pythinker-code 2.3.0__tar.gz → 2.5.0__tar.gz

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 2.3.0
+Version: 2.5.0
 Summary: Pythinker Code is your next CLI agent.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Mohamed Elkholy
@@ -110,6 +110,39 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
+## 🆕 What's New in 2.5.0
+
+Coding-agent runtime hardening: runtime-enforced permission profiles, FetchURL SSRF protection, a Windows self-upgrade fix, and a configurable feedback endpoint.
+
+- **Runtime-enforced permission profiles** — every built-in role (`read-only` / `plan` / `ask` / `implement` / `review` / `verify`) is now backed by `src/pythinker_code/soul/permission.py`. Profiles are snapshot per LLM step so a mid-step model switch can't escalate. **Plan mode hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- **Plan → Implement handoff** — new `tools/plan/handoff.py` plus dynamic injection through `soul/dynamic_injections/plan_mode.py` carries the approved plan into implementation without re-priming the context.
+- **FetchURL SSRF + size hardening** — `_validate_fetch_url` blocks private / loopback / link-local / multicast / reserved IPv4 + IPv6 ranges; rejects non-`http`/`https` schemes; non-host URLs. Responses are streamed with a hard **5 MB** ceiling honoring `Content-Length`.
+- **Windows self-upgrade fixed** — `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Eliminates the `os error 32: The process cannot access the file because it is being used by another process` error.
+- **Background recovery improved** — `recoverable` (resumable via stored `agent_id`) vs `lost` (worker gone, no resume target). Subagent instances are parked as `idle` when recoverable. `pythinker-host` subprocess teardown kills the entire child process tree and creates a new session group.
+- **Feedback endpoint config** — new `feedback` config block (`endpoint_url`, `api_key`, `custom_headers`). The `/feedback` slash command now routes submissions to a user-configured HTTP endpoint instead of being a no-op.
+- **Welcome-screen version banner** — installed Pythinker version is now visible up-front.
+- **VS 2026 CI forward-compat probe** — non-blocking `windows-2025-vs2026` matrix entry on the host + cli builds validates MSVC v144 ahead of GitHub's eventual `windows-2022` deprecation.
+- **anthropic 0.101 compat** — added fallbacks for the six new tool-result block types so `pyright` stays exhaustive.
+- **Telemetry hygiene** — OTel `service.name` normalized to a stable value for SigNoz dashboards; Sentry filters drop test and shutdown noise.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
+### What was new in 2.4.0
+
+## 🆕 What's New in 2.4.0
+
+Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.
+
+- **New subagents** — `implementer` (scoped edits + verification), `review` (severity-scored read-only review), and `verifier` (`PASS` / `FAIL` / `FLAKY` validation runner). Join the existing `coder` / `explore` / `plan` roster.
+- **Structured subagent output** — every default agent now answers with `### SUMMARY / EVIDENCE / CHANGES / RISKS / BLOCKERS`, so the parent agent can consume results without re-parsing prose. New recommended flow: **Scout → Plan → Implement → Review → Verify** (review and verify can run in parallel).
+- **Kimi K2.5 / K2.6 (Moonshot) support** — `--thinking` is routed via the provider-specific `thinking.type` body field, and assistant tool-call replays always carry `reasoning_content` so multi-step tool flows stop tripping Moonshot's strict thinking-replay check. Same hardening applied to DeepSeek's strict mode.
+- **`Grep` works without `rg`** — pure-Python fallback honors `pattern` / `glob` / `type` / `ignore_case` / `multiline` / `context` / `output_mode` / `offset` / `head_limit` and respects `.gitignore`. The downloader also retries against the upstream GitHub releases mirror and accepts `PYTHINKER_RG_PATH=/absolute/path` plus extra discovery paths (`~/.cargo/bin`, `~/.local/bin`, `~/.pi/agent/bin`, `/usr/bin`, `/usr/local/bin`).
+- **`AGENTS.md` rewritten** to match the new roster, and `tools/agent/description.md` documents the parallel-review and cross-check patterns.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.4.0`.
+
+### What was new in 2.3.0
+
 ## 🆕 What's New in 2.3.0
 
 Telemetry & observability audit on top of 2.2.1.
@@ -120,8 +153,6 @@ Telemetry & observability audit on top of 2.2.1.
 - **`pythinker.mcp.call` span** with `mcp.server` attribute.
 - **`docs/en/reference/telemetry.md`** documents the full contract.
 
-Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.3.0`.
-
 ### What was new in 2.2.1
 
 ## 🆕 What's New in 2.2.1
@@ -131,8 +162,6 @@ CI hardening on top of 2.2.0.
 - **macOS binary build is now optional-codesign** — the release workflow detects whether `APPLE_CERTIFICATE_P12` / `APPLE_NOTARIZATION_KEY_P8` repo secrets are set. When they aren't (the v2.2.0 case), it ships an ad-hoc-signed PyInstaller binary instead of failing the whole release. PyPI install (`pip install pythinker-code`) is unaffected.
 - **PyPI publish is idempotent** — `pypa/gh-action-pypi-publish` now runs with `skip-existing: true`, so re-running the release workflow against an already-published version is a no-op.
 
-Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.3.0`.
-
 ### What was new in 2.2.0
 
 Animated installer + Windows PATH automation, on top of 2.1.2.

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/README.md

@@ -48,6 +48,39 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
+## 🆕 What's New in 2.5.0
+
+Coding-agent runtime hardening: runtime-enforced permission profiles, FetchURL SSRF protection, a Windows self-upgrade fix, and a configurable feedback endpoint.
+
+- **Runtime-enforced permission profiles** — every built-in role (`read-only` / `plan` / `ask` / `implement` / `review` / `verify`) is now backed by `src/pythinker_code/soul/permission.py`. Profiles are snapshot per LLM step so a mid-step model switch can't escalate. **Plan mode hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- **Plan → Implement handoff** — new `tools/plan/handoff.py` plus dynamic injection through `soul/dynamic_injections/plan_mode.py` carries the approved plan into implementation without re-priming the context.
+- **FetchURL SSRF + size hardening** — `_validate_fetch_url` blocks private / loopback / link-local / multicast / reserved IPv4 + IPv6 ranges; rejects non-`http`/`https` schemes; non-host URLs. Responses are streamed with a hard **5 MB** ceiling honoring `Content-Length`.
+- **Windows self-upgrade fixed** — `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Eliminates the `os error 32: The process cannot access the file because it is being used by another process` error.
+- **Background recovery improved** — `recoverable` (resumable via stored `agent_id`) vs `lost` (worker gone, no resume target). Subagent instances are parked as `idle` when recoverable. `pythinker-host` subprocess teardown kills the entire child process tree and creates a new session group.
+- **Feedback endpoint config** — new `feedback` config block (`endpoint_url`, `api_key`, `custom_headers`). The `/feedback` slash command now routes submissions to a user-configured HTTP endpoint instead of being a no-op.
+- **Welcome-screen version banner** — installed Pythinker version is now visible up-front.
+- **VS 2026 CI forward-compat probe** — non-blocking `windows-2025-vs2026` matrix entry on the host + cli builds validates MSVC v144 ahead of GitHub's eventual `windows-2022` deprecation.
+- **anthropic 0.101 compat** — added fallbacks for the six new tool-result block types so `pyright` stays exhaustive.
+- **Telemetry hygiene** — OTel `service.name` normalized to a stable value for SigNoz dashboards; Sentry filters drop test and shutdown noise.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
+### What was new in 2.4.0
+
+## 🆕 What's New in 2.4.0
+
+Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.
+
+- **New subagents** — `implementer` (scoped edits + verification), `review` (severity-scored read-only review), and `verifier` (`PASS` / `FAIL` / `FLAKY` validation runner). Join the existing `coder` / `explore` / `plan` roster.
+- **Structured subagent output** — every default agent now answers with `### SUMMARY / EVIDENCE / CHANGES / RISKS / BLOCKERS`, so the parent agent can consume results without re-parsing prose. New recommended flow: **Scout → Plan → Implement → Review → Verify** (review and verify can run in parallel).
+- **Kimi K2.5 / K2.6 (Moonshot) support** — `--thinking` is routed via the provider-specific `thinking.type` body field, and assistant tool-call replays always carry `reasoning_content` so multi-step tool flows stop tripping Moonshot's strict thinking-replay check. Same hardening applied to DeepSeek's strict mode.
+- **`Grep` works without `rg`** — pure-Python fallback honors `pattern` / `glob` / `type` / `ignore_case` / `multiline` / `context` / `output_mode` / `offset` / `head_limit` and respects `.gitignore`. The downloader also retries against the upstream GitHub releases mirror and accepts `PYTHINKER_RG_PATH=/absolute/path` plus extra discovery paths (`~/.cargo/bin`, `~/.local/bin`, `~/.pi/agent/bin`, `/usr/bin`, `/usr/local/bin`).
+- **`AGENTS.md` rewritten** to match the new roster, and `tools/agent/description.md` documents the parallel-review and cross-check patterns.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.4.0`.
+
+### What was new in 2.3.0
+
 ## 🆕 What's New in 2.3.0
 
 Telemetry & observability audit on top of 2.2.1.
@@ -58,8 +91,6 @@ Telemetry & observability audit on top of 2.2.1.
 - **`pythinker.mcp.call` span** with `mcp.server` attribute.
 - **`docs/en/reference/telemetry.md`** documents the full contract.
 
-Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.3.0`.
-
 ### What was new in 2.2.1
 
 ## 🆕 What's New in 2.2.1
@@ -69,8 +100,6 @@ CI hardening on top of 2.2.0.
 - **macOS binary build is now optional-codesign** — the release workflow detects whether `APPLE_CERTIFICATE_P12` / `APPLE_NOTARIZATION_KEY_P8` repo secrets are set. When they aren't (the v2.2.0 case), it ships an ad-hoc-signed PyInstaller binary instead of failing the whole release. PyPI install (`pip install pythinker-code`) is unaffected.
 - **PyPI publish is idempotent** — `pypa/gh-action-pypi-publish` now runs with `skip-existing: true`, so re-running the release workflow against an already-published version is a no-op.
 
-Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.3.0`.
-
 ### What was new in 2.2.0
 
 Animated installer + Windows PATH automation, on top of 2.1.2.

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "2.3.0"
+version = "2.5.0"
 description = "Pythinker Code is your next CLI agent."
 readme = "README.md"
 requires-python = ">=3.12"

pythinker_code-2.5.0/src/pythinker_code/CHANGELOG.md

@@ -0,0 +1,165 @@
+# Changelog
+
+## Unreleased
+
+## 2.5.0 (2026-05-13)
+
+bk_box_main coding-agent runtime port, Windows self-upgrade fix, FetchURL SSRF hardening, and a broad reliability/security pass.
+
+### Subagent runtime & permissions
+
+- Runtime-enforced permission profiles for every built-in role: **read-only**, **plan**, **ask**, **implement**, **review**, **verify**. Profiles are snapshot per LLM step in the new `src/pythinker_code/soul/permission.py` so a mid-step model switch can't escalate. Plan mode now **hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- New plan-handoff workflow in `src/pythinker_code/tools/plan/handoff.py` with dynamic injection through `soul/dynamic_injections/plan_mode.py`. Smooth handoff from `plan` → `implement` without re-priming the context.
+- New smart-search grep variant; new subagent metadata plumbing (`subagents/models.py`, `subagents/store.py`, `subagents/builder.py`, `subagents/runner.py`).
+
+### Background tasks
+
+- Recovery distinguishes **`recoverable`** (resumable via a stored `agent_id`) from **`lost`** (worker is gone with no resume target). Agent instances are parked as `idle` rather than failed when the underlying task is recoverable.
+- Guards against overwriting terminal task states; subagent races on instance transitions closed.
+- `pythinker-host`: subprocess teardown now kills the **entire child process tree** and creates a new session group, so background workers can no longer survive their parent on Linux/macOS.
+
+### FetchURL — SSRF + resource-exhaustion hardening
+
+- `pythinker_code.tools.web.fetch._validate_fetch_url` blocks **private, loopback, link-local, multicast, and reserved** IPv4/IPv6 ranges; rejects non-`http`/`https` schemes and host-less URLs up front.
+- Responses are streamed with a hard **5 MB** ceiling (`_read_limited`) honoring `Content-Length`. Both the direct path and the configured fetch-service path enforce the same caps.
+
+### Web / vis surface
+
+- Upload limits, open-in path escaping, and vis auth all hardened (`src/pythinker_code/web/`, `src/pythinker_code/vis/`, `vis/src/lib/api.ts`).
+
+### Plugin
+
+- Plugin definitions no longer persist host credentials. Plugin **name validation** tightened to reject path-traversal and shell-meta characters.
+
+### Telemetry & observability
+
+- OTel `service.name` normalized to a stable value, decoupled from the configured display name, so SigNoz dashboards keep working across rebrands.
+- Sentry filters drop test-process noise and benign shutdown errors; `pythinker_code/telemetry/config.py` and `pythinker_code/telemetry/crash.py` updated accordingly.
+- New `tests/telemetry/test_otel_resource.py` asserts the resource identity used by the dashboards.
+
+### Windows
+
+- `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent process before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Fixes the `os error 32: The process cannot access the file because it is being used by another process` error that blocked self-upgrade.
+- New CI matrix entry on **`windows-2025-vs2026`** (experimental, non-blocking) for the pythinker-host and pythinker-cli build, validating Visual Studio 2026 / MSVC v144 forward-compat before GitHub eventually deprecates `windows-2022`.
+
+### Feedback
+
+- New `feedback` config block: `endpoint_url`, `api_key`, `custom_headers`. The `/feedback` slash command now routes user submissions to a user-configured HTTP endpoint instead of being a no-op.
+
+### UI
+
+- Pythinker version is shown on the welcome screen.
+
+### CI
+
+- Pre-push hooks mirror CI's `check` target (`ruff format --check`, `ruff check`, `pyright`) so local pushes catch the same regressions CI does.
+- README + CHANGELOG release-validate gate hardened; the GitHub Release publish step is now resilient to transient upstream failures.
+- Spell-check vocabulary fix in `soul/permission.py` for an internal error string the typos crate flagged; experimental `windows-2025-vs2026` build no longer collides with `windows-2022` on the shared `pythinker-x86_64-pc-windows-msvc` artifact name.
+
+### Compatibility
+
+- `pythinker_core.contrib.chat_provider.anthropic`: handle the six new tool-result block types added by anthropic SDK 0.101 (`web_fetch_tool_result`, `code_execution_tool_result`, `bash_code_execution_tool_result`, `text_editor_code_execution_tool_result`, `tool_search_tool_result`, `container_upload`). pyright is exhaustive again.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
+## 2.4.0 (2026-05-11)
+
+Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.
+
+- New built-in subagents under `src/pythinker_code/agents/default/`:
+  - `implementer.yaml` — scoped code changes with minimum surrounding edits and a quick verification pass.
+  - `review.yaml` — read-only code review with severity-scored findings (BLOCKER / MAJOR / MINOR / NIT).
+  - `verifier.yaml` — read-only validation runner that reports `PASS` / `FAIL` / `FLAKY` without applying fixes.
+- `coder.yaml`, `explore.yaml`, and `plan.yaml` now emit a standard `### SUMMARY / EVIDENCE / CHANGES / RISKS / BLOCKERS` response contract so the parent agent can consume subagent output without re-parsing prose.
+- `agent.yaml` registers the three new roles; `tools/agent/description.md` documents the Scout → Plan → Implement → Review → Verify workflow and the parallel review/verification pattern.
+- `agents/default/system.md`: adds decomposition guidance (preview → todo list → parallel chunks), enforces post-tool-call verification before acting on results, and tells the agent to cross-check at least one load-bearing subagent finding before editing from it.
+- Kimi K2.5 / K2.6 (Moonshot) and other strict interleaved-thinking providers:
+  - `packages/pythinker-core/.../chat_provider/pythinker.py`: always emit `reasoning_content` on assistant tool-call replays so Moonshot's "thinking is enabled but reasoning_content is missing in assistant tool call message at index N" error no longer trips multi-step tool flows.
+  - `packages/pythinker-core/.../contrib/chat_provider/openai_legacy.py`: replay reasoning metadata on every assistant turn for `kimi-k2*` / `deepseek*` models (falls back to the assistant text or `"[reasoning unavailable]"` when reasoning content was not retained).
+  - `src/pythinker_code/llm.py`: route Kimi K2 thinking through the provider-specific `extra_body={"thinking": {"type": "enabled"|"disabled"}}` body field instead of OpenAI's `reasoning_effort` (which Kimi ignores), and persist `LLM.thinking` across `clone_llm_with_model_alias` so model switches preserve the user's thinking choice.
+- `tools/file/grep_local.py`:
+  - Pure-Python `rg`-free fallback (`_python_grep`) honoring `pattern`, `path`, `glob`, `type` (bash / c / cpp / go / java / js / json / md / py / rust / sh / toml / ts / txt / yaml / zsh), `ignore_case`, `multiline`, `context` / `before_context` / `after_context`, `line_number`, `output_mode` (`content` / `files_with_matches` / `count_matches`), `offset`, `head_limit`, and the standard sensitive-file redaction. `.gitignore` / `.ignore` and the VCS metadata directories (`.git`, `.svn`, `.hg`, `.bzr`, `.jj`, `.sl`) are respected unless `include_ignored=true`.
+  - `_find_existing_rg` now honors `PYTHINKER_RG_PATH` and additionally probes `/usr/bin`, `/usr/local/bin`, `~/.cargo/bin`, `~/.local/bin`, and `~/.pi/agent/bin` before falling through to download.
+  - Downloader retries against the upstream GitHub releases mirror (`https://github.com/BurntSushi/ripgrep/releases/download/<version>/...`) when the CDN mirror is unreachable, and the failure path now degrades into the Python fallback instead of raising.
+- `.gitignore`: ignore `graphify-out*/`, `.graphify_*.json`, `.graphify_*.txt`, and the local `blackbox/` scratch area.
+- `AGENTS.md` rewritten to reflect the new subagent roster and workflow.
+
+## 2.3.0 (2026-05-09)
+
+Telemetry & observability audit.
+
+- New `pythinker_code/telemetry/errors.py` helper `report_handled_error(exc, *, site, tool=None, **attrs)` forwards caught-and-rendered exceptions to both Sentry/Bugsink and the OTel `error` event stream. Both forwarding paths are `contextlib.suppress`-wrapped so monitoring can never break the host program.
+- 38 silent-catch sites instrumented across `tools/`, `auth/`, `soul/`, `acp/`, `hooks/`, `subagents/`. Tool failures, OAuth errors, MCP server hiccups, hook callback failures, and subagent crashes now reach Bugsink and SigNoz.
+- `pythinker_code/telemetry/otel.py`: TracerProvider now uses `ParentBased(TraceIdRatioBased(rate))` driven by `PYTHINKER_OTEL_TRACE_SAMPLE_RATE` (default 1.0).
+- New `pythinker.mcp.call` span around every MCPTool RPC.
+- New `/report-error` slash command (aliases `/report`, `/report-error`).
+- `docs/en/reference/telemetry.md` documents the full telemetry contract.
+- `chore(test)`: updated google-genai snapshot for pydantic 2.13.4 + google-genai 2.0.0.
+
+
+## 2.2.1 (2026-05-09)
+
+CI hardening: macOS binary build is now optional-codesign.
+
+- `.github/workflows/release-pythinker-cli.yml`: detect whether `APPLE_CERTIFICATE_P12` and `APPLE_NOTARIZATION_KEY_P8` repo secrets are configured. When they aren't, skip the keychain setup, codesign, and notarization steps and ship an ad-hoc-signed PyInstaller binary instead of failing the whole release. The 2.2.0 release run failed because those secrets were empty in CI; this makes the release matrix all-green even without an Apple Developer cert.
+- `.github/workflows/release-pythinker-cli.yml`: add `skip-existing: true` to `pypa/gh-action-pypi-publish` so re-runs of the release workflow against an already-published version are no-ops instead of HTTP 400 errors.
+- macOS-arm64 binary downloads from the GitHub Release page will now show a Gatekeeper warning on first launch when the secrets aren't configured. Users can clear it with `xattr -d com.apple.quarantine ./pythinker`. PyPI install (`pip install pythinker-code`) is unaffected.
+
+## 2.2.0 (2026-05-09)
+
+Installer UX: animated logo + Windows PATH automation.
+
+- `scripts/install.sh`: Tetris-style logo animation. Pieces (walls, bars, eyes, ears, antenna) fall from above the canvas one at a time and settle into the robot head before install proceeds. Static logo remains the fallback for non-TTY / `NO_COLOR` / `TERM=dumb` / `CI=1` / `PYTHINKER_NO_ANIMATION=1`. Tunables: `PYTHINKER_LOGO_FRAME_DELAY` and `PYTHINKER_LOGO_STAGGER_DELAY` (seconds).
+- `scripts/install.ps1`: same animation, PowerShell port. Tunables: `PYTHINKER_LOGO_FRAME_DELAY_MS` and `PYTHINKER_LOGO_STAGGER_DELAY_MS` (milliseconds).
+- `scripts/install.ps1`: idempotently append `$USERPROFILE\.local\bin` to the User PATH via `[Environment]::SetEnvironmentVariable` and broadcast `WM_SETTINGCHANGE` so future shells (and Explorer-spawned children) pick up the new PATH automatically. No-op when the directory is already present.
+- `scripts/install.ps1`: force `[Console]::OutputEncoding = UTF8` so the box-drawing characters render correctly on Windows hosts.
+
+## 2.1.2 (2026-05-09)
+
+Windows installer fix.
+
+- `scripts/install.ps1`: dot-source Astral's `uv` bootstrap inside `& { ... }` instead of spawning `powershell -File`, so `$env:PATH` updates land in the running process.
+- `scripts/install.ps1`: refresh PATH after `uv tool install` and verify `pythinker` resolves before printing success; otherwise emit the absolute shim path.
+- README: invoke the downloaded `install.ps1` with `& $installer` (current shell) instead of a `powershell -NoProfile -File $installer` subprocess. `uv`, `uvx`, and `pythinker` are now usable in the calling shell as soon as the installer exits.
+- `tests/test_installation_docs.py`: lock in current-session invocation in the README and a dot-sourced `uv` bootstrap in `install.ps1`.
+
+## 2.1.1 (2026-05-08)
+
+Documentation refresh.
+
+- README: image and key file links converted to absolute GitHub URLs so the project page on PyPI renders the logo, demo GIFs, and architecture diagram correctly.
+- README: added a "What's New in 2.1.0" section summarising the TUI CLI and slash-command enhancements.
+- README: corrected the License section to Apache-2.0 (matches `pyproject.toml` and the `LICENSE` badge).
+
+## 2.1.0 (2026-05-08)
+
+TUI CLI design and slash command enhancements.
+
+- New selectors package — interactive `/theme`, `/thinking`, `/model`, `/login`, `/settings`, `/extension`, and `/show-images` panels replace inline numeric/text prompts.
+- New `/thinking` slash command for adjusting reasoning effort at runtime.
+- `SettingsList` component + `/settings` selector for live `Config` editing (theme, default model, TUI style, default thinking, telemetry).
+- Selector framework: `SelectorHeader` sentinel and per-row `on_change` callback.
+- Card-style TUI polish: bordered shell card, footer/toolbar, tool renderers (read/write/edit/grep/find/bash/agent) and a diff component; subagent tool cards get a running-dots spinner.
+- Pythinker-branded slash menu, input row, and tool execution components.
+- Prompt template discovery simplified to `.pythinker/prompts` at project and user scope (legacy directory lookup removed).
+- TUI style flag now accepts only `card` (default) or `pythinker`; the legacy alias has been dropped.
+
+- Update notifier: standalone "Update Available" banner shown above the welcome panel when a newer release is on PyPI; suppressed by `PYTHINKER_CLI_NO_AUTO_UPDATE=1`.
+- New `pythinker update` subcommand (`--check` for a non-installing check) that auto-detects the install method (`uv tool`, `pipx`, or `pip`) and runs the matching upgrade command.
+- Image paste placeholder now renders as `[Image #N]` in the input/buffer (mirroring `[Pasted text #N +K lines]`); history serialization keeps the canonical `[image:<id>,WxH]` form so attachments still resolve cross-session.
+- Lower default paste-placeholderize thresholds to 200 chars / 5 lines (was 1000 / 15) so medium-length pastes collapse into `[Pasted text #N]` instead of overflowing the compact input window. Override via `PYTHINKER_CLI_PASTE_CHAR_THRESHOLD` and `PYTHINKER_CLI_PASTE_LINE_THRESHOLD`.
+
+## 1.0.0 (2026-05-06)
+
+Initial release of Pythinker CLI.
+
+- Interactive terminal AI coding agent with shell command mode (Ctrl-X)
+- ACP server (`pythinker acp`) for IDE integrations such as Zed and JetBrains
+- MCP tool support: `pythinker mcp` sub-commands and ad-hoc `--mcp-config-file`
+- Multi-provider auth: OpenAI, OpenAI Codex, Anthropic, OpenRouter, DeepSeek, MiniMax, Opencode-Go
+- Skills, plugins, and slash commands across project / user / built-in scopes
+- Session persistence with subagents and approval workflows
+- Print mode and wire mode for non-interactive and programmatic use
+- Plan mode for read-only research and design before code changes
+- YOLO mode (`--yolo` / `/yolo`) to dangerously skip permission approvals while keeping the user reachable via `AskUserQuestion`
+- Auto mode (`--auto` / `/auto`) for unattended runs: auto-approves tool calls and auto-dismisses `AskUserQuestion` so the agent finishes end-to-end without a user

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/acp/tools.py

@@ -8,6 +8,7 @@ from pythinker_host.local import local_host
 
 from pythinker_code.soul.agent import Runtime
 from pythinker_code.soul.approval import Approval
+from pythinker_code.soul.permission import check_shell_command_allowed
 from pythinker_code.soul.toolset import PythinkerToolset
 from pythinker_code.tools.shell import Params as ShellParams
 from pythinker_code.tools.shell import Shell
@@ -35,6 +36,7 @@ def replace_tools(
                 acp_conn,
                 acp_session_id,
                 runtime.approval,
+                runtime,
             )
         )
 
@@ -52,6 +54,7 @@ class Terminal(CallableTool2[ShellParams]):
         acp_conn: acp.Client,
         acp_session_id: str,
         approval: Approval,
+        runtime: Runtime,
     ) -> None:
         # Use the `name`, `description`, and `params` from the existing Shell tool,
         # so that when this is added to the toolset, it replaces the original Shell tool.
@@ -59,6 +62,7 @@ class Terminal(CallableTool2[ShellParams]):
         self._acp_conn = acp_conn
         self._acp_session_id = acp_session_id
         self._approval = approval
+        self._runtime = runtime
 
     async def __call__(self, params: ShellParams) -> ToolReturnValue:
         from pythinker_code.acp.session import get_current_acp_tool_call_id_or_none
@@ -71,6 +75,9 @@ class Terminal(CallableTool2[ShellParams]):
         if not params.command:
             return builder.error("Command cannot be empty.", brief="Empty command")
 
+        if err := check_shell_command_allowed(self._runtime, params.command):
+            return err
+
         approval_result = await self._approval.request(
             self.name,
             "run shell command",

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/agent.yaml

@@ -18,6 +18,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.file:WriteFile"
     - "pythinker_code.tools.file:StrReplaceFile"
     - "pythinker_code.tools.web:SearchWeb"
@@ -34,3 +35,12 @@ agent:
     plan:
       path: ./plan.yaml
       description: "Read-only implementation planning and architecture design."
+    review:
+      path: ./review.yaml
+      description: "Read-only code review with severity-scored findings."
+    implementer:
+      path: ./implementer.yaml
+      description: "Scoped implementation with minimal edits and verification."
+    verifier:
+      path: ./verifier.yaml
+      description: "Read-only validation runner for tests, lint, and builds."

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/coder.yaml

@@ -4,6 +4,22 @@ agent:
   system_prompt_args:
     ROLE_ADDITIONAL: |
       You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.
+
+      Stay tightly scoped to exactly what the parent assigned. Do not expand into adjacent cleanup or refactors. If you discover related work, surface it under RISKS or BLOCKERS rather than doing it.
+
+      Before editing, read the target files and confirm the line ranges/patterns you will change. Prefer the minimum edit that satisfies the brief. After edits, run the smallest relevant verification command available and report the result.
+
+      Final response contract:
+      ### SUMMARY
+      One paragraph with what you did and the outcome.
+      ### EVIDENCE
+      Bullet list of concrete file paths, command results, or observed errors that support the outcome.
+      ### CHANGES
+      Bullet list of every file you modified, or `None.` if read-only.
+      ### RISKS
+      Bullet list of remaining risks or `None observed.`.
+      ### BLOCKERS
+      Bullet list of anything that stopped completion, or `None.`.
   when_to_use: |
     Use this agent for non-trivial software engineering work that may require reading files, editing code, running commands, and returning a compact but technically complete summary to the parent agent.
   allowed_tools:
@@ -12,6 +28,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.file:WriteFile"
     - "pythinker_code.tools.file:StrReplaceFile"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/explore.yaml

@@ -5,7 +5,7 @@ agent:
     ROLE_ADDITIONAL: |
       You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.
 
-      You are a codebase exploration specialist. Your role is EXCLUSIVELY to search, read, and analyze existing code and resources. You do NOT have access to file editing tools.
+      You are a codebase exploration specialist. Your role is EXCLUSIVELY to search, read, and analyze existing code and resources. You do NOT have access to file editing tools. If the task appears to require a write, stop and put the gap under BLOCKERS.
 
       Your strengths:
       - Rapidly finding files using glob patterns
@@ -24,7 +24,19 @@ agent:
 
       If the prompt includes a <git-context> block, use it to orient yourself about the repository state before starting your investigation.
 
-      You are meant to be a fast agent. Complete the search request efficiently and report your findings clearly in a structured format.
+      You are meant to be a fast agent. Complete the search request efficiently and report your findings clearly in a structured format. EVIDENCE is the load-bearing section: cite each important finding as `path:line-range` when possible, and stop once you have enough evidence rather than exhaustively reading the whole repository.
+
+      Final response contract:
+      ### SUMMARY
+      One paragraph with the headline answer.
+      ### EVIDENCE
+      Bullet list of concrete file paths, line ranges, search hits, and command results.
+      ### CHANGES
+      Always write `None.`.
+      ### RISKS
+      Bullet list of uncertainties or `None observed.`.
+      ### BLOCKERS
+      Bullet list of missing context/capabilities or `None.`.
   when_to_use: |
     Fast agent specialized for exploring codebases. Use this when you need to quickly find files by patterns (e.g. "src/**/*.yaml"), search code for keywords (e.g. "database connection"), or answer questions about the codebase (e.g. "how does the auth module work?"). When calling this agent, specify the desired thoroughness level: "quick" for basic searches, "medium" for moderate exploration, or "thorough" for comprehensive analysis across multiple locations and naming conventions. Use this agent for any read-only exploration that will clearly require more than 3 tool calls. Prefer launching multiple explore agents concurrently when investigating independent questions.
   allowed_tools:
@@ -33,6 +45,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.web:SearchWeb"
     - "pythinker_code.tools.web:FetchURL"
   exclude_tools:

pythinker_code-2.5.0/src/pythinker_code/agents/default/implementer.yaml

@@ -0,0 +1,46 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. Treat the parent agent as your caller. Do not directly ask the end user questions.
+
+      You are an implementation specialist. Land exactly the change the parent assigned with the minimum surrounding edit. Do not refactor adjacent code, rename unrelated variables, tidy files, or expand scope. Put related follow-up work under RISKS or BLOCKERS instead.
+
+      Method:
+      - Read target files before editing.
+      - Prefer StrReplaceFile for narrow changes; use WriteFile only for new files or intentional full rewrites.
+      - Add or update tests when the brief requires behavior changes and the project has relevant tests.
+      - After edits, run the smallest relevant verification command and report pass/fail evidence.
+
+      Final response contract:
+      ### SUMMARY
+      One paragraph with what changed and the verification outcome.
+      ### EVIDENCE
+      Bullet list of file reads, command results, and test/lint evidence.
+      ### CHANGES
+      Bullet list of every modified path with a one-line reason.
+      ### RISKS
+      Bullet list of remaining risks or `None observed.`.
+      ### BLOCKERS
+      Bullet list of anything that stopped completion, or `None.`.
+  when_to_use: |
+    Use this agent when the required code change is already specified and should be implemented with minimal edits and a quick verification pass.
+  allowed_tools:
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  exclude_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+  subagents:

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/plan.yaml

@@ -5,10 +5,21 @@ agent:
     ROLE_ADDITIONAL: |
       You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.
 
-      Before designing your implementation plan, consider whether you fully understand the codebase areas relevant to the task. If not, recommend the parent agent to use the explore agent (subagent_type="explore") to investigate key questions first. In your response, clearly state:
-      1. What you already know from the information provided
-      2. What questions remain unanswered that would benefit from explore agent investigation
-      3. Your implementation plan (either preliminary if questions remain, or final if sufficient context exists)
+      Before designing your implementation plan, consider whether you fully understand the codebase areas relevant to the task. If not, recommend the parent agent to use the explore agent (subagent_type="explore") to investigate key questions first.
+
+      Ground the plan in evidence. Read enough files to avoid guessing, name the trade-offs, and choose one path with a reason. Each step should name the artifact it changes and the verification that proves it worked. Order steps by dependency first, then by risk reduced per effort.
+
+      Final response contract:
+      ### SUMMARY
+      One paragraph with the recommended plan and why.
+      ### EVIDENCE
+      Bullet list of concrete file paths, line ranges, docs, or search hits that shaped the plan.
+      ### CHANGES
+      Always write `None.` unless you wrote a plan artifact.
+      ### RISKS
+      Bullet list of trade-offs, unknowns, or rollout risks.
+      ### BLOCKERS
+      Bullet list of questions that must be answered before execution, or `None.`.
   when_to_use: |
     Use this agent when the parent agent needs a step-by-step implementation plan, key file identification, and architectural trade-off analysis before code changes are made.
   allowed_tools:
@@ -16,6 +27,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.web:SearchWeb"
     - "pythinker_code.tools.web:FetchURL"
   exclude_tools:

pythinker_code-2.5.0/src/pythinker_code/agents/default/review.yaml

@@ -0,0 +1,47 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. Treat the parent agent as your caller. Do not directly ask the end user questions.
+
+      You are a code review specialist. Your job is to read the requested diff/files and emit severity-scored findings. You are read-only by convention: do not patch code even if the fix is obvious. Describe the fix so the parent can dispatch an implementer.
+
+      Method:
+      - Read the diff or target files before scoring.
+      - Use Grep/Glob to check sibling call sites, similar patterns, and existing tests.
+      - Score each finding as BLOCKER, MAJOR, MINOR, or NIT.
+      - Order findings by severity, BLOCKER first.
+      - Be constructive: cite failure modes and evidence, not author intent.
+
+      Final response contract:
+      ### SUMMARY
+      One paragraph. If there are no MAJOR/BLOCKER issues, say that plainly.
+      ### EVIDENCE
+      Bullet list. Format review findings as `[SEVERITY] path:line-range — issue; suggested fix`.
+      ### CHANGES
+      Always write `None.`.
+      ### RISKS
+      Bullet list of residual review limitations or `None observed.`.
+      ### BLOCKERS
+      Bullet list of missing context/capabilities or `None.`.
+  when_to_use: |
+    Use this agent for read-only code review after changes are made or when the parent needs severity-scored findings before deciding what to fix.
+  allowed_tools:
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  exclude_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+  subagents:

{pythinker_code-2.3.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/system.md

@@ -10,10 +10,26 @@ The user's messages may contain questions and/or task descriptions in natural la
 
 When handling the user's request, if it involves creating, modifying, or running code or files, you MUST use the appropriate tools (e.g., `WriteFile`, `Shell`) to make actual changes — do not just describe the solution in text. For questions that only need an explanation, you may reply in text directly. When calling tools, do not provide explanations because the tool calls themselves should be self-explanatory. You MUST follow the description of each tool and its parameters when calling tools.
 
-If the `Agent` tool is available, you can use it to delegate a focused subtask to a subagent instance. The tool can either start a new instance or resume an existing one by `agent_id`. Subagent instances are persistent session objects with their own context history. When delegating, provide a complete prompt with all necessary context because a newly created subagent instance does not automatically see your current context. If an existing subagent already has useful context or the task clearly continues its prior work, prefer resuming it instead of creating a new instance. Default to foreground subagents. Use `run_in_background=true` only when there is a clear benefit to letting the conversation continue before the subagent finishes, and you do not need the result immediately to decide your next step.
+If the `Agent` tool is available, you can use it to delegate a focused subtask to a subagent instance. Treat subagents as focused roles, not just extra capacity: use `explore` for read-only mapping, `plan` for strategy, `coder` or `implementer` for scoped edits, `review` for severity-scored critique, and `verifier` for validation gates. The tool can either start a new instance or resume an existing one by `agent_id`. Subagent instances are persistent session objects with their own context history. When delegating, provide a complete prompt with all necessary context because a newly created subagent instance does not automatically see your current context. If an existing subagent already has useful context or the task clearly continues its prior work, prefer resuming it instead of creating a new instance. Default to foreground subagents. Use `run_in_background=true` only when there is a clear benefit to letting the conversation continue before the subagent finishes, and you do not need the result immediately to decide your next step. Spawn multiple subagents in the same turn when they can investigate independent regions concurrently.
 
 You have the capability to output any number of tool calls in a single response. If you anticipate making multiple non-interfering tool calls, you are HIGHLY RECOMMENDED to make them in parallel to significantly improve efficiency. This is very important to your performance.
 
+For any non-trivial request, decompose before acting:
+
+- Preview the terrain first: scan the directory structure, file headers, and relevant module boundaries before choosing an implementation path.
+- Use `SetTodoList` for multi-step work so the user can see the active plan and progress.
+- Split broad work into independent chunks; use parallel tool calls or focused subagents for chunks that do not depend on each other.
+- Re-read the plan after each phase and adjust it when new evidence changes the approach.
+
+Before every tool response, ask whether another independent read/search/check can run in the same turn. Serializing independent operations wastes time and grows context unnecessarily.
+
+After every tool call whose result you will act on, verify the result before proceeding:
+
+- File reads: confirm the path and line range you are about to modify match what you read.
+- Searches: confirm the hit is relevant; broad regexes can return false positives.
+- Shell commands: inspect stdout/stderr, not just the exit code.
+- Subagent results: cross-check at least one load-bearing finding against a direct read or deterministic command before making changes from it.
+
 The results of the tool calls will be returned to you in a tool message. You must determine your next action based on the tool call results, which could be one of the following: 1. Continue working on the task, 2. Inform the user that the task is completed or has failed, or 3. Ask the user for more information.
 
 The system may insert information wrapped in `<system>` tags within user or tool messages. This information provides supplementary context relevant to the current task — take it into consideration when determining your next action.