micro-models-agent 2.0.0 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,96 @@ All notable changes to Micro Models Agent (MMA) will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.5.0] - 2026-09-24
+
+### Added
+
+- **web file viewer** (`src/modules/webui/file-api.ts`): `GET /api/file?path=<p>` serves a workspace text file for the chat file cards' Open link — resolved against the workspace (lexical + `realpath` guards, so symlinks/junctions cannot escape), protected paths (`.git/`, `.env*`, keys) refused, 512 KB cap, binary refused. UTF-16 LE/BE BOM and UTF-8 BOM are decoded; errors are human-readable `text/plain` (the endpoint opens as a browser tab).
+- **web cookie auth** (`src/modules/webui/util.ts`, `server.ts`): authenticated requests set an `HttpOnly; SameSite=Strict` `mma_web_auth` cookie and `checkAuth` accepts it, so a plain `<a target="_blank">` navigation authenticates without the token in the URL.
+- **web session persistence** (`assets/app.js`): the active session is mirrored into `?session=` (`history.replaceState`, token preserved) and restored on reload after the first state refresh.
+
+### Fixed
+
+- **web reasoning text** (`src/modules/webui/forward.ts`, `history-api.ts`): ANSI escape sequences (`ESC[2m…`) are stripped from streamed/replayed text, meta and tool output — reasoning no longer renders as literal `\u001b[2m…` garbage on the model's own words.
+- **web file card** (`assets/app.js`, `styles.css`): the card stacks vertically (path on its own line) and its `open` control is a real `<a target="_blank">` link that opens the file in a new tab.
+
+### Changed
+
+- **dedicated reasoning channel** (`src/core/agent.ts`, `src/modules/webui/forward.ts`, `src/cli/repl.ts`, `src/cli/main.ts`): model reasoning now travels on its own `onReasoning` callback and SSE `reasoning` event (no longer pre-dimmed and no longer mixed into the generic `meta` channel); the terminal renders it via `renderer.reasoning`.
+- **web reasoning collapsed by default** (`assets/app.js`): `thinking` blocks (live and replayed) start collapsed; generic `meta` (status, context stats, compaction, tool summaries, warnings) renders as always-visible `.metaln` lines instead of being folded into the reasoning block.
+
+## [2.4.0] - 2026-09-24
+
+### Added
+
+- **web UI chrome icons**: topbar, session tabs/dropdown, settings modal, attach button, chevrons and delete/close controls use inlined [Lucide](https://lucide.dev) SVGs (MIT) instead of emoji/gear glyphs. Chat status glyphs (`◇ ✓ ✗ ✦ ⟡ …`) stay textual per `docs/design/ui/STYLE.md`.
+- **web accessibility**: real `<button>`/`role="switch"`/tablist/`role="log"` semantics, `aria-label`/`aria-expanded`/`aria-checked`/`aria-selected`, `:focus-visible` outlines, arrow-key navigation in the settings tablist, a Tab focus trap in the dialog, and `prefers-reduced-motion` handling. Question options, toggles and menu rows are keyboard-operable; the settings modal moves focus in/out.
+- **web context probe** (`src/modules/webui/module.ts`, `src/core/host.ts`): the LM Studio loaded-context probe is surfaced as a real sidebar "probe" cell (`{actual} loaded`, warns when below the configured window) instead of a dead `—`.
+- **web question parity** (`src/modules/webui/assets/app.js`, `prompt-io.ts`): multi-select hint, and an "own answer…" choice entry mapped to `CUSTOM_INDEX` so `allowCustom` works in the browser (follow-up free-text prompt), matching the terminal.
+- **web busy feedback**: the composer reflects `aria-busy`/dim state during a turn, and Enter while busy shows a hint instead of silently dropping the message; Enter is IME-safe (`isComposing`).
+- **web session delete guard** (`assets/app.js`): deleting a session is a two-step action (arm → confirm within 3s) instead of an instant destructive click.
+- **web context size**: a custom context window is entered inline in the selector menu (focusable number field + save) instead of a native `window.prompt`.
+- **web screen-reader status**: a polite live region announces turn end and warnings/errors.
+- **web favicon**: a data-URI icon stops the `/favicon.ico` 404 console error.
+- **web composer** (`assets/index.html`, `app.js`, `styles.css`): attach + textarea + send share one bordered input surface (controls integrated into the field, focus ring on the group); the send button (`arrow-up`) becomes stop (`square`) during a turn; the textarea auto-grows up to ~200px; selector chips use Lucide chevrons; the `Esc — stop` hint shows only while a turn is running (`web.input.send`/`web.input.stop`).
+
+### Changed
+
+- **web light theme** (`assets/styles.css`): the palette is rebuilt from a single token source. All tokens are defined for both themes (no `-const` duplicates); light-theme `dim`, `cmdout`, success/warn/cyan/think and checker colors now meet text contrast (was ~1.8–2.8:1).
+- **web SSE session routing** (`state.ts`, `module.ts`, `assets/app.js`): `broadcast` stamps `activeSessionId` on every event, and the client routes streamed text/tool/plan output to the originating session tab instead of whichever tab is foregrounded.
+- **web sidebar polling** (`assets/app.js`): plan/usage re-render is skipped when the `/api/state` snapshot is unchanged, so a 2s poll no longer resets the plan scroll position.
+
+### Fixed
+
+- **web i18n leaks** (`assets/app.js`, `src/i18n`): reasoning hide/show toggle, turn metric ("tools"), usage/metric labels, start banner and `<html lang>` are localized; `attach` hint drops the emoji; added `web.usage.*`, `web.turn.tools`, `web.start.*`, `web.question.*`, `web.input.busy`.
+- **web custom answers** (`prompt-io.ts`): `toIndexes` preserves `CUSTOM_INDEX` (`-1`); previously the custom entry was filtered out, so choose-your-own answers were impossible in the browser.
+- **web empty-state hint** no longer hardcodes a dark-only color.
+- **web horizontal overflow** (`assets/styles.css`): long unbreakable content (user text, file paths, URLs, tool args, command output) now wraps or ellipsizes instead of pushing the feed; `#msgs` clips horizontal overflow. The model/provider/session dropdowns are width-clamped with ellipsized labels, so long names can no longer widen the page and shove the sidebar off-screen. The light-theme input border was softened (was solid green, looked permanently focused). A Chromium smoke test guards all of this at 1440/1000/820px.
+- **web tabs** (`assets/styles.css`): tab height now matches the topbar icon buttons (24px, scrollbar padding dropped); the session name ellipsizes with `min-width:0` so the short id and close button always stay inside the tab.
+- **web session delete** (`assets/app.js`, `assets/styles.css`): the two-step confirmation no longer resets every 2s (armed id lives in app state, not the rebuilt DOM row); failures show an inline message in the dropdown (the old `#saveIndicator` is modal-only and invisible); deleting the active session is guarded with a clear message instead of a silent `409`; the delete button lost its default UA border/background (was a bordered square). A Chromium smoke test covers the arm → delete and the active-session guard.
+
+### Removed
+
+- **web dead assets**: unused mockup i18n keys (`web.settings.font_size`/`sidebar_default`/`stream_partials`/`add_entry`/`provider_label`/`add_provider_hint`/`pending`) and the obsolete `.edit` CSS selectors; remaining latent `t()` shadowing in `app.js` renamed.
+
+## [2.3.0] - 2026-09-23
+
+### Added
+
+- **web mode parity** (`src/modules/webui/`): the browser UI is rebuilt to match the canonical mockup — topbar with `+`/`☰`/session tabs/`⚙`, chat feed (start banner, user blocks, colored `◇` tool lines, `↳` details, `⟡` metrics, `✦` reasoning toggle, plan/file/link/image cards, `/command` output), model/provider/context selectors, independently collapsible sidebar (scrollable plan + session·usage), and a wide settings modal (General / Model / Context / Reasoning / UI / Memory / Skills / Plugins·MCP / Security / Advanced) with dark/light/auto theme.
+- **web REST** (`config-api.ts`, `settings-api.ts`, `sessions-api.ts`, `history-api.ts`): `GET/POST /api/config`, `GET /api/models`, `GET /api/memory` + `POST` + `DELETE /api/memory/:category/:n`, `GET /api/skills`, `GET /api/plugins`, `GET/POST /api/sessions`, `POST /api/sessions/activate`, `DELETE /api/sessions/:id`, `GET /api/sessions/:id/history`.
+- **web slash commands** (`commands.ts`): `/help`, `/status`, `/config`, `/model`, `/provider`, `/memory` run in the browser via a handler map, streaming output over the SSE `command` event; `/clear` and `/new` are client-side. Terminal-only commands stay out of scope.
+- **web slash commands (extended)**: `/reasoning`, `/verbose`, `/context`, `/session list|use`, `/export [md|json|jsonl]` in the browser (same registry/session machinery as the REPL).
+- **web questions** (`src/modules/webui/prompt-io.ts`): the `question`/`approve` tools are registered in web mode with a `PromptIO` over SSE (`question` event) + `POST /api/answer`, so the agent can ask the user interactively in the browser; terminal mode keeps them unregistered.
+- **web i18n** (`GET /api/i18n`, `web.*` keys): the browser chrome is localized and switches live when `locale` changes.
+- **web resilience**: SSE reconnect with state resync; `Cache-Control: no-store` on static assets (no stale UI after restart).
+- **fix**: `--no-agents-md` is now honored on all paths (commander exposes the negatable option as `agentsMd`).
+- **web settings polish**: responsive settings modal and adaptive layout; localized config labels and enum values (`config.key.*`/`config.enum.*`); read-only `version`; real Security toggles (`security.enabled`, `security.paths.enabled`, `security.contentScan.enabled`, `security.sessionEncryption.enabled`) + masked web token; provider add/edit (`GET/POST /api/providers`, `DELETE /api/providers/:name`); MCP enable/disable (`POST /api/mcp/:id`); clearer Memory page.
+- **web live data**: real usage metrics in the sidebar, clipped tool output in `tool_end`, plan card, image attachments (paste/drag/file, ≤3 × ≤6MB), and new-session creation from `+`.
+
+## [2.2.0] - 2026-09-23
+
+### Added
+
+- **web mode** (`src/cli/web-command.ts`, `src/modules/webui/`): `mma web [--port N] [--host H] [--token T] [--no-open]` — browser chat (SSE `GET /events` + REST `GET /api/state`, `POST /api/message`, `POST /api/interrupt`, `POST /api/command`, static `/` `/app.js` `/styles.css`) without a TTY; loopback by default, token required for non-loopback binds, same-origin check on writes, body/client caps; env `MMA_WEBUI_PORT/HOST/TOKEN/OPEN/MAX_CLIENTS`.
+- **host seam** (`src/core/host.ts`, `src/core/web-host.ts`): shared `Host` interface extending the plugin-facing `HostBridge` with `executeCommand`/`getState`; `Repl` and `WebHost` are two implementations over one `Agent`, both submitting through the same `runAgent` path.
+
+## [2.1.0] - 2026-09-23
+
+### Added
+
+- **`meet` / «Познакомимся»** (`src/modules/onboarding/`): LLM-driven interview that records the user's usage profile, preferences and facts to global memory (`~/.mma/memory/preferences.json`, `facts.md`), domain-neutral (development, smart home, assistant, …).
+- **`agents init`** (`src/modules/onboarding/init.ts`, REPL `/init`): LLM generation/improvement of `AGENTS.md` for any workspace (code, docs, notes, configs); an existing file is improved in place with a diff and confirmation, never blindly replaced.
+- **REPL**: `/meet` (alias `/познакомимся`), `/init`, `/memory` (get/set/unset/find/forget), and a post-setup `[Y/n]` meet offer.
+- **CLI**: `mma meet`, `mma agents init` interactive entrypoints.
+- **Tools**: strict `ToolContext.toolAllowlist` enforced by the executor; `meet_done` sentinel tool; `question` rendering aligned with STYLE.md (`?` glyph, indented options, `>` prompt).
+- **Providers**: shared `preflightProvider`/`preflightFromConfig` (cheap `max_tokens=1` chat probe) gating LLM-dependent entry points.
+
+### Changed
+
+- **CLI**: `mma setup` is the preferred name for the provider wizard; `mma init` remains a working **deprecated alias** (prints a hint to use `mma setup`).
+- **Agent**: universal positioning reaffirmed — onboarding and prompts are domain-neutral, not code-only.
+
 ## [2.0.0] - 2026-09-22
 
 ### Added

package/README.md

@@ -96,10 +96,10 @@ bun run build:prod
 ### 2. Запустите мастер настройки
 
 ```bash
-bun run mma init
+bun run mma setup
 ```
 
-Сканирует локальные порты, находит модель, тестирует соединение и записывает конфиг.
+Сканирует локальные порты, находит модель, тестирует соединение и записывает конфиг. Устаревший алиас: `bun run mma init`.
 
 ### 3. Используйте агента
 
@@ -121,7 +121,10 @@ bun run dev
 bun run mma "<prompt>"
 
 # Подкоманды
-bun run mma init                       # Интерактивный мастер настройки
+bun run mma setup                      # Интерактивный мастер настройки
+bun run mma init                       # Устаревший алиас mma setup (мастер провайдера)
+bun run mma meet                       # «Познакомимся» — интервью, пишет в память
+bun run mma agents init                # Создать/улучшить AGENTS.md для workspace
 bun run mma config set model qwen/qwen3.5-9b
 bun run mma config show
 bun run mma model list                 # Список доступных моделей (✔ = сертифицирована)