10 releases 11 tags

RSS feed

• v1.3.0 0d1fb97f98

  Compare

  v1.3.0 — the web companion, a ported compaction engine, and a steadier transcript Stable

  evileko released this 2026-09-17 00:10:23 -04:00 | 24 commits to main since this release

  evilcode v1.3.0 — the web companion, a ported compaction engine, and a steadier transcript

  The headline of this release is the web companion: the daemon now serves a real second frontend, so the roster and the full chat — streaming, interrupts, answers, model and effort switching, commands, spawning — drive the same session from a browser or a phone. Alongside it: the compaction engine ported from omp with overflow recovery and full-document handoff, a four-phase orchestrator swarm with live worker previews, every MCP corner found in review hardened, and a transcript that holds still while you read instead of sliding away.

  What changed

  The web companion (P1–P7)

  • A second frontend in the daemon. The [webui] config table, an embedded app shell with manifest, icons, and security headers, token auth with a handoff cookie and Origin+Host discipline, and -web / -web-addr flags with a startup line and a once-only tokenized URL.
  • A live mirror. An SSE event stream replays the attach sequence against a durable deep-history reader with pagination, so a browser session looks like a TUI window: a live snapshot or stored read-only history per session.
  • The full command surface. Input, interrupt, ask answers, model and effort switching, slash commands, session create and spawn, and the models list — the browser can drive everything the TUI can.
  • Design system. Palette-driven CSS token generation keeps the web theme in step with the TUI's themes, and the transcript engine mirrors streaming, tool rows, and history.
  • Mobile and PWA. Install hint, keyboard shim, touch audit, reconnect resilience, and a wake lock.
  • Network hardening. Tailscale forwarded hosts, proxied same-origin writes, and a trusted-network auth opt-out for homelab use.

  Compaction, ported from omp

  • The engine. A candidate chain with trigger thresholds, per-turn pruning that reclaims superseded reads, and the shake strategy for deterministic reclaim; overflow and incomplete recovery are handled inside agent.Run.
  • Handoff. A full-document continuation strategy for turns that outgrow the window.
  • Storage meta and display. Short summaries and before-tokens land in storage, and the TUI can visualize and inspect what compaction did.
  • Budget discipline. Compaction checks every round, and manual compaction no longer consumes the auto budget. A dedicated embedding model can power semantic memory and compaction relevance, decoupled from the chat choice.

  The orchestrator swarm and grunts

  • Four phases. Parallel spawn scheduling with wait:false, per-call model routing with an audit trail, layered guidance across four layers, and ops knobs — cancel and partial results, a depth flag, and cost rollup — plus live-cap fixes for real reservation counting.
  • Grunts. Workers are named grunt-N off an on-disk high-water mark, preview live in boxes on the start screen and transcript with click-to-expand, and can attach in observe mode.

  MCP hardening

  Nine review gaps closed: per-server call timeouts, every result content type plus structured content, pagination cursors, tools/list_changed refresh reaching the agent, streamable HTTP for hosted servers, an environment allowlist for server subprocesses, dead-server reconnect with surfaced status, prompts and resources adapted into the tool set, and schema diagnostics with a real version and duplicate refusal.

  A steadier transcript

  • Scrolling up holds the window. Reading old context while the agent streams no longer slides away: the window stays put until you scroll back to the bottom, background completions no longer yank it, and their failure notices actually reach the frame.
  • Status lines expire. Transient notices clear after 8 seconds — configurable with display.notice_ttl — instead of going stale; the detach confirm and masked-input prompts stay pinned, and a failed background task becomes a transcript block instead of a flash.
  • Other agents share the streaming line (streaming… · 1 agent · bat) instead of spending their own row.
  • The overscroll reveal got substance. Pulling past the bottom shows the context window with its meter, the cache hit rate (or an honest n/a), the model with its effort and thinking mode, and the location — and it reserves its rows, so it shows even when the window is full.
  • Auto-poke is opt-in. features.auto_poke = true restores the old behavior; the /poke toggle and the orchestrator's save/restore are unchanged.
  • Responses thinking streams. OpenAI Responses models now request a reasoning summary, so thinking deltas reach the TUI instead of opaque encrypted items.

  Daemon and session reliability

  • A daemon holds its socket claim for life; a session is created on the first prompt and an idle daemon stops on quit; stale-socket recovery keeps the lifetime lock through the race.
  • Reasoning-only responses retry instead of ending the turn, restore the normal agentic loop, and stream a thought's last word with the thought.
  • The R2 hardening pass: daemon frames can no longer exceed the client's 8 MiB limit, the replay ring subtracts replaced events, a refused dispatch restores the prompt, workspace confinement fails closed with a descriptor walk, model-run shell commands get an environment allowlist, role fallback chains fire at runtime, the updater verifies checksum manifests, credentials are validated before they are committed, model switching builds its candidate off the lock, and strict decoding repairs the argument shapes real models send. A CI workflow runs the review's minimum gate.

  Install or update

  Fresh install:

  curl -fsSL https://evileko.dev/evilcode | sh
  

  Existing installations can update in place:

  evilcode update
  

  Source builds require Go 1.26 or newer. This release publishes the Linux/amd64 binary evilcode-linux-amd64.

  Verification

  • go build ./...
  • go test ./internal/...
  • go vet ./...

  SHA-256 for evilcode-linux-amd64:

  1cd9ae5049b5a75f5b8ed3e4aeba77203e41f7b02c4f11d6424b6486cd91a9ab
  

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • checksums.txt
    2 downloads · 2026-09-17 00:15:28 -04:00 · 94 B
  • evilcode-linux-amd64
    6 downloads · 2026-09-17 00:11:09 -04:00 · 41 MiB