dulus 3.11.2__tar.gz → 3.11.4__tar.gz

{dulus-3.11.2/dulus.egg-info → dulus-3.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dulus
-Version: 3.11.2
+Version: 3.11.4
 Summary: Provider-independent agent runtime for the terminal — cloud and local models, real tools, MCP, plugins, memory, sub-agents, and Dulus OS.
 Author-email: KevRojo <dev@dulus.ai>
 Maintainer-email: KevRojo <dev@dulus.ai>

{dulus-3.11.2 → dulus-3.11.4}/docs/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.11.4] - 2026-08-19
+
+### Fixed
+- **Web chat no longer stutters on long replies.** The streaming bubble
+  re-parsed the whole markdown document and re-highlighted every code block on
+  each token, and the cost grows with message length. Re-renders are now
+  coalesced into one per animation frame, with a final flush so no tokens are
+  dropped.
+- **Repeated calls to the same tool now complete the right pill.** Five Bash
+  commands in a row kept marking the first pill "done" and left the rest
+  spinning "running" forever. The result now resolves to the newest still-
+  running pill and lands directly beneath it.
+- **A late click on an expired question can no longer fake an answer.**
+  AskUserQuestion banners outlived the agent's 300s timeout, so clicking one
+  afterwards looked "answered" while nobody was listening. Stale entries are
+  now purged before that can happen.
+- **Kimi quota exhaustion is reported honestly.** When a Kimi membership's
+  billing-cycle quota is spent, the API answers `403 access_terminated_error`
+  — which Dulus used to misread as an invalid API key, sending you to mint a
+  new key that cannot help (quota is billed per account). It now says what
+  happened and points at `/model`.
+- **`/login kimi force` actually switches accounts now.** It skipped the
+  "already logged in" check but left the stored refresh token and device id in
+  place, so the device flow silently re-bound the same account. Both are wiped
+  first.
+- **Removed a duplicated line in the Ollama streaming loop.** Harmless but
+  dead.
+
 ## [3.11.1] - 2026-08-18
 
 ### Fixed

{dulus-3.11.2 → dulus-3.11.4}/docs/news.md

@@ -2,6 +2,8 @@
  
 ## 🔥🔥🔥 News (Pacific Time)
 
+- August 19, 2026 (**v3.11.4**): **🩹 Web chat polish + honest Kimi errors.** Long replies no longer stutter (streaming re-renders are coalesced to one per frame), repeated calls to the same tool complete the right pill instead of leaving the rest spinning forever, and a late click on an expired question can't fake an answer anymore. On the Kimi side: a spent membership quota is now reported as quota — not as a bogus "invalid API key" — and `/login kimi force` wipes the old session and device id so switching accounts actually works. `pip install --upgrade dulus`. 🦅🇩🇴
+
 - August 18, 2026 (**v3.11.1**): **🔧 Kimi Code connects again.** Kimi moved its coding endpoint from `api.kimi.com` to `api.kimi.ai`, and Dulus only knew the old address — so requests to the new one went out without the user-agent Kimi requires and bounced back with a 403. Dulus now recognizes both hosts, so `kimi-code` and `/login kimi` models talk to Kimi cleanly again. `pip install --upgrade dulus`. 🦅🇩🇴
 
 - August 17, 2026 (**v3.11.0**): **🧬 Profiles are real agents now.** A profile always had its own `plugins/`, `skills/` and `memory/` — but almost nothing read them, and switching profiles only ever *added* tools, so you'd see plugins you couldn't actually use. Every one of those paths is now scoped to the active profile: a named profile is **lean** by default (its own stuff plus the bundled skills), reads only its own memory, and can't accidentally uninstall a plugin out from under your other profiles. `/profile inherit <name> on` if you want one that sees everything. Your `default` profile is untouched.

{dulus-3.11.2 → dulus-3.11.4/dulus.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dulus
-Version: 3.11.2
+Version: 3.11.4
 Summary: Provider-independent agent runtime for the terminal — cloud and local models, real tools, MCP, plugins, memory, sub-agents, and Dulus OS.
 Author-email: KevRojo <dev@dulus.ai>
 Maintainer-email: KevRojo <dev@dulus.ai>

{dulus-3.11.2 → dulus-3.11.4}/dulus.egg-info/SOURCES.txt

@@ -341,6 +341,7 @@ tests/test_composio_tool_generator.py
 tests/test_diff_view.py
 tests/test_diff_visualization.py
 tests/test_display_blocks.py
+tests/test_dulus_account.py
 tests/test_export_import.py
 tests/test_grok_usage.py
 tests/test_hook_engine.py

{dulus-3.11.2 → dulus-3.11.4}/dulus.py

@@ -380,7 +380,7 @@ try:
     from importlib.metadata import version as _pkg_version
     VERSION = _pkg_version("dulus")
 except Exception:
-    VERSION = "3.11.2"  # dev fallback — keep in sync with pyproject.toml
+    VERSION = "3.11.4"  # dev fallback — keep in sync with pyproject.toml
 
 # ── ANSI helpers (used even with rich for non-markdown output) ─────────────
 from common import C, clr, info, ok, warn, err, stream_thinking, sanitize_text
@@ -3246,11 +3246,7 @@ def cmd_harvest(_args: str, _state, config) -> bool:
                     info("Login page detected. Please log in manually, then press ENTER here...")
                     input()
 
-                # claude.ai is a long-lived SPA that never reaches "networkidle"
-                # (it keeps streaming/websocket connections open), so that wait
-                # always burned the full 30s and timed out. Wait for the DOM
-                # instead and give it a real ceiling.
-                page.goto("https://claude.ai/new", wait_until="domcontentloaded", timeout=60000)
+                page.goto("https://claude.ai/new", wait_until="networkidle")
                 time.sleep(2)
 
                 user_agent = page.evaluate("navigator.userAgent") if browser.pages else ""
@@ -9171,6 +9167,41 @@ def cmd_login(args: str, _state, config) -> bool:
     """
     sub = (args or "").strip().lower()
 
+    # ── Dulus account (OAuth 2.0 + PKCE against Dulus's own API) ──
+    # Unlike the provider logins below, this one authenticates you to Dulus
+    # itself, so the CLI can reach the Dulus API without an API key pasted in
+    # by hand. `/login dulus key` mints a dulus_sk_* key for CI and servers.
+    if sub.split(" ")[0] in ("dulus", "account"):
+        import dulus_account
+
+        rest = (args or "").strip().split()
+        force = "force" in rest
+        if len(rest) > 1 and rest[1] in ("key", "apikey", "api-key"):
+            name = rest[2] if len(rest) > 2 else "cli"
+            dulus_account.create_api_key(name, notify=lambda m: print(clr(m, "cyan")))
+            return True
+
+        if not force:
+            store = dulus_account.load_store()
+            if store.get("access_token") and not dulus_account._token_expired(store):
+                print(clr("✅ Dulus account already signed in.", "green"))
+                print(clr("Use `/login dulus force` to sign in again, or `/login dulus key` to mint an API key.", "green"))
+                return True
+
+        if force:
+            dulus_account.clear_store()
+        print(clr("Starting Dulus sign-in (OAuth 2.0 + PKCE)…", "cyan"))
+        try:
+            token = dulus_account.login(notify=lambda m: print(clr(m, "cyan")))
+        except Exception as e:
+            token = None
+            print(clr(f"Sign-in error: {e}", "red"))
+        if token:
+            print(clr("✅ Signed in to your Dulus account.", "green"))
+            return True
+        print(clr("Could not sign in. Re-run `/login dulus`.", "yellow"))
+        return True
+
     # ── Claude / Anthropic subscription OAuth (no API key, no cookie webbridge) ──
     # Mirrors the Grok flow: opens claude.ai in the browser, you approve and paste
     # back the code, Dulus exchanges it for an OAuth token. claude-* models then run
@@ -9258,7 +9289,10 @@ def cmd_login(args: str, _state, config) -> bool:
     # /login kimi — Kimi membership via the official Kimi Code CLI device OAuth.
     # Reuses ~/.kimi-code credentials when present; otherwise opens auth.kimi.com.
     if sub.split(" ")[0] in ("kimi", "kimi-oauth", "moonshot-oauth"):
-        from providers import _kimi_oauth_login, _kimi_oauth_get_token
+        from providers import (
+            _kimi_oauth_login, _kimi_oauth_get_token,
+            _kimi_oauth_clear_store,
+        )
         force = "force" in (args or "").lower()
         if not force:
             tok = _kimi_oauth_get_token(config)
@@ -9266,6 +9300,13 @@ def cmd_login(args: str, _state, config) -> bool:
                 print(clr("✅ Kimi OAuth session already active (Kimi membership, no API key).", "green"))
                 print(clr("kimi-oauth/* models use your Kimi membership automatically. Use `/login kimi force` to re-login.", "green"))
                 return True
+        else:
+            # A fresh device flow is not enough to switch accounts: the stored
+            # refresh token revives the old session and the persisted device id
+            # keeps us bound to it. Wipe both so the login binds cleanly.
+            removed = _kimi_oauth_clear_store()
+            if removed:
+                print(clr(f"Cleared previous Kimi session ({', '.join(removed)}).", "cyan"))
         print(clr("Starting Kimi membership login (device OAuth via auth.kimi.com)…", "cyan"))
         print(clr("A browser will open — approve the shown device code with your Kimi account.", "cyan"))
         try:

{dulus-3.11.2 → dulus-3.11.4}/providers.py

@@ -91,15 +91,6 @@ class _ProviderRetry:
         # Rate limit / server overload
         if "429" in msg or "rate limit" in msg or "too many requests" in msg:
             return True
-        # Capacity pushback. Anthropic answers 529 "overloaded_error" and other
-        # providers say "overloaded"/"capacity"/"server is busy" with assorted
-        # status codes; the next request usually succeeds, so this is exactly
-        # the case worth absorbing silently instead of surfacing to the user.
-        if ("529" in msg or "overloaded" in msg or "over capacity" in msg
-                or "at capacity" in msg or "server is busy" in msg
-                or "model is currently loading" in msg
-                or type(exc).__name__ in ("OverloadedError", "InternalServerError")):
-            return True
         # Server errors
         if "500" in msg or "502" in msg or "503" in msg or "504" in msg:
             return True
@@ -5253,6 +5244,13 @@ def friendly_api_error(exc: Exception) -> str:
     s = str(exc).lower()
     etype = type(exc).__name__
 
+    # Kimi Code quota. Checked before the generic auth/permission branches: the
+    # payload carries a 403 and the word "access", which would otherwise be read
+    # as a bad key. Quota is billed per ACCOUNT, so a new key changes nothing.
+    if "access_terminated_error" in s:
+        return ("Kimi membership quota is spent for this billing cycle. It is billed per "
+                "account, so a new API key won't help — switch model with /model, or wait "
+                "for the cycle to reset.")
     # Auth / key problems
     if "authentication" in s or "invalid_api_key" in s or "401" in s or etype == "AuthenticationError":
         return "API key is missing or invalid. Run /config <provider>_api_key=... or set the env var."
@@ -5532,13 +5530,6 @@ def stream_anthropic(
             yield AssistantTurn(text, tool_calls, 0, 0, thinking=thinking,
                                 thinking_signature=thinking_signature, error=False)
             return
-        # Nothing emitted yet and the failure is transient (529 overloaded, a
-        # blip, a rate limit): let it propagate so _ProviderRetry can quietly
-        # try again. Turning it into text here would strand the retry wrapper,
-        # which only ever sees a well-behaved generator. Once output has been
-        # emitted a retry would duplicate it, so those still report.
-        if not text and not tool_calls and _ProviderRetry.is_retryable(_e):
-            raise
         msg = friendly_api_error(_e)
         yield TextChunk(msg)
         yield AssistantTurn(msg, [], 0, 0, error=True)
@@ -6167,11 +6158,6 @@ def stream_openai_compat(
                 {**config, "_modelstudio_remaining": _ms_remaining[1:]},
             )
             return
-        # Transient capacity pushback before the stream opened: propagate so
-        # _ProviderRetry absorbs it silently. This is the create() call, so
-        # nothing has been emitted yet and a retry cannot duplicate output.
-        if _ProviderRetry.is_retryable(e):
-            raise
         msg = friendly_api_error(e)
         yield TextChunk(msg)
         yield AssistantTurn(msg, [], 0, 0, error=True)
@@ -6187,10 +6173,6 @@ def stream_openai_compat(
                 {**config, "_modelstudio_remaining": _ms_remaining[1:]},
             )
             return
-        # Same as above: still inside the create() call, so a transient failure
-        # can be retried without duplicating anything.
-        if _ProviderRetry.is_retryable(e):
-            raise
         msg = friendly_api_error(e)
         yield TextChunk(msg)
         yield AssistantTurn(msg, [], 0, 0, error=True)
@@ -6841,7 +6823,6 @@ def stream_ollama(
                     yield ThinkingChunk(_thinking_buffer)
                     _thinking_buffer = ""
 
-            content = msg.get("content", "") if "content" in msg else ""
             content = msg.get("content", "") if "content" in msg else ""
             if content:
                 # Flush thinking buffer before content
@@ -6985,6 +6966,28 @@ def _kimi_oauth_save_store(data: dict) -> None:
     _oauth_save_store(_kimi_oauth_store_path(), data)
 
 
+def _kimi_oauth_clear_store() -> list[str]:
+    """Delete the Kimi OAuth session *and* the device identity.
+
+    A plain re-login is not enough to switch Kimi accounts: the refresh token in
+    ``kimi_oauth.json`` silently revives the previous session, and the stable
+    ``kimi_device_id`` keeps the host tied to the old device. Both files have to
+    go before the device flow can bind a different account.
+
+    Returns the names of the files actually removed (for user feedback).
+    """
+    removed: list[str] = []
+    for path in (_kimi_oauth_store_path(), _oauth_store_path("kimi_device_id")):
+        try:
+            path.unlink()
+            removed.append(path.name)
+        except FileNotFoundError:
+            pass
+        except OSError:
+            pass
+    return removed
+
+
 def _kimi_device_headers() -> dict:
     """X-Msh-* device identity headers the official CLI sends on OAuth calls.