pythinker-code 0.24.0__tar.gz → 0.26.0__tar.gz

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 0.24.0
+Version: 0.26.0
 Summary: Pythinker Code is your next CLI agent.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Mohamed Elkholy
@@ -28,7 +28,7 @@ Requires-Dist: loguru>=0.6.0,<0.7
 Requires-Dist: prompt-toolkit==3.0.52
 Requires-Dist: pillow==12.2.0
 Requires-Dist: pyyaml==6.0.3
-Requires-Dist: rich==14.2.0
+Requires-Dist: rich==15.0.0
 Requires-Dist: certifi>=2025.10.5
 Requires-Dist: click==8.3.0
 Requires-Dist: pyperclip==1.11.0
@@ -115,15 +115,15 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.24.0
+## 🆕 What's New in 0.26.0
 
-- **Update prompt is now wired and highlighted.** The blocking 4-choice update menu was defined but never invoked — users only ever saw the passive toast. It now runs before the auto-update path in every interactive session, and the status-line notice renders in bold bright-yellow.
-- **Complete native installer `Fetch` fix.** The `.exe`, `.deb`, and `.rpm` builds now bundle both `trafilatura` and `justext` data files so `Fetch` no longer crashes with `FileNotFoundError` on stoplists in native installs. PyPI / `pip install` was unaffected.
-- **Atomic "latest" release gating.** `/releases/latest` is no longer flipped until every platform asset is attached, preventing the in-app updater from serving a partially-built release.
-- **Smarter `/update` command.** Gets a fresh PyPI version and verifies the platform binary exists on the release before initiating a native upgrade.
-- **Repository transferred to TechMatrix-labs.** All URLs now point to `github.com/TechMatrix-labs/pythinker-code`.
+- **Install and update no longer 404 on a freshly published release.** Releases are now published as a prerelease and promoted to "latest" only once every platform asset has uploaded, and the curl/PowerShell installers wait for their archive + checksum before downloading — so `irm | iex` / `curl | bash` run mid-publish no longer fail on a missing installer.
+- **OpenCode Go model catalog refreshes on startup without a re-login.** Bundled catalog changes (new models, corrected provider shapes) now reach existing installs through the every-startup refresh, across both OpenAI- and Anthropic-shaped providers, while preserving your default model and thinking settings.
+- **Homebrew install shows the logo and fails fast on a missing tap token.** `brew install` now prints the robot-head banner via formula caveats, and the tap workflow reports an actionable error when `HOMEBREW_TAP_TOKEN` is missing instead of an opaque git failure.
+- **Markdown and report rendering hardened against real model output.** Code-span pipes inside tables no longer fracture the table, and a `report` block nested inside a documentation fence is no longer wrongly promoted — report fences are now extracted via a markdown-it AST walk.
+- **Steadier agent editing and a restored update prompt.** File-replace edit handling is hardened, subagent prompt persistence and the agent's working language are preserved, and the blocking pre-start update prompt is restored so it runs before every interactive session.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.24.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.26.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -213,7 +213,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.24.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.26.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install TechMatrix-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **<img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux"> — system package** | Download the `.deb` or `.rpm` for your distro below | [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
@@ -238,7 +238,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.24.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.26.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -249,13 +249,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.24.0.exe
+.\PythinkerSetup-0.26.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.24.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.26.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -306,26 +306,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.24.0_amd64.deb
+sudo dpkg -i pythinker-code_0.26.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.24.0_arm64.deb
+sudo dpkg -i pythinker-code_0.26.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.x86_64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.26.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.24.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.26.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.24.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.26.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.24.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.26.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.26.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -334,8 +334,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.24.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.26.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.26.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -365,7 +365,7 @@ at `~/.local/bin/pythinker`.
 curl -fsSL https://pythinker.com/install.sh | bash
 
 # Pin a specific version
-curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.24.0
+curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.26.0
 
 # Custom prefix (defaults to $HOME/.local)
 curl -fsSL https://pythinker.com/install.sh | bash -s -- --prefix /opt/pythinker

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/README.md

@@ -50,15 +50,15 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.24.0
+## 🆕 What's New in 0.26.0
 
-- **Update prompt is now wired and highlighted.** The blocking 4-choice update menu was defined but never invoked — users only ever saw the passive toast. It now runs before the auto-update path in every interactive session, and the status-line notice renders in bold bright-yellow.
-- **Complete native installer `Fetch` fix.** The `.exe`, `.deb`, and `.rpm` builds now bundle both `trafilatura` and `justext` data files so `Fetch` no longer crashes with `FileNotFoundError` on stoplists in native installs. PyPI / `pip install` was unaffected.
-- **Atomic "latest" release gating.** `/releases/latest` is no longer flipped until every platform asset is attached, preventing the in-app updater from serving a partially-built release.
-- **Smarter `/update` command.** Gets a fresh PyPI version and verifies the platform binary exists on the release before initiating a native upgrade.
-- **Repository transferred to TechMatrix-labs.** All URLs now point to `github.com/TechMatrix-labs/pythinker-code`.
+- **Install and update no longer 404 on a freshly published release.** Releases are now published as a prerelease and promoted to "latest" only once every platform asset has uploaded, and the curl/PowerShell installers wait for their archive + checksum before downloading — so `irm | iex` / `curl | bash` run mid-publish no longer fail on a missing installer.
+- **OpenCode Go model catalog refreshes on startup without a re-login.** Bundled catalog changes (new models, corrected provider shapes) now reach existing installs through the every-startup refresh, across both OpenAI- and Anthropic-shaped providers, while preserving your default model and thinking settings.
+- **Homebrew install shows the logo and fails fast on a missing tap token.** `brew install` now prints the robot-head banner via formula caveats, and the tap workflow reports an actionable error when `HOMEBREW_TAP_TOKEN` is missing instead of an opaque git failure.
+- **Markdown and report rendering hardened against real model output.** Code-span pipes inside tables no longer fracture the table, and a `report` block nested inside a documentation fence is no longer wrongly promoted — report fences are now extracted via a markdown-it AST walk.
+- **Steadier agent editing and a restored update prompt.** File-replace edit handling is hardened, subagent prompt persistence and the agent's working language are preserved, and the blocking pre-start update prompt is restored so it runs before every interactive session.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.24.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.26.0`, or use the native installer for your platform from the [Releases page](https://github.com/TechMatrix-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -148,7 +148,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.24.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.26.0.exe` from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install TechMatrix-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **<img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux"> — system package** | Download the `.deb` or `.rpm` for your distro below | [Releases](https://github.com/TechMatrix-labs/pythinker-code/releases/latest) |
@@ -173,7 +173,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.24.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.26.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -184,13 +184,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.24.0.exe
+.\PythinkerSetup-0.26.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.24.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.26.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -241,26 +241,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.24.0_amd64.deb
+sudo dpkg -i pythinker-code_0.26.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.24.0_arm64.deb
+sudo dpkg -i pythinker-code_0.26.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.x86_64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.26.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.24.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.26.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.24.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.26.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm
-curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.24.0/pythinker-code-0.24.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.24.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.24.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.aarch64.rpm
+curl -LO https://github.com/TechMatrix-labs/pythinker-code/releases/download/v0.26.0/pythinker-code-0.26.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.26.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.26.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -269,8 +269,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.24.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.24.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.26.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.26.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -300,7 +300,7 @@ at `~/.local/bin/pythinker`.
 curl -fsSL https://pythinker.com/install.sh | bash
 
 # Pin a specific version
-curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.24.0
+curl -fsSL https://pythinker.com/install.sh | bash -s -- --version 0.26.0
 
 # Custom prefix (defaults to $HOME/.local)
 curl -fsSL https://pythinker.com/install.sh | bash -s -- --prefix /opt/pythinker

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "0.24.0"
+version = "0.26.0"
 description = "Pythinker Code is your next CLI agent."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -32,7 +32,7 @@ dependencies = [
     "prompt-toolkit==3.0.52",
     "pillow==12.2.0",
     "pyyaml==6.0.3",
-    "rich==14.2.0",
+    "rich==15.0.0",
     "certifi>=2025.10.5",
     "click==8.3.0",
     "pyperclip==1.11.0",
@@ -175,4 +175,16 @@ reviewr = "reviewr"
 fnd = "fnd"
 edn = "edn"
 Encrypter = "Encrypter"
+# Hex session IDs (e.g. 06ba6c38) contain "ba".
+ba = "ba"
 uest = "uest"
+# Verb stems in the unfinished-intent detection regex (soul/pythinkersoul.py)
+# match word prefixes ("prepar" → prepare/preparing); kept as bare stems on
+# purpose so they cover every inflection.
+prepar = "prepar"
+generat = "generat"
+provid = "provid"
+updat = "updat"
+examin = "examin"
+continu = "continu"
+

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/CHANGELOG.md

@@ -15,6 +15,33 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+## 0.26.0 (2026-05-30)
+
+### What changed in this release
+
+- **Install and update no longer 404 on a freshly published release.** The 0.24.0 "atomic latest" gate turned out to be dead code — it ran only on a `release: published` event that a token-created release never fires, and did not affect `/releases/latest` anyway. The GitHub Release is now created as a **prerelease**, and a new `promote-release.yml` runs on the tag push, waits for every platform asset to finish uploading, then clears the prerelease flag and marks the release latest — the single point at which a version becomes resolvable by installers and the in-app updater. As defense-in-depth, the curl and PowerShell installers now resolve the newest release that actually carries their platform asset (skipping drafts and prereleases) and wait for the archive plus checksum before downloading, so `irm | iex` / `curl | bash` run during the publish window no longer fail on a missing `PythinkerSetup-<ver>.exe` or archive.
+- **OpenCode Go model catalog refreshes on every startup without a re-login.** Bundled catalog changes — new models, corrected provider shapes — previously reached an existing install only after a manual `pythinker login --opencode-go`. OpenCode Go is now wired into the every-startup `refresh_managed_models` task with its own discovery and a dedicated apply that upserts and prunes across both its OpenAI- and Anthropic-shaped providers while preserving your `default_model` and `default_thinking`. Discovery failures are isolated so they cannot abort other providers' saves; provider `base_url` repairs still require a re-login.
+- **Homebrew install shows the logo and fails fast on a missing tap token.** `brew install` now prints the robot-head banner via a formula `caveats` block — the banner previously lived only in the curl and PowerShell installers, which Homebrew never runs. The tap auto-update workflow now detects an empty `HOMEBREW_TAP_TOKEN` (lost in the org migration, which had frozen the tap at 0.23.0) and fails with an actionable error instead of an opaque git exit-128.
+- **Markdown and report rendering hardened against real model output.** Code-span pipes inside Markdown tables are now protected so a `|` inside backticks no longer fractures the table, and a `report` block nested inside an outer documentation fence is no longer wrongly promoted to a report — report fences are extracted via a markdown-it AST walk instead of a flat regex. Backed by a new TUI markdown/report contract test suite grounded in a real security-scan fixture.
+- **Steadier agent editing and a restored update prompt.** File-replace edit handling is hardened, subagent prompt persistence and the agent's working language are preserved across turns, and the todo list stays aligned during a turn. The blocking pre-start update prompt — wired in 0.24.0 but again left unwired by a later refactor — is restored so it runs before every interactive session.
+- **CI runs required checks on every pull request.** The `check`, `test`, and `release-validate` contexts were path-filtered off docs-only (and `sdks/`/`examples/`-only) PRs, so the required statuses never reported and those PRs stayed BLOCKED under branch protection with no clean override. The `pull_request` path filter is dropped so every PR runs each required context exactly once; the `push` trigger keeps its filter unchanged.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.26.0`, or use the native installer for your OS (see the README install table).
+
+## 0.25.0 (2026-05-29)
+
+### What changed in this release
+
+- **`Fetch` now re-checks every redirect hop against the SSRF guard.** Redirects were followed without re-validating the destination, so a public URL could redirect to a link-local address (e.g. a cloud metadata endpoint) and slip past the guard that only inspected the original URL. Redirects are now followed manually and every hop is re-validated, closing the public→link-local bypass.
+- **Web domain allowlist for `Fetch` and `Search`.** A new `web.allowed_domains` config option restricts which hosts the web tools may reach. When set, `Fetch` (including every redirect hop) and `Search` reject any host outside the list; leave it unset to keep web access unrestricted.
+- **Crash-consistent background tasks.** Task and agent-task state is now serialised under a cross-process per-task lock, so a worker heartbeat landing mid-update is no longer lost. Every terminal agent-task update routes through a single finalizer that writes the authoritative runtime first, and recovery reconciles records left divergent by a crash or kill without ever clobbering a live agent. Bash task output is capped (default 50 MiB) so a chatty task cannot exhaust disk, terminated processes get a SIGTERM→SIGKILL fallback, and aged terminal task directories are pruned (default 7 days).
+- **Calmer, more reliable TUI.** The todo list no longer renders twice during an in-flight turn, OAuth and feedback links open through a detached browser launcher so browser output cannot corrupt the terminal or steal key presses, and the terminal is restored to a sane state on `SIGTERM`/`SIGQUIT` and at exit.
+- **Live tool-execution feedback.** Tool calls now show a calm "preparing" row during approval and hooks, switch to a live status once execution starts, and stream shell `stdout`/`stderr` as a running tail before the final result lands. The composing assistant block renders a live Markdown preview as the model writes, code blocks gain clearer framing, and the active spinner uses smoother braille dots.
+- **Steadier agent loop.** The model is nudged once when a turn ends on a bare statement of intent with no tool call, steered away from blocking on a single background task while siblings are still running, and a `SetTodoList` call whose todos arrive as a JSON-encoded string is now parsed transparently instead of failing validation.
+- **Unified report rendering.** Code review, verify, and security-review output now share one standardized, muted report renderer — including `report` blocks emitted by skills and agents; a malformed block falls back to ordinary markdown rather than being swallowed.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.25.0`, or use the native installer for your OS (see the README install table).
+
 ## 0.24.0 (2026-05-28)
 
 ### What changed in this release

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/agents/default/code_reviewer.yaml

@@ -51,6 +51,7 @@ agent:
     Use to run a read-only diff-focused code review or code-reviewr-derived PR artifact workflow on the current branch.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
     - "pythinker_code.tools.skill:ReadSkill"

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/agents/default/debugger.yaml

@@ -36,6 +36,7 @@ agent:
     Use for failing tests, stack traces, runtime errors, flaky failures, or debugging requests where root cause should be found before editing code.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
   exclude_tools:

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/agents/default/security_reviewer.yaml

@@ -44,6 +44,7 @@ agent:
     Use to run a diff-only security review on the current branch. Can run in parallel with `code-reviewer`.
   allowed_tools:
     - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
     - "pythinker_code.tools.file:ReadFile"
     - "pythinker_code.tools.file:Grep"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/agents/default/system.md

@@ -1,5 +1,9 @@
 You are Pythinker — a think-first software engineering agent running on the user's computer. Before you write code, you read code.
 
+# Output Language
+
+Always write natural-language output in the same language as the user's latest human request, unless the user explicitly asks for another language. This applies to direct replies, plans, review summaries, subagent final summaries, todo text, and continuation/repair responses. If you are a subagent and the parent prompt includes an explicit end-user language or quoted user request, use that; otherwise match the parent prompt's language. Do not switch to a provider/model default language (for example Chinese from Qwen). Keep code, commands, logs, identifiers, paths, and quoted text in their original language unless translation is requested.
+
 Your identity, in order of priority:
 
 1. **Code reviewer.** Diff-aware critique with severity-scored findings, anchored to specific files and lines.
@@ -39,6 +43,23 @@ For any codebase, architecture, debugging, security, performance, planning, or "
 
 **Professional handoff format:** For substantial tasks, keep a visible plan/todo and structure work as `context -> assessment -> plan -> execution -> verification -> residual risks`. Use parallelism only for independent work; never batch unrelated objectives into one delegated task.
 
+**Report format (severity-scored findings):** When you present a code review, security audit, or any other set of severity-scored findings to the user, emit it as a single fenced ` ```report ` block containing JSON — the shell renders it as a clean, consistently styled report (and degrades to a plain code block elsewhere). Use it only for genuine findings reports, not for ordinary prose, plans, or single-line answers. Schema:
+
+```report
+{
+  "title": "Code Review Results",
+  "scope": "one-line context, e.g. files/area reviewed",
+  "findings": [
+    {"title": "short headline", "severity": "critical|high|medium|low|info", "location": "path:line-range", "body": "what and why, with the suggested fix"}
+  ],
+  "note": "optional closing 'most actionable' line"
+}
+```
+
+`title` is required; `scope`, `note`, `location`, and `body` are optional. `severity` must be one of the five listed values. Order does not matter — the renderer groups by severity (critical first) and derives the summary tally. Put narrative prose outside the block, before or after it.
+
+**Dual-destination reports:** When acting as the root agent and the user asks for a review, audit, deep scan, or other report, always do both: present a concise terminal report in your final response and save the full report under `.pythinker/reports/<descriptive-slug>.md`. Create `.pythinker/reports/` first if it is missing, include the saved path in the terminal response, and never persist raw secrets, PII, or oversized logs. If you are a read-only subagent or lack write tools, do not write files; return terminal-ready report content plus a suggested `.pythinker/reports/...` path so the parent can display and persist it.
+
 # Engineering Discipline
 
 These principles govern every engineering response. They override speed: a slow right answer beats a fast wrong one.
@@ -119,8 +140,6 @@ If the `Shell`, `TaskList`, `TaskOutput`, and `TaskStop` tools are available and
 
 If a foreground tool call or a background agent requests approval, the approval is coordinated through the unified approval runtime and surfaced through the root UI channel. Do not assume approvals are local to a single subagent turn.
 
-When responding to the user, you MUST use the SAME language as the user, unless explicitly instructed to do otherwise.
-
 # General Guidelines for Coding
 
 When building something from scratch, you should:
@@ -173,7 +192,7 @@ The operating environment is not in a sandbox. Any actions you do will immediate
 
 ## Date and Time
 
-The current date and time in ISO format is `${PYTHINKER_NOW}`. This is only a reference for you when searching the web, or checking file modification time, etc. If you need the exact time, use Shell tool with proper command.
+The current date and time in ISO format is `${PYTHINKER_NOW}`. Treat this as the authoritative present — it reflects the real "now", which is later than your training data suggests. Anchor all reasoning about the current date, the year, recency, and what counts as the "latest" version or release to `${PYTHINKER_NOW}`; do not fall back on an earlier year you might assume from training. Use it as your reference when searching the web or checking file modification times. If you need the exact time, use the Shell tool with a proper command.
 
 ## Working Directory
 
@@ -246,6 +265,15 @@ Identify the skills that are likely to be useful for the tasks you are currently
 
 Only read skill details when needed to conserve the context window.
 
+# Output Formatting
+
+Your responses are rendered as Markdown in a terminal. Emit well-formed Markdown so it renders cleanly:
+
+- **Tables:** put the header row on its own line, the `|---|---|` delimiter row on the immediately following line (no blank line between them), and one row per line. Never glue a table onto adjacent prose (e.g. `Findings| Col |`) and never cram multiple rows onto one line. Leave a blank line before and after the table.
+- Prefer a short bullet list over a table when there are only a few items or any cell is long; reserve tables for genuinely tabular data with short cells.
+- **Code fences are for code only.** Use triple-backtick blocks tagged with a language (for example, `python` or `toml`) solely for source, config, or commands — one snippet per block. Never wrap a prose report, finding list, checklist, or ASCII box in a fence to align or frame it; write it as normal Markdown (headings, bullets, tables) so it renders cleanly.
+- **Status icons sparingly.** A check/cross/dot can mark a single headline result, but do not prefix every line with one. Use plain words for severity and outcomes (e.g. `High`, `PASS`, `0 findings`). The terminal renders icons as calm monochrome glyphs only outside code fences — another reason not to box reports.
+
 # Ultimate Reminders
 
 At any time, you should be HELPFUL, CONCISE, and ACCURATE. Be thorough in your actions — test what you build, verify what you change — not in your explanations.

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/auth/github_feedback.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import asyncio
 import time
-import webbrowser
 from dataclasses import dataclass
 from typing import Any, cast
 
@@ -150,7 +149,9 @@ async def login_github_feedback(
     )
     if open_browser:
         try:
-            webbrowser.open(auth.verification_uri)
+            from pythinker_code.utils.term import open_url_in_browser
+
+            open_url_in_browser(auth.verification_uri)
         except Exception as exc:
             logger.warning("Failed to open browser: {error}", error=exc)
     yield OAuthEvent("waiting", "Waiting for GitHub authorization...")

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/auth/oauth.py

@@ -10,7 +10,6 @@ import sys
 import tempfile
 import time
 import uuid
-import webbrowser
 from collections.abc import AsyncGenerator, AsyncIterator
 from contextlib import asynccontextmanager, suppress
 from dataclasses import dataclass
@@ -660,7 +659,9 @@ async def login_pythinker_code(
         )
         if open_browser:
             try:
-                webbrowser.open(auth.verification_uri_complete)
+                from pythinker_code.utils.term import open_url_in_browser
+
+                open_url_in_browser(auth.verification_uri_complete)
             except Exception as exc:
                 logger.warning("Failed to open browser: {error}", error=exc)
 

{pythinker_code-0.24.0 → pythinker_code-0.26.0}/src/pythinker_code/auth/openai.py

@@ -7,7 +7,6 @@ import hashlib
 import json
 import secrets
 import time
-import webbrowser
 from collections.abc import AsyncIterator
 from dataclasses import dataclass
 from typing import Any, cast
@@ -329,7 +328,9 @@ async def _wait_for_browser_code(open_browser: bool = True) -> tuple[str, str, s
 
     auth_url = _build_authorize_url(redirect_uri=redirect_uri, pkce=pkce, state=state)
     if open_browser:
-        webbrowser.open(auth_url)
+        from pythinker_code.utils.term import open_url_in_browser
+
+        open_url_in_browser(auth_url)
 
     try:
         code, error = await asyncio.wait_for(result, timeout=15 * 60)