thincoder 0.7.7 → 0.7.8

package/README.md

@@ -193,6 +193,10 @@ Code conventions: pure `.mjs`, no semicolons, no npm dependencies allowed (inclu
 
 ## Changelog
 
+### 0.7.8 (2026-07)
+- **Provider config flow streamlined**: adding a provider now immediately prompts for API key (no more "go back to /provider → Set Key"). Switching to a keyless provider via `/model` also prompts for key inline. Empty input gives clear "skipped" feedback
+- **bash tool: file writing forbidden**: models must use write/edit/insert_after/apply_patch instead of `echo`/`sed`/`printf > file`. Fixes GBK encoding corruption on Chinese Windows (cmd.exe writes redirected files in ANSI code page, not UTF-8). `PYTHONIOENCODING=utf-8` set for Python subprocesses on Windows
+
 ### 0.7.7 (2026-07)
 - **Code review fixes (4 critical bugs)**:
   - `gitSync` anchor never set after full `codeSync` fallback → fast path was dead in production; now `codeSync`/`docSync` write the anchor on success

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/tools/bash.md

@@ -25,3 +25,4 @@ Notes:
 - Do NOT run destructive commands (rm -rf, force-push, drop table) without explicit user confirmation
 - After commands that change files (git checkout, npm install, etc.), repo_outline and code_search may be stale — re-run them to get current results.
 - Prefer read/glob/grep/ls for file operations inside the project — bash has no directory confinement.
+- NEVER use bash to write or modify files (echo/sed/printf > file, cat << EOF, etc.). Use write/edit/insert_after/apply_patch instead — they handle encoding, escaping, and directory confinement correctly.

package/src/tools.mjs

@@ -600,6 +600,11 @@ const bashTool = {
           try { child.kill("SIGKILL") } catch {} // 组杀失败时兜底杀本体
         }
       }
+      // Windows 中文系统默认代码页是 GBK (CP936)，cmd.exe 重定向写文件时用 ANSI 代码页，
+      // chcp 65001 也改不了重定向的编码。bash 工具写含 CJK 的文件会产生 GBK——
+      // 提示词层已禁止用 bash 写文件（用 write/edit 工具替代），这里设 PYTHONIOENCODING
+      // 覆盖 Python 脚本的 stdout 编码（Python 是唯一可能正确响应环境变量的子进程）
+      const winCmd = process.platform === "win32"
       const child = spawn(args.command, {
         cwd: ctx.cwd,
         shell: true,
@@ -614,6 +619,7 @@ const bashTool = {
           GIT_PAGER: "cat",
           PAGER: "cat",
           TERM: "dumb",
+          ...(winCmd ? { PYTHONIOENCODING: "utf-8" } : {}),
         },
       })
       // stdout / stderr 各自独立解码（同进程通常同编码，但分开收集更干净，

package/src/tui.mjs

@@ -1661,7 +1661,15 @@ export async function startTUI(agent, opts = {}) {
                 await persistRaw((raw) => { raw.providers = agent.providers })
                 pushLabel(`❯ Provider`, ansi.bold + C.tool)
                 pushLine(`Added ${name} (${baseURL} / ${model}）`, C.tool)
-                pushLine(`Next: /provider → Set Key`, C.dim)
+                // 直接接 key 输入，不让用户再绕一圈
+                askQuestion(`Enter API key for ${name} (留空跳过，之后 /provider → Set Key):`).then(async (key) => {
+                  if (key) {
+                    await setProviderKey(name, key)
+                    pushLine(`Key saved for ${name}`, C.tool)
+                  } else {
+                    pushLine(`跳过 key。之后 /provider → Set API Key 配置`, C.dim)
+                  }
+                })
               })
               return
             }
@@ -1680,7 +1688,10 @@ export async function startTUI(agent, opts = {}) {
                 entries: keyEntries,
                 onSelect: (se) => {
                   askQuestion(`Enter API key for ${se.name}:`).then(async (key) => {
-                    if (!key) return
+                    if (!key) {
+                      pushLine(`跳过 key 输入`, C.dim)
+                      return
+                    }
                     await setProviderKey(se.name, key)
                   })
                 },
@@ -2142,7 +2153,16 @@ export async function startTUI(agent, opts = {}) {
     agent.config.activeProvider = item.provider
     pushLabel(`❯ Model`, ansi.bold + C.tool)
     pushLine(`Switched to ${item.provider} / ${item.model}${thresholdNote} (persisted)`, C.tool)
-    if (!agent.provider.apiKey) pushLine(`Provider has no key: /provider → Set Key`, C.warn)
+    if (!agent.provider.apiKey) {
+      pushLine(`Provider has no key`, C.warn)
+      askQuestion(`Enter API key for ${item.provider} (留空跳过):`).then(async (key) => {
+        if (key) {
+          await setProviderKey(item.provider, key)
+        } else {
+          pushLine(`跳过。之后 /provider → Set API Key 配置`, C.dim)
+        }
+      })
+    }
   }
 
   /** /distill：从current会话提取候选，逐条 y/n 确认后入库 */