kolega-code 0.16.1__tar.gz → 0.17.0__tar.gz

{kolega_code-0.16.1 → kolega_code-0.17.0}/.env.example

@@ -25,6 +25,12 @@ OLLAMA_API_KEY=
 KOLEGA_CODE_THINKING_EFFORT=
 
 BROWSERLESS_API_KEY=
+# Optional Browserless connection overrides. CDP and the SFO region remain the defaults.
+# BROWSERLESS_WS_ENDPOINT=wss://production-sfo.browserless.io
+# BROWSERLESS_REGION=sfo
+# BROWSERLESS_PROTOCOL=cdp
+# BROWSERLESS_TIMEOUT_MS=300000
+# BROWSER_CONNECT_TIMEOUT_MS=30000
 
 LANGFUSE_HOST=https://us.cloud.langfuse.com
 LANGFUSE_PUBLIC_KEY=

{kolega_code-0.16.1 → kolega_code-0.17.0}/.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 on:
   pull_request:
     branches: [main]
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened]
   push:
     branches: [main]
   workflow_dispatch:
@@ -84,6 +84,10 @@ jobs:
         if: needs.changes.outputs.coverage-badge-only != 'true'
         run: uv sync --extra dev --frozen
 
+      - name: Install Playwright Chromium
+        if: needs.changes.outputs.coverage-badge-only != 'true'
+        run: uv run playwright install --with-deps chromium
+
       - name: Run pre-commit hooks
         if: needs.changes.outputs.coverage-badge-only != 'true'
         run: uv run pre-commit run --all-files --show-diff-on-failure

{kolega_code-0.16.1 → kolega_code-0.17.0}/.github/workflows/release.yml

@@ -34,6 +34,9 @@ jobs:
       - name: Install dependencies
         run: uv sync --extra dev --frozen
 
+      - name: Install Playwright Chromium
+        run: uv run playwright install --with-deps chromium
+
       - name: Verify release version metadata
         run: |
           uv run python - <<'PY'

{kolega_code-0.16.1 → kolega_code-0.17.0}/CHANGELOG.md

@@ -6,6 +6,30 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.17.0 - 2026-07-10
+
+### Changed
+
+- Rebuilt the browser agent on a Playwright MCP-style accessibility-snapshot
+  toolset (`browser_navigate`, `browser_snapshot`, `browser_find`,
+  `browser_click`, `browser_type`, and more). Actions use stable element refs
+  (e.g. `e12`) and return an updated snapshot, so the agent interacts
+  deterministically without inventing CSS selectors or relying on screenshots.
+- The browser agent now requires a vision-capable model. Models without image
+  input support are rejected with guidance to choose a vision-capable model or
+  inherit the default.
+
+### Fixed
+
+- Prevented `glob`, `search_codebase`, and LSP language detection from hanging
+  on large or broad project directories by adding bounded, cancellable,
+  timeout-limited workspace traversal.
+- Normalized TUI transcript indentation for consistent rendering.
+
+### Security
+
+- Hardened browser URL validation to address CodeQL static-analysis findings.
+
 ## 0.16.1 - 2026-07-10
 
 ### Changed

{kolega_code-0.16.1 → kolega_code-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.16.1
+Version: 0.17.0
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/

{kolega_code-0.16.1 → kolega_code-0.17.0}/RELEASING.md

@@ -115,8 +115,8 @@ the organization request.
 
 2. In GitHub, create an environment named `pypi`.
 
-   Require approval from trusted maintainers before deployment. The release
-   workflow will pause before publishing to PyPI.
+   The release workflow publishes to PyPI automatically when a release tag is
+   pushed; no manual deployment approval is required.
 
 ## Installer handoff
 

{kolega_code-0.16.1 → kolega_code-0.17.0}/docs/src/assets/coverage.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 80.00%"><title>coverage: 80.00%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">80.00%</text><text x="865" y="150" fill-opacity=".3" textLength="430">80.00%</text></g><text x="865" y="140" textLength="430">80.00%</text></g></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 79.92%"><title>coverage: 79.92%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">79.92%</text><text x="865" y="150" fill-opacity=".3" textLength="430">79.92%</text></g><text x="865" y="140" textLength="430">79.92%</text></g></g></svg>

{kolega_code-0.16.1 → kolega_code-0.17.0}/docs/src/content/docs/concepts/tools.md

@@ -31,10 +31,14 @@ Run shell commands in the project and stream their output to the **Terminal** ta
 
 Drive a real browser (Playwright) for web tasks:
 
-- `launch_browser`, `list_browsers`, `close_browser`
-- `get_browser_interactive_elements`, `get_browser_console_logs`
-- `take_browser_screenshot`
-- `interact_with_browser`, `set_browser_select_value`
+- `browser_navigate`, `browser_snapshot`, `browser_find`, `browser_close`
+- `browser_click`, `browser_type`, `browser_fill_form`, `browser_select_option`
+- `browser_tabs`, `browser_wait_for`, `browser_handle_dialog`, `browser_file_upload`
+- `browser_console_messages`, `browser_network_requests`, `browser_take_screenshot`
+
+The browser agent uses accessibility snapshots with element refs such as `e12`.
+Actions return an updated snapshot, so the agent can interact deterministically
+without inventing CSS selectors or relying on screenshots.
 
 Launch visible browser windows (instead of headless) with `--browser-visible` on
 the [TUI](../../cli/overview/) or [`ask`](../../cli/ask/).

{kolega_code-0.16.1 → kolega_code-0.17.0}/docs/src/content/docs/configuration/environment-variables.md

@@ -86,6 +86,12 @@ section.
 | `KOLEGA_CODE_<ROLE>_MODEL` | Model for that agent |
 | `KOLEGA_CODE_<ROLE>_EFFORT` | Thinking effort for that agent |
 
+The `BROWSER` role requires a vision-capable model. An incompatible explicit or
+inherited model is never replaced automatically; dispatching the browser agent
+fails with a configuration error until `KOLEGA_CODE_BROWSER_PROVIDER` and
+`KOLEGA_CODE_BROWSER_MODEL` (or the equivalent Settings override) select a model
+with vision support.
+
 ## State & environment
 
 | Variable | Purpose |
@@ -106,6 +112,24 @@ explicitly when you want a cloud provider or a self-hosted SearXNG instance.
 | `TAVILY_API_KEY` | Tavily API key |
 | `SEARXNG_BASE_URL` | Base URL for a self-hosted SearXNG instance |
 
+## Browser automation
+
+Local browser automation needs no credentials. Hosted sandbox deployments can
+connect the same browser agent to Browserless.
+
+| Variable | Purpose |
+| --- | --- |
+| `BROWSERLESS_API_KEY` | Browserless cloud API token |
+| `BROWSERLESS_WS_ENDPOINT` | Optional cloud or self-hosted WebSocket endpoint |
+| `BROWSERLESS_REGION` | Cloud region used when no endpoint is supplied: `sfo`, `lon`, or `ams` |
+| `BROWSERLESS_PROTOCOL` | Connection protocol: `cdp` (default) or `playwright` |
+| `BROWSERLESS_TIMEOUT_MS` | Optional maximum Browserless session duration; must fit the account plan |
+| `BROWSER_CONNECT_TIMEOUT_MS` | Browser transport connection timeout (default 30000 ms) |
+
+Custom endpoint query parameters are preserved, including Browserless proxy,
+stealth, profile, and recording options. If `BROWSERLESS_TIMEOUT_MS` is unset,
+Browserless applies the account's default session duration.
+
 ## Telemetry (Langfuse)
 
 Optional [Langfuse](https://langfuse.com/) tracing of LLM usage.

{kolega_code-0.16.1 → kolega_code-0.17.0}/docs/src/content/docs/configuration/providers-and-models.mdx

@@ -149,6 +149,12 @@ In the **Settings tab**, the **Agent Models** section (below the main Model sect
 has a provider/model/effort group per role. Leave a role on **Default** to inherit;
 pick a provider, model, and thinking effort to override it.
 
+The **Browser** role requires a model whose catalog entry supports vision. It does
+not fall back to another model or run in a text-only mode. If **Default** resolves
+to a non-vision model, Settings shows a warning and the browser agent fails with a
+configuration error when dispatched. Select an explicit vision-capable Browser
+model to enable it.
+
 Or use environment variables, named `KOLEGA_CODE_<ROLE>_PROVIDER` / `_MODEL` / `_EFFORT`:
 
 ```bash
@@ -156,6 +162,10 @@ Or use environment variables, named `KOLEGA_CODE_<ROLE>_PROVIDER` / `_MODEL` / `
 export KOLEGA_CODE_INVESTIGATION_PROVIDER=deepseek
 export KOLEGA_CODE_INVESTIGATION_MODEL=deepseek-v4-flash
 export KOLEGA_CODE_INVESTIGATION_EFFORT=high
+
+# Browser overrides must name a vision-capable model.
+export KOLEGA_CODE_BROWSER_PROVIDER=anthropic
+export KOLEGA_CODE_BROWSER_MODEL=claude-sonnet-4-6
 ```
 
 Resolution order for a role (first match wins): **env var → saved Settings → the

{kolega_code-0.16.1 → kolega_code-0.17.0}/docs/src/content/docs/configuration/settings-and-api-keys.mdx

@@ -32,6 +32,10 @@ agents (planning, building, investigation, general, browser) their own provider,
 model, and effort. Leave a role on **Default** to inherit the active model. See
 [Per-agent models](../providers-and-models/#per-agent-models).
 
+The Browser role only accepts vision-capable model overrides. If it inherits a
+non-vision active model, Settings allows the inheritance but warns that the browser
+agent is unavailable until you choose a compatible Browser model.
+
 The **Web Search** section configures the `web_search` tool. DuckDuckGo is the
 default and needs no key. Firecrawl can also run without a key, with an optional
 key for higher rate limits. Tavily requires a key, and SearXNG requires the base

{kolega_code-0.16.1 → kolega_code-0.17.0}/kolega_code/__init__.py

@@ -151,4 +151,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.16.1"
+__version__ = "0.17.0"

{kolega_code-0.16.1 → kolega_code-0.17.0}/kolega_code/agent/__init__.py

@@ -44,4 +44,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.16.1"
+__version__ = "0.17.0"

{kolega_code-0.16.1 → kolega_code-0.17.0}/kolega_code/agent/browseragent.py

@@ -5,6 +5,7 @@ from .baseagent import BaseAgent
 from kolega_code.config import AgentConfig
 from kolega_code.events import AgentConnectionManager
 from kolega_code.llm.models import Message, TextBlock
+from kolega_code.llm.specs import supports_vision as model_supports_vision
 from .prompt_provider import AgentMode, AgentType, PromptExtension, PromptProvider
 from .tools import ToolCollection
 
@@ -19,6 +20,19 @@ class BrowserAgent(BaseAgent):
 
     agent_name = "browser-agent"
 
+    @classmethod
+    def validate_model_capabilities(cls, config: AgentConfig) -> None:
+        """Require the resolved browser-agent model to accept image input."""
+        model_config = config.model_config_for_agent(cls.agent_name)
+        provider = getattr(model_config.provider, "value", model_config.provider)
+        if model_supports_vision(provider, model_config.model):
+            return
+        raise ValueError(
+            "BrowserAgent requires a vision-capable model, but "
+            f"{provider}/{model_config.model} does not support image input. "
+            "Configure a vision-capable model for the Browser agent."
+        )
+
     def __init__(
         self,
         project_path: str | Path,
@@ -74,6 +88,7 @@ class BrowserAgent(BaseAgent):
             usage_recorder: Optional callback for recording normalized LLM usage
             sub_agent_recorder: Optional callback for persisting sub-agent conversation state
         """
+        self.validate_model_capabilities(config)
         super().__init__(
             project_path,
             workspace_id,

{kolega_code-0.16.1 → kolega_code-0.17.0}/kolega_code/agent/prompt_templates/system/agents/browser.md.j2

@@ -45,6 +45,15 @@ If you are asked for links to assets such as images, do not answer from your mem
 
 1. If a website has a cookie consent popup, avoid it. Try another website if you can.
 2. Your search engine of choice is duckduckgo.com
+3. Navigate with `browser_navigate`; it starts the browser session automatically.
+4. Use `browser_snapshot` to understand the page. Prefer exact element refs such as `e12` from the snapshot
+   over manually invented selectors.
+5. Every state-changing action returns an updated snapshot. Use the new refs from that result because refs can
+   become stale when the page changes.
+6. On large pages, use `browser_find` to locate relevant snapshot nodes without loading the entire tree again.
+7. Use `browser_take_screenshot` only for visual inspection. Do not choose interaction targets from screenshots.
+8. Use explicit waits for visible or disappearing text when an application updates asynchronously.
+9. If an action reports a dialog or file chooser, handle that modal before attempting another browser action.
 
 ## **CRITICAL: URL Navigation Guidelines**