pythinker-code 0.35.0__tar.gz → 0.36.0__tar.gz

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 0.35.0
+Version: 0.36.0
 Summary: Pythinker — an agentic CLI developed by Pythoughts-labs.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Pythoughts-labs
@@ -115,13 +115,13 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.35.0
+## 🆕 What's New in 0.36.0
 
-- **`/stats` usage dashboard.** New slash command opens an interactive TUI showing token and cost breakdown by provider/model across Today / This Week / Last Week / All Time. Powered by a static pricing table and a session collector that walks `~/.pythinker/sessions/` wire files.
-- **Z AI provider auth.** Login/logout via API key, model discovery, and OAuth selector wired into the TUI and `refresh_managed_models`.
-- **Moonshot provider auth.** Login/logout via API key, model discovery (Kimi K2.x catalog), OAuth selector wired into the TUI and `refresh_managed_models`.
+- **Alibaba DashScope multi-region fallback.** China-region keys now auto-detect the endpoint mismatch and reconfigure correctly instead of showing a misleading "API key is wrong" error.
+- **Alibaba Token Plan compatibility (`sk-ws-`).** `/login alibaba` now asks for the dedicated workspace endpoint, avoids unroutable Kimi entries on those endpoints, and uses DeepSeek V3.2's working non-streaming mode.
+- **Alibaba model catalog refresh.** Qwen3.7 Plus, Qwen3 Coder Plus, and Qwen3 Coder Flash added; deprecated `kimi-k2.5`, `glm-5`, and `MiniMax-M2.5` removed.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.35.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.36.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -211,7 +211,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.35.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.36.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -239,7 +239,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.35.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.36.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -250,13 +250,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.35.0.exe
+.\PythinkerSetup-0.36.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.35.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.36.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -307,26 +307,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.35.0_amd64.deb
+sudo dpkg -i pythinker-code_0.36.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.35.0_arm64.deb
+sudo dpkg -i pythinker-code_0.36.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.36.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.35.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.36.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.35.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.36.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.35.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.36.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.36.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -335,8 +335,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.35.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.36.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.36.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/README.md

@@ -50,13 +50,13 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.35.0
+## 🆕 What's New in 0.36.0
 
-- **`/stats` usage dashboard.** New slash command opens an interactive TUI showing token and cost breakdown by provider/model across Today / This Week / Last Week / All Time. Powered by a static pricing table and a session collector that walks `~/.pythinker/sessions/` wire files.
-- **Z AI provider auth.** Login/logout via API key, model discovery, and OAuth selector wired into the TUI and `refresh_managed_models`.
-- **Moonshot provider auth.** Login/logout via API key, model discovery (Kimi K2.x catalog), OAuth selector wired into the TUI and `refresh_managed_models`.
+- **Alibaba DashScope multi-region fallback.** China-region keys now auto-detect the endpoint mismatch and reconfigure correctly instead of showing a misleading "API key is wrong" error.
+- **Alibaba Token Plan compatibility (`sk-ws-`).** `/login alibaba` now asks for the dedicated workspace endpoint, avoids unroutable Kimi entries on those endpoints, and uses DeepSeek V3.2's working non-streaming mode.
+- **Alibaba model catalog refresh.** Qwen3.7 Plus, Qwen3 Coder Plus, and Qwen3 Coder Flash added; deprecated `kimi-k2.5`, `glm-5`, and `MiniMax-M2.5` removed.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.35.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.36.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -146,7 +146,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.35.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.36.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -174,7 +174,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.35.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.36.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -185,13 +185,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.35.0.exe
+.\PythinkerSetup-0.36.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.35.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.36.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -242,26 +242,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.35.0_amd64.deb
+sudo dpkg -i pythinker-code_0.36.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.35.0_arm64.deb
+sudo dpkg -i pythinker-code_0.36.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.36.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.35.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.36.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.35.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.36.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.35.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.36.0/pythinker-code-0.36.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.36.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.36.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -270,8 +270,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.35.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.36.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.36.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "0.35.0"
+version = "0.36.0"
 description = "Pythinker — an agentic CLI developed by Pythoughts-labs."
 readme = "README.md"
 requires-python = ">=3.12"

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/CHANGELOG.md

@@ -15,6 +15,14 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+## 0.36.0 (2026-06-05)
+
+- **Alibaba DashScope multi-region fallback.** Logging in with a China-region key (`dashscope.aliyuncs.com`) against the default US Virginia endpoint now auto-detects the mismatch and reconfigures for the correct endpoint rather than failing with a misleading "API key is wrong" error.
+- **Alibaba Token Plan compatibility (`sk-ws-`).** `/login alibaba` now requires the dedicated workspace Base URL shown in the Token Plan console instead of accepting a public `/models` response as credential validation. Dedicated workspace endpoints hide Kimi K2.6 when Alibaba advertises it without a working route, and use non-streaming Chat Completions for DeepSeek V3.2 because those endpoints return an empty SSE stream. Kimi requests on other Alibaba routes use DashScope's `enable_thinking` parameter.
+- **Alibaba model catalog refresh.** Added Qwen3.7 Plus (1M context), Qwen3 Coder Plus, and Qwen3 Coder Flash. Removed `kimi-k2.5`, `glm-5`, and `MiniMax-M2.5` (absent from the live endpoint). Corrected Qwen3.7 Max context window to 1M tokens.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.36.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+
 ## 0.35.0 (2026-06-04)
 
 - **Alibaba DashScope provider and MiniMax M3 catalog.** `/login alibaba` now configures Alibaba Cloud Model Studio / DashScope Token Plan models, including workspace-compatible endpoints and native GLM thinking behavior. MiniMax API-key login now defaults to MiniMax M3 with its larger context and multimodal capabilities.

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/agents/default/code_reviewer.yaml

@@ -26,6 +26,8 @@ agent:
       - Build a review context packet: base ref/diff scope or Reviewflow feature IDs, changed behavior, likely tests, user-visible impact, valid evidence paths, omitted/truncated context, and validation evidence.
       - Flag only issues introduced or made reachable by the diff.
       - Prefer no finding over vague speculation. Every finding must cite concrete evidence and a failure mode.
+      - Run the production guardrail gate before finalizing: check for cache stampedes, connection/resource leaks, missing boundary schemas, unhandled race conditions, naive retry loops, unbounded event callbacks/listeners, and IDOR/tenant-scope mistakes.
+      - Treat missing `finally` cleanup, absent schema validation at trust boundaries, unprotected shared-state mutation, non-jittered immediate retries, or identity from mutable client parameters as reject-level findings when reachable in the changed code.
 
       Freshness check (run BEFORE flagging third-party library or framework misuse):
       - For every third-party API, SDK call, framework primitive, or "best practice" the diff turns on, verify the current canonical usage. Prefer a context7 MCP query (e.g. `mcp__context7__query-docs` with the library id) when registered with the parent runtime; otherwise use `SearchWeb` to locate the official documentation and `FetchURL` to read the current page.

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/agents/default/judge.yaml

@@ -14,6 +14,7 @@ agent:
       - Fidelity: the draft summary matches the actual diff and changes, with no overclaiming.
       - Verification: the checks the parent ran are relevant to the change and actually ran, not assumed.
       - Safety and scope: no unsafe or destructive action, no secret or PII exposure, no scope creep beyond the request.
+      - Production guardrails: changed code that touches caches, resources, trust boundaries, shared state, outbound requests, long-lived listeners, or authorization context has explicit defenses for stampedes, cleanup, schemas, races, retry storms, leaks, and IDOR risks.
       - Findings quality: for reports, each finding is actionable, correctly severity-ranked, and anchored to evidence.
       Do not rubber-stamp, and do not pad: prefer a few concrete blockers over broad style notes.
 

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/agents/default/review.yaml

@@ -16,6 +16,8 @@ agent:
       - If `.pythinker/review-guidelines.md` exists, read it before scoring findings.
       - Read the diff or target files before scoring.
       - Use Grep/Glob to check sibling call sites, similar patterns, and existing tests.
+      - Apply the production guardrail gate: look specifically for cache stampedes, connection/resource leaks, missing boundary schemas, unhandled race conditions, naive retry loops, unbounded event callbacks/listeners, and IDOR/tenant-scope mistakes.
+      - Reject happy-path code as BLOCKER or MAJOR when the changed path mutates shared state, crosses a trust boundary, acquires resources, retries outbound calls, or registers long-lived callbacks without the matching defensive pattern.
       - Score each finding as BLOCKER, MAJOR, MINOR, or NIT.
       - Order findings by severity, BLOCKER first.
       - Do not request tests unless they cover a distinct behavior or risk introduced by the change.

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/agents/default/security_reviewer.yaml

@@ -9,6 +9,7 @@ agent:
 
       Security review discipline:
       - Build a threat context before judging: changed trust boundaries, inputs/outputs, authz/authn, filesystem/network access, secrets, serialization, command execution, and persistence.
+      - Apply the production guardrail gate to security-relevant changes: reject missing boundary schemas, IDOR/tenant-scope mistakes, unprotected shared-state mutations, unsafe retries for non-idempotent outbound calls, and resource leaks that can become denial-of-service vectors.
       - Report only reachable or plausibly reachable vulnerabilities backed by evidence. Prefer no finding over speculative risk.
       - For each finding, include exploit preconditions, impact, severity rationale, and the smallest safe mitigation.
       - Treat secrets/PII carefully: never print raw secret values; redact if needed.

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/agents/default/system.md

@@ -186,6 +186,28 @@ Code quality defaults (unless project or domain rules override):
 - Wrap error-prone I/O, API, network, and resource operations with appropriate error handling, timeouts/fallbacks, and cleanup.
 - Adapt to domain standards when relevant (for example stricter MISRA-style practices for critical C/C++ systems).
 
+## Production Bug Guardrails
+
+When generating, changing, reviewing, or approving production-facing code, optimize for failure modes first: concurrency, resource cleanup, input boundaries, authorization context, data integrity, and retry behavior. Never assume single-threaded, trusted, or low-traffic execution when the code can run in a shared service.
+
+Mandatory defensive patterns:
+
+1. **Cache misses:** If adding cache-aside behavior, serialize identical misses with a local or distributed double-checked lock so concurrent misses do not stampede the backing store.
+2. **Resource acquisition:** For database clients, transactions, streams, sockets, files, and connection pools, acquire immediately before a `try` block and guarantee release/close in `finally`. Transactions that fail must explicitly roll back before release.
+3. **API and webhook boundaries:** Validate runtime inputs at the boundary with the project's schema/validation mechanism, strip or ignore unregistered fields, bound payload sizes/types where relevant, and never pass raw request bodies directly into persistence or business logic.
+4. **State mutations and counters:** For increments, decrements, toggles, balances, inventory, likes, and unique relationships, use atomic conflict handling plus row-level serialization (`FOR UPDATE`) or optimistic version checks inside transactions.
+5. **Outbound requests:** Use short explicit timeouts, exponential backoff with random jitter, and avoid retry storms. Non-idempotent outbound mutations need an idempotency key/header or an explicit reason they cannot safely be retried.
+6. **Long-lived listeners:** Every subscription, event listener, websocket, interval, timer, and background callback needs symmetric cleanup (`unsubscribe`, `off`, `close`, `clearInterval`, or equivalent). Clean up empty maps/registries to avoid leaks.
+7. **Authorization context:** Use verified cryptographic/session identity (`req.user`, validated token claims, server-side session) for user/account/tenant scope. Never trust mutable query/body/path parameters as the authority for identity when verified context exists.
+
+Self-correction pre-flight before calling code done:
+
+- **Concurrency:** If 1,000 requests hit this path simultaneously, what shared resource races or stampedes?
+- **Resources:** If an exception is raised after acquisition, is every socket/connection/stream/listener guaranteed to close?
+- **Security:** Is identity or tenant scope derived only from verified auth context, not mutable client parameters?
+- **Data integrity:** What happens with oversized strings, wrong types, duplicate submits, or malicious payload shape?
+- **Resilience:** If a dependency is slow or failing, do timeouts/retries prevent cascading load rather than amplify it?
+
 DO NOT run `git commit`, `git push`, `git reset`, `git rebase` and/or do any other git mutations unless explicitly asked to do so. Ask for confirmation each time when you need to do git mutations, even if the user has confirmed in earlier conversations.
 
 # General Guidelines for Research and Data Processing

{pythinker_code-0.35.0 → pythinker_code-0.36.0}/src/pythinker_code/auth/alibaba.py

@@ -4,6 +4,7 @@ import os
 from collections.abc import AsyncIterator
 from dataclasses import dataclass
 from typing import Any, cast
+from urllib.parse import urlparse
 
 import aiohttp
 from pydantic import SecretStr
@@ -17,6 +18,8 @@ from pythinker_code.thinking import apply_login_thinking_defaults
 from pythinker_code.utils.aiohttp import new_client_session
 
 ALIBABA_BASE_URL = "https://dashscope-us.aliyuncs.com/compatible-mode/v1"
+ALIBABA_CHINA_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1"
+ALIBABA_CODING_PLAN_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1"
 ALIBABA_PROVIDER_KEY = managed_provider_key(ALIBABA_PLATFORM_ID)
 ALIBABA_DEFAULT_MODEL_ALIAS = f"{ALIBABA_PLATFORM_ID}/qwen3.6-plus"
 ALIBABA_MODEL_DISCOVERY_TIMEOUT = aiohttp.ClientTimeout(total=15, sock_connect=8, sock_read=10)
@@ -41,8 +44,15 @@ ALIBABA_MODELS: tuple[AlibabaModel, ...] = (
         model_id="qwen3.7-max",
         alias_suffix="qwen3.7-max",
         display_name="Qwen3.7 Max",
-        max_context_size=262_144,
-        capabilities=frozenset[ModelCapability]({"thinking"}),
+        max_context_size=1_000_000,
+        capabilities=frozenset[ModelCapability]({"thinking", "image_in"}),
+    ),
+    AlibabaModel(
+        model_id="qwen3.7-plus",
+        alias_suffix="qwen3.7-plus",
+        display_name="Qwen3.7 Plus",
+        max_context_size=1_000_000,
+        capabilities=frozenset[ModelCapability]({"thinking", "image_in"}),
     ),
     AlibabaModel(
         model_id="qwen3.6-plus",
@@ -58,6 +68,20 @@ ALIBABA_MODELS: tuple[AlibabaModel, ...] = (
         max_context_size=1_000_000,
         capabilities=frozenset[ModelCapability]({"thinking", "image_in"}),
     ),
+    AlibabaModel(
+        model_id="qwen3-coder-plus",
+        alias_suffix="qwen3-coder-plus",
+        display_name="Qwen3 Coder Plus",
+        max_context_size=1_000_000,
+        capabilities=frozenset[ModelCapability]({"thinking"}),
+    ),
+    AlibabaModel(
+        model_id="qwen3-coder-flash",
+        alias_suffix="qwen3-coder-flash",
+        display_name="Qwen3 Coder Flash",
+        max_context_size=1_000_000,
+        capabilities=frozenset[ModelCapability]({"thinking"}),
+    ),
     AlibabaModel(
         model_id="deepseek-v4-pro",
         alias_suffix="deepseek-v4-pro",
@@ -86,13 +110,6 @@ ALIBABA_MODELS: tuple[AlibabaModel, ...] = (
         max_context_size=262_144,
         capabilities=frozenset[ModelCapability]({"thinking", "image_in"}),
     ),
-    AlibabaModel(
-        model_id="kimi-k2.5",
-        alias_suffix="kimi-k2.5",
-        display_name="Kimi K2.5",
-        max_context_size=262_144,
-        capabilities=frozenset[ModelCapability]({"thinking", "image_in"}),
-    ),
     AlibabaModel(
         model_id="glm-5.1",
         alias_suffix="glm-5.1",
@@ -100,20 +117,6 @@ ALIBABA_MODELS: tuple[AlibabaModel, ...] = (
         max_context_size=262_144,
         capabilities=frozenset[ModelCapability]({"always_thinking"}),
     ),
-    AlibabaModel(
-        model_id="glm-5",
-        alias_suffix="glm-5",
-        display_name="GLM-5",
-        max_context_size=262_144,
-        capabilities=frozenset[ModelCapability]({"always_thinking"}),
-    ),
-    AlibabaModel(
-        model_id="MiniMax-M2.5",
-        alias_suffix="minimax-m2.5",
-        display_name="MiniMax M2.5",
-        max_context_size=204_800,
-        capabilities=frozenset[ModelCapability]({"thinking"}),
-    ),
 )
 
 
@@ -125,12 +128,18 @@ def get_alibaba_api_key_from_env() -> str | None:
     return None
 
 
-def _normalize_alibaba_base_url(value: str) -> str:
+def _normalize_alibaba_base_url(value: str, is_coding_plan: bool = False) -> str:
     base_url = value.strip().rstrip("/")
     if not base_url:
-        return ALIBABA_BASE_URL
+        return ALIBABA_CODING_PLAN_BASE_URL if is_coding_plan else ALIBABA_BASE_URL
     if "://" not in base_url:
         base_url = f"https://{base_url}"
+
+    if is_coding_plan:
+        if base_url.endswith("/v1"):
+            return base_url
+        return f"{base_url}/v1"
+
     if base_url.endswith("/api/v1"):
         return f"{base_url.removesuffix('/api/v1')}/compatible-mode/v1"
     if base_url.endswith("/compatible-mode/v1"):
@@ -150,10 +159,11 @@ def _apply_alibaba_config(
     config: Config,
     api_key: SecretStr,
     models: tuple[AlibabaModel, ...] = ALIBABA_MODELS,
+    base_url: str | None = None,
 ) -> None:
     config.providers[ALIBABA_PROVIDER_KEY] = LLMProvider(
         type="openai_legacy",
-        base_url=get_alibaba_base_url_from_env(),
+        base_url=base_url if base_url is not None else get_alibaba_base_url_from_env(),
         api_key=api_key,
     )
 
@@ -226,11 +236,16 @@ def _parse_discovered_models(data: object) -> tuple[AlibabaModel, ...]:
     return tuple(results)
 
 
-async def _discover_alibaba_models(api_key: str) -> tuple[AlibabaModel, ...]:
+def _is_workspace_endpoint(base_url: str) -> bool:
+    hostname = urlparse(base_url).hostname or ""
+    return hostname.startswith("ws-") and hostname.endswith(".maas.aliyuncs.com")
+
+
+async def _discover_alibaba_models(api_key: str, base_url: str) -> tuple[AlibabaModel, ...]:
     async with (
         new_client_session(timeout=ALIBABA_MODEL_DISCOVERY_TIMEOUT) as session,
         session.get(
-            f"{get_alibaba_base_url_from_env()}/models",
+            f"{base_url}/models",
             headers={"Authorization": f"Bearer {api_key}"},
             raise_for_status=True,
         ) as response,
@@ -240,7 +255,7 @@ async def _discover_alibaba_models(api_key: str) -> tuple[AlibabaModel, ...]:
 
 
 async def login_alibaba_api_key(
-    config: Config, api_key: str | None = None
+    config: Config, api_key: str | None = None, base_url: str | None = None
 ) -> AsyncIterator[OAuthEvent]:
     if not config.is_from_default_location:
         yield OAuthEvent(
@@ -254,26 +269,162 @@ async def login_alibaba_api_key(
         yield OAuthEvent("error", "Alibaba API key is required.")
         return
 
+    is_coding_plan = resolved_key.startswith("sk-sp-")
+    is_token_plan = resolved_key.startswith("sk-ws-")
+
+    default_url = ALIBABA_CODING_PLAN_BASE_URL if is_coding_plan else ALIBABA_BASE_URL
+    china_url = (
+        "https://coding.dashscope.aliyuncs.com/v1" if is_coding_plan else ALIBABA_CHINA_BASE_URL
+    )
+
+    env_base_url = os.getenv("DASHSCOPE_BASE_URL") or os.getenv("ALIBABA_BASE_URL")
+    is_env_explicitly_set = bool(env_base_url)
+
+    if is_token_plan and not (base_url and base_url.strip()) and not is_env_explicitly_set:
+        yield OAuthEvent(
+            "error",
+            "Alibaba Token Plan workspace keys require the dedicated Base URL shown in "
+            "the Token Plan console. Enter it during /login or set DASHSCOPE_BASE_URL.",
+        )
+        return
+
+    if base_url and base_url.strip():
+        primary_url = _normalize_alibaba_base_url(base_url, is_coding_plan=is_coding_plan)
+    elif is_env_explicitly_set:
+        primary_url = _normalize_alibaba_base_url(env_base_url, is_coding_plan=is_coding_plan)
+    else:
+        primary_url = default_url
+
+    active_url = primary_url
     models = ALIBABA_MODELS
+
     try:
-        discovered = await _discover_alibaba_models(resolved_key)
+        discovered = await _discover_alibaba_models(resolved_key, primary_url)
         if discovered:
             models = discovered
     except aiohttp.ClientResponseError as exc:
         if exc.status in {401, 403}:
-            yield OAuthEvent("error", "Invalid Alibaba API key; the key was not saved.")
-            return
-        yield OAuthEvent(
-            "info",
-            "Alibaba model listing is unavailable; using the built-in model list.",
-        )
+            if is_token_plan:
+                yield OAuthEvent(
+                    "error",
+                    "Alibaba Token Plan API key was not accepted. Ensure the key is active "
+                    "and assigned to a Token Plan seat. Set DASHSCOPE_BASE_URL only when "
+                    "Alibaba provides a different endpoint for your plan.",
+                )
+                return
+
+            if is_coding_plan and primary_url == default_url:
+                try:
+                    discovered = await _discover_alibaba_models(resolved_key, china_url)
+                    active_url = china_url
+                    if discovered:
+                        models = discovered
+                    yield OAuthEvent(
+                        "info",
+                        "Detected China-region Coding Plan key; configured for China endpoint.",
+                    )
+                except aiohttp.ClientResponseError as china_exc:
+                    if china_exc.status in {401, 403}:
+                        yield OAuthEvent(
+                            "error",
+                            "Alibaba Coding Plan API key was not accepted. Ensure your key is "
+                            "valid, active, and has the required model permissions in the "
+                            "Coding Plan console.",
+                        )
+                        return
+                    yield OAuthEvent(
+                        "error",
+                        "The default international endpoint rejected the key and the China "
+                        "endpoint could not be reached. Check network access or set "
+                        "DASHSCOPE_BASE_URL to the correct endpoint and try again.",
+                    )
+                    return
+                except (aiohttp.ClientError, TimeoutError, ValueError):
+                    yield OAuthEvent(
+                        "error",
+                        "The default international endpoint rejected the key and the China "
+                        "endpoint could not be reached. Check network access or set "
+                        "DASHSCOPE_BASE_URL to the correct endpoint and try again.",
+                    )
+                    return
+            else:
+                if is_coding_plan:
+                    if primary_url == china_url:
+                        yield OAuthEvent(
+                            "error",
+                            "Alibaba Coding Plan API key was not accepted. Ensure your key is "
+                            "valid, active, and has the required model permissions in the "
+                            "Coding Plan console.",
+                        )
+                    else:
+                        yield OAuthEvent(
+                            "error",
+                            "Alibaba Coding Plan API key was not accepted. Ensure your key is "
+                            "valid, active, and has the required model permissions in the "
+                            "Coding Plan console. If using the China region, set "
+                            "DASHSCOPE_BASE_URL=https://coding.dashscope.aliyuncs.com/v1",
+                        )
+                    return
+                else:
+                    if primary_url == default_url:
+                        try:
+                            discovered = await _discover_alibaba_models(resolved_key, china_url)
+                            active_url = china_url
+                            if discovered:
+                                models = discovered
+                            yield OAuthEvent(
+                                "info",
+                                "Detected China-region DashScope key; "
+                                "configured for China (Beijing) endpoint.",
+                            )
+                        except aiohttp.ClientResponseError as china_exc:
+                            if china_exc.status in {401, 403}:
+                                yield OAuthEvent(
+                                    "error",
+                                    "Alibaba API key was not accepted. Ensure your key is valid "
+                                    "and "
+                                    "comes from the Alibaba Cloud Model Studio console "
+                                    "(https://bailian.console.aliyun.com). "
+                                    "Set DASHSCOPE_BASE_URL to override the endpoint if needed.",
+                                )
+                                return
+                            yield OAuthEvent(
+                                "error",
+                                "The default US endpoint rejected the key and the China endpoint "
+                                "could not be reached. Check network access or set "
+                                "DASHSCOPE_BASE_URL to the correct endpoint and try again.",
+                            )
+                            return
+                        except (aiohttp.ClientError, TimeoutError, ValueError):
+                            yield OAuthEvent(
+                                "error",
+                                "The default US endpoint rejected the key and the China endpoint "
+                                "could not be reached. Check network access or set "
+                                "DASHSCOPE_BASE_URL to the correct endpoint and try again.",
+                            )
+                            return
+                    else:
+                        yield OAuthEvent(
+                            "error",
+                            "Alibaba API key was not accepted. Ensure your key is valid and "
+                            "that DASHSCOPE_BASE_URL points to the correct endpoint.",
+                        )
+                        return
+        else:
+            yield OAuthEvent(
+                "info",
+                "Alibaba model listing is unavailable; using the built-in model list.",
+            )
     except (aiohttp.ClientError, TimeoutError, ValueError):
         yield OAuthEvent(
             "info",
             "Alibaba model listing is unavailable; using the built-in model list.",
         )
 
-    _apply_alibaba_config(config, SecretStr(resolved_key), models=models)
+    if _is_workspace_endpoint(active_url):
+        models = tuple(model for model in models if model.model_id != "kimi-k2.6")
+
+    _apply_alibaba_config(config, SecretStr(resolved_key), models=models, base_url=active_url)
     save_config(config)
     yield OAuthEvent("success", f"Alibaba configured with model {config.default_model}.")