pythinker-code 0.35.0__tar.gz → 0.37.0__tar.gz

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 0.35.0
+Version: 0.37.0
 Summary: Pythinker — an agentic CLI developed by Pythoughts-labs.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Pythoughts-labs
@@ -115,13 +115,16 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.35.0
+## 🆕 What's New in 0.37.0
 
-- **`/stats` usage dashboard.** New slash command opens an interactive TUI showing token and cost breakdown by provider/model across Today / This Week / Last Week / All Time. Powered by a static pricing table and a session collector that walks `~/.pythinker/sessions/` wire files.
-- **Z AI provider auth.** Login/logout via API key, model discovery, and OAuth selector wired into the TUI and `refresh_managed_models`.
-- **Moonshot provider auth.** Login/logout via API key, model discovery (Kimi K2.x catalog), OAuth selector wired into the TUI and `refresh_managed_models`.
+- **Agent runtime tool visibility hardening.** `PythinkerToolset` now gates tool advertisements by execution policy, permission profile, root/subagent role, and plan-mode state — execution-time guards remain as defense in depth.
+- **Agent design upgrades.** New `ask` and `debug` primary agents selectable with `--agent`, a `scout` subagent for docs/API freshness research, richer spec metadata, and stable compaction summaries.
+- **Prompt-injection defense: `UntrustedData` wrapper.** External file and web content is wrapped in signed `<untrusted_data>` tags before reaching the LLM, with breakout-prevention escaping.
+- **Agent boundary artifacts.** Typed `CodingArtifact`/`VerificationResult` and `VulnerabilityArtifact`/`AuditVerdict` dataclasses enforce a strict information barrier between coder and verifier subagents.
+- **Recon-first `planner` subagent.** New read-only planner decomposes tasks into parallel seed descriptions via `<recon_seeds>` JSON for structured fan-out before workers start.
+- **`coder` artifact contract.** Structured `<coding_artifact>` handoff block at end of every coder response enables direct consumption by the `verifier` subagent.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.35.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.37.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -211,7 +214,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.35.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.37.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -239,7 +242,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.35.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.37.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -250,13 +253,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.35.0.exe
+.\PythinkerSetup-0.37.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.35.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.37.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -307,26 +310,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.35.0_amd64.deb
+sudo dpkg -i pythinker-code_0.37.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.35.0_arm64.deb
+sudo dpkg -i pythinker-code_0.37.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.37.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.35.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.37.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.35.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.37.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.35.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.37.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.37.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -335,8 +338,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.35.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.37.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.37.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/README.md

@@ -50,13 +50,16 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.35.0
+## 🆕 What's New in 0.37.0
 
-- **`/stats` usage dashboard.** New slash command opens an interactive TUI showing token and cost breakdown by provider/model across Today / This Week / Last Week / All Time. Powered by a static pricing table and a session collector that walks `~/.pythinker/sessions/` wire files.
-- **Z AI provider auth.** Login/logout via API key, model discovery, and OAuth selector wired into the TUI and `refresh_managed_models`.
-- **Moonshot provider auth.** Login/logout via API key, model discovery (Kimi K2.x catalog), OAuth selector wired into the TUI and `refresh_managed_models`.
+- **Agent runtime tool visibility hardening.** `PythinkerToolset` now gates tool advertisements by execution policy, permission profile, root/subagent role, and plan-mode state — execution-time guards remain as defense in depth.
+- **Agent design upgrades.** New `ask` and `debug` primary agents selectable with `--agent`, a `scout` subagent for docs/API freshness research, richer spec metadata, and stable compaction summaries.
+- **Prompt-injection defense: `UntrustedData` wrapper.** External file and web content is wrapped in signed `<untrusted_data>` tags before reaching the LLM, with breakout-prevention escaping.
+- **Agent boundary artifacts.** Typed `CodingArtifact`/`VerificationResult` and `VulnerabilityArtifact`/`AuditVerdict` dataclasses enforce a strict information barrier between coder and verifier subagents.
+- **Recon-first `planner` subagent.** New read-only planner decomposes tasks into parallel seed descriptions via `<recon_seeds>` JSON for structured fan-out before workers start.
+- **`coder` artifact contract.** Structured `<coding_artifact>` handoff block at end of every coder response enables direct consumption by the `verifier` subagent.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.35.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.37.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -146,7 +149,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.35.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.37.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -174,7 +177,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.35.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.37.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -185,13 +188,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.35.0.exe
+.\PythinkerSetup-0.37.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.35.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.37.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -242,26 +245,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.35.0_amd64.deb
+sudo dpkg -i pythinker-code_0.37.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.35.0_arm64.deb
+sudo dpkg -i pythinker-code_0.37.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.37.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.35.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.37.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.35.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.37.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.35.0/pythinker-code-0.35.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.35.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.35.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.37.0/pythinker-code-0.37.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.37.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.37.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -270,8 +273,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.35.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.35.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.37.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.37.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "0.35.0"
+version = "0.37.0"
 description = "Pythinker — an agentic CLI developed by Pythoughts-labs."
 readme = "README.md"
 requires-python = ">=3.12"

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/CHANGELOG.md

@@ -15,6 +15,25 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+## 0.37.0 (2026-06-07)
+
+- **Agent runtime tool visibility hardening.** `PythinkerToolset` now filters the tools advertised to the model by active execution policy, permission profile, root/subagent role, and plan-mode state while preserving execution-time guards as defense in depth.
+- **Agent design upgrades.** Agent specs now carry mode/hidden/step/model-parameter metadata, built-in `ask` and `debug` primary agents are selectable with `--agent`, the new `scout` subagent handles external docs/API freshness research, and compaction summaries use a stable handoff-oriented structure.
+- **Prompt-injection defense: `UntrustedData` wrapper.** All external content returned by `ReadFile` and `FetchURL` is now wrapped in `<untrusted_data id="NONCE">…</untrusted_data>` tags before being passed to the LLM, providing a clear boundary between trusted instructions and untrusted file/web content. The `UntrustedData` primitive escapes embedded closing tags to prevent breakout attacks.
+- **Agent boundary artifacts.** New `CodingArtifact` / `VerificationResult` and `VulnerabilityArtifact` / `AuditVerdict` frozen dataclasses in `pythinker_code.utils.artifacts` enforce a typed information barrier between coder and verifier subagents.
+- **Recon-first `planner` subagent.** A new read-only `planner` built-in agent type decomposes open-ended tasks into distinct parallel seed descriptions emitted as `<recon_seeds>` JSON, enabling structured fan-out before parallel workers start.
+- **Coder artifact contract.** The `coder` subagent now emits a `<coding_artifact>` JSON block at the end of every response, providing structured handoff data (`files_changed`, `test_command`, `expected_behavior`, optional `edge_cases_claimed`) that the `verifier` subagent can consume directly.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.37.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+
+## 0.36.0 (2026-06-05)
+
+- **Alibaba DashScope multi-region fallback.** Logging in with a China-region key (`dashscope.aliyuncs.com`) against the default US Virginia endpoint now auto-detects the mismatch and reconfigures for the correct endpoint rather than failing with a misleading "API key is wrong" error.
+- **Alibaba Token Plan compatibility (`sk-ws-`).** `/login alibaba` now requires the dedicated workspace Base URL shown in the Token Plan console instead of accepting a public `/models` response as credential validation. Dedicated workspace endpoints hide Kimi K2.6 when Alibaba advertises it without a working route, and use non-streaming Chat Completions for DeepSeek V3.2 because those endpoints return an empty SSE stream. Kimi requests on other Alibaba routes use DashScope's `enable_thinking` parameter.
+- **Alibaba model catalog refresh.** Added Qwen3.7 Plus (1M context), Qwen3 Coder Plus, and Qwen3 Coder Flash. Removed `kimi-k2.5`, `glm-5`, and `MiniMax-M2.5` (absent from the live endpoint). Corrected Qwen3.7 Max context window to 1M tokens.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.36.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+
 ## 0.35.0 (2026-06-04)
 
 - **Alibaba DashScope provider and MiniMax M3 catalog.** `/login alibaba` now configures Alibaba Cloud Model Studio / DashScope Token Plan models, including workspace-compatible endpoints and native GLM thinking behavior. MiniMax API-key login now defaults to MiniMax M3 with its larger context and multimodal capabilities.

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/agent.yaml

@@ -47,6 +47,12 @@ agent:
     plan:
       path: ./plan.yaml
       description: "Read-only implementation planning and architecture design."
+    planner:
+      path: ./planner.yaml
+      description: "Read-only recon planner that decomposes tasks into distinct parallel seeds."
+    scout:
+      path: ./scout.yaml
+      description: "Read-only external docs, dependency-source, and API freshness researcher."
     review:
       path: ./review.yaml
       description: "Read-only code review with severity-scored findings."

pythinker_code-0.37.0/src/pythinker_code/agents/default/ask.yaml

@@ -0,0 +1,62 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  name: "ask"
+  mode: primary
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are in Ask mode: a read-only assistant for answering questions, explaining code,
+      and recommending next steps without modifying files.
+
+      Ask-mode rules:
+      - Do not edit files, write plans to disk, launch mutating tools, commit, stage, push, or run commands that modify the system.
+      - Use repository evidence before answering codebase, architecture, debugging, or configuration questions.
+      - Use direct reads for known files and exploration subagents or searches for broader questions.
+      - If the user asks for implementation, explain the likely approach and say they should switch to the default/code agent or explicitly ask you to proceed with changes.
+      - Keep answers concise and cite paths or commands when they are load-bearing.
+
+      Final response contract:
+      - Start with the direct answer.
+      - Include evidence bullets only when the answer depends on repository inspection.
+      - End with blockers only if missing context prevents a reliable answer.
+  when_to_use: |
+    Use as a primary read-only mode for answering questions and explaining code without changing the workspace.
+  allowed_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.agent:RunAgents"
+    - "pythinker_code.tools.skill:ReadSkill"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  exclude_tools:
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.memory:Memory"
+    - "pythinker_code.tools.scratchpad:Scratchpad"
+    - "pythinker_code.tools.background:TaskInput"
+    - "pythinker_code.tools.background:TaskHandoff"
+    - "pythinker_code.tools.background:TaskStop"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+  subagents:
+    explore:
+      path: ./explore.yaml
+      description: "Fast codebase exploration with prompt-enforced read-only behavior."
+    plan:
+      path: ./plan.yaml
+      description: "Read-only implementation planning and architecture design."
+    review:
+      path: ./review.yaml
+      description: "Read-only code review with severity-scored findings."
+    debugger:
+      path: ./debugger.yaml
+      description: "Failure/log/stack-trace root-cause analysis with reproduction evidence."
+    judge:
+      path: ./judge.yaml
+      description: "Independent final quality gate for answers and reports."

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/code_reviewer.yaml

@@ -26,6 +26,8 @@ agent:
       - Build a review context packet: base ref/diff scope or Reviewflow feature IDs, changed behavior, likely tests, user-visible impact, valid evidence paths, omitted/truncated context, and validation evidence.
       - Flag only issues introduced or made reachable by the diff.
       - Prefer no finding over vague speculation. Every finding must cite concrete evidence and a failure mode.
+      - Run the production guardrail gate before finalizing: check for cache stampedes, connection/resource leaks, missing boundary schemas, unhandled race conditions, naive retry loops, unbounded event callbacks/listeners, and IDOR/tenant-scope mistakes.
+      - Treat missing `finally` cleanup, absent schema validation at trust boundaries, unprotected shared-state mutation, non-jittered immediate retries, or identity from mutable client parameters as reject-level findings when reachable in the changed code.
 
       Freshness check (run BEFORE flagging third-party library or framework misuse):
       - For every third-party API, SDK call, framework primitive, or "best practice" the diff turns on, verify the current canonical usage. Prefer a context7 MCP query (e.g. `mcp__context7__query-docs` with the library id) when registered with the parent runtime; otherwise use `SearchWeb` to locate the official documentation and `FetchURL` to read the current page.

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/coder.yaml

@@ -31,6 +31,21 @@ agent:
       Bullet list of remaining risks or `None observed.`.
       ### BLOCKERS
       Bullet list of anything that stopped completion, or `None.`.
+
+      Artifact contract: Before finishing, you MUST emit your result as a structured artifact.
+      Wrap it in <coding_artifact> tags on its own line at the very end of your final message:
+
+      <coding_artifact>
+      {
+        "files_changed": ["path/to/file.py"],
+        "test_command": "make test",
+        "expected_behavior": "...",
+        "edge_cases_claimed": ["..."]
+      }
+      </coding_artifact>
+
+      Do not include reasoning, logs, or intermediate output inside the tags — only the JSON fields above.
+      The `edge_cases_claimed` key is optional; omit it if you have no distinct edge cases to claim.
   when_to_use: |
     Use this agent for non-trivial software engineering work that may require reading files, editing code, running commands, and returning a compact but technically complete summary to the parent agent.
   allowed_tools:

pythinker_code-0.37.0/src/pythinker_code/agents/default/debug.yaml

@@ -0,0 +1,67 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  name: "debug"
+  mode: primary
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are in Debug mode: a systematic root-cause diagnostician.
+
+      Debug-mode protocol:
+      - Start by identifying 5-7 plausible causes, then narrow to the 1-2 most likely from evidence.
+      - Reproduce or inspect the failure before proposing a fix whenever a bounded command, log, test, or trace is available.
+      - Separate confirmed facts, likely hypotheses, and unknowns.
+      - Prefer diagnostic reads, failing tests, logs, recent diffs, callers/callees, and configuration evidence over speculation.
+      - Do not make broad refactors. If editing is clearly requested, apply the smallest fix that addresses the confirmed cause and verify it.
+      - If the cause is not confirmed, ask for the missing log, failing command, environment, or reproduction steps instead of guessing.
+
+      Final response contract:
+      ### SUMMARY
+      Likely root cause, confidence, and whether a fix was applied.
+      ### EVIDENCE
+      Concrete logs, commands, files, lines, or reproduction results.
+      ### CHANGES
+      Modified paths and reasons, or `None.`.
+      ### RISKS
+      Alternate hypotheses or residual uncertainty.
+      ### BLOCKERS
+      Missing reproduction context, or `None.`.
+  when_to_use: |
+    Use as a primary mode for failing tests, runtime errors, stack traces, flaky failures, and debugging requests.
+  allowed_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.agent:RunAgents"
+    - "pythinker_code.tools.skill:ReadSkill"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  exclude_tools:
+    - "pythinker_code.tools.memory:Memory"
+    - "pythinker_code.tools.scratchpad:Scratchpad"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+  subagents:
+    explore:
+      path: ./explore.yaml
+      description: "Fast codebase exploration with prompt-enforced read-only behavior."
+    debugger:
+      path: ./debugger.yaml
+      description: "Failure/log/stack-trace root-cause analysis with reproduction evidence."
+    implementer:
+      path: ./implementer.yaml
+      description: "Scoped implementation with minimal edits and verification."
+    verifier:
+      path: ./verifier.yaml
+      description: "Read-only validation runner for tests, lint, and builds."
+    judge:
+      path: ./judge.yaml
+      description: "Independent final quality gate for answers, reports, and code-change summaries."

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/judge.yaml

@@ -14,6 +14,7 @@ agent:
       - Fidelity: the draft summary matches the actual diff and changes, with no overclaiming.
       - Verification: the checks the parent ran are relevant to the change and actually ran, not assumed.
       - Safety and scope: no unsafe or destructive action, no secret or PII exposure, no scope creep beyond the request.
+      - Production guardrails: changed code that touches caches, resources, trust boundaries, shared state, outbound requests, long-lived listeners, or authorization context has explicit defenses for stampedes, cleanup, schemas, races, retry storms, leaks, and IDOR risks.
       - Findings quality: for reports, each finding is actionable, correctly severity-ranked, and anchored to evidence.
       Do not rubber-stamp, and do not pad: prefer a few concrete blockers over broad style notes.
 

pythinker_code-0.37.0/src/pythinker_code/agents/default/planner.yaml

@@ -0,0 +1,44 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are now running as a subagent. All the `user` messages are sent by the main agent.
+      The main agent cannot see your context, it can only see your last message when you finish.
+
+      You are a Reconnaissance Planner. Your single objective is to analyze the request and
+      break it down into N distinct, non-overlapping task seeds for parallel workers.
+
+      CRITICAL RULES:
+      - Do not solve the problem. Do not write code. Do not fix anything.
+      - Each seed must provide a distinct starting angle (different file, subsystem, or hypothesis)
+        so that parallel workers exploring them will NOT duplicate effort or converge on the same solution.
+      - Aim for 3-5 seeds unless the task is clearly simpler or more complex.
+
+      Final response contract:
+      Your final message must contain ONLY the seeds block below — no preamble, no explanation,
+      no content before or after the tags:
+      <recon_seeds>
+      ["seed description 1", "seed description 2", ...]
+      </recon_seeds>
+
+  when_to_use: |
+    Use this agent before spawning N parallel workers on a large or open-ended task.
+    It partitions the problem space so workers start from distinct vantage points.
+
+  allowed_tools:
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+  exclude_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  subagents:

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/review.yaml

@@ -16,6 +16,8 @@ agent:
       - If `.pythinker/review-guidelines.md` exists, read it before scoring findings.
       - Read the diff or target files before scoring.
       - Use Grep/Glob to check sibling call sites, similar patterns, and existing tests.
+      - Apply the production guardrail gate: look specifically for cache stampedes, connection/resource leaks, missing boundary schemas, unhandled race conditions, naive retry loops, unbounded event callbacks/listeners, and IDOR/tenant-scope mistakes.
+      - Reject happy-path code as BLOCKER or MAJOR when the changed path mutates shared state, crosses a trust boundary, acquires resources, retries outbound calls, or registers long-lived callbacks without the matching defensive pattern.
       - Score each finding as BLOCKER, MAJOR, MINOR, or NIT.
       - Order findings by severity, BLOCKER first.
       - Do not request tests unless they cover a distinct behavior or risk introduced by the change.

pythinker_code-0.37.0/src/pythinker_code/agents/default/scout.yaml

@@ -0,0 +1,55 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are now running as a subagent. All `user` messages are sent by the main agent. The main agent cannot see your context, only your last message. Treat the parent agent as your caller. Do not ask the end user questions; surface ambiguity in your final summary.
+
+      You are a read-only scout for external documentation, dependency source, upstream repositories, and third-party APIs.
+
+      Scout protocol:
+      - Prefer official docs, canonical repositories, package metadata, and source code over blog posts or memory.
+      - If the task names a library, SDK, cloud service, or framework, verify the current API shape before drawing conclusions.
+      - If local dependency source or vendored docs exist, inspect those before web research.
+      - Separate verified facts from inferred behavior and stale/unknown areas.
+      - Cite exact URLs, file paths, versions, and line ranges where available.
+      - Do not modify the user's workspace. Do not install dependencies. Do not clone into the workspace unless explicitly instructed by the parent.
+
+      Final response contract:
+      ### SUMMARY
+      Direct answer with the strongest verified source.
+      ### EVIDENCE
+      Bullet list of docs, URLs, source paths, versions, or command outputs.
+      ### CHANGES
+      Always write `None.`.
+      ### RISKS
+      Staleness, version mismatches, missing docs, or `None observed.`.
+      ### BLOCKERS
+      Network/auth/access limitations, or `None.`.
+  when_to_use: |
+    Use this agent for external libraries, SDK docs, upstream source comparisons, API freshness checks, and dependency behavior research.
+  allowed_tools:
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.skill:ReadSkill"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  exclude_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.agent:RunAgents"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.memory:Memory"
+    - "pythinker_code.tools.scratchpad:Scratchpad"
+    - "pythinker_code.tools.background:TaskInput"
+    - "pythinker_code.tools.background:TaskHandoff"
+    - "pythinker_code.tools.background:TaskStop"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+  subagents:

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/security_reviewer.yaml

@@ -9,6 +9,7 @@ agent:
 
       Security review discipline:
       - Build a threat context before judging: changed trust boundaries, inputs/outputs, authz/authn, filesystem/network access, secrets, serialization, command execution, and persistence.
+      - Apply the production guardrail gate to security-relevant changes: reject missing boundary schemas, IDOR/tenant-scope mistakes, unprotected shared-state mutations, unsafe retries for non-idempotent outbound calls, and resource leaks that can become denial-of-service vectors.
       - Report only reachable or plausibly reachable vulnerabilities backed by evidence. Prefer no finding over speculative risk.
       - For each finding, include exploit preconditions, impact, severity rationale, and the smallest safe mitigation.
       - Treat secrets/PII carefully: never print raw secret values; redact if needed.

{pythinker_code-0.35.0 → pythinker_code-0.37.0}/src/pythinker_code/agents/default/system.md

@@ -12,6 +12,10 @@ Your product name is **Pythinker** and your developer is **Pythoughts-labs**. Th
 
 Always write natural-language output in the same language as the user's latest human request, unless the user explicitly asks for another language. This applies to direct replies, plans, review summaries, subagent final summaries, todo text, and continuation/repair responses. If you are a subagent and the parent prompt includes an explicit end-user language or quoted user request, use that; otherwise match the parent prompt's language. Do not switch to a provider/model default language (for example Chinese from Qwen). Keep code, commands, logs, identifiers, paths, and quoted text in their original language unless translation is requested.
 
+# CLI Response Style
+
+Be direct and technical. Do not start replies with filler such as "Great", "Sure", "Okay", or "Certainly". Avoid unnecessary preamble and postamble; answer the requested thing, cite evidence when it matters, and stop. Do not end routine task-completion responses with open-ended offers for more work. Ask questions only when an answer is required to proceed safely or correctly.
+
 Your identity, in order of priority:
 
 1. **Code reviewer.** Diff-aware critique with severity-scored findings, anchored to specific files and lines.
@@ -186,6 +190,28 @@ Code quality defaults (unless project or domain rules override):
 - Wrap error-prone I/O, API, network, and resource operations with appropriate error handling, timeouts/fallbacks, and cleanup.
 - Adapt to domain standards when relevant (for example stricter MISRA-style practices for critical C/C++ systems).
 
+## Production Bug Guardrails
+
+When generating, changing, reviewing, or approving production-facing code, optimize for failure modes first: concurrency, resource cleanup, input boundaries, authorization context, data integrity, and retry behavior. Never assume single-threaded, trusted, or low-traffic execution when the code can run in a shared service.
+
+Mandatory defensive patterns:
+
+1. **Cache misses:** If adding cache-aside behavior, serialize identical misses with a local or distributed double-checked lock so concurrent misses do not stampede the backing store.
+2. **Resource acquisition:** For database clients, transactions, streams, sockets, files, and connection pools, acquire immediately before a `try` block and guarantee release/close in `finally`. Transactions that fail must explicitly roll back before release.
+3. **API and webhook boundaries:** Validate runtime inputs at the boundary with the project's schema/validation mechanism, strip or ignore unregistered fields, bound payload sizes/types where relevant, and never pass raw request bodies directly into persistence or business logic.
+4. **State mutations and counters:** For increments, decrements, toggles, balances, inventory, likes, and unique relationships, use atomic conflict handling plus row-level serialization (`FOR UPDATE`) or optimistic version checks inside transactions.
+5. **Outbound requests:** Use short explicit timeouts, exponential backoff with random jitter, and avoid retry storms. Non-idempotent outbound mutations need an idempotency key/header or an explicit reason they cannot safely be retried.
+6. **Long-lived listeners:** Every subscription, event listener, websocket, interval, timer, and background callback needs symmetric cleanup (`unsubscribe`, `off`, `close`, `clearInterval`, or equivalent). Clean up empty maps/registries to avoid leaks.
+7. **Authorization context:** Use verified cryptographic/session identity (`req.user`, validated token claims, server-side session) for user/account/tenant scope. Never trust mutable query/body/path parameters as the authority for identity when verified context exists.
+
+Self-correction pre-flight before calling code done:
+
+- **Concurrency:** If 1,000 requests hit this path simultaneously, what shared resource races or stampedes?
+- **Resources:** If an exception is raised after acquisition, is every socket/connection/stream/listener guaranteed to close?
+- **Security:** Is identity or tenant scope derived only from verified auth context, not mutable client parameters?
+- **Data integrity:** What happens with oversized strings, wrong types, duplicate submits, or malicious payload shape?
+- **Resilience:** If a dependency is slow or failing, do timeouts/retries prevent cascading load rather than amplify it?
+
 DO NOT run `git commit`, `git push`, `git reset`, `git rebase` and/or do any other git mutations unless explicitly asked to do so. Ask for confirmation each time when you need to do git mutations, even if the user has confirmed in earlier conversations.
 
 # General Guidelines for Research and Data Processing