pythinker-code 0.24.0__tar.gz → 0.25.0__tar.gz

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 0.24.0
+Version: 0.25.0
 Summary: Pythinker Code is your next CLI agent.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Mohamed Elkholy
@@ -28,7 +28,7 @@ Requires-Dist: loguru>=0.6.0,<0.7
 Requires-Dist: prompt-toolkit==3.0.52
 Requires-Dist: pillow==12.2.0
 Requires-Dist: pyyaml==6.0.3
-Requires-Dist: rich==14.2.0
+Requires-Dist: rich==15.0.0
 Requires-Dist: certifi>=2025.10.5
 Requires-Dist: click==8.3.0
 Requires-Dist: pyperclip==1.11.0
@@ -115,15 +115,16 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.24.0
+## 🆕 What's New in 0.25.0
 
-- **Update prompt is now wired and highlighted.** The blocking 4-choice update menu was defined but never invoked — users only ever saw the passive toast. It now runs before the auto-update path in every interactive session, and the status-line notice renders in bold bright-yellow.
-- **Complete native installer `Fetch` fix.** The `.exe`, `.deb`, and `.rpm` builds now bundle both `trafilatura` and `justext` data files so `Fetch` no longer crashes with `FileNotFoundError` on stoplists in native installs. PyPI / `pip install` was unaffected.
-- **Atomic "latest" release gating.** `/releases/latest` is no longer flipped until every platform asset is attached, preventing the in-app updater from serving a partially-built release.
-- **Smarter `/update` command.** Gets a fresh PyPI version and verifies the platform binary exists on the release before initiating a native upgrade.
-- **Repository transferred to TechMatrix-labs.** All URLs now point to `github.com/TechMatrix-labs/pythinker-code`.
+- **`Fetch` re-checks every redirect hop against the SSRF guard.** Redirects were followed without re-validating the destination, so a public URL could redirect to a link-local address (e.g. a cloud metadata endpoint) and slip past the guard. Every hop is now re-validated, closing the public→link-local bypass.
+- **Web domain allowlist for `Fetch` and `Search`.** Set `web.allowed_domains` to restrict which hosts the web tools may reach — `Fetch` (every redirect hop included) and `Search` reject anything off the list. Leave it unset to keep web access unrestricted.
+- **Crash-consistent background tasks.** Task state is serialised under a cross-process lock, terminal updates route through a single finalizer, and recovery reconciles records left divergent by a crash or kill without clobbering a live agent. Bash output is capped (default 50 MiB), kills escalate SIGTERM→SIGKILL, and aged terminal tasks are pruned (default 7 days).
+- **Calmer TUI with live tool feedback.** Tool calls show a "preparing" row during approval, stream shell output as a running tail, and render a live Markdown preview as the model writes. The todo list no longer renders twice mid-turn, links open through a detached launcher, and the terminal is restored to a sane state on `SIGTERM`/`SIGQUIT` and at exit.
+- **Steadier agent loop.** The model is nudged when a turn ends on a bare statement of intent, steered away from blocking on one background task while siblings run, and a `SetTodoList` whose todos arrive as a JSON string is parsed transparently instead of failing validation.
+- **Unified report rendering.** Code review, verify, and security-review output share one standardized renderer, including `report` blocks emitted by skills and agents.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.24.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.25.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -213,7 +214,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.24.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.25.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install TechMatrix-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **<img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux"> — system package** | Download the `.deb` or `.rpm` for your distro below | [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
@@ -238,7 +239,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.24.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.25.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -249,13 +250,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.24.0.exe
+.\PythinkerSetup-0.25.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.24.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.25.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -306,26 +307,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.24.0_amd64.deb
+sudo dpkg -i pythinker-code_0.25.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.24.0_arm64.deb
+sudo dpkg -i pythinker-code_0.25.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.x86_64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.25.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.24.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.25.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.24.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.25.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.24.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.25.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.25.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -334,8 +335,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.24.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.25.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.25.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -365,7 +366,7 @@ at `~/.local/bin/pythinker`.
 curl -fsSL https://pythinker.com/install.sh | bash
 
 # Pin a specific version
-curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.24.0
+curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.25.0
 
 # Custom prefix (defaults to $HOME/.local)
 curl -fsSL https://pythinker.com/install.sh | bash -s -- --prefix /opt/pythinker

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/README.md

@@ -50,15 +50,16 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.24.0
+## 🆕 What's New in 0.25.0
 
-- **Update prompt is now wired and highlighted.** The blocking 4-choice update menu was defined but never invoked — users only ever saw the passive toast. It now runs before the auto-update path in every interactive session, and the status-line notice renders in bold bright-yellow.
-- **Complete native installer `Fetch` fix.** The `.exe`, `.deb`, and `.rpm` builds now bundle both `trafilatura` and `justext` data files so `Fetch` no longer crashes with `FileNotFoundError` on stoplists in native installs. PyPI / `pip install` was unaffected.
-- **Atomic "latest" release gating.** `/releases/latest` is no longer flipped until every platform asset is attached, preventing the in-app updater from serving a partially-built release.
-- **Smarter `/update` command.** Gets a fresh PyPI version and verifies the platform binary exists on the release before initiating a native upgrade.
-- **Repository transferred to TechMatrix-labs.** All URLs now point to `github.com/TechMatrix-labs/pythinker-code`.
+- **`Fetch` re-checks every redirect hop against the SSRF guard.** Redirects were followed without re-validating the destination, so a public URL could redirect to a link-local address (e.g. a cloud metadata endpoint) and slip past the guard. Every hop is now re-validated, closing the public→link-local bypass.
+- **Web domain allowlist for `Fetch` and `Search`.** Set `web.allowed_domains` to restrict which hosts the web tools may reach — `Fetch` (every redirect hop included) and `Search` reject anything off the list. Leave it unset to keep web access unrestricted.
+- **Crash-consistent background tasks.** Task state is serialised under a cross-process lock, terminal updates route through a single finalizer, and recovery reconciles records left divergent by a crash or kill without clobbering a live agent. Bash output is capped (default 50 MiB), kills escalate SIGTERM→SIGKILL, and aged terminal tasks are pruned (default 7 days).
+- **Calmer TUI with live tool feedback.** Tool calls show a "preparing" row during approval, stream shell output as a running tail, and render a live Markdown preview as the model writes. The todo list no longer renders twice mid-turn, links open through a detached launcher, and the terminal is restored to a sane state on `SIGTERM`/`SIGQUIT` and at exit.
+- **Steadier agent loop.** The model is nudged when a turn ends on a bare statement of intent, steered away from blocking on one background task while siblings run, and a `SetTodoList` whose todos arrive as a JSON string is parsed transparently instead of failing validation.
+- **Unified report rendering.** Code review, verify, and security-review output share one standardized renderer, including `report` blocks emitted by skills and agents.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.24.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.25.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -148,7 +149,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.24.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.25.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install TechMatrix-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **<img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux"> — system package** | Download the `.deb` or `.rpm` for your distro below | [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
@@ -173,7 +174,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.24.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.25.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -184,13 +185,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.24.0.exe
+.\PythinkerSetup-0.25.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.24.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.25.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -241,26 +242,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.24.0_amd64.deb
+sudo dpkg -i pythinker-code_0.25.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.24.0_arm64.deb
+sudo dpkg -i pythinker-code_0.25.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.x86_64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.25.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.24.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.25.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.24.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.25.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.24.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.25.0/pythinker-code-0.25.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.25.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.25.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -269,8 +270,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.24.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.25.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.25.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -300,7 +301,7 @@ at `~/.local/bin/pythinker`.
 curl -fsSL https://pythinker.com/install.sh | bash
 
 # Pin a specific version
-curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.24.0
+curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.25.0
 
 # Custom prefix (defaults to $HOME/.local)
 curl -fsSL https://pythinker.com/install.sh | bash -s -- --prefix /opt/pythinker

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "0.24.0"
+version = "0.25.0"
 description = "Pythinker Code is your next CLI agent."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -32,7 +32,7 @@ dependencies = [
     "prompt-toolkit==3.0.52",
     "pillow==12.2.0",
     "pyyaml==6.0.3",
-    "rich==14.2.0",
+    "rich==15.0.0",
     "certifi>=2025.10.5",
     "click==8.3.0",
     "pyperclip==1.11.0",
@@ -175,4 +175,16 @@ reviewr = "reviewr"
 fnd = "fnd"
 edn = "edn"
 Encrypter = "Encrypter"
+# Hex session IDs (e.g. 06ba6c38) contain "ba".
+ba = "ba"
 uest = "uest"
+# Verb stems in the unfinished-intent detection regex (soul/pythinkersoul.py)
+# match word prefixes ("prepar" → prepare/preparing); kept as bare stems on
+# purpose so they cover every inflection.
+prepar = "prepar"
+generat = "generat"
+provid = "provid"
+updat = "updat"
+examin = "examin"
+continu = "continu"
+

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/CHANGELOG.md

@@ -15,6 +15,20 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+## 0.25.0 (2026-05-29)
+
+### What changed in this release
+
+- **`Fetch` now re-checks every redirect hop against the SSRF guard.** Redirects were followed without re-validating the destination, so a public URL could redirect to a link-local address (e.g. a cloud metadata endpoint) and slip past the guard that only inspected the original URL. Redirects are now followed manually and every hop is re-validated, closing the public→link-local bypass.
+- **Web domain allowlist for `Fetch` and `Search`.** A new `web.allowed_domains` config option restricts which hosts the web tools may reach. When set, `Fetch` (including every redirect hop) and `Search` reject any host outside the list; leave it unset to keep web access unrestricted.
+- **Crash-consistent background tasks.** Task and agent-task state is now serialised under a cross-process per-task lock, so a worker heartbeat landing mid-update is no longer lost. Every terminal agent-task update routes through a single finalizer that writes the authoritative runtime first, and recovery reconciles records left divergent by a crash or kill without ever clobbering a live agent. Bash task output is capped (default 50 MiB) so a chatty task cannot exhaust disk, terminated processes get a SIGTERM→SIGKILL fallback, and aged terminal task directories are pruned (default 7 days).
+- **Calmer, more reliable TUI.** The todo list no longer renders twice during an in-flight turn, OAuth and feedback links open through a detached browser launcher so browser output cannot corrupt the terminal or steal key presses, and the terminal is restored to a sane state on `SIGTERM`/`SIGQUIT` and at exit.
+- **Live tool-execution feedback.** Tool calls now show a calm "preparing" row during approval and hooks, switch to a live status once execution starts, and stream shell `stdout`/`stderr` as a running tail before the final result lands. The composing assistant block renders a live Markdown preview as the model writes, code blocks gain clearer framing, and the active spinner uses smoother braille dots.
+- **Steadier agent loop.** The model is nudged once when a turn ends on a bare statement of intent with no tool call, steered away from blocking on a single background task while siblings are still running, and a `SetTodoList` call whose todos arrive as a JSON-encoded string is now parsed transparently instead of failing validation.
+- **Unified report rendering.** Code review, verify, and security-review output now share one standardized, muted report renderer — including `report` blocks emitted by skills and agents; a malformed block falls back to ordinary markdown rather than being swallowed.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.25.0`, or use the native installer for your OS (see the README install table).
+
 ## 0.24.0 (2026-05-28)
 
 ### What changed in this release

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/agents/default/code_reviewer.yaml

@@ -51,6 +51,7 @@ agent:
     Use to run a read-only diff-focused code review or code-reviewr-derived PR artifact workflow on the current branch.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
     - "pythinker_code.tools.skill:ReadSkill"

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/agents/default/debugger.yaml

@@ -36,6 +36,7 @@ agent:
     Use for failing tests, stack traces, runtime errors, flaky failures, or debugging requests where root cause should be found before editing code.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
   exclude_tools:

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/agents/default/security_reviewer.yaml

@@ -44,6 +44,7 @@ agent:
     Use to run a diff-only security review on the current branch. Can run in parallel with `code-reviewer`.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/agents/default/system.md

@@ -39,6 +39,21 @@ For any codebase, architecture, debugging, security, performance, planning, or "
 
 **Professional handoff format:** For substantial tasks, keep a visible plan/todo and structure work as `context -> assessment -> plan -> execution -> verification -> residual risks`. Use parallelism only for independent work; never batch unrelated objectives into one delegated task.
 
+**Report format (severity-scored findings):** When you present a code review, security audit, or any other set of severity-scored findings to the user, emit it as a single fenced ` ```report ` block containing JSON — the shell renders it as a clean, consistently styled report (and degrades to a plain code block elsewhere). Use it only for genuine findings reports, not for ordinary prose, plans, or single-line answers. Schema:
+
+```report
+{
+  "title": "Code Review Results",
+  "scope": "one-line context, e.g. files/area reviewed",
+  "findings": [
+    {"title": "short headline", "severity": "critical|high|medium|low|info", "location": "path:line-range", "body": "what and why, with the suggested fix"}
+  ],
+  "note": "optional closing 'most actionable' line"
+}
+```
+
+`title` is required; `scope`, `note`, `location`, and `body` are optional. `severity` must be one of the five listed values. Order does not matter — the renderer groups by severity (critical first) and derives the summary tally. Put narrative prose outside the block, before or after it.
+
 # Engineering Discipline
 
 These principles govern every engineering response. They override speed: a slow right answer beats a fast wrong one.
@@ -173,7 +188,7 @@ The operating environment is not in a sandbox. Any actions you do will immediate
 
 ## Date and Time
 
-The current date and time in ISO format is `${PYTHINKER_NOW}`. This is only a reference for you when searching the web, or checking file modification time, etc. If you need the exact time, use Shell tool with proper command.
+The current date and time in ISO format is `${PYTHINKER_NOW}`. Treat this as the authoritative present — it reflects the real "now", which is later than your training data suggests. Anchor all reasoning about the current date, the year, recency, and what counts as the "latest" version or release to `${PYTHINKER_NOW}`; do not fall back on an earlier year you might assume from training. Use it as your reference when searching the web or checking file modification times. If you need the exact time, use the Shell tool with a proper command.
 
 ## Working Directory
 
@@ -246,6 +261,15 @@ Identify the skills that are likely to be useful for the tasks you are currently
 
 Only read skill details when needed to conserve the context window.
 
+# Output Formatting
+
+Your responses are rendered as Markdown in a terminal. Emit well-formed Markdown so it renders cleanly:
+
+- **Tables:** put the header row on its own line, the `|---|---|` delimiter row on the immediately following line (no blank line between them), and one row per line. Never glue a table onto adjacent prose (e.g. `Findings| Col |`) and never cram multiple rows onto one line. Leave a blank line before and after the table.
+- Prefer a short bullet list over a table when there are only a few items or any cell is long; reserve tables for genuinely tabular data with short cells.
+- **Code fences are for code only.** Use triple-backtick blocks tagged with a language (for example, `python` or `toml`) solely for source, config, or commands — one snippet per block. Never wrap a prose report, finding list, checklist, or ASCII box in a fence to align or frame it; write it as normal Markdown (headings, bullets, tables) so it renders cleanly.
+- **Status icons sparingly.** A check/cross/dot can mark a single headline result, but do not prefix every line with one. Use plain words for severity and outcomes (e.g. `High`, `PASS`, `0 findings`). The terminal renders icons as calm monochrome glyphs only outside code fences — another reason not to box reports.
+
 # Ultimate Reminders
 
 At any time, you should be HELPFUL, CONCISE, and ACCURATE. Be thorough in your actions — test what you build, verify what you change — not in your explanations.

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/auth/github_feedback.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import asyncio
 import time
-import webbrowser
 from dataclasses import dataclass
 from typing import Any, cast
 
@@ -150,7 +149,9 @@ async def login_github_feedback(
     )
     if open_browser:
         try:
-            webbrowser.open(auth.verification_uri)
+            from pythinker_code.utils.term import open_url_in_browser
+
+            open_url_in_browser(auth.verification_uri)
         except Exception as exc:
             logger.warning("Failed to open browser: {error}", error=exc)
     yield OAuthEvent("waiting", "Waiting for GitHub authorization...")

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/auth/oauth.py

@@ -10,7 +10,6 @@ import sys
 import tempfile
 import time
 import uuid
-import webbrowser
 from collections.abc import AsyncGenerator, AsyncIterator
 from contextlib import asynccontextmanager, suppress
 from dataclasses import dataclass
@@ -660,7 +659,9 @@ async def login_pythinker_code(
         )
         if open_browser:
             try:
-                webbrowser.open(auth.verification_uri_complete)
+                from pythinker_code.utils.term import open_url_in_browser
+
+                open_url_in_browser(auth.verification_uri_complete)
             except Exception as exc:
                 logger.warning("Failed to open browser: {error}", error=exc)
 

{pythinker_code-0.24.0 → pythinker_code-0.25.0}/src/pythinker_code/auth/openai.py

@@ -7,7 +7,6 @@ import hashlib
 import json
 import secrets
 import time
-import webbrowser
 from collections.abc import AsyncIterator
 from dataclasses import dataclass
 from typing import Any, cast
@@ -329,7 +328,9 @@ async def _wait_for_browser_code(open_browser: bool = True) -> tuple[str, str, s
 
     auth_url = _build_authorize_url(redirect_uri=redirect_uri, pkce=pkce, state=state)
     if open_browser:
-        webbrowser.open(auth_url)
+        from pythinker_code.utils.term import open_url_in_browser
+
+        open_url_in_browser(auth_url)
 
     try:
         code, error = await asyncio.wait_for(result, timeout=15 * 60)