kolega-code 0.38.0__tar.gz → 0.40.0__tar.gz

{kolega_code-0.38.0 → kolega_code-0.40.0}/CHANGELOG.md

@@ -6,6 +6,66 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.40.0 - 2026-09-18
+
+### Added
+
+- **Faster, clearer startup.** A themed splash paints immediately while the
+  application loads, followed by a compact startup card with expandable details
+  that folds away when the conversation begins.
+- **Resume recent sessions from the startup card.** Browse recent conversations
+  and resume them directly, with ownership checks to avoid opening a session
+  already in use.
+- **Context-sensitive keyboard help.** A shortcut bar follows the focused widget,
+  and `F1` opens local help for the current context.
+- **Optional discovery tips.** Fresh sessions can show dismissible tips covering
+  commands, settings, and workflows; enable them in Settings.
+
+### Changed
+
+- **More informative tool calls.** Tool headings include concise, sanitized
+  subjects such as file paths, commands, and search queries. Recorded sessions
+  and the web player retain those subjects too.
+- **A more compact, readable TUI.** Session metadata, empty sidebar sections,
+  task lists, transcript paths, and command previews take less space. Build and
+  plan indicators have distinct colors, and working-state labels use a subtle
+  shimmer.
+
+### Fixed
+
+- Startup-card disclosure preferences persist reliably across rapid toggles and
+  terminal resizes.
+
+### Security
+
+- Updated Soup Sieve to 2.9.2 to fix CVE-2026-86000 and CVE-2026-85999.
+
+## 0.39.0 - 2026-09-15
+
+### Security
+
+- **Telegram gateway now fails closed.** Empty configured and persisted
+  allowlists no longer admit everyone: access is locked, or pairing-only when
+  explicitly enabled. Unknown senders cannot start sessions, run commands,
+  download attachments, or consume permission buttons. First-user pairing
+  requires local review of the numeric sender ID and approval of the code.
+- **Strict access settings and running-policy diagnostics.** Malformed
+  restrictions produce actionable field-specific errors rather than permissive
+  defaults. Token-only setup warns when no operators are authorized; omitting
+  `--allow` preserves configured IDs, while `--allow ''` clears only that list.
+  Startup/status report the enforced access policy from the daemon heartbeat;
+  old snapshots without policy fields are explicitly unknown.
+- **Migration required for formerly open gateways.** Restart old daemons after
+  upgrading; updating files alone does not change a running process. Configured
+  IDs and `gateway_allowlist.json` approvals remain a union, with no automatic
+  deletion of approvals or sessions. For exclusive-owner access, stop the
+  gateway, inspect both authorization sources, remove unwanted approvals,
+  configure the owner, and restart without deleting settings or credentials.
+  All admitted users remain trusted operators: `ask` prompts their chat, allows
+  them to approve their own tools, and does not prevent switching to `auto`;
+  admitted group participants share the chat's control surface. Local echo
+  smoke testing remains available without opening remote access.
+
 ## 0.38.0 - 2026-09-11
 
 ### Added

{kolega_code-0.38.0 → kolega_code-0.40.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.38.0
+Version: 0.40.0
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/
@@ -61,6 +61,7 @@ Requires-Dist: pypdfium2==5.11.0
 Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: readability-lxml==0.8.4.1
+Requires-Dist: soupsieve==2.9.2
 Requires-Dist: tavily-python==0.7.26
 Requires-Dist: tenacity==9.1.4
 Requires-Dist: textual==8.2.5

{kolega_code-0.38.0 → kolega_code-0.40.0}/kolega_code/__init__.py

@@ -174,4 +174,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.38.0"
+__version__ = "0.40.0"

{kolega_code-0.38.0 → kolega_code-0.40.0}/kolega_code/agent/__init__.py

@@ -51,4 +51,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.38.0"
+__version__ = "0.40.0"

{kolega_code-0.38.0 → kolega_code-0.40.0}/kolega_code/agent/baseagent.py

@@ -75,6 +75,7 @@ from kolega_code.services.base import TerminalManager, BrowserManager
 from kolega_code.services.file_system import FileSystem, LocalFileSystem
 from .tools import ToolCollection, ToolExtension  # noqa: F401 - ToolCollection kept for downstream monkeypatching
 from kolega_code.tools import ToolError
+from kolega_code.tool_subjects import build_tool_display, build_tool_subject, configured_tool_subject_secrets
 from .utils.commands import CommandProcessor
 
 if TYPE_CHECKING:
@@ -829,12 +830,14 @@ class BaseAgent(LogMixin):
             payload=delta.get("payload"),
         )
         tool_call_id = block.item_id or str(uuid.uuid4())
+        tool_subject = self._build_tool_subject(block.tool_label, block.action)
         await self.send_chat_message(
             message_type="tool_call",
             content=f"Calling {block.tool_label}: {block.label()}",
             is_streaming=False,
             tool_description=block.tool_label,
             tool_call_id=tool_call_id,
+            tool_subject=tool_subject,
         )
         await self.send_chat_message(
             message_type="tool_result",
@@ -842,6 +845,7 @@ class BaseAgent(LogMixin):
             is_streaming=False,
             tool_description=block.tool_label,
             tool_call_id=tool_call_id,
+            tool_subject=tool_subject,
         )
 
     def apply_goal(self, condition: Optional[str], prompt_extension: Optional["PromptExtension"] = None) -> None:
@@ -1396,9 +1400,37 @@ class BaseAgent(LogMixin):
     def current_provider_tool_call_id(self, value):
         self._current_provider_tool_call_id_var.set(value)
 
+    def _build_tool_subject(self, tool_name: str, tool_input: object) -> str:
+        """Best-effort display metadata, using only this agent's available credentials."""
+        try:
+            return build_tool_subject(
+                tool_name,
+                tool_input,
+                project_path=self.project_path,
+                secret_values=configured_tool_subject_secrets(self.config),
+            )
+        except Exception:
+            # No input/config/formatter failure should change tool execution.
+            # Deliberately do not log the exception: it could contain credentials.
+            return ""
+
+    def _build_tool_display(self, tool_name: str, tool_input: object) -> dict[str, list[str] | str]:
+        """Structured display metadata parallel to ``tool_subject``."""
+        try:
+            return build_tool_display(
+                tool_name,
+                tool_input,
+                project_path=self.project_path,
+                secret_values=configured_tool_subject_secrets(self.config),
+            )
+        except Exception:
+            return {}
+
     async def execute_single_tool(self, tool_use_block: ToolCall) -> ToolResult:
         """Execute a single tool and return its result with metadata"""
         tool_name = tool_use_block.name
+        tool_subject = self._build_tool_subject(tool_name, tool_use_block.input)
+        tool_display = self._build_tool_display(tool_name, tool_use_block.input)
         inputs = (
             {"input": tool_use_block.input}
             if tool_use_block.input_kind == "freeform" and isinstance(tool_use_block.input, str)
@@ -1429,6 +1461,8 @@ class BaseAgent(LogMixin):
                     is_streaming=False,
                     tool_description=tool_name,
                     tool_call_id=tool_execution_id,
+                    tool_subject=tool_subject,
+                    tool_display=tool_display,
                 )
                 return ToolResult(
                     tool_use_id=provider_tool_call_id,
@@ -1465,6 +1499,8 @@ class BaseAgent(LogMixin):
                         is_streaming=False,
                         tool_description=tool_name,
                         tool_call_id=tool_execution_id,
+                        tool_subject=tool_subject,
+                        tool_display=tool_display,
                     )
                     return ToolResult(
                         tool_use_id=provider_tool_call_id,
@@ -1484,6 +1520,8 @@ class BaseAgent(LogMixin):
                         is_streaming=False,
                         tool_description=tool_name,
                         tool_call_id=tool_execution_id,
+                        tool_subject=tool_subject,
+                        tool_display=tool_display,
                     )
                     return ToolResult(
                         tool_use_id=provider_tool_call_id,
@@ -1501,9 +1539,18 @@ class BaseAgent(LogMixin):
                 target=tool_name,
             )
             if pre.blocked:
-                return await self._blocked_tool_result(tool_name, provider_tool_call_id, tool_execution_id, pre.reason)
+                return await self._blocked_tool_result(
+                    tool_name,
+                    provider_tool_call_id,
+                    tool_execution_id,
+                    pre.reason,
+                    tool_subject=tool_subject,
+                    tool_display=tool_display,
+                )
             if pre.updated_input is not None:
                 inputs = pre.updated_input
+                tool_subject = self._build_tool_subject(tool_name, inputs)
+                tool_display = self._build_tool_display(tool_name, inputs)
 
             # Send tool_call message to indicate we're starting execution
             if not all(
@@ -1518,6 +1565,8 @@ class BaseAgent(LogMixin):
                     is_streaming=False,
                     tool_description=tool_name,
                     tool_call_id=tool_execution_id,
+                    tool_subject=tool_subject,
+                    tool_display=tool_display,
                 )
 
             output = await registry.call(tool_name, **inputs)
@@ -1550,6 +1599,8 @@ class BaseAgent(LogMixin):
                 tool_description=tool_name,
                 tool_call_id=tool_execution_id,
                 images=images,
+                tool_subject=tool_subject,
+                tool_display=tool_display,
             )
 
             return ToolResult(
@@ -1572,6 +1623,8 @@ class BaseAgent(LogMixin):
                 is_streaming=False,
                 tool_description=tool_name,
                 tool_call_id=tool_execution_id,
+                tool_subject=tool_subject,
+                tool_display=tool_display,
             )
 
             return ToolResult(
@@ -1593,6 +1646,8 @@ class BaseAgent(LogMixin):
                 is_streaming=False,
                 tool_description=tool_name,
                 tool_call_id=tool_execution_id,
+                tool_subject=tool_subject,
+                tool_display=tool_display,
             )
 
             return ToolResult(
@@ -1641,6 +1696,8 @@ class BaseAgent(LogMixin):
                         is_streaming=False,
                         tool_description=block.name,
                         tool_call_id=execution_id,
+                        tool_subject=self._build_tool_subject(block.name, block.input),
+                        tool_display=self._build_tool_display(block.name, block.input),
                     )
                     results.append(
                         ToolResult(
@@ -1862,7 +1919,14 @@ class BaseAgent(LogMixin):
         return output if isinstance(output, str) else str(output)
 
     async def _blocked_tool_result(
-        self, tool_name: str, provider_tool_call_id: str, tool_execution_id: str, reason: str
+        self,
+        tool_name: str,
+        provider_tool_call_id: str,
+        tool_execution_id: str,
+        reason: str,
+        *,
+        tool_subject: Optional[str] = None,
+        tool_display: Optional[dict[str, list[str] | str]] = None,
     ) -> ToolResult:
         """Build the is_error ToolResult a blocked tool produces — identical to the
         permission-deny path so the model and UI handle a hook block the same way."""
@@ -1876,6 +1940,8 @@ class BaseAgent(LogMixin):
             is_streaming=False,
             tool_description=tool_name,
             tool_call_id=tool_execution_id,
+            tool_subject=tool_subject,
+            tool_display=tool_display,
         )
         return ToolResult(
             tool_use_id=provider_tool_call_id,
@@ -1935,6 +2001,9 @@ class BaseAgent(LogMixin):
         tool_description=None,
         tool_call_id=None,
         images: Optional[Sequence[Tuple[str, str]]] = None,
+        *,
+        tool_subject: Optional[str] = None,
+        tool_display: Optional[dict[str, list[str] | str]] = None,
     ) -> None:
         """
         Send a message to the chat interface.
@@ -1945,6 +2014,18 @@ class BaseAgent(LogMixin):
             images: ``(media_type, base64_data)`` pairs a tool produced, so a
                 frontend can show the picture rather than a description of one
         """
+        if tool_subject or tool_display:
+            await self.emitter.chat(
+                message_type,
+                content,
+                is_streaming=is_streaming,
+                tool_description=tool_description,
+                tool_call_id=tool_call_id,
+                images=images,
+                tool_subject=tool_subject,
+                tool_display=tool_display,
+            )
+            return
         await self.emitter.chat(
             message_type,
             content,
@@ -2109,6 +2190,8 @@ class BaseAgent(LogMixin):
                 is_streaming=False,
                 tool_description=tool_name,
                 tool_call_id=tool_execution_id,
+                tool_subject=self._build_tool_subject(tool_name, tool_call_delta.get("input")),
+                tool_display=self._build_tool_display(tool_name, tool_call_delta.get("input")),
             )
 
     def should_stop_after_tools(self) -> bool: