among the ones you've already configured. With no argument it opens the profile picker; `/switch-profile <profile-id>` selects one directly. The change is saved as `activeProfile` and applies on the next launch |
28
29
  | `/switch-model` (alias `/sm`) | Open the model picker. `/switch-model <provider/model>` applies for this session; `/switch-model save <provider/model>` also saves it as the default for new sessions |
29
- | `/login` | Authenticate with Glob.AI OS via browser (OAuth PKCE) when `auth` is configured |
30
+ | `/login` | Authenticate with Glob.AI via browser (OAuth PKCE) when `auth` is configured |
30
31
  | `/effort [<level>]` | Set the model's thinking (reasoning) effort — `low`, `medium`, `high`, `xhigh`, `max`. With no level, pick from the levels the current model supports; some models don't support effort at all |
31
- | `/logout` | Sign out of your Glob.AI OS session |
32
+ | `/logout` | Sign out of your Glob.AI session |
32
33
  | `/settings` | Open the settings panel: UI theme, permission mode, compaction |
33
34
  | `/auth-status` (alias `/whoami`) | Show the current authentication status |
34
35
 
@@ -40,6 +41,7 @@ Reference for the slash commands available in the interactive TUI, plus the shel
40
41
  | `/mcp status` | Show each server's connection status |
41
42
  | `/mcp list-tools [server]` | List the tools a server exposes |
42
43
  | `/mcp enable <server>` / `/mcp disable <server>` | Toggle a server for this session |
44
+ | `/mcp login <server>` | OAuth sign-in for an HTTP server declared with `"oauth": true` in `mcp.json` — opens the browser, receives the code on a loopback redirect, stores tokens in `~/.coda/mcp-oauth/<server>.json`, bound to the authorization server that issued them (a login saved before that binding existed is discarded and needs one new sign-in) |
43
45
  | `/skills` | Open the skills manager (no args), or use a subcommand |
44
46
  | `/skills list` | List skills and their enabled state |
45
47
  | `/skills enable <name>` / `/skills disable <name>` | Toggle a skill |
@@ -61,6 +63,30 @@ Reference for the slash commands available in the interactive TUI, plus the shel
61
63
  | `/workflows` | Open the workflow dashboard (live run → phase → agent tree and history) |
62
64
  | `/workflows stop [runId]` | Stop a workflow run; omit the id to stop all in-flight runs |
63
65
 
66
+ ## Planning, changes and side questions
67
+
68
+ | Command | What it does |
69
+ | --- | --- |
70
+ | `/plan <goal>` | Switch to `read-only`, research the codebase and write a plan (`Context / Steps / Acceptance / Risks`) to `.coda/plans/<date>-<slug>.md`. The mode stays read-only until you approve |
71
+ | `/plan approve [--auto]` | Switch back to `default` (or `auto`) and implement the latest plan; its `## Acceptance` checklist becomes the objective of a `/goal` run, so completion is judged against the plan |
72
+ | `/plan list` / `/plan status` | List plan files / show the current permission mode and latest plan |
73
+ | `/review [--base <ref>\|--commit <sha>\|--pr <n>\|--branch <name>] [--instructions <focus>]` | Professional code review from inside the session, same reviewer as `coda review`: intent first, verified findings only (correctness, security, concurrency, error handling, API/behaviour changes, tests), no linter nits, every finding with file:line, severity, the failure scenario and a fix. `--pr` checks the PR out in `.coda/worktrees/pr-<n>` and posts the findings on GitHub as a review (inline comments with one-click `suggestion` blocks where the line is in the diff, the rest in the review body; `--no-post` keeps them local). `--branch` reviews a branch vs `--base` (default: the repo's main branch) — a branch has nowhere on GitHub to hold comments, so open a PR (`gh pr create --head <branch>`) and `--post` sends the same review there. Either way the full review document is saved to `.coda/reviews/<target>/review-<n>.md` |
74
+ | `/fix-pr <n\|url> [--max-rounds N]` | Reads the PR's unresolved review threads and failing checks (with their logs), checks the branch out in a worktree and starts a `/goal`: fix, commit, push, reply on each thread with the commit, wait for the checks — until every check is green and no thread is unresolved. `/goal status` / `/goal stop` control it |
75
+ | `/review --by <model> [...]` / `/review followup` | "Review in another session": the same professional review runs as a read-only reviewer sub-session on the model you name, in the side panel, while this conversation keeps going. `/review followup` sends its findings as the next turn ("address each finding") |
76
+ | `/sessions launch [--models a,b,c] <brief>` (alias `/fanout`) | "Launch sessions": the same brief runs on several models at once — one headless session per model, each in its own worktree (`.coda/worktrees/sess-<stamp>-<n>`), its work committed on that branch when it ends. The side panel follows them: model, state, time · cost · tokens · files, first line of the answer. Default models: ★ favorites plus the current one (max 5) |
77
+ | `/sessions compare [--models a,b] <brief>` (alias `/compare-sessions`) | "Compare on two sessions": the same, on exactly two models; `/sessions synthesize` then asks the current model for a comparison table (approach, files, tests, cost, time, risks) and a pick |
78
+ | `/sessions synthesize` / `/sessions pick <n>` / `/sessions status\|show\|close` | `synthesize`: the current model reads every session's answer, files and commit (it can `git -C <worktree> show HEAD`) and merges or picks; `pick <n>`: cherry-picks session n's commit into this working tree, staged and uncommitted, so `/changes` shows it and `/commit` lands it |
79
+ | `/handoff <model>` | "Hand off to…": the conversation continues on another model; before doing anything it says what it understood (goal, state, open points, next step) and asks what to correct |
80
+ | `/second-opinion [--model m] <question>` / `use` | "Second opinion": one other model (default: the first ★ favorite that is not the current one) answers a bounded question with the recent conversation as context, in the side panel, never in the transcript; `/second-opinion use` folds the last answer into the conversation as the next turn |
81
+ | `/changes [n\|close\|before]` | Expand the sidebar into the **changes panel**: the files this session touched with `+added −removed`, the files that were already dirty before the session (collapsible), and the diff of the selected file. The sidebar's `▸ View changes` row opens the same panel; click a file to select it, PgUp/PgDn or the wheel scroll the diff, Esc or × return to the normal sidebar |
82
+ | `/diff` | Show the working-tree diff (bash tool output already appends `[changed files: …]` after each command that changes the repo) |
83
+ | `/commit [message]` | Ask the agent to stage and commit the current changes with a conventional-commit message |
84
+ | `/export [md\|json] [path]` | Export the current session as Markdown or lossless JSON (`coda session import` re-creates it) |
85
+ | `/ps` / `/stop <id>` | List background processes started with `bash … background: true` (read their output with the `background_output` tool) / terminate one |
86
+ | `/trust [status\|revoke]` | Trust the current folder so its `.coda` hooks, extensions, skills roots, plugins and MCP servers load on the next launch (until then an untrusted folder's executable config is ignored and a notice is printed at startup) |
87
+ | `/council [--models a,b,c] <question>` (alias `/compare`) | Opens a live view: one column per model streaming its answer side by side (spinner → ✓ time · tokens · cost, ✗ on failure), the synthesis streaming underneath with the picked column starred, and one key to continue — `1–N` from that answer, `s` from the synthesis, Esc to close. Every member is a full agent of the session on its model — web search, repo reads, read-only commands — so answers are looked up, not recalled (`provider/model` refs of another configured provider answer without tools). Asks 2–5 models the same question in parallel (default: your ★ favorite models topped up with the current model — star models in `/model` with Space; `provider/model` refs reach other configured providers), see the answers side by side with time/tokens/cost, plus a synthesis by the current model that picks or merges. Nothing enters the conversation until `/council use <n\|synthesis>`; `/council show` repeats the last one |
88
+ | `/btw <question>` (alias `/side`) · `/btw show` · `/btw close` | Ask a side question **in a side panel**: the sidebar gives way to a panel where the question and its answer stream (markdown; run by the bundled `side` sub-agent — web search, grep, read-only bash — on your current model, with the recent transcript as context, so "how did X do yesterday" is looked up rather than declined) — nothing is added to the conversation. Earlier questions stay in the panel; Esc or × returns to the sidebar |
89
+
64
90
  ## Context
65
91
 
66
92
  | Command | What it does |
@@ -86,6 +112,7 @@ Reference for the slash commands available in the interactive TUI, plus the shel
86
112
  | `coda --timeout <ms>` | Abort a headless run after the given time |
87
113
  | `coda --checkpoints[=true\|false]` | Force checkpoints on or off for this run |
88
114
  | `coda --model <name>` / `-m` | Use a specific model for this run |
115
+ | `coda --reasoning-effort <level>` | Set the thinking effort for THIS run only — `none\|minimal\|low\|medium\|high\|xhigh\|max` (case-insensitive). Applied in memory; never written to config. Overrides a persisted `reasoning.effort` at launch and is inherited by subagents. An invalid value fails fast; a level the model can't honor prints a stderr warning and is not applied (no silent fallback) |
89
116
  | `coda -e <path>` | Load an extra extension file for this run |
90
117
  | `coda --mcp-config <path>` | Point at a specific `mcp.json` for this run |
91
118
  | `coda --system-prompt <text>` | Replace the built-in base system prompt for this run |
@@ -94,7 +121,7 @@ Reference for the slash commands available in the interactive TUI, plus the shel
94
121
  | `coda --coda-home <dir>` | Use an alternate config/data home (equivalent to `CODA_HOME` env var) |
95
122
  | `coda --profile <id>` | Select a persisted profile for this run (read-only) |
96
123
  | `coda --provider <name>` | Ephemeral provider for a headless run (`glob-ai \| openai-compat \| ollama`) |
97
- | `coda --instance <id>` | Glob.AI OS instance for a headless run (e.g. `saas-europe`) |
124
+ | `coda --instance <id>` | Glob.AI instance for a headless run (e.g. `us-v1`; the former `saas-us` still works, naming it) |
98
125
  | `coda --base-url <url>` | Base URL for `openai-compat` / `ollama` runs |
99
126
  | `coda --api-key <key>` | Ephemeral API key for this run (never persisted) |
100
127
 
@@ -109,8 +136,17 @@ Beyond launching a session, `coda` exposes a few standalone subcommands:
109
136
  | `coda upgrade` | Download and install the platform-native CODA binary from the release feed |
110
137
  | `coda logs` | Open the log viewer (or stream when piped); supports filters and `--follow` |
111
138
  | `coda logs export` | Write a redacted support bundle to `~/.coda/exports/` — see [View & Share Logs](#logging) |
139
+ | `coda skills` | Inspect and configure skill-discovery sources. `list` / `sources` print the resolved merged view; `enable`/`disable <source>`, `add-path`/`remove-path <dir>` require an explicit `--global\|--project` scope. Add `--json` for a machine-readable envelope — see [Extend CODA](#guide-extend) |
112
140
  | `coda plugin install <source>` | Install a plugin from npm, a Git URL, or a local path. Flags: `--scope global\|project` (default `global`; `project` also records it in `<project>/.coda/plugins.json`), `--name <folder>` (pick a subfolder in a monorepo repo), `--copy` (copy-based install for local paths). Note: a `plugin-id@marketplace-id` argument is **not** supported |
113
141
  | `coda marketplace install <source>` | Register a plugin marketplace catalog. Flags: `--id <id>`, `--display-name <name>`, `--root-path <path>` |
142
+ | `coda review [--base <ref>\|--commit <sha>\|--uncommitted\|--pr <n>\|--branch <name>]` | Governed headless code review — the same professional reviewer as `/review`: reads the diff (never edits; may run tests/lint), applies `.coda/checks/*.md` if present, returns findings validated against a JSON Schema (file, line, severity, category, kind, title, detail, optional `suggestion`). **Every run writes the full review document** to `.coda/reviews/<target>/review-<n>.md` (or `--out <file>`) in the directory you invoked it from: overview, a files-changed table grouped by concern, a feature overview, a high-level conceptual review, the numbered findings and general feedback — the terminal only shows a digest. `--pr <n\|url>` reviews the PR in its own worktree and also posts a GitHub review (inline comments + summary table; `REQUEST_CHANGES` when a finding reaches `--fail-on`; `--no-post` to only write the document). `--branch <name> [--base <ref>]` reviews a branch and, with `--post`, sends the review to its open PR. `--severity low\|medium\|high\|critical` sets the reporting floor (default `low` — the document is meant to be read in full) and `--fail-on` the CI exit code (default `medium`, so a `low` finding never fails a build; `none` never fails), `--json` prints findings as JSON, `--dry-run` shows the assembled prompt. Progress is reported on stderr as a single status line while it runs; `--verbose` logs every tool call instead |
143
+ | `coda fix-pr <n\|url> [--max-rounds N] [--timeout MIN] [--dry-run]` | Headless "make it green" loop: each round gathers the PR's unresolved review threads and failing checks (with `gh run view --log-failed` excerpts), runs `coda -p <brief>` in `.coda/worktrees/pr-<n>` (the agent fixes, commits, pushes and replies on the threads with the commit), then waits for the checks (`gh pr checks --watch`, up to `--timeout` minutes). The agent only inherits trust when the repo is already trusted (`coda trust`) **and** the PR's branch did not modify `.coda/config.json`/`.coda/mcp.json` relative to its base — otherwise that config is ignored (no override). Exit 0 once every check passes and no thread is unresolved, 1 after `--max-rounds` (default 5), 2 on a usage/setup error. Needs `gh` logged in; `CODA_BIN` picks the binary |
144
+ | `coda github install` | Write a GitHub Actions workflow that runs `coda review` on pull requests (the check fails on findings) and answers `/coda <task>` comments on issues and PRs. Credentials come from repository secrets |
145
+ | `coda mcp add <name> --url <URL> [--oauth [--client-id <id>]] [--header K=V] [--scope global\|project]` / `coda mcp add <name> -- <command> [args]` | Add an HTTP or stdio server to `mcp.json` (project scope when `./.coda` exists, else global). `coda mcp remove <name>`, `coda mcp list`, `coda mcp login <name>` (OAuth 2.1 with PKCE, dynamic client registration and refresh handled by the MCP SDK; `--client-id` sets a pre-registered client id for servers without dynamic registration, e.g. Glob.AI's `mcp`), `coda mcp logout <name>` |
146
+ | `coda schedule add --cron "<expr>" [--name N] [--cwd DIR] [--goal] "<prompt>"` | Persistent schedules stored in `~/.coda/schedules.json`: each run executes `coda -p <prompt>` (or `--goal`) in its cwd and appends to `~/.coda/schedules/<id>.log`. `list`, `remove`, `pause`/`resume`, `run <id>` (now), `log <id>`; `tick` runs what is due and exits (what cron/launchd call every minute), `daemon [--interval S]` keeps ticking in the foreground, `install` registers the tick with launchd (macOS) or prints the crontab line |
147
+ | `coda trust [DIR] \| --list` / `coda untrust [DIR]` | Trusted folders: until a project folder is trusted, coda ignores its `.coda/config.json` hooks, extensions, skills roots and plugins and its `.coda/mcp.json` servers (permissions, model and rules still apply). `--trust` trusts the current folder for one run; `CODA_TRUST_FOLDER` is tri-state — `1` trusts (e.g. CI), `0` is an authoritative deny (set by headless child spawns such as `fix-pr`/`schedule`/`sessions`; overrides `--trust` and folder inheritance), unset falls back to the folder check |
148
+ | `coda session list\|show\|export\|import\|delete` | Headless session management: list this project's sessions, export one as lossless JSON or Markdown, import a JSON export as a new session |
149
+ | `coda session import claude-code\|codex [--list\|--pick N\|--last\|--all] [--continue]` | Continue a conversation started in Claude Code (`~/.claude/projects/*/*.jsonl`) or Codex (`~/.codex/sessions/**/rollout-*.jsonl`): lists that tool's conversations for the current project, imports the one(s) you pick with tool calls and results as history, then `coda --lastsession` (or `--continue`) resumes it on your active profile. A `.jsonl` path works too; the format is detected |
114
150
  | `coda checkpoints-demo` | Smoke-test the checkpoint subsystem against a throwaway project |
115
151
  | `coda logs-demo` | Self-test the logging pipeline end to end |
116
152
 
@@ -47,6 +47,8 @@ Batch runs a **single turn** — one prompt in, one result out — then exits. T
47
47
  | `--lastsession` | Resume the most recent session in headless mode |
48
48
  | `--checkpoints` | Enable checkpoint creation (no TUI restore, but useful for diff workflows) |
49
49
 
50
+ With the LLM safety check enabled, headless runs consult it too: an approved command runs, and a command it refuses is never auto-approved — not even with `--auto-approve all`.
51
+
50
52
  See [Automate with Batch Mode](#guide-automate) for full examples.
51
53
 
52
54
  ## How to choose