kolega-code 0.45.0__tar.gz → 0.46.0__tar.gz

{kolega_code-0.45.0 → kolega_code-0.46.0}/CHANGELOG.md

@@ -6,6 +6,66 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.46.0 - 2026-10-27
+
+### Added
+
+- **Kimi K3.1 Pro support.** Moonshot's October 2026 K3.1 release is selectable
+  on both Kimi providers: `kimi-k3.1-pro` and `kimi-k3.1-pro-highspeed` on
+  `moonshot`, and `k3.1-pro` / `k3.1-pro-highspeed` on the Kimi Coding Plan.
+  All four always think and expose a `low`/`high`/`max` reasoning-effort ladder;
+  the 1M window is catalogued directly where every eligible plan has it. The
+  Coding Plan's `k3.1-pro` keeps a 256K budget because its 1M window is gated to
+  Pro-and-above plans.
+- **Cloudflare Workers AI support.** Select `cloudflare_workers_ai` with a
+  Workers AI API token (`CLOUDFLARE_API_TOKEN` or Settings) and your account ID
+  (`CLOUDFLARE_ACCOUNT_ID`, or the new Account ID field on Settings → Providers
+  and in onboarding). The curated catalog covers tool-calling models with at
+  least a 128K window, led by GLM-5.3 (the default) plus GLM-5.3 Flash,
+  Kimi K2.7 Code, DeepSeek V4.1 Flash, GPT-OSS, and more, with Cloudflare's
+  per-model reasoning-effort ladders. `kolega-code models refresh --provider
+  cloudflare_workers_ai` discovers newer models from your account.
+  `CLOUDFLARE_AI_GATEWAY_ID` optionally routes requests through an AI Gateway.
+  Exhausted free allocations and Workers Paid-only models report a billing
+  error instead of retrying.
+
+### Changed
+
+- Refreshed the OpenRouter, Ollama Cloud, and Tinker model catalogs from their
+  live endpoints (2026-10-27 snapshots) with newly available models, removal of
+  retired entries, updated limits and capabilities, and a refreshed OpenRouter
+  featured ordering. OpenRouter also stopped advertising `temperature` for the
+  Anthropic family, matching their adaptive thinking behavior. The Perplexity
+  Agent catalog is unchanged because its live endpoint could not be read.
+- Updated the documentation site's undici dependency to 8.12.3.
+
+### Security
+
+- Updated Brotli to 1.2.1, fixing an out-of-bounds write in the decoder
+  (CVE-2026-111497, GHSA-9v8h-qqgm-4m35) reachable through compressed HTTP
+  responses.
+- Updated filelock to 4.2.4 for three `SoftFileLock`/`ReadWriteLock`
+  advisories (Kolega Code uses neither class) and setuptools to 84.2.0
+  (GHSA-xmj3-9gf7-h52w). The dev-only virtualenv pin moves to 21.14.5 so
+  filelock 4 resolves; its remaining advisories stay an accepted risk until
+  langfuse allows the fixed release.
+
+## 0.45.1 - 2026-10-23
+
+### Fixed
+
+- Healthy pauses in model responses now show "Waiting for response…" instead
+  of incorrectly reporting a connection issue. The waiting notice clears when
+  activity resumes without overwriting newer activity such as "Thinking…".
+- Retry notices distinguish actual response timeouts from other transient
+  failures, with detailed errors retained in diagnostics.
+
+### Security
+
+- Updated OpenTelemetry's API to 1.45.1, fixing excessive CPU use when parsing
+  malicious trace-state headers (CVE-2026-114603), and refreshed its companion
+  packages.
+
 ## 0.45.0 - 2026-10-22
 
 ### Added

{kolega_code-0.45.0 → kolega_code-0.46.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.45.0
+Version: 0.46.0
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/
@@ -35,7 +35,7 @@ Requires-Dist: cryptography==48.0.1; sys_platform == 'darwin' and platform_machi
 Requires-Dist: cryptography==50.0.0; sys_platform != 'darwin' or platform_machine != 'x86_64'
 Requires-Dist: ddgs==9.14.4
 Requires-Dist: fastapi==0.139.2
-Requires-Dist: filelock==3.24.2
+Requires-Dist: filelock==4.2.4
 Requires-Dist: firecrawl-py==4.28.2
 Requires-Dist: google-genai==2.12.1
 Requires-Dist: httpx==0.28.1
@@ -50,6 +50,7 @@ Requires-Dist: nest-asyncio==1.6.0
 Requires-Dist: onnxruntime==1.19.2; sys_platform == 'darwin' and platform_machine == 'x86_64' and python_version < '3.13'
 Requires-Dist: onnxruntime==1.27.0; python_version >= '3.14' and sys_platform != 'win32'
 Requires-Dist: openai==2.46.0
+Requires-Dist: opentelemetry-api==1.45.1
 Requires-Dist: packaging==25.0
 Requires-Dist: pathspec==1.1.1
 Requires-Dist: pillow==13.0.0
@@ -82,7 +83,7 @@ Requires-Dist: pytest-xdist==3.8.0; extra == 'dev'
 Requires-Dist: pytest==9.0.3; extra == 'dev'
 Requires-Dist: ruff==0.15.12; extra == 'dev'
 Requires-Dist: twine==6.2.0; extra == 'dev'
-Requires-Dist: virtualenv==21.7.13; extra == 'dev'
+Requires-Dist: virtualenv==21.14.5; extra == 'dev'
 Provides-Extra: tinker
 Requires-Dist: tinker-cookbook==0.5.4; extra == 'tinker'
 Requires-Dist: tinker==0.25.0; extra == 'tinker'
@@ -276,6 +277,7 @@ Supported model providers:
 - Z.AI / GLM Coding Plan
 - Kimi Coding Plan
 - Ollama Cloud
+- Cloudflare Workers AI
 - local Llama
 
 With a paid **ChatGPT** plan (Plus, Pro, or Business), `/login chatgpt` runs

{kolega_code-0.45.0 → kolega_code-0.46.0}/README.md

@@ -185,6 +185,7 @@ Supported model providers:
 - Z.AI / GLM Coding Plan
 - Kimi Coding Plan
 - Ollama Cloud
+- Cloudflare Workers AI
 - local Llama
 
 With a paid **ChatGPT** plan (Plus, Pro, or Business), `/login chatgpt` runs

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/__init__.py

@@ -174,4 +174,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.45.0"
+__version__ = "0.46.0"

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/__init__.py

@@ -51,4 +51,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.45.0"
+__version__ = "0.46.0"

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/baseagent.py

@@ -99,9 +99,6 @@ logger = logging.getLogger(__name__)
 
 PROJECT_GUIDANCE_FILES = ("AGENTS.md", "KOLEGA.md")
 
-#: The status strip is one narrow line, so every stall notice opens with this fixed lead.
-STALL_NOTICE_LEAD = "Connection issue"
-
 _STREAM_CLEANUP_TIMEOUT = 0.1
 _STREAM_CLEANUP_TASKS: set[asyncio.Future[Any]] = set()
 
@@ -1904,7 +1901,6 @@ class BaseAgent(LogMixin):
 
         from kolega_code.llm.client import LLMClient
 
-        endpoint = self.config.custom_endpoint_for(model_config)
         client = LLMClient(
             provider=model_config.provider.value,
             api_key=self.config.get_api_key(model_config.provider) or "",
@@ -1915,8 +1911,7 @@ class BaseAgent(LogMixin):
             token_manager=self.config.get_chatgpt_token_manager(),
             usage_ledger=self.usage_ledger,
             trace_sink=self.llm_trace_sink,
-            base_url=endpoint.base_url if endpoint else None,
-            api_style=endpoint.api_style if endpoint else None,
+            **self.config.llm_client_kwargs(model_config),
         )
         with llm_call_origin(helper_origin("hook_prompt")):
             response = await client.generate(
@@ -2160,6 +2155,7 @@ class BaseAgent(LogMixin):
     ) -> Any:
         limit = self._stream_first_chunk_timeout if received == 0 else self._stream_idle_timeout
         next_heartbeat = self._stream_heartbeat_seconds
+        reported_wait = False
         while True:
             budget_left = self._remaining_llm_retry_budget()
             if budget_left is not None and budget_left <= 0:
@@ -2173,7 +2169,10 @@ class BaseAgent(LogMixin):
                     limit_s=limit,
                 )
             if pending.done():
-                return pending.result()
+                result = pending.result()
+                if reported_wait:
+                    await self._emit_stream_resume_status()
+                return result
             slice_s = min(self._stream_heartbeat_seconds, limit - waited)
             if budget_left is not None:
                 slice_s = min(slice_s, budget_left)
@@ -2186,6 +2185,7 @@ class BaseAgent(LogMixin):
             if waited >= next_heartbeat and waited < limit:
                 next_heartbeat = waited + self._stream_heartbeat_seconds
                 await self._emit_stream_wait_status(received, waited, limit)
+                reported_wait = True
 
     async def _finish_stream_cleanup(self, cleanup: Awaitable[Any]) -> Any:
         task = asyncio.ensure_future(cleanup)
@@ -2302,7 +2302,7 @@ class BaseAgent(LogMixin):
         try:
             await self.emitter.llm_status(
                 "info",
-                f"{STALL_NOTICE_LEAD} — waiting for a response…",
+                "Waiting for response…",
                 stall=True,
                 seconds_since_data=round(waited_s, 1),
                 timeout_s=limit_s,
@@ -2312,18 +2312,21 @@ class BaseAgent(LogMixin):
             # A status heartbeat must never break the turn it is describing.
             pass
 
-    def _retry_status_message(self, *, attempt: int, cap: int, delay: float) -> str:
+    async def _emit_stream_resume_status(self) -> None:
+        try:
+            await self.emitter.llm_status("info", "Reading model response…", resumed=True)
+        except Exception:
+            pass
+
+    def _retry_status_message(self, error: Exception, *, attempt: int, cap: int, delay: float) -> str:
         """Short strip copy; the failure detail is already in the log and ``llm_error``."""
-        return f"{STALL_NOTICE_LEAD} — retrying ({attempt}/{cap}) in {delay:.0f}s…"
+        lead = "Response timed out — retrying" if isinstance(error, LLMTimeout) else "Retrying request"
+        return f"{lead} ({attempt}/{cap}) in {delay:.0f}s…"
 
     def _retry_exhausted_message(self, error: Exception, *, attempts: int, budget_used_s: float) -> str:
-        """Terminal message: the same one lead, plus how hard it tried and for how long."""
         if isinstance(error, LLMStreamStalled):
             attempt_word = "attempt" if attempts == 1 else "attempts"
-            return (
-                f"{STALL_NOTICE_LEAD} — no response after {attempts} {attempt_word} "
-                f"over {self._format_wait(budget_used_s)}."
-            )
+            return f"Response timed out after {attempts} {attempt_word} over {self._format_wait(budget_used_s)}."
         return llm_error_message(
             error if isinstance(error, LLMError) else LLMError(str(error)),
             model=self.primary_model_config.model,
@@ -2408,7 +2411,7 @@ class BaseAgent(LogMixin):
             # instead of only flashing it in the status strip.
             await self.emitter.llm_status(
                 "info",
-                self._retry_status_message(attempt=self._consecutive_llm_retries, cap=cap, delay=delay),
+                self._retry_status_message(error, attempt=self._consecutive_llm_retries, cap=cap, delay=delay),
                 retry=True,
                 attempt=self._consecutive_llm_retries,
                 cap=cap,

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/context.py

@@ -113,7 +113,7 @@ class AgentContext:
         itself is still passed per call.
         """
         model_config = self.config.model_config_for_agent(agent_name)
-        endpoint = self.config.custom_endpoint_for(model_config)
+        connection_kwargs = self.config.llm_client_kwargs(model_config)
 
         if self.telemetry.langfuse_client:
             return InstrumentedLLMClient(
@@ -136,8 +136,7 @@ class AgentContext:
                 trace_sink=self.telemetry.llm_trace_sink,
                 context_window_tokens=self.config.context_window_tokens,
                 max_output_tokens=self.config.max_output_tokens,
-                base_url=endpoint.base_url if endpoint else None,
-                api_style=endpoint.api_style if endpoint else None,
+                **connection_kwargs,
             )
 
         return LLMClient(
@@ -152,6 +151,5 @@ class AgentContext:
             trace_sink=self.telemetry.llm_trace_sink,
             context_window_tokens=self.config.context_window_tokens,
             max_output_tokens=self.config.max_output_tokens,
-            base_url=endpoint.base_url if endpoint else None,
-            api_style=endpoint.api_style if endpoint else None,
+            **connection_kwargs,
         )

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/model_routing.py

@@ -56,6 +56,8 @@ def provider_is_configured(config: AgentConfig, provider: ModelProvider) -> bool
         return True
     if provider == ModelProvider.OPENAI_CHATGPT:
         return config.openai_chatgpt_tokens is not None
+    if provider == ModelProvider.CLOUDFLARE_WORKERS_AI:
+        return bool(config.get_api_key(provider)) and bool(config.cloudflare_account_id)
     return bool(config.get_api_key(provider))
 
 

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/tool_backend/terminal_tool.py

@@ -97,7 +97,6 @@ class TerminalTool(BaseTool):
         provider = self.config.fast_config.provider
         api_key = self.config.get_api_key(provider)
         rate_limits = self.config.fast_config.rate_limits
-        endpoint = self.config.custom_endpoint_for(self.config.fast_config)
 
         client = LLMClient(
             provider=provider.value,
@@ -109,8 +108,7 @@ class TerminalTool(BaseTool):
             token_manager=self.config.get_chatgpt_token_manager(),
             usage_ledger=getattr(self.caller, "usage_ledger", None),
             trace_sink=getattr(self.caller, "llm_trace_sink", None),
-            base_url=endpoint.base_url if endpoint else None,
-            api_style=endpoint.api_style if endpoint else None,
+            **self.config.llm_client_kwargs(self.config.fast_config),
         )
 
         try:

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/agent/tool_backend/web_fetch_tool.py

@@ -146,7 +146,6 @@ class WebFetchTool(StreamingTool):
     def _build_client(self) -> LLMClient:
         provider = self.config.fast_config.provider
         rate_limits = self.config.fast_config.rate_limits
-        endpoint = self.config.custom_endpoint_for(self.config.fast_config)
         client_kwargs = {
             "provider": provider.value,
             "api_key": self.config.get_api_key(provider),
@@ -157,8 +156,7 @@ class WebFetchTool(StreamingTool):
             "token_manager": self.config.get_chatgpt_token_manager(),
             "usage_ledger": getattr(self.caller, "usage_ledger", None),
             "trace_sink": getattr(self.caller, "llm_trace_sink", None),
-            "base_url": endpoint.base_url if endpoint else None,
-            "api_style": endpoint.api_style if endpoint else None,
+            **self.config.llm_client_kwargs(self.config.fast_config),
         }
         caller_llm = getattr(self.caller, "llm", None)
         if isinstance(caller_llm, InstrumentedLLMClient):

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/config.py

@@ -20,6 +20,7 @@ from kolega_code.config import (
     ModelProvider,
     RateLimitConfig,
 )
+from kolega_code.llm import cloudflare_workers_ai
 from kolega_code.llm.specs import MODEL_SPECS, get_model_specs, model_is_known, normalize_thinking_effort
 from kolega_code.llm.specs.custom_endpoints import (
     API_STYLES,
@@ -72,6 +73,7 @@ API_KEY_ENV = {
     ModelProvider.ZAI: "ZAI_API_KEY",
     ModelProvider.KIMI_CODING: "KIMI_CODING_API_KEY",
     ModelProvider.OLLAMA_CLOUD: "OLLAMA_API_KEY",
+    ModelProvider.CLOUDFLARE_WORKERS_AI: cloudflare_workers_ai.API_TOKEN_ENV,
     ModelProvider.OPENROUTER: "OPENROUTER_API_KEY",
     ModelProvider.THINKING_MACHINES: "TINKER_API_KEY",
     # Native Tinker sampling authenticates with the same key.
@@ -399,6 +401,45 @@ def _api_key_for_provider(
     return None
 
 
+CLOUDFLARE_MISSING_ACCOUNT_MESSAGE = (
+    f"Missing Cloudflare account ID: set {cloudflare_workers_ai.ACCOUNT_ID_ENV} or enter it in Settings → Providers."
+)
+
+
+def _cloudflare_account_id_source(env: Mapping[str, str], settings: Optional[CliSettings]) -> tuple[Optional[str], str]:
+    """The raw account ID and where it came from: the environment wins over Settings."""
+    from_env = (env.get(cloudflare_workers_ai.ACCOUNT_ID_ENV) or "").strip()
+    if from_env:
+        return from_env, cloudflare_workers_ai.ACCOUNT_ID_ENV
+    return (settings.cloudflare_account_id if settings else None), "the account ID saved in Settings"
+
+
+def _cloudflare_route_settings(
+    env: Mapping[str, str], settings: Optional[CliSettings], *, required: bool
+) -> tuple[Optional[str], Optional[str]]:
+    """Resolve ``(account_id, gateway_id)``.
+
+    Invalid values are fatal only when a Cloudflare route is in use; otherwise they
+    are dropped so a stale value cannot lock the user out of other providers.
+    """
+    raw_account, account_source = _cloudflare_account_id_source(env, settings)
+    try:
+        account_id = cloudflare_workers_ai.normalize_account_id(raw_account)
+    except ValueError as exc:
+        if required:
+            raise CliConfigError(f"Invalid Cloudflare account ID from {account_source}: {exc}") from exc
+        account_id = None
+    if required and account_id is None:
+        raise CliConfigError(CLOUDFLARE_MISSING_ACCOUNT_MESSAGE)
+    try:
+        gateway_id = cloudflare_workers_ai.normalize_gateway_id(env.get(cloudflare_workers_ai.GATEWAY_ID_ENV))
+    except ValueError as exc:
+        if required:
+            raise CliConfigError(f"Invalid {cloudflare_workers_ai.GATEWAY_ID_ENV}: {exc}") from exc
+        gateway_id = None
+    return account_id, gateway_id
+
+
 def _resolve_chatgpt_tokens(settings: Optional[CliSettings]) -> Optional[OAuthTokens]:
     """Load stored ChatGPT OAuth tokens from settings, if present and well-formed."""
     if not settings:
@@ -952,6 +993,10 @@ def build_agent_config(
     if missing_keys:
         raise CliConfigError(f"Missing required API key environment variable(s): {', '.join(missing_keys)}")
 
+    cloudflare_account_id, cloudflare_ai_gateway_id = _cloudflare_route_settings(
+        loaded_env, settings, required=ModelProvider.CLOUDFLARE_WORKERS_AI in required_providers
+    )
+
     chatgpt_tokens = _resolve_chatgpt_tokens(settings)
     if ModelProvider.OPENAI_CHATGPT in required_providers and chatgpt_tokens is None:
         raise CliConfigError("Not signed in to ChatGPT. Run /login chatgpt to sign in with your ChatGPT subscription.")
@@ -981,6 +1026,9 @@ def build_agent_config(
             zai_api_key=_api_key_for_provider(ModelProvider.ZAI, loaded_env, settings),
             kimi_coding_api_key=_api_key_for_provider(ModelProvider.KIMI_CODING, loaded_env, settings),
             ollama_cloud_api_key=_api_key_for_provider(ModelProvider.OLLAMA_CLOUD, loaded_env, settings),
+            cloudflare_api_token=_api_key_for_provider(ModelProvider.CLOUDFLARE_WORKERS_AI, loaded_env, settings),
+            cloudflare_account_id=cloudflare_account_id,
+            cloudflare_ai_gateway_id=cloudflare_ai_gateway_id,
             openrouter_api_key=_api_key_for_provider(ModelProvider.OPENROUTER, loaded_env, settings),
             thinking_machines_api_key=_api_key_for_provider(ModelProvider.THINKING_MACHINES, loaded_env, settings),
             perplexity_api_key=_api_key_for_provider(ModelProvider.PERPLEXITY_AGENT, loaded_env, settings),
@@ -1068,10 +1116,19 @@ def key_status(provider: str, project_path: Path, settings: Optional[CliSettings
     env = load_cli_env(project_path)
     env_name = API_KEY_ENV.get(provider_value)
     if env_name and env.get(env_name):
-        return f"present via {env_name}"
-    if settings and settings.get_api_key(provider_value.value):
-        return "present in local settings"
-    return "missing"
+        status = f"present via {env_name}"
+    elif settings and settings.get_api_key(provider_value.value):
+        status = "present in local settings"
+    else:
+        return "missing"
+    if provider_value == ModelProvider.CLOUDFLARE_WORKERS_AI:
+        raw_account, _ = _cloudflare_account_id_source(env, settings)
+        try:
+            if cloudflare_workers_ai.normalize_account_id(raw_account) is None:
+                status += "; account ID missing"
+        except ValueError:
+            status += "; account ID invalid"
+    return status
 
 
 def resolved_api_key(provider: str, project_path: Path, settings: Optional[CliSettings] = None) -> Optional[str]:
@@ -1082,6 +1139,33 @@ def resolved_api_key(provider: str, project_path: Path, settings: Optional[CliSe
     return _api_key_for_provider(_provider(provider), load_cli_env(project_path), settings)
 
 
+def resolved_cloudflare_account_id(project_path: Path, settings: Optional[CliSettings] = None) -> Optional[str]:
+    """The valid Cloudflare account ID a route would use (environment, then Settings), or ``None``."""
+    raw_account, _ = _cloudflare_account_id_source(load_cli_env(project_path), settings)
+    try:
+        return cloudflare_workers_ai.normalize_account_id(raw_account)
+    except ValueError:
+        return None
+
+
+def provider_connection_kwargs(
+    provider: str, project_path: Path, settings: Optional[CliSettings] = None
+) -> dict[str, Any]:
+    """Connection kwargs for probing a built-in provider's credential from a Settings draft.
+
+    Raises ``ValueError`` with user-facing copy when a Cloudflare account ID is
+    missing or invalid; returns ``{}`` for providers with a fixed endpoint.
+    """
+    if _provider(provider) != ModelProvider.CLOUDFLARE_WORKERS_AI:
+        return {}
+    env = load_cli_env(project_path)
+    raw_account, _ = _cloudflare_account_id_source(env, settings)
+    return cloudflare_workers_ai.connection_kwargs(
+        cloudflare_workers_ai.normalize_account_id(raw_account),
+        cloudflare_workers_ai.normalize_gateway_id(env.get(cloudflare_workers_ai.GATEWAY_ID_ENV)),
+    )
+
+
 def probe_token_manager(settings: Optional[CliSettings]) -> Optional[ChatGPTTokenManager]:
     """A ChatGPT token manager for credential probes, deliberately non-persisting.
 

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/messages.py

@@ -297,6 +297,13 @@ PROVIDER_KEY_NOT_STORED = (
 )
 PROVIDER_KEY_REMOVAL_STAGED = "The locally stored API key will be removed when you Apply."
 PROVIDER_TEST_RUNNING = "Testing {provider}/{model}…"
+CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER = "32-character Cloudflare account ID"
+CLOUDFLARE_ACCOUNT_ID_HINT = (
+    "Find the account ID in the Cloudflare dashboard under Workers AI → Use REST API. "
+    "CLOUDFLARE_ACCOUNT_ID overrides this value."
+)
+CLOUDFLARE_API_TOKEN_PLACEHOLDER = "Cloudflare API token (Workers AI Read)"
+CLOUDFLARE_ACCOUNT_ID_REQUIRED = "Enter your Cloudflare account ID or set CLOUDFLARE_ACCOUNT_ID."
 MODEL_SLOT_INHERITED = "Using {provider}/{model} (inherited from the active model)."
 MODEL_SLOT_PINNED = "Using {provider}/{model}."
 MODEL_SLOT_HINT = (

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/model_catalog.py

@@ -20,7 +20,9 @@ from pathlib import Path
 from typing import Any, Iterable, Optional, Sequence
 
 from kolega_code.config import ModelProvider
+from kolega_code.llm.cloudflare_workers_ai import normalize_account_id
 from kolega_code.llm.specs import MODEL_SPECS, is_featured_model
+from kolega_code.llm.specs import cloudflare_workers_ai_catalog as cloudflare_workers_ai
 from kolega_code.llm.specs import mistral_catalog as mistral
 from kolega_code.llm.specs import ollama_cloud_catalog as ollama_cloud
 from kolega_code.llm.specs import openrouter_catalog as openrouter
@@ -37,13 +39,16 @@ from .settings import SettingsStore, SettingsStoreError
 # and save_cache(). The Perplexity entry is a duck-typed catalog object rather
 # than a module — same contract. An entry that publishes ``API_KEY_ENV`` is
 # authenticated: ``models refresh`` resolves that credential and passes it to
-# ``fetch_models(api_key=...)``; every other source is fetched anonymously.
+# ``fetch_models(api_key=...)``; every other source is fetched anonymously. An
+# entry that also publishes ``ACCOUNT_ID_ENV`` is account-scoped and receives
+# ``account_id=...`` too.
 OVERLAY_SOURCES = {
     mistral.PROVIDER: mistral,
     ollama_cloud.PROVIDER: ollama_cloud,
     openrouter.PROVIDER: openrouter,
     tinker.PROVIDER: tinker,
     perplexity.AGENT_PROVIDER: perplexity.AGENT_CATALOG,
+    cloudflare_workers_ai.PROVIDER: cloudflare_workers_ai,
 }
 
 # Capture the release snapshot before startup applies any runtime caches.
@@ -83,6 +88,20 @@ def _overlay_api_key(provider: str, env_name: str) -> Optional[str]:
     return (stored or "").strip() or None
 
 
+def _overlay_account_id(env_name: str, setting_name: str) -> Optional[str]:
+    """Resolve an account-scoped overlay's account ID: environment first, then Settings."""
+    value = (os.environ.get(env_name) or "").strip()
+    if not value:
+        try:
+            value = str(getattr(SettingsStore().load(), setting_name, None) or "").strip()
+        except (SettingsStoreError, OSError):
+            return None
+    try:
+        return normalize_account_id(value)
+    except ValueError:
+        return None
+
+
 def _overlay_fetch_kwargs(provider: str, module: Any) -> tuple[Optional[dict[str, Any]], Optional[str]]:
     """Return ``(fetch kwargs, error message)`` for one overlay source."""
     env_name = getattr(module, "API_KEY_ENV", None)
@@ -91,7 +110,16 @@ def _overlay_fetch_kwargs(provider: str, module: Any) -> tuple[Optional[dict[str
     api_key = _overlay_api_key(provider, str(env_name))
     if not api_key:
         return None, f"Refreshing the {provider} catalog needs {env_name} (or a key saved in Settings)."
-    return {"api_key": api_key}, None
+    kwargs: dict[str, Any] = {"api_key": api_key}
+    account_env = getattr(module, "ACCOUNT_ID_ENV", None)
+    if account_env:
+        account_id = _overlay_account_id(str(account_env), str(getattr(module, "ACCOUNT_ID_SETTING", "")))
+        if not account_id:
+            return None, (
+                f"Refreshing the {provider} catalog needs {account_env} (or an account ID saved in Settings)."
+            )
+        kwargs["account_id"] = account_id
+    return kwargs, None
 
 
 def _catalog_env_names(catalog: str) -> tuple[str, str]:

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/model_connection.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import asyncio
 from dataclasses import dataclass
-from typing import Any, Callable, Optional
+from typing import Any, Callable, Mapping, Optional
 
 from kolega_code.config import ModelProvider, RateLimitConfig
 from kolega_code.llm.client import LLMClient
@@ -49,6 +49,7 @@ async def test_model_connection(
     usage_ledger: Any = None,
     base_url: Optional[str] = None,
     api_style: Optional[str] = None,
+    default_headers: Optional[Mapping[str, str]] = None,
 ) -> ModelConnectionResult:
     """Send a tiny no-tool prompt through one provider/model pair.
 
@@ -78,6 +79,8 @@ async def test_model_connection(
             factory_kwargs["base_url"] = base_url
         if api_style:
             factory_kwargs["api_style"] = api_style
+        if default_headers:
+            factory_kwargs["default_headers"] = dict(default_headers)
         client = client_factory(**factory_kwargs)
         messages = MessageHistory([Message(role="user", content=[TextBlock(text="Reply with OK.")])])
         await asyncio.wait_for(

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/provider_registry.py

@@ -45,6 +45,7 @@ PROVIDER_LABELS: dict[ModelProvider, str] = {
     ModelProvider.TOGETHER: "Together AI",
     ModelProvider.DASHSCOPE: "DashScope / Qwen",
     ModelProvider.OLLAMA_CLOUD: "Ollama Cloud",
+    ModelProvider.CLOUDFLARE_WORKERS_AI: "Cloudflare Workers AI",
     ModelProvider.OPENROUTER: "OpenRouter",
     ModelProvider.THINKING_MACHINES: "Thinking Machines",
     ModelProvider.TINKER: "Tinker",
@@ -63,6 +64,8 @@ MODEL_LABELS: dict[str, str] = {
     "meta-llama/llama-4-maverick-17b-128e-instruct": "Llama 4 Maverick 17B",
     # Moonshot
     "kimi-k3": "Kimi K3",
+    "kimi-k3.1-pro": "Kimi K3.1 Pro",
+    "kimi-k3.1-pro-highspeed": "Kimi K3.1 Pro (High-Speed)",
     "kimi-k2.7-code": "Kimi K2.7 Code",
     "kimi-k2.7-code-highspeed": "Kimi K2.7 Code (High-Speed)",
     "kimi-k2.6": "Kimi K2.6",
@@ -79,6 +82,8 @@ MODEL_LABELS: dict[str, str] = {
     # Kimi Coding Plan
     "k3": "Kimi K3 (256K)",
     "k3-256k": "Kimi K3-256K",
+    "k3.1-pro": "Kimi K3.1 Pro (256K)",
+    "k3.1-pro-highspeed": "Kimi K3.1 Pro (HighSpeed)",
     "kimi-for-coding": "Kimi for Coding",
     "kimi-for-coding-highspeed": "Kimi for Coding (HighSpeed)",
     # DeepSeek
@@ -196,6 +201,20 @@ MODEL_LABELS: dict[str, str] = {
     "qwen3-coder-next": "Qwen3 Coder Next",
     "qwen3-coder:480b": "Qwen3 Coder 480B",
     "qwen3.5:397b": "Qwen3.5 397B",
+    # Cloudflare Workers AI
+    "@cf/zai-org/glm-5.3": "GLM-5.3",
+    "@cf/zai-org/glm-5.3-flash": "GLM-5.3 Flash",
+    "@cf/moonshotai/kimi-k2.7-code": "Kimi K2.7 Code",
+    "@cf/deepseek-ai/deepseek-v4.1-flash-1017": "DeepSeek V4.1 Flash",
+    "@cf/deepseek-ai/deepseek-v4-pro-0813": "DeepSeek V4 Pro",
+    "@cf/zai-org/glm-5.2": "GLM-5.2",
+    "@cf/moonshotai/kimi-k2.6": "Kimi K2.6",
+    "@cf/qwen/qwen3.8-27b": "Qwen 3.8 27B",
+    "@cf/google/gemma-4-26b-a4b-it": "Gemma 4 26B A4B",
+    "@cf/nvidia/nemotron-3-120b-a12b": "Nemotron 3 120B A12B",
+    "@cf/openai/gpt-oss-120b": "GPT-OSS 120B",
+    "@cf/openai/gpt-oss-20b": "GPT-OSS 20B",
+    "@cf/zai-org/glm-4.7-flash": "GLM-4.7 Flash",
     # Thinking Machines
     "thinkingmachines/Inkling": "Inkling",
     "thinkingmachines/Inkling-Small": "Inkling Small",
@@ -219,6 +238,7 @@ PROVIDER_DEFAULT_MODEL: dict[ModelProvider, str] = {
     ModelProvider.TOGETHER: "moonshotai/Kimi-K2.7-Code",
     ModelProvider.DASHSCOPE: "qwen3-coder-plus",
     ModelProvider.OLLAMA_CLOUD: "gpt-oss:20b",
+    ModelProvider.CLOUDFLARE_WORKERS_AI: "@cf/zai-org/glm-5.3",
     # Hardcoded on purpose: regenerating the OpenRouter catalog reorders it by
     # live usage, and that must never silently change what new users get.
     ModelProvider.OPENROUTER: "moonshotai/kimi-k3",
@@ -265,6 +285,8 @@ def _api_key_env(provider: ModelProvider) -> str:
         return ""
     if provider == ModelProvider.OLLAMA_CLOUD:
         return "OLLAMA_API_KEY"
+    if provider == ModelProvider.CLOUDFLARE_WORKERS_AI:
+        return "CLOUDFLARE_API_TOKEN"
     if provider == ModelProvider.THINKING_MACHINES:
         # Thinking Machines documents TINKER_API_KEY, not THINKING_MACHINES_API_KEY.
         return "TINKER_API_KEY"

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/settings.py

@@ -311,6 +311,9 @@ class CliSettings:
     # Custom model endpoints keyed by endpoint id (provider value "custom:<id>").
     # Additive optional field — absent in older files -> empty mapping.
     custom_endpoints: dict[str, dict] = field(default_factory=dict)
+    # Account that scopes Cloudflare Workers AI requests (not a secret; the API
+    # token lives in api_keys). Additive optional field — absent -> None.
+    cloudflare_account_id: Optional[str] = None
     schema_version: int = SETTINGS_SCHEMA_VERSION
     # The document this instance was loaded from, used as the merge base by
     # SettingsStore.save(). Never serialized.
@@ -376,6 +379,8 @@ class CliSettings:
             compression_threshold=_coerce_compression_threshold(data.get("compression_threshold")),
             # Additive optional field; absent in older files -> empty mapping.
             custom_endpoints=_coerce_custom_endpoints(data.get("custom_endpoints")),
+            # Additive optional field; absent in older files -> None.
+            cloudflare_account_id=_coerce_optional_text(data.get("cloudflare_account_id")),
         )
 
     def to_dict(self) -> dict:
@@ -408,6 +413,7 @@ class CliSettings:
             "skills_enabled": self.skills_enabled,
             "compression_threshold": self.compression_threshold,
             "custom_endpoints": self.custom_endpoints,
+            "cloudflare_account_id": self.cloudflare_account_id,
         }
 
     def get_api_key(self, provider: str) -> Optional[str]:

{kolega_code-0.45.0 → kolega_code-0.46.0}/kolega_code/cli/tui/agent_runtime.py

@@ -1628,6 +1628,8 @@ class AgentRuntimeMixin(tui_app_base.KolegaAppBase):
             if event.sub_agent_info:
                 self._note_sub_agent_status(event)
             else:
+                if event.content.get("resumed") and self._turn_status_text != "Waiting for response…":
+                    return
                 text = self._display_text_from_event(event)
                 if text:
                     if self.show_logs: