kolega-code 0.12.0__tar.gz → 0.13.0__tar.gz

{kolega_code-0.12.0 → kolega_code-0.13.0}/CHANGELOG.md

@@ -6,6 +6,30 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.13.0 - 2026-07-02
+
+### Added
+
+- Added first-class MCP (Model Context Protocol) support in the CLI and TUI,
+  including server settings management.
+- Persisted plan artifacts so they survive across CLI invocations.
+
+### Changed
+
+- Made session diff refreshes incremental and asynchronous for smoother TUI
+  performance.
+
+### Fixed
+
+- Hid queued follow-up messages from the transcript view.
+- Polished status card spacing and made the context-full note generic.
+- Avoided tool dispatcher input name collisions and excluded internal tool
+  collection methods from dispatch.
+- Hardened MCP credential handling, status logging, config output, and server
+  settings reliability.
+- Preserved gigacode enabled state across session resume.
+- Corrected the GPT-5.5 context window to 272K on the Codex backend.
+
 ## 0.12.0 - 2026-06-30
 
 ### Added

{kolega_code-0.12.0 → kolega_code-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.12.0
+Version: 0.13.0
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/
@@ -235,6 +235,7 @@ Requires-Dist: httpx==0.28.1
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: langfuse==3.14.5
 Requires-Dist: lxml-html-clean==0.4.4
+Requires-Dist: mcp>=1.21.2
 Requires-Dist: nest-asyncio==1.6.0
 Requires-Dist: openai==1.109.1
 Requires-Dist: packaging==25.0
@@ -323,6 +324,8 @@ enough that one serial agent pass would be the bottleneck.
 - **Web search and browsing:** DuckDuckGo works by default with no key; Firecrawl,
   Tavily, and SearXNG are configurable search backends. Kolega Code can also fetch URLs
   directly and use a Playwright-powered browser agent for interactive sites.
+- **MCP servers:** connect verified `streamable_http`, `sse`, and `stdio` MCP servers
+  (including OAuth-enabled HTTP servers) as permission-gated tools.
 - **Model routing:** choose provider/model combinations, set thinking effort, split
   long-context/fast/thinking roles, and override models per agent role.
 - **Interactive or scriptable:** use the Textual TUI, queue follow-up prompts

{kolega_code-0.12.0 → kolega_code-0.13.0}/README.md

@@ -60,6 +60,8 @@ enough that one serial agent pass would be the bottleneck.
 - **Web search and browsing:** DuckDuckGo works by default with no key; Firecrawl,
   Tavily, and SearXNG are configurable search backends. Kolega Code can also fetch URLs
   directly and use a Playwright-powered browser agent for interactive sites.
+- **MCP servers:** connect verified `streamable_http`, `sse`, and `stdio` MCP servers
+  (including OAuth-enabled HTTP servers) as permission-gated tools.
 - **Model routing:** choose provider/model combinations, set thinking effort, split
   long-context/fast/thinking roles, and override models per agent role.
 - **Interactive or scriptable:** use the Textual TUI, queue follow-up prompts

{kolega_code-0.12.0 → kolega_code-0.13.0}/docs/astro.config.mjs

@@ -64,6 +64,10 @@ export default defineConfig({
               label: "Settings & API Keys",
               slug: "configuration/settings-and-api-keys",
             },
+            {
+              label: "MCP Servers",
+              slug: "configuration/mcp",
+            },
             {
               label: "Environment Variables",
               slug: "configuration/environment-variables",

{kolega_code-0.12.0 → kolega_code-0.13.0}/docs/src/assets/coverage.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 81.04%"><title>coverage: 81.04%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">81.04%</text><text x="865" y="150" fill-opacity=".3" textLength="430">81.04%</text></g><text x="865" y="140" textLength="430">81.04%</text></g></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 80.14%"><title>coverage: 80.14%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">80.14%</text><text x="865" y="150" fill-opacity=".3" textLength="430">80.14%</text></g><text x="865" y="140" textLength="430">80.14%</text></g></g></svg>

kolega_code-0.13.0/docs/src/content/docs/configuration/mcp.md

@@ -0,0 +1,209 @@
+---
+title: MCP servers
+description: Configure Model Context Protocol servers for Kolega Code tools.
+---
+
+Kolega Code can expose verified [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server tools as first-class agent tools.
+
+MCP support is local-first and opt-in:
+
+- Global servers are read from `<state_dir>/mcp_servers.json`.
+- Project servers are read from `<project>/.kolega/mcp_servers.json` only after the project is trusted for MCP.
+- Agent startup never opens a browser and never starts an OAuth flow. OAuth is only started by an explicit `kolega-code mcp verify` command or the TUI **Verify** button.
+- MCP tools are not propagated to sub-agents.
+- In `ask` permission mode, every MCP tool call prompts unless you save an exact-tool or whole-server allow rule.
+
+## Config locations
+
+| Scope | Path | Enabled when |
+| --- | --- | --- |
+| Global | `<state_dir>/mcp_servers.json` | Always loaded |
+| Project | `<project>/.kolega/mcp_servers.json` | Project is trusted with `--trust-mcp` or from the TUI |
+
+`<state_dir>` is the Kolega Code state directory. You can override it with `--state-dir` for CLI management commands.
+
+Project MCP config is intentionally gated because it can point at local executables or remote services controlled by the repository. Trust a project only after reviewing `.kolega/mcp_servers.json`.
+
+## Config format
+
+```json
+{
+  "schema_version": 1,
+  "servers": [
+    {
+      "id": "docs",
+      "name": "Docs search",
+      "transport": "streamable_http",
+      "url": "https://mcp.example.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ..."
+      },
+      "enabled": true
+    }
+  ]
+}
+```
+
+`servers` may be an array, or an object keyed by server ID. Server IDs may contain letters, numbers, `_`, and `-`.
+
+### `streamable_http`
+
+```json
+{
+  "id": "remote-http",
+  "transport": "streamable_http",
+  "url": "https://mcp.example.com/mcp",
+  "headers": {
+    "Authorization": "Bearer ..."
+  }
+}
+```
+
+### `sse`
+
+```json
+{
+  "id": "remote-sse",
+  "transport": "sse",
+  "url": "https://mcp.example.com/sse",
+  "headers": {
+    "Authorization": "Bearer ..."
+  },
+  "sse_read_timeout_seconds": 300
+}
+```
+
+### `stdio`
+
+```json
+{
+  "id": "local-server",
+  "transport": "stdio",
+  "command": "npx",
+  "args": ["-y", "@vendor/mcp-server"],
+  "env": {
+    "TOKEN": "..."
+  },
+  "cwd": "."
+}
+```
+
+`stdio` servers execute a local command. `kolega-code mcp verify` refuses to start `stdio` commands in non-interactive mode unless you pass `--yes`.
+
+## OAuth
+
+Enable OAuth for HTTP transports with the `oauth` object:
+
+```json
+{
+  "id": "oauth-server",
+  "transport": "streamable_http",
+  "url": "https://mcp.example.com/mcp",
+  "oauth": {
+    "enabled": true,
+    "scope": "read write"
+  }
+}
+```
+
+Run verification to start the OAuth flow:
+
+```bash
+kolega-code mcp verify oauth-server --project .
+```
+
+Use `--no-browser` to print the authorization URL instead of opening a browser. Tokens and dynamic client registration data are stored locally in `<state_dir>/mcp_oauth_tokens.json`. Kolega Code writes this file with owner-only permissions where the platform supports POSIX modes, redacts those values from diagnostics, and does not encrypt the file beyond the protection provided by the OS and filesystem permissions.
+
+## CLI management
+
+List servers and status:
+
+```bash
+kolega-code mcp --project . list
+```
+
+Add a remote server to global config:
+
+```bash
+kolega-code mcp --project . add docs \
+  --transport streamable_http \
+  --url https://mcp.example.com/mcp \
+  --header 'Authorization=Bearer ...'
+```
+
+Add a project config server:
+
+```bash
+kolega-code mcp --project . add repo-local \
+  --project-config \
+  --transport stdio \
+  --command npx \
+  --arg -y \
+  --arg @vendor/mcp-server
+```
+
+Trust project MCP config:
+
+```bash
+kolega-code . --trust-mcp
+# or for one-shot use:
+kolega-code ask "use repo tools" --project . --trust-mcp
+```
+
+Verify one server or all enabled servers:
+
+```bash
+kolega-code mcp --project . verify docs
+kolega-code mcp --project . verify --all --yes
+```
+
+Enable, disable, or remove servers:
+
+```bash
+kolega-code mcp --project . disable docs
+kolega-code mcp --project . enable docs
+kolega-code mcp --project . remove docs
+```
+
+## TUI management
+
+Open the **Settings** tab and use the **MCP Servers** section to:
+
+- Refresh status.
+- Trust project MCP config.
+- Create, update, delete, enable, and disable global MCP servers.
+- Verify a selected server.
+- Clear stored OAuth tokens for a selected server.
+
+Project servers are shown in the TUI but are read-only there. Edit `.kolega/mcp_servers.json` directly or use `kolega-code mcp ... --project-config`.
+
+## Verification and tool exposure
+
+Verification opens a real MCP session, calls `initialize`, lists all tools (including paginated results), and stores a fingerprinted status in `<state_dir>/mcp_server_status.json`.
+
+A server's tools are exposed only when:
+
+1. the server is enabled,
+2. verification succeeded, and
+3. the saved fingerprint still matches the current server config.
+
+Changing connection details, command args, headers, env, OAuth settings, or URL makes the saved status stale and hides tools until you verify again. Changing only `enabled` does not invalidate verification.
+
+Exposed tools are named:
+
+```text
+mcp__{server_id}__{tool_id}
+```
+
+The server-provided `inputSchema` is preserved verbatim.
+
+## Permissions
+
+MCP tools participate in the same project permission flow as shell and edit tools.
+
+In `ask` mode, the TUI can save:
+
+- an exact-tool allow rule for `mcp__server__tool`, or
+- a whole-server allow rule for all verified tools from one server.
+
+Saved rules live in `<project>/.kolega/permissions.json`.

{kolega_code-0.12.0 → kolega_code-0.13.0}/docs/src/content/docs/gigacode.mdx

@@ -52,9 +52,11 @@ Gigacode is **off by default**. Toggle it with the `/gigacode`
 | `/gigacode on` | Enable workflow orchestration for the session |
 | `/gigacode off` | Disable it |
 
-Once on, it stays on for the session, and the agent decides when a task is worth
-orchestrating. It works in both [Build and Plan modes](../tui/modes/) — see
-[Behavior and safety](#behavior-and-safety) for how each differs.
+Once on, it stays on for that resumable session — if you quit and resume the same
+session, the setting is restored. New sessions still start with Gigacode off. The
+agent decides when a task is worth orchestrating. It works in both
+[Build and Plan modes](../tui/modes/) — see [Behavior and safety](#behavior-and-safety)
+for how each differs.
 
 ## What you'll see
 

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/__init__.py

@@ -151,4 +151,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.12.0"
+__version__ = "0.13.0"

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/agent/__init__.py

@@ -44,4 +44,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.12.0"
+__version__ = "0.13.0"

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/agent/baseagent.py

@@ -679,11 +679,7 @@ class BaseAgent(LogMixin):
 
         if usage_percentage >= 60:
             alert_level = "info"
-            message = (
-                "Longer threads consume more credits. "
-                f"Contents will be compressed automatically at {self.history_compression_threshold * 100:.0f}%. "
-                'You can start fresh by clicking "New Thread" in the sidebar.'
-            )
+            message = f"Contents will be compressed automatically at {self.history_compression_threshold * 100:.0f}%."
 
         await self.emitter.context_update(
             input_tokens=token_count.input_tokens,

kolega_code-0.13.0/kolega_code/agent/prompt_templates/extensions/cli/current_plan_artifact.md.j2

@@ -0,0 +1,7 @@
+The current approved implementation plan is persisted as a private Markdown artifact at:
+
+`{{ plan_artifact_path }}`
+
+If the conversation has been compacted, context seems incomplete, or you need exact acceptance criteria, read the artifact with `read_entire_file` (or `read_file_section` if the file is large) before continuing.
+
+Treat this artifact as read-only. Do not edit or overwrite it.

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/agent/prompt_templates/user_tasks/cli/implement_plan.md.j2

@@ -1,4 +1,8 @@
 Implement the approved plan below. Follow it as the source of truth, but still inspect the code before editing and run appropriate checks.
+{% if plan_artifact_path %}
+
+The approved plan is also persisted at `{{ plan_artifact_path }}`. If the conversation is compacted or you need the exact plan again later, read that file with `read_entire_file` (or `read_file_section` if needed). Treat it as read-only.
+{% endif %}
 {% if gigacode_enabled %}
 
 gigacode is enabled. If this plan splits into independent, non-overlapping workstreams (parts that don't edit the same files or depend on each other's output), implement them in parallel by authoring a workflow and calling `run_workflow` — fan out one coder sub-agent per workstream, then verify. Keep tightly-coupled or ordering-dependent changes sequential and do them directly yourself. If the plan is small or its parts are coupled, just implement it directly.

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/agent/prompts.py

@@ -50,6 +50,9 @@ COMPRESSION_SUMMARY_USER_PROMPT_TEMPLATE = prompt_template_source("auxiliary/com
 IMPLEMENT_PLAN_PROMPT_TEMPLATE = prompt_template_source("user_tasks/cli/implement_plan.md.j2").replace(
     "{{ plan }}", "{plan}"
 )
+CURRENT_PLAN_ARTIFACT_PROMPT_TEMPLATE = prompt_template_source("extensions/cli/current_plan_artifact.md.j2").replace(
+    "{{ plan_artifact_path }}", "{plan_artifact_path}"
+)
 SKILL_CATALOG_PROMPT_TEMPLATE = prompt_template_source("extensions/skills/catalog.md.j2").replace(
     "{{ catalog }}", "{catalog}"
 )
@@ -64,8 +67,24 @@ def build_compression_summary_user_prompt(history: str, previous_summary: Option
     )
 
 
-def build_implement_plan_prompt(plan: str, gigacode_enabled: bool = False) -> str:
-    return render_prompt_template("user_tasks/cli/implement_plan.md.j2", plan=plan, gigacode_enabled=gigacode_enabled)
+def build_implement_plan_prompt(
+    plan: str,
+    gigacode_enabled: bool = False,
+    plan_artifact_path: Optional[str | Path] = None,
+) -> str:
+    return render_prompt_template(
+        "user_tasks/cli/implement_plan.md.j2",
+        plan=plan,
+        gigacode_enabled=gigacode_enabled,
+        plan_artifact_path=str(plan_artifact_path) if plan_artifact_path else "",
+    )
+
+
+def build_current_plan_artifact_prompt(plan_artifact_path: str | Path) -> str:
+    return render_prompt_template(
+        "extensions/cli/current_plan_artifact.md.j2",
+        plan_artifact_path=str(plan_artifact_path),
+    )
 
 
 def build_init_agents_prompt(arguments: str) -> str:

{kolega_code-0.12.0 → kolega_code-0.13.0}/kolega_code/agent/tools.py

@@ -42,6 +42,9 @@ class ToolExtension:
     # schema is used verbatim instead of introspecting the callable signature,
     # allowing nested input shapes the introspector cannot express.
     tool_schemas: dict[str, dict[str, Any]] = field(default_factory=dict)
+    # Optional cleanup hook. May be sync or async; ToolCollection.cleanup awaits
+    # it when needed.
+    cleanup: Optional[Callable[[], Any]] = None
     # Whether this extension is inherited by sub-agents. Interactive or
     # session-shared host tools (task list, planning questions) belong to the
     # single top-level agent only; leaving them on for parallel sub-agents lets
@@ -239,12 +242,17 @@ class ToolCollection(LogMixin):
         self.read_only = tool_config.read_only
         self.browser_only = tool_config.browser_only
 
-        # Build tool exclusions list from config
+        # Build tool exclusions list from config. These are internal
+        # management/logging APIs, not model-facing tools.
         self.tool_exclusions = [
             "read_memory",
             "write_memory",
             "execute_terminal_command",
             "get_tool_list",
+            "registry",
+            "has_tool",
+            "call",
+            "cleanup",
             "log_error",
             "log_warning",
             "log_info",
@@ -1472,9 +1480,9 @@ class ToolCollection(LogMixin):
         """True if the named tool is currently enabled."""
         return name in self.registry()
 
-    async def call(self, name: str, **inputs: Any) -> Any:
+    async def call(self, tool_name: str, /, **inputs: Any) -> Any:
         """Dispatch an enabled tool by name."""
-        return await self.registry().call(name, **inputs)
+        return await self.registry().call(tool_name, **inputs)
 
     def get_tool_list(self) -> List[ToolDefinition]:
         """
@@ -1582,6 +1590,18 @@ class ToolCollection(LogMixin):
                         except Exception as e:
                             print(f"Error cleaning up sub-agent {agent_id}: {e}")
 
+            # Clean up host-provided tool extensions (MCP transports, etc.).
+            for extension in self.tool_extensions:
+                cleanup = getattr(extension, "cleanup", None)
+                if cleanup is None:
+                    continue
+                try:
+                    result = cleanup()
+                    if inspect.isawaitable(result):
+                        await result
+                except Exception as e:
+                    print(f"Error cleaning up tool extension {extension.name}: {e}")
+
         except Exception as e:
             await self.log_error(f"Error during tool cleanup: {str(e)}", sender="ToolCollection")