pythinker-code 0.41.0__tar.gz → 0.42.0__tar.gz

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 0.41.0
+Version: 0.42.0
 Summary: Pythinker — an agentic CLI developed by Pythoughts-labs.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Pythoughts-labs
@@ -115,14 +115,15 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.41.0
+## 🆕 What's New in 0.42.0
 
-- **Goal-driven execution: new `/goal`, `/best-practices`, and `/learn` commands.** `/goal <objective>` sets a persistent thread goal the agent pursues across turns, restarts, and compaction until it is verifiably complete — with an evidence-based completion audit, a root-only `UpdateGoal` tool to mark it `complete`/`blocked`, and opt-in `goal.auto_continue` to loop automatically toward it. `/best-practices` (alias `/bp`) injects engineering-discipline guidance now also shipped always-on in the default prompt, and `/learn` distills session lessons into per-project memory.
-- **Statusline v2: a full redesign of the shell footer.** Colored segments with a gradient context bar, working spinner, live token speed, session cost/budget, thinking-effort badge, git diff counts, elapsed time, and a clock — all fail-closed and tunable via the new `/statusline` command (persisted under `[tui.statusline]`), with ASCII fallback and narrow-width graceful degradation.
-- **Agentic orchestration hardening.** Parallel subagents and background tasks get distinctive codenames, foreground `RunAgents` batches run concurrently and roll up child RISKS/BLOCKERS, the review pipeline decomposes large diffs and adversarially verifies every finding, and restricted-profile subagents are now offline, secret-scrubbed, and workspace-jailed by default — enforced at execution time, not just prompted.
-- **TUI polish.** Flicker-free streaming on synchronized-output terminals, inline ghost-completion for slash commands, monotonic tool-call rows, shell error briefs that surface the failing command's output, and no more transient `<invalid>` flashes or raw-mode hangs on exit.
+- **Parallel coding agents are truly isolated.** `isolation="worktree"` is now enforced, not just recorded: each background write agent runs in its own git worktree of HEAD and reports its worktree path with a diff summary so changes merge deliberately, while foreground shell commands and relative-path edits resolve against the agent's own work dir. Worktrees with commits ahead of their base are retained instead of orphaned, and worktree add/remove serializes per repo.
+- **The agent knows its own permission posture — and stops asking when it shouldn't.** A live permissions-state reminder renders the enforced profile, safe-mode/yolo/auto flags, mutation/network allowances, and shell-gate rules, re-emitted exactly when the posture changes. Provably read-only commands (`ls`, `git status`) no longer interrupt the root agent with an approval dialog, via a fail-closed positive allowlist.
+- **Edits recover from whitespace and smart-punctuation drift.** `StrReplaceFile` no longer hard-fails when the only mismatch is trailing whitespace, indentation, or smart quotes/dashes — a graduated line-window ladder relocates the edit, preserves CRLF endings, and names the relaxation it used. Ambiguous fuzzy matches still error rather than silently resolving.
+- **MCP servers are controllable.** Per-server `enabledTools`/`disabledTools` arrays in `mcp.json` scope a noisy server down to the tools you want, and a new `mcp.client.startup_timeout_ms` (default 30s) means a hung server can no longer stall every turn — `/mcp` now shows one actionable line per failed server.
+- **Quality of life.** `/model` switches now carry the conversation forward via a plain-text summary instead of starting fresh; typo'd config keys warn with their dotted path and source file (`PYTHINKER_STRICT_CONFIG=1` escalates to a startup error); project-scope hooks load only after `/trust`; the in-app updater recovers from Homebrew's untrusted-tap refusal; `/export` redacts secret-named values; inline `/command` references get acted on; and the thinking shimmer no longer animates while a foreground command runs.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.41.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.42.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -212,7 +213,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.41.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.42.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -240,7 +241,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.41.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.42.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -251,13 +252,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.41.0.exe
+.\PythinkerSetup-0.42.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.41.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.42.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -279,6 +280,8 @@ the files and the PATH edit.
 ```sh
 # 1. Install
 brew install Pythoughts-labs/pythinker/pythinker-code
+#    Homebrew ≥ 5 may refuse the untrusted tap; trust it once, then re-run:
+#      brew trust pythoughts-labs/pythinker
 
 # 2. Verify
 pythinker --version
@@ -294,6 +297,11 @@ latest version.
 **Upgrade:** `brew upgrade pythinker-code` (Homebrew packages don't
 auto-update; run this whenever you want the latest).
 
+> **Untrusted-tap refusal** — Homebrew ≥ 5 (with `HOMEBREW_REQUIRE_TAP_TRUST`)
+> refuses third-party taps until you trust them once:
+> `brew trust pythoughts-labs/pythinker`. The in-app updater detects the
+> refusal and offers to run it for you.
+
 **Uninstall:** `brew uninstall pythinker-code && brew untap Pythoughts-labs/pythinker`.
 
 > The tap repo is [Pythoughts-labs/homebrew-pythinker](https://github.com/Pythoughts-labs/homebrew-pythinker)
@@ -308,26 +316,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.41.0_amd64.deb
+sudo dpkg -i pythinker-code_0.42.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.41.0_arm64.deb
+sudo dpkg -i pythinker-code_0.42.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.41.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.42.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.41.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.42.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.41.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.42.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.41.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.41.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.42.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.42.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -336,8 +344,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.41.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.41.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.42.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.42.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -620,7 +628,7 @@ Pythinker loads [Model Context Protocol](https://modelcontextprotocol.io/) tools
 ### 🛠️ Manage persistent MCP servers
 
 ```sh
-# 📚 Context7 stdio server (Codex-style: NAME -- COMMAND)
+# 📚 Context7 stdio server (positional form: NAME -- COMMAND)
 pythinker mcp add context7 -- npx -y @upstash/context7-mcp --api-key YOUR-API-KEY
 # Added MCP server 'context7' to ~/.pythinker/mcp.json
 

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/README.md

@@ -50,14 +50,15 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
-## 🆕 What's New in 0.41.0
+## 🆕 What's New in 0.42.0
 
-- **Goal-driven execution: new `/goal`, `/best-practices`, and `/learn` commands.** `/goal <objective>` sets a persistent thread goal the agent pursues across turns, restarts, and compaction until it is verifiably complete — with an evidence-based completion audit, a root-only `UpdateGoal` tool to mark it `complete`/`blocked`, and opt-in `goal.auto_continue` to loop automatically toward it. `/best-practices` (alias `/bp`) injects engineering-discipline guidance now also shipped always-on in the default prompt, and `/learn` distills session lessons into per-project memory.
-- **Statusline v2: a full redesign of the shell footer.** Colored segments with a gradient context bar, working spinner, live token speed, session cost/budget, thinking-effort badge, git diff counts, elapsed time, and a clock — all fail-closed and tunable via the new `/statusline` command (persisted under `[tui.statusline]`), with ASCII fallback and narrow-width graceful degradation.
-- **Agentic orchestration hardening.** Parallel subagents and background tasks get distinctive codenames, foreground `RunAgents` batches run concurrently and roll up child RISKS/BLOCKERS, the review pipeline decomposes large diffs and adversarially verifies every finding, and restricted-profile subagents are now offline, secret-scrubbed, and workspace-jailed by default — enforced at execution time, not just prompted.
-- **TUI polish.** Flicker-free streaming on synchronized-output terminals, inline ghost-completion for slash commands, monotonic tool-call rows, shell error briefs that surface the failing command's output, and no more transient `<invalid>` flashes or raw-mode hangs on exit.
+- **Parallel coding agents are truly isolated.** `isolation="worktree"` is now enforced, not just recorded: each background write agent runs in its own git worktree of HEAD and reports its worktree path with a diff summary so changes merge deliberately, while foreground shell commands and relative-path edits resolve against the agent's own work dir. Worktrees with commits ahead of their base are retained instead of orphaned, and worktree add/remove serializes per repo.
+- **The agent knows its own permission posture — and stops asking when it shouldn't.** A live permissions-state reminder renders the enforced profile, safe-mode/yolo/auto flags, mutation/network allowances, and shell-gate rules, re-emitted exactly when the posture changes. Provably read-only commands (`ls`, `git status`) no longer interrupt the root agent with an approval dialog, via a fail-closed positive allowlist.
+- **Edits recover from whitespace and smart-punctuation drift.** `StrReplaceFile` no longer hard-fails when the only mismatch is trailing whitespace, indentation, or smart quotes/dashes — a graduated line-window ladder relocates the edit, preserves CRLF endings, and names the relaxation it used. Ambiguous fuzzy matches still error rather than silently resolving.
+- **MCP servers are controllable.** Per-server `enabledTools`/`disabledTools` arrays in `mcp.json` scope a noisy server down to the tools you want, and a new `mcp.client.startup_timeout_ms` (default 30s) means a hung server can no longer stall every turn — `/mcp` now shows one actionable line per failed server.
+- **Quality of life.** `/model` switches now carry the conversation forward via a plain-text summary instead of starting fresh; typo'd config keys warn with their dotted path and source file (`PYTHINKER_STRICT_CONFIG=1` escalates to a startup error); project-scope hooks load only after `/trust`; the in-app updater recovers from Homebrew's untrusted-tap refusal; `/export` redacts secret-named values; inline `/command` references get acted on; and the thinking shimmer no longer animates while a foreground command runs.
 
-Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.41.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.42.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
 
 
 ---
@@ -147,7 +148,7 @@ matches your OS — no Python, Node, or `uv` prerequisite.
 
 | Platform | Recommended install | Artifact source |
 |---|---|---|
-| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.41.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
+| **🪟 Windows** | `irm https://pythinker.com/install.ps1 \| iex` | `PythinkerSetup-0.42.0.exe` from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> / <img src="https://img.shields.io/badge/-Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux">** | `curl -fsSL https://pythinker.com/install.sh \| bash` | native tarball from [Releases](https://github.com/Pythoughts-labs/pythinker-code/releases/latest) |
 | **<img src="https://img.shields.io/badge/-macOS-000000?style=flat-square&logo=apple&logoColor=white" alt="macOS"> — Homebrew** | `brew install Pythoughts-labs/pythinker/pythinker-code` | auto-published Homebrew tap |
 | **🐳 Docker** | `docker run --rm -it ghcr.io/pythoughts-labs/pythinker-code` | GHCR multi-arch image |
@@ -175,7 +176,7 @@ pythinker                      # start the interactive TUI
 
 ### 🪟 Windows — native installer
 
-`PythinkerSetup-0.41.0.exe` is a signed* Inno Setup wizard. Installs per-user
+`PythinkerSetup-0.42.0.exe` is a signed* Inno Setup wizard. Installs per-user
 into `%LOCALAPPDATA%\Programs\Pythinker`, registers `pythinker` on your user
 PATH (`HKCU\Environment`), broadcasts `WM_SETTINGCHANGE` so new shells see
 the change. **No UAC prompt.**
@@ -186,13 +187,13 @@ irm https://pythinker.com/install.ps1 | iex
 
 # Or manually download the installer + checksum from the Releases page,
 # verify with Get-FileHash, then run:
-.\PythinkerSetup-0.41.0.exe
+.\PythinkerSetup-0.42.0.exe
 
 # Open a fresh PowerShell
 pythinker --version
 ```
 
-**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.41.0.exe /ALLUSERS`
+**Per-machine install** (IT-managed boxes): `.\PythinkerSetup-0.42.0.exe /ALLUSERS`
 installs to `%ProgramFiles%\Pythinker` and writes PATH to HKLM (requires admin).
 
 **Upgrade:** `pythinker update` from inside the running app — it downloads
@@ -214,6 +215,8 @@ the files and the PATH edit.
 ```sh
 # 1. Install
 brew install Pythoughts-labs/pythinker/pythinker-code
+#    Homebrew ≥ 5 may refuse the untrusted tap; trust it once, then re-run:
+#      brew trust pythoughts-labs/pythinker
 
 # 2. Verify
 pythinker --version
@@ -229,6 +232,11 @@ latest version.
 **Upgrade:** `brew upgrade pythinker-code` (Homebrew packages don't
 auto-update; run this whenever you want the latest).
 
+> **Untrusted-tap refusal** — Homebrew ≥ 5 (with `HOMEBREW_REQUIRE_TAP_TRUST`)
+> refuses third-party taps until you trust them once:
+> `brew trust pythoughts-labs/pythinker`. The in-app updater detects the
+> refusal and offers to run it for you.
+
 **Uninstall:** `brew uninstall pythinker-code && brew untap Pythoughts-labs/pythinker`.
 
 > The tap repo is [Pythoughts-labs/homebrew-pythinker](https://github.com/Pythoughts-labs/homebrew-pythinker)
@@ -243,26 +251,26 @@ attached to every GitHub Release.
 
 ```sh
 # Debian / Ubuntu (x86_64)
-sudo dpkg -i pythinker-code_0.41.0_amd64.deb
+sudo dpkg -i pythinker-code_0.42.0_amd64.deb
 sudo apt-get install -f       # only if dpkg reports missing deps
 
 # Debian / Ubuntu (ARM64)
-sudo dpkg -i pythinker-code_0.41.0_arm64.deb
+sudo dpkg -i pythinker-code_0.42.0_arm64.deb
 
 # Fedora / RHEL / openSUSE (x86_64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.x86_64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.x86_64.rpm.sha256
-sha256sum -c pythinker-code-0.41.0.x86_64.rpm.sha256
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.x86_64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.x86_64.rpm.sha256
+sha256sum -c pythinker-code-0.42.0.x86_64.rpm.sha256
 # Fedora / RHEL:
-sudo dnf install ./pythinker-code-0.41.0.x86_64.rpm
+sudo dnf install ./pythinker-code-0.42.0.x86_64.rpm
 # openSUSE:
-sudo zypper install ./pythinker-code-0.41.0.x86_64.rpm
+sudo zypper install ./pythinker-code-0.42.0.x86_64.rpm
 
 # Fedora / RHEL (aarch64)
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.aarch64.rpm
-curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.41.0/pythinker-code-0.41.0.aarch64.rpm.sha256
-sha256sum -c pythinker-code-0.41.0.aarch64.rpm.sha256
-sudo dnf install ./pythinker-code-0.41.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.aarch64.rpm
+curl -LO https://github.com/Pythoughts-labs/pythinker-code/releases/download/v0.42.0/pythinker-code-0.42.0.aarch64.rpm.sha256
+sha256sum -c pythinker-code-0.42.0.aarch64.rpm.sha256
+sudo dnf install ./pythinker-code-0.42.0.aarch64.rpm
 ```
 
 Both packages drop a small `/usr/bin/pythinker` launcher that execs the real
@@ -271,8 +279,8 @@ binary under `/usr/lib/pythinker/`, so your `$PATH` stays tidy.
 **Verify before install:**
 
 ```sh
-sha256sum -c pythinker-code_0.41.0_amd64.deb.sha256        # Debian/Ubuntu
-sha256sum -c pythinker-code-0.41.0.x86_64.rpm.sha256       # Fedora/RHEL
+sha256sum -c pythinker-code_0.42.0_amd64.deb.sha256        # Debian/Ubuntu
+sha256sum -c pythinker-code-0.42.0.x86_64.rpm.sha256       # Fedora/RHEL
 ```
 
 **Upgrade:** download the new `.deb`/`.rpm` from Releases and `dpkg -i` /
@@ -555,7 +563,7 @@ Pythinker loads [Model Context Protocol](https://modelcontextprotocol.io/) tools
 ### 🛠️ Manage persistent MCP servers
 
 ```sh
-# 📚 Context7 stdio server (Codex-style: NAME -- COMMAND)
+# 📚 Context7 stdio server (positional form: NAME -- COMMAND)
 pythinker mcp add context7 -- npx -y @upstash/context7-mcp --api-key YOUR-API-KEY
 # Added MCP server 'context7' to ~/.pythinker/mcp.json
 

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "0.41.0"
+version = "0.42.0"
 description = "Pythinker — an agentic CLI developed by Pythoughts-labs."
 readme = "README.md"
 requires-python = ">=3.12"

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/CHANGELOG.md

@@ -15,6 +15,27 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+## 0.42.0 (2026-06-12)
+
+- **Adversarial branch review hardening.** A multi-agent review pass confirmed and fixed: committed-but-clean isolation worktrees are now retained (commits ahead of the creation base count as changes — they were previously orphaned on cleanup); foreground shell commands and relative-path file edits now resolve against the agent's work dir, so worktree isolation actually binds them (host exec gained a `cwd` argument); safe mode now also disables the read-only-command prompt elision; locally parallel-safe MCP/tools run in parallel in the same-step gate; worktree add/remove serializes per repo. Behavior notes: same-step tool calls without `supports_parallel` now serialize deterministically (previously fully concurrent), and text-mode error diagnostics moved to stderr — capture `2>&1` or use `--output-format stream-json` if you scraped stdout.
+- **The agent now knows its own permission posture.** A live permissions-state reminder renders the enforced profile, safe-mode/yolo/auto flags, mutation/network allowances, session-approved actions, and the shell gate's command-shaping rules — re-emitted exactly when the posture changes (/yolo, /auto, /trust, new approvals) instead of the model discovering policy through denied tool calls.
+- **Edits recover from whitespace and smart-punctuation drift.** StrReplaceFile no longer hard-fails with "old string not found" when the only mismatch is trailing whitespace, indentation, or smart quotes/dashes: a graduated line-window ladder relocates the edit, replaces the actual file slice (preserving CRLF endings), and names the relaxation it used in the tool message. Multiple fuzzy hits without replace_all still error, so ambiguity is never silently resolved.
+- **`isolation="worktree"` is now enforced for background write agents.** Previously it only recorded intent, so parallel coders shared one working tree and could clobber each other. A write-profile child now runs in its own git worktree of HEAD; its final report names the worktree path with a diff summary so changes merge deliberately, clean worktrees are removed, non-git roots fail with an actionable error, and read-profile children ignore the request.
+- **MCP servers can be scoped to specific tools.** Optional `enabledTools` (exclusive allowlist) and `disabledTools` (denylist, wins on conflict) arrays per server in `mcp.json` keep a noisy server from flooding the model's tool list — filtered tools are never registered, and a call-time re-check guards shared tool maps.
+- **A hung MCP server can no longer stall the whole session.** Server connects are bounded by a new `mcp.client.startup_timeout_ms` (default 30s) — previously a hung connect blocked every agent turn. `/mcp` now shows one actionable line per failed server (timeout → the config knob, 401 → the exact auth command, missing binary → the command path) instead of a bare "failed".
+- **Provably read-only commands no longer prompt for approval.** The first `ls` or `git status` of a session used to interrupt with an approval dialog. A tight positive allowlist (read-only binaries and git subcommands, with hidden-command, write-redirection, wrapper, and fake-path rejections, fail closed) now elides the prompt in the root agent; subagents keep requesting approval as their unattended defense surface, and deny-profile decisions are never overridden.
+- **Switching models keeps your conversation.** `/model` used to start a fresh session, discarding all context. The switch now seeds the new session with a plain-text summary written by the outgoing model (so provider-specific message formats never cross the boundary), falling back to the old fresh start if summarization fails; disable with `model_switch_carryover = false`.
+- **Typo'd config keys are no longer silently ignored.** Loading now diffs the merged config against the model schema and warns with the dotted path and originating scope file for every unrecognized key (`default_yolo_typo = true` names itself and its file instead of silently changing nothing); `PYTHINKER_STRICT_CONFIG=1` escalates the findings to a startup error for CI.
+- **Project-scope hooks now require trusting the project.** A cloned repository's `.pythinker/config.toml` could previously auto-execute its shell hooks at session start. Hooks from project and local scopes now load only after `/trust` records a durable per-project decision (stored user-side in `trusted_projects.json`, keyed by the resolved repo root); until then they are stripped with a warning naming the fix. Broken TOML in an untrusted project no longer blocks startup — the scope is treated as empty with a warning, while trusted projects keep the loud error.
+- **Agent orchestration guidance is sharper for substantial tasks.** The default prompt now sharpens work-shaping guidance, and a new root-only runtime reminder nudges substantial normal-mode tasks toward the lightest effective path — direct tools, `SetTodoList`, foreground `RunAgents`, or verification — while backing off for plan mode, `/goal`, auto mode, and subagents.
+- **The in-app updater recovers from Homebrew's untrusted-tap refusal.** Homebrew 5.0 (`HOMEBREW_REQUIRE_TAP_TRUST`) refuses to load formulas from third-party taps until `brew trust <tap>` is run once, which made the in-app `brew upgrade` fail with only a generic "run manually" hint. The updater now detects both the hard `Refusing to load … from untrusted tap` refusal and the soft `Skipping … not trusted` warning, offers to run `brew trust pythoughts-labs/pythinker` and retry the upgrade once on an interactive terminal, and otherwise prints the exact remediation. It also catches the silent no-op where an untrusted tap is skipped during `brew update` and `brew upgrade` exits 0 without advancing the version.
+- **Session exports redact secrets surfaced by tool output.** A tool result (e.g. `grep`/`cat` over a `.env`) could write a secret value into an exported transcript in plaintext. `/export` now redacts the value of secret-named keys (`password`, `token`, `api_key`, `secret`, …) to `[REDACTED]` in both the markdown and YAML formats, while leaving non-secret keys such as `token_count`, usernames, and ports intact.
+- **The welcome logo's antenna blinks a fixed number of times on launch, then settles.** Replaces the terminal's indefinite slow-blink with a bounded boot animation — the antenna ball blinks seven times after the banner prints and then holds steady. It is skipped under reduced motion, on non-interactive output, and when the terminal is too short to keep the antenna row on screen.
+- **Inline `/command` references get acted on, not just explained away.** When a message mentions a slash command mid-sentence (e.g. "your `/goal` today is to `/plan` and build the page"), the command doesn't auto-run — but the agent no longer leads its reply by reporting it as failed. The per-turn reminder and the system prompt now steer the agent to act on the intent: call the real `EnterPlanMode` tool for `/plan` (clarified as a genuine, callable tool so models stop doubting it exists), pursue the described objective for `/goal`, load `/skill:<name>` via `ReadSkill`, and apply equivalent guidance for other commands — only surfacing how to invoke the literal command when genuinely needed.
+- **The "thinking" shimmer no longer runs while a foreground command does.** When the agent started a long-running foreground process — a dev server via `npm`/`docker`, a watch task — the shimmering verb spinner ("Working…/Thinking…") kept animating for the whole turn, implying the agent was busy when it was really just awaiting the subprocess. The spinner is now suppressed while any foreground tool is mid-execution; the tool card's own animated running marker (and its streaming output) carries the liveness, so the shimmer means "the agent is thinking" again and reappears the moment the command returns.
+
+Upgrade with `pythinker update`, `pip install --upgrade pythinker-code==0.42.0`, or use the native installer for your platform from the [Releases page](https://github.com/Pythoughts-labs/pythinker-code/releases/latest).
+
 ## 0.41.0 (2026-06-11)
 
 - **New `/goal` command — goal-driven execution that loops until verified.** `/goal <objective>` sets a persistent thread goal the agent pursues across turns, restarts, and context compaction until it is verifiably complete. It kicks off immediately with a success-criteria derivation prompt and is re-injected each turn with fidelity rules (no scope-shrinking, no easier-to-test substitutes) and an evidence-based completion audit — completion may only be claimed after every requirement is proven against current state. The new root-only `UpdateGoal` tool marks the goal `complete` (after that audit) or `blocked` (after a strict three-strike audit) and stops the reminders; opt-in `goal.auto_continue` (new config table, default off, `max_continuations` 1–10, capped at 3) drives automatic continuation turns toward the goal until it is marked, a tool call is rejected, or the cap is reached, with a wrap-up instruction on the final continuation. Subcommands: `view`, `pause`, `resume`, `clear`. Objectives are injected as untrusted data, never as higher-priority instructions.

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/acp/host.py

@@ -296,8 +296,10 @@ class ACPHost:
     ) -> None:
         await self._fallback.mkdir(path, parents=parents, exist_ok=exist_ok)
 
-    async def exec(self, *args: str, env: Mapping[str, str] | None = None) -> HostProcess:
-        return await self._fallback.exec(*args, env=env)
+    async def exec(
+        self, *args: str, env: Mapping[str, str] | None = None, cwd: str | None = None
+    ) -> HostProcess:
+        return await self._fallback.exec(*args, env=env, cwd=cwd)
 
     def _abs_path(self, path: StrOrHostPath) -> str:
         host_path = path if isinstance(path, HostPath) else HostPath(path)

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/acp/tools.py

@@ -10,6 +10,7 @@ from pythinker_code.soul.agent import Runtime
 from pythinker_code.soul.approval import Approval
 from pythinker_code.soul.permission import check_shell_command_allowed
 from pythinker_code.soul.toolset import PythinkerToolset
+from pythinker_code.tools.ask_user import AskUserQuestion
 from pythinker_code.tools.shell import Params as ShellParams
 from pythinker_code.tools.shell import Shell
 from pythinker_code.tools.utils import ToolResultBuilder
@@ -28,6 +29,11 @@ def replace_tools(
         # Only replace tools when running locally or under ACPHost.
         return
 
+    # ACP clients get no interactive question UI (the session loop signals
+    # QuestionNotSupported), so don't advertise the tool — a hallucinated call
+    # still resolves through the registered tool's graceful fallback.
+    toolset.hide(AskUserQuestion.name)
+
     if client_capabilities.terminal and (shell_tool := toolset.find(Shell)):
         # Replace the Shell tool with the ACP Terminal tool if supported.
         toolset.add(
@@ -48,6 +54,8 @@ class HideOutputDisplayBlock(DisplayBlock):
 
 
 class Terminal(CallableTool2[ShellParams]):
+    emits_tool_execution_started_after_approval = True
+
     def __init__(
         self,
         shell_tool: Shell,

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/agents/default/system.md

@@ -105,7 +105,7 @@ For research or multimedia tasks (images, video, PDFs, docs, spreadsheets, prese
 
 **Act with tools; prose is not action.** Code that appears only in your reply is not saved — use `WriteFile` to create or overwrite, `StrReplaceFile` to edit, `Shell` to run and verify; iterate on failures. Follow each tool's parameter spec exactly. Don't narrate routine tool calls. Do not re-read a file after a successful edit tool call.
 
-**Parallelize.** Before every tool response, ask whether another independent read/search/check can run in the same turn — you may emit any number of tool calls in one response; batch non-interfering calls. Serializing independent operations wastes time and grows context. This is very important to your performance.
+**Parallelize.** Before every tool response, ask whether another independent read/search/check can run in the same turn — you may emit any number of tool calls in one response; batch non-interfering calls. Choose the lightest effective work shape: direct tools for known-path checks, `SetTodoList` once a substantial approach is clear, foreground `RunAgents` when independent children feed immediate synthesis, and background agents only when you can make other progress while they run. Serializing independent operations wastes time and grows context. This is very important to your performance.
 
 **Spend context deliberately.** The context window is a finite budget: read targeted ranges instead of whole files when the region is known, distill long command output to what the task needs, and push bulky exploration into subagents that return summaries rather than raw dumps.
 
@@ -125,7 +125,7 @@ For research or multimedia tasks (images, video, PDFs, docs, spreadsheets, prese
 
 **Skills (`ReadSkill`).** Load a skill's exact instructions before applying its workflow — mandatory for `review-pr`, `diagnose-ci-failures`, `fix-errors`, `implement-specs`, `spec-driven-implementation`, `check-impl-against-spec`, `resolve-merge-conflicts`, and `create-pr`. Read skill details only when needed, to conserve context. Catalog and scope precedence in §12.
 
-**Inline `/command` references.** Slash commands execute only as their own message starting with `/`. A `/command` or `/skill:<name>` mentioned mid-message did not run: treat the reference as part of the request — load a referenced skill via `ReadSkill`, apply referenced guidance yourself, or tell the user to invoke it as a standalone message. Never silently drop such a reference.
+**Inline `/command` references.** Slash commands execute only as their own message starting with `/`. A `/command` or `/skill:<name>` mentioned mid-message did not auto-run, but it still expresses intent — act on it rather than leading your reply by reporting it as failed. For `/plan`, call `EnterPlanMode` (a real tool in your toolset, not just prose); for `/goal`, pursue the described objective until it is verifiably done; for `/skill:<name>`, load it via `ReadSkill` and apply it; for other guidance commands, apply the equivalent guidance yourself. Mention invoking the real command only when genuinely needed. Never silently drop such a reference.
 
 **MCP.** Connected MCP servers expose their capabilities as ordinary tools already in your toolset (descriptions name the server). To *use* one, invoke its tools directly — never pip-install the server, import it as a module, or search the repo for its config. If a named server has no tools present, it is not connected (loading, failed, or unauthorized), not missing: point the user to `/mcp` for status, and to `pythinker mcp auth <server_name>` for an unauthorized OAuth server.
 

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/app.py

@@ -388,6 +388,30 @@ class PythinkerCLI:
         from pythinker_code.hooks.engine import HookEngine
 
         hook_engine = HookEngine(config.hooks, cwd=str(session.work_dir))
+        if config.disabled_project_hooks:
+            # The load-time logger.warning only reaches shell users; publish a
+            # notification so web/ACP frontends also learn why their project
+            # hooks did not run and how to enable them.
+            from pythinker_code.notifications.models import NotificationEvent
+
+            runtime.notifications.publish(
+                NotificationEvent(
+                    id=f"project-hooks-disabled:{session.id}",
+                    category="system",
+                    type="project_hooks_disabled",
+                    source_kind="config",
+                    source_id="project_trust",
+                    title="Project hooks disabled (untrusted project)",
+                    body=(
+                        "Hooks defined in "
+                        + ", ".join(config.disabled_project_hooks)
+                        + " are disabled until you trust this project. Run /trust to "
+                        "enable them (takes effect on /reload or next start)."
+                    ),
+                    severity="warning",
+                    dedupe_key=f"project-hooks-disabled:{session.id}",
+                )
+            )
         soul.set_hook_engine(hook_engine)
         runtime.hook_engine = hook_engine
 
@@ -603,7 +627,7 @@ class PythinkerCLI:
     async def _env(self) -> AsyncGenerator[None]:
         async with _CWD_LOCK:
             original_cwd = HostPath.cwd()
-            await pythinker_host.chdir(self._runtime.session.work_dir)
+            await pythinker_host.chdir(self._runtime.work_dir)
             try:
                 # to ignore possible warnings from dateparser
                 warnings.filterwarnings("ignore", category=DeprecationWarning)
@@ -782,7 +806,7 @@ class PythinkerCLI:
         """Run the Pythinker CLI instance with shell UI."""
         from pythinker_code.ui.shell import Shell, WelcomeInfoItem
 
-        work_dir = self._runtime.session.work_dir
+        work_dir = self._runtime.work_dir
         welcome_info = [
             WelcomeInfoItem(name="Directory", value=str(shorten_home(work_dir))),
         ]

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/background/agent_runner.py

@@ -4,8 +4,11 @@ from __future__ import annotations
 import asyncio
 import contextlib
 from dataclasses import replace
+from pathlib import Path
 from typing import TYPE_CHECKING
 
+from pythinker_host.path import HostPath
+
 from pythinker_code.approval_runtime import (
     ApprovalSource,
     reset_current_approval_source,
@@ -64,6 +67,7 @@ class BackgroundAgentRunner:
         model_override: str | None,
         timeout_s: int | None = None,
         resumed: bool = False,
+        isolation: str | None = None,
     ) -> None:
         self._runtime = runtime
         self._manager = manager
@@ -74,6 +78,8 @@ class BackgroundAgentRunner:
         self._model_override = model_override
         self._timeout_s = timeout_s
         self._resumed = resumed
+        self._isolation = isolation
+        self._worktree_path: Path | None = None
         self._builder = SubagentBuilder(runtime)
         self._approval_update_tasks: set[asyncio.Task[None]] = set()
 
@@ -131,11 +137,13 @@ class BackgroundAgentRunner:
                 output.error(
                     _timeout_recovery_message(timeout_s=self._timeout_s, agent_id=self._agent_id)
                 )
+                self._note_retained_worktree(output)
             else:
                 # Internal timeout (e.g. aiohttp request) — treat as generic failure
                 logger.exception("Background agent runner failed")
                 self._finalize_safely(outcome="failed", reason=str(exc))
                 output.error(_failure_recovery_message(reason=str(exc), agent_id=self._agent_id))
+                self._note_retained_worktree(output)
         except asyncio.CancelledError:
             self._finalize_safely(outcome="killed", reason="Stopped by TaskStop")
             output.stage("cancelled")
@@ -150,6 +158,7 @@ class BackgroundAgentRunner:
             logger.exception("Background agent runner failed")
             self._finalize_safely(outcome="failed", reason=str(exc))
             output.error(_failure_recovery_message(reason=str(exc), agent_id=self._agent_id))
+            self._note_retained_worktree(output)
         finally:
             # Whatever happens in approval cleanup below, the dict pop must
             # run — it is the *only* place that removes this task from
@@ -184,12 +193,14 @@ class BackgroundAgentRunner:
                 effective_model=self._model_override,
             )
 
+        work_dir_override = await self._prepare_isolation_worktree(output)
         spec = SubagentRunSpec(
             agent_id=self._agent_id,
             type_def=type_def,
             launch_spec=launch_spec,
             prompt=self._prompt,
             resumed=self._resumed,
+            work_dir_override=work_dir_override,
         )
         soul, prompt = await prepare_soul(
             spec,
@@ -220,6 +231,7 @@ class BackgroundAgentRunner:
         if failure is not None:
             self._finalize_safely(outcome="failed", reason=failure.message)
             output.error(_failure_recovery_message(reason=failure.message, agent_id=self._agent_id))
+            self._note_retained_worktree(output)
             output.stage(f"failed: {failure.brief}")
             return
         output.stage("run_soul_finished")
@@ -228,6 +240,7 @@ class BackgroundAgentRunner:
             self._finalize_safely(
                 outcome="failed", reason="Agent completed but produced no output."
             )
+            self._note_retained_worktree(output)
             output.stage("failed: empty output")
             return
         # Surface this child's total LLM spend so the orchestrating parent can budget a
@@ -235,9 +248,74 @@ class BackgroundAgentRunner:
         # runner. Background results are read later via TaskOutput, so the spend rides in
         # the written transcript rather than the immediate (launch-stub) tool return.
         output.usage(format_usage_lines("child", soul.cumulative_usage, soul.model_name))
+        final_response = await self._append_worktree_report(final_response)
         output.summary(final_response)
         self._finalize_safely(outcome="completed")
 
+    async def _prepare_isolation_worktree(self, output: SubagentOutputWriter) -> HostPath | None:
+        """Honor isolation='worktree' for write-profile children.
+
+        Read-profile children gain nothing from isolation (they cannot
+        mutate), so the request is logged and skipped rather than failing
+        the task. Raises WorktreeError for non-git roots — actionable, and
+        better surfaced before any model spend.
+        """
+        if self._isolation != "worktree":
+            return None
+        from pythinker_code.soul.permission import subagent_type_allows_file_mutation
+        from pythinker_code.subagents.worktree import create_agent_worktree
+
+        if not subagent_type_allows_file_mutation(self._subagent_type):
+            logger.info(
+                "isolation='worktree' ignored for read-profile subagent type {t}",
+                t=self._subagent_type,
+            )
+            return None
+        worktree = Path(str(self._runtime.session.dir)) / "worktrees" / self._agent_id
+        await create_agent_worktree(Path(str(self._runtime.work_dir)), worktree)
+        self._worktree_path = worktree
+        output.stage(f"worktree_created: {worktree}")
+        return HostPath.unsafe_from_local_path(worktree)
+
+    def _note_retained_worktree(self, output: SubagentOutputWriter) -> None:
+        """Name the retained worktree on failure/timeout paths.
+
+        Retention on failure is deliberate — resume reuses the worktree and a
+        post-mortem may need its state — but it must never be silent.
+        """
+        if self._worktree_path is None:
+            return
+        output.stage(
+            f"worktree_retained: {self._worktree_path} (resume reuses it; remove with "
+            f"`git worktree remove {self._worktree_path}`)"
+        )
+
+    async def _append_worktree_report(self, final_response: str) -> str:
+        """Tell the orchestrator where the isolated changes live.
+
+        Changes are never auto-merged; the report carries the worktree path
+        and a diff summary so merging stays a deliberate decision. Clean
+        worktrees are removed.
+        """
+        if self._worktree_path is None:
+            return final_response
+        from pythinker_code.subagents.worktree import (
+            cleanup_agent_worktree,
+            worktree_change_summary,
+        )
+
+        summary = await worktree_change_summary(self._worktree_path)
+        disposition = await cleanup_agent_worktree(
+            Path(str(self._runtime.work_dir)),
+            self._worktree_path,
+            has_changes=bool(summary),
+        )
+        return (
+            f"{final_response}\n\n## Isolation worktree\n"
+            f"Path: {self._worktree_path} ({disposition})\n"
+            f"{summary or 'No changes were made.'}"
+        )
+
     def _on_approval_runtime_event(self, event: ApprovalRuntimeEvent) -> None:
         request = event.request
         if request.source.kind != "background_agent" or request.source.id != self._task_id:

{pythinker_code-0.41.0 → pythinker_code-0.42.0}/src/pythinker_code/background/manager.py

@@ -397,6 +397,7 @@ class BackgroundTaskManager:
                 model_override=model_override,
                 timeout_s=effective_timeout,
                 resumed=resumed,
+                isolation=isolation,
             ).run()
         )
         self._live_agent_tasks[task_id] = task