v2.3.0 "Platform" — TUI mode, web dashboard, themes, rate limiting

Version bump 2.2.0 → 2.3.0 with full changelog, roadmap update,
and README additions for all new features (--tui, --dashboard,
--doctor, --theme, --no-stream flags; /doctor, /toolcost, /rate,
/theme slash commands; TUI and dashboard architecture sections).

1035 tests, 0 failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Ascendral

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [2.3.0] — 2026-03-02
+
+### Added
+- **TUI mode** (`--tui`) — full terminal UI with plan/output/details panels, keyboard-driven navigation (Tab=cycle, arrows=scroll, y/n=approve/deny, q=quit), real-time step tracking
+- **Web dashboard** (`--dashboard`) — local browser UI on port 3120 with session history, audit chain viewer with integrity verification, metrics summary, and SARIF export
+- **Theme system** (`--theme <name>`) — dark, light, and mono themes with semantic color roles; respects `NO_COLOR` env; persisted in config; `/theme` slash command
+- **Provider-aware rate limiting** — proactive sliding-window RPM/TPM tracking per provider (Anthropic, OpenAI, Gemini, DeepSeek, Groq, Mistral, xAI); automatic backoff on 429; `/rate` slash command
+- **Per-tool cost breakdown** — `TokenTracker.getToolCostBreakdown()` with per-tool input/output tokens, USD cost, call count, and percentage of total; `/toolcost` slash command
+- **`codebot doctor`** (`--doctor`) — 12 environment health checks (Node, npm, config, sessions, audit integrity, disk, local LLM, cloud API keys, encryption, git, Docker); `/doctor` slash command
+- **Enhanced streaming display** — `streamingIndicator()` with tokens/sec, `budgetBar()` with color gradient, `costBadge()` for REPL prompt, `timedStep()` for step timing, `collapsibleSection()` for verbose output
+- **TUI layout engine** — `LayoutEngine` with panel management, focus cycling, scroll, bordered rendering; `Screen` abstraction with alt screen buffer; `KeyboardListener` with raw stdin parsing
+- **Dashboard REST API** — 9 endpoints: `/api/health`, `/api/sessions` (paginated), `/api/sessions/:id`, `/api/audit` (filterable), `/api/audit/verify`, `/api/audit/:sessionId`, `/api/metrics/summary`, `/api/usage`, `POST /api/audit/export`
+- **`--no-stream` flag** — disable streaming token display
+
+### Changed
+- CLI help text updated with all new flags (`--tui`, `--dashboard`, `--doctor`, `--theme`, `--no-stream`)
+- UI component library: hardcoded colors replaced with theme-aware `getTheme().colors`
+- Banner system: local color constants replaced with theme integration
+- Agent loop: yields `stream_progress` events every 500ms during LLM streaming
+- Agent loop: `ProviderRateLimiter` integrated — acquire/release/backoff around provider calls
+- Tests: 907 → 1035+ (128 new tests across 12 test files)
+
+### Security
+- Dashboard server binds to `127.0.0.1` only (no network exposure)
+- Dashboard static file serving prevents directory traversal
+- Dashboard frontend uses `escapeHtml()` for all user-data rendering (XSS prevention)
+- Audit chain verification endpoint validates SHA-256 hash chains
+
+
 ## [2.2.0] — 2026-03-02
 
 ### Added

README.md

@@ -4,7 +4,7 @@
 [![npm version](https://img.shields.io/npm/v/codebot-ai.svg)](https://www.npmjs.com/package/codebot-ai)
 [![license](https://img.shields.io/npm/l/codebot-ai.svg)](https://github.com/zanderone1980/codebot-ai/blob/main/LICENSE)
 [![node](https://img.shields.io/node/v/codebot-ai.svg)](https://nodejs.org)
-![tests](https://img.shields.io/badge/tests-907%20passing-brightgreen)
+![tests](https://img.shields.io/badge/tests-1035%2B%20passing-brightgreen)
 ![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)
 ![tools](https://img.shields.io/badge/tools-28-blue)
 
@@ -142,6 +142,11 @@ echo "explain this error" | codebot            # Pipe mode
 --max-iterations <n> Max agent loop iterations (default: 50)
 --no-animate         Disable mascot and banner animations
 --verbose            Show detailed debug output
+--tui                Full terminal UI mode (panels, keyboard nav)
+--dashboard          Start web dashboard on localhost:3120
+--doctor             Run environment health checks
+--theme <name>       Color theme: dark, light, mono
+--no-stream          Disable streaming token display
 ```
 
 ### Interactive Commands
@@ -160,6 +165,10 @@ echo "explain this error" | codebot            # Pipe mode
 /metrics    Show session metrics (token counts, latency, costs)
 /risk       Show risk assessment history
 /config     Show configuration
+/doctor     Run environment health checks
+/toolcost   Show per-tool cost breakdown
+/rate       Show provider rate limit status
+/theme      Switch color theme
 /quit       Exit
 ```
 
@@ -315,7 +324,7 @@ CodeBot is hardened for continuous operation:
 - **Context compaction** — when the conversation exceeds the model's context window, messages are intelligently summarized
 - **Process resilience** — unhandled exceptions and rejections are caught, logged, and the REPL keeps running
 - **Routine timeouts** — scheduled tasks are capped at 5 minutes to prevent the scheduler from hanging
-- **907+ tests** — comprehensive suite covering core agent, security, extension, and action
+- **1035+ tests** — comprehensive suite covering core agent, security, extension, and action
 
 ## Programmatic API
 
@@ -365,6 +374,19 @@ src/
   replay.ts             Session replay
   capabilities.ts       Per-tool capability restrictions
   banner.ts             Mascot and banner animation system
+  theme.ts              Color themes (dark/light/mono)
+  doctor.ts             Environment health checks
+  provider-rate-limiter.ts  Proactive RPM/TPM rate limiting
+  telemetry.ts          Token tracking and cost estimation
+  tui/
+    layout.ts           Panel-based TUI layout engine
+    keyboard.ts         Raw stdin keyboard input handler
+    screen.ts           ANSI terminal screen control
+    tui-mode.ts         Full TUI mode integration
+  dashboard/
+    server.ts           HTTP server (node:http, zero deps)
+    api.ts              REST API for sessions/audit/metrics
+    static/             Browser UI (HTML/CSS/JS)
   context/
     manager.ts          Context window management, LLM-powered compaction
     repo-map.ts         Project structure scanner

ROADMAP.md

@@ -8,8 +8,8 @@
 
 | Metric | Value |
 |--------|-------|
-| Version | 2.2.0 |
-| Tests | 907 passing |
+| Version | 2.3.0 |
+| Tests | 1035+ passing |
 | Tools | 28 built-in + MCP + plugins |
 | Security | 8-layer stack: policy, RBAC, capabilities, risk scoring, path safety, secret detection, SSRF, sandbox |
 | Platforms | CLI, VS Code extension, GitHub Action |
@@ -32,6 +32,7 @@
 | v2.1.5 | Hardened II | RBAC consistency, browser safety, encryption wiring | 559 | Shipped |
 | v2.1.6 | Intelligence | Prompt caching, vision/multimodal, model routing, JSON mode | 586 | Shipped |
 | v2.2.0 | Quality | 907 tests, CLI UI polish, permission cards, cost estimation, browser resilience | 907 | Shipped |
+| v2.3.0 | Platform | TUI mode, web dashboard, theme system, provider rate limiting, doctor | 1035 | Shipped |
 
 ---
 
@@ -65,7 +66,7 @@
 
 ---
 
-## Next: v2.3.0 — Platform
+## Shipped: v2.3.0 — Platform
 
 **Theme:** Run anywhere, for anyone.
 
@@ -92,10 +93,18 @@
 - Streaming response display (token-by-token)
 - Cost budget visualization
 
+### Completed
+- \u2705 TUI mode with 3-panel layout, keyboard navigation, permission dialogs
+- \u2705 Web dashboard with session viewer, audit chain verification, metrics
+- \u2705 Theme system (dark/light/mono) with NO_COLOR support
+- \u2705 Provider-aware rate limiting with sliding-window RPM/TPM
+- \u2705 Per-tool cost breakdown + doctor command (deferred from v2.2.0)
+- \u2705 Enhanced streaming display with budget visualization
+
 ### Gate Criteria
-- TUI prototype working
-- Web dashboard serving locally
-- 900+ tests
+- 1035+ tests, 0 failures \u2705
+- TUI mode working \u2705
+- Web dashboard serving locally \u2705
 
 ---
 
@@ -146,4 +155,4 @@ The only open-source AI coding agent that is:
 - **Provider-agnostic** — any LLM, local or cloud
 - **Zero dependencies** — pure Node.js, no install bloat
 - **Enterprise-ready** — VS Code extension, GitHub Action, CI/CD integration
-- **Tested** — 880+ tests covering every tool and security boundary
+- **Tested** — 1035+ tests covering every tool and security boundary

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebot-ai",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Zero-dependency autonomous AI agent. Code, browse, search, automate. Works with any LLM \u2014 Ollama, Claude, GPT, Gemini, DeepSeek, Groq, Mistral, Grok.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,6 +18,7 @@
     "format:check": "prettier --check 'src/**/*.ts' '*.json' '*.md'",
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf dist",
+    "postbuild": "cp -r src/dashboard/static dist/dashboard/",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -70,6 +71,7 @@
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
+    "dist/dashboard/static/**",
     "!dist/**/*.test.*",
     "bin",
     "README.md",

src/cli.ts

@@ -25,7 +25,7 @@ import { TuiMode } from './tui/tui-mode';
 import { DashboardServer } from './dashboard/server';
 import { registerApiRoutes } from './dashboard/api';
 
-const VERSION = '2.2.0';
+const VERSION = '2.3.0';
 
 let verbose = false;
 

src/index.ts

@@ -1,4 +1,4 @@
-export const VERSION = '2.2.0';
+export const VERSION = '2.3.0';
 export { Agent } from './agent';
 export { OpenAIProvider } from './providers/openai';
 export { AnthropicProvider } from './providers/anthropic';