- Web GUI: a Chat / Agent mode selector. Agent mode runs the coding
agent on `cod serve --root`, shows tool calls as cards, and asks for
approval in the browser; sessions live in .cod/sessions/ and resume
after a restart. Closing the stream stops the turn.
- The API now rejects requests whose Host isn't loopback (DNS rebinding)
and POSTs without the per-process token embedded in the page.
- `explore` tool: a sub-agent on an in-memory session with only
read_file, glob and grep, returning a report; its usage counts toward
the turn.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
- Requests turn on server-side compaction (compact_20260112, default
trigger 150k input tokens); compaction blocks are stored and resent.
- The memory_20250818 tool keeps notes in .cod/memory/, with paths and
symlinks confined to that folder. Whether a session has it is saved in
the session header so the tool list stays fixed across resumes.
- Shell commands run under bwrap when installed: read-only system,
hidden home, writable project and /tmp, read-only .cod/.
- The file tools can no longer write into .cod/, so Claude can't grant
itself permissions.
- The REPL prints token usage after each turn.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
Removes the Pi configs, the placeholder prompt, context, security and
sub-agent modules, and the docs and tests that described them.
Adds src/agent/: a streaming tool-use loop on the Messages API with
file, search and shell tools, permission rules (.cod/settings.json),
append-only JSONL sessions with resume, and a terminal front end
(`cod`, `cod -p`, `--continue`, `--resume`). The web chat now shares the
model table and history rules with the agent.
Keeps the memory store and worktree runner, with a stricter memory key
check and failed workers reported as failed. All tests use a fake client.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
- Keep the last fallback marker in echoed history, so the blocks on both
sides of a mid-output fallback stay in their original shape.
- Report failures that happen before a request is sent (the SDK raises
TypeError when no credentials are configured) as a generic SSE error.
The details go to the server log, not the browser.
- `cod serve` refuses non-loopback hosts unless --allow-remote is passed,
because the chat API has no authentication.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
Model output was escaped before being assigned to innerHTML, but the page
no longer relies on a hand-rolled escaper: Markdown is rendered with
createElement/textContent, and link targets must parse as http(s) URLs.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
The v2 GUI never actually chatted: without a key it showed canned replies
and fake "synthesized" code, and with one it called the API straight from
the browser with the key in localStorage. The server only returned
hardcoded telemetry, and fastapi was not a declared dependency.
- src/web_server.py: POST /api/chat streams a Messages API turn as SSE via
the Anthropic SDK. Credentials stay server-side. Adaptive thinking,
effort, automatic prompt caching and refusal fallbacks are set per
model; requests are validated at the boundary.
- web/index.html: single-page chat with streaming replies, thinking
summaries, Markdown rendering, stop, usage lines and local conversation
history. Drops the duplicate cod_ai_claude_web_gui.html.
- `cod serve` subcommand; anthropic, fastapi and uvicorn declared.
- tests/test_web_server.py covers streaming, history echo, refusals,
fallbacks, errors and validation with a fake client.
- DESIGN.md now documents the real request flow; the duplicate style
guide in docs/ is removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015NGPpYxuPWkyJUoefut3Wo
BillyOutlast