pythinker-code 2.4.0__tar.gz → 2.5.0__tar.gz

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythinker-code
-Version: 2.4.0
+Version: 2.5.0
 Summary: Pythinker Code is your next CLI agent.
 Keywords: cli,agent,ai,coding-assistant,llm,claude,openai,terminal
 Author: Mohamed Elkholy
@@ -110,6 +110,25 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
+## 🆕 What's New in 2.5.0
+
+Coding-agent runtime hardening: runtime-enforced permission profiles, FetchURL SSRF protection, a Windows self-upgrade fix, and a configurable feedback endpoint.
+
+- **Runtime-enforced permission profiles** — every built-in role (`read-only` / `plan` / `ask` / `implement` / `review` / `verify`) is now backed by `src/pythinker_code/soul/permission.py`. Profiles are snapshot per LLM step so a mid-step model switch can't escalate. **Plan mode hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- **Plan → Implement handoff** — new `tools/plan/handoff.py` plus dynamic injection through `soul/dynamic_injections/plan_mode.py` carries the approved plan into implementation without re-priming the context.
+- **FetchURL SSRF + size hardening** — `_validate_fetch_url` blocks private / loopback / link-local / multicast / reserved IPv4 + IPv6 ranges; rejects non-`http`/`https` schemes; non-host URLs. Responses are streamed with a hard **5 MB** ceiling honoring `Content-Length`.
+- **Windows self-upgrade fixed** — `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Eliminates the `os error 32: The process cannot access the file because it is being used by another process` error.
+- **Background recovery improved** — `recoverable` (resumable via stored `agent_id`) vs `lost` (worker gone, no resume target). Subagent instances are parked as `idle` when recoverable. `pythinker-host` subprocess teardown kills the entire child process tree and creates a new session group.
+- **Feedback endpoint config** — new `feedback` config block (`endpoint_url`, `api_key`, `custom_headers`). The `/feedback` slash command now routes submissions to a user-configured HTTP endpoint instead of being a no-op.
+- **Welcome-screen version banner** — installed Pythinker version is now visible up-front.
+- **VS 2026 CI forward-compat probe** — non-blocking `windows-2025-vs2026` matrix entry on the host + cli builds validates MSVC v144 ahead of GitHub's eventual `windows-2022` deprecation.
+- **anthropic 0.101 compat** — added fallbacks for the six new tool-result block types so `pyright` stays exhaustive.
+- **Telemetry hygiene** — OTel `service.name` normalized to a stable value for SigNoz dashboards; Sentry filters drop test and shutdown noise.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
+### What was new in 2.4.0
+
 ## 🆕 What's New in 2.4.0
 
 Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/README.md

@@ -48,6 +48,25 @@ It speaks the [**Agent Client Protocol (ACP)**](https://github.com/agentclientpr
 
 ---
 
+## 🆕 What's New in 2.5.0
+
+Coding-agent runtime hardening: runtime-enforced permission profiles, FetchURL SSRF protection, a Windows self-upgrade fix, and a configurable feedback endpoint.
+
+- **Runtime-enforced permission profiles** — every built-in role (`read-only` / `plan` / `ask` / `implement` / `review` / `verify`) is now backed by `src/pythinker_code/soul/permission.py`. Profiles are snapshot per LLM step so a mid-step model switch can't escalate. **Plan mode hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- **Plan → Implement handoff** — new `tools/plan/handoff.py` plus dynamic injection through `soul/dynamic_injections/plan_mode.py` carries the approved plan into implementation without re-priming the context.
+- **FetchURL SSRF + size hardening** — `_validate_fetch_url` blocks private / loopback / link-local / multicast / reserved IPv4 + IPv6 ranges; rejects non-`http`/`https` schemes; non-host URLs. Responses are streamed with a hard **5 MB** ceiling honoring `Content-Length`.
+- **Windows self-upgrade fixed** — `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Eliminates the `os error 32: The process cannot access the file because it is being used by another process` error.
+- **Background recovery improved** — `recoverable` (resumable via stored `agent_id`) vs `lost` (worker gone, no resume target). Subagent instances are parked as `idle` when recoverable. `pythinker-host` subprocess teardown kills the entire child process tree and creates a new session group.
+- **Feedback endpoint config** — new `feedback` config block (`endpoint_url`, `api_key`, `custom_headers`). The `/feedback` slash command now routes submissions to a user-configured HTTP endpoint instead of being a no-op.
+- **Welcome-screen version banner** — installed Pythinker version is now visible up-front.
+- **VS 2026 CI forward-compat probe** — non-blocking `windows-2025-vs2026` matrix entry on the host + cli builds validates MSVC v144 ahead of GitHub's eventual `windows-2022` deprecation.
+- **anthropic 0.101 compat** — added fallbacks for the six new tool-result block types so `pyright` stays exhaustive.
+- **Telemetry hygiene** — OTel `service.name` normalized to a stable value for SigNoz dashboards; Sentry filters drop test and shutdown noise.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
+### What was new in 2.4.0
+
 ## 🆕 What's New in 2.4.0
 
 Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pythinker-code"
-version = "2.4.0"
+version = "2.5.0"
 description = "Pythinker Code is your next CLI agent."
 readme = "README.md"
 requires-python = ">=3.12"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/CHANGELOG.md

@@ -2,6 +2,66 @@
 
 ## Unreleased
 
+## 2.5.0 (2026-05-13)
+
+bk_box_main coding-agent runtime port, Windows self-upgrade fix, FetchURL SSRF hardening, and a broad reliability/security pass.
+
+### Subagent runtime & permissions
+
+- Runtime-enforced permission profiles for every built-in role: **read-only**, **plan**, **ask**, **implement**, **review**, **verify**. Profiles are snapshot per LLM step in the new `src/pythinker_code/soul/permission.py` so a mid-step model switch can't escalate. Plan mode now **hard-denies** non-plan writes and dangerous shell mutations instead of relying on prompt-deny.
+- New plan-handoff workflow in `src/pythinker_code/tools/plan/handoff.py` with dynamic injection through `soul/dynamic_injections/plan_mode.py`. Smooth handoff from `plan` → `implement` without re-priming the context.
+- New smart-search grep variant; new subagent metadata plumbing (`subagents/models.py`, `subagents/store.py`, `subagents/builder.py`, `subagents/runner.py`).
+
+### Background tasks
+
+- Recovery distinguishes **`recoverable`** (resumable via a stored `agent_id`) from **`lost`** (worker is gone with no resume target). Agent instances are parked as `idle` rather than failed when the underlying task is recoverable.
+- Guards against overwriting terminal task states; subagent races on instance transitions closed.
+- `pythinker-host`: subprocess teardown now kills the **entire child process tree** and creates a new session group, so background workers can no longer survive their parent on Linux/macOS.
+
+### FetchURL — SSRF + resource-exhaustion hardening
+
+- `pythinker_code.tools.web.fetch._validate_fetch_url` blocks **private, loopback, link-local, multicast, and reserved** IPv4/IPv6 ranges; rejects non-`http`/`https` schemes and host-less URLs up front.
+- Responses are streamed with a hard **5 MB** ceiling (`_read_limited`) honoring `Content-Length`. Both the direct path and the configured fetch-service path enforce the same caps.
+
+### Web / vis surface
+
+- Upload limits, open-in path escaping, and vis auth all hardened (`src/pythinker_code/web/`, `src/pythinker_code/vis/`, `vis/src/lib/api.ts`).
+
+### Plugin
+
+- Plugin definitions no longer persist host credentials. Plugin **name validation** tightened to reject path-traversal and shell-meta characters.
+
+### Telemetry & observability
+
+- OTel `service.name` normalized to a stable value, decoupled from the configured display name, so SigNoz dashboards keep working across rebrands.
+- Sentry filters drop test-process noise and benign shutdown errors; `pythinker_code/telemetry/config.py` and `pythinker_code/telemetry/crash.py` updated accordingly.
+- New `tests/telemetry/test_otel_resource.py` asserts the resource identity used by the dashboards.
+
+### Windows
+
+- `pythinker update` on Windows now spawns the upgrade in a **detached console** and exits the parent process before `uv tool upgrade` runs, releasing the lock on the running `pythinker.exe`. Fixes the `os error 32: The process cannot access the file because it is being used by another process` error that blocked self-upgrade.
+- New CI matrix entry on **`windows-2025-vs2026`** (experimental, non-blocking) for the pythinker-host and pythinker-cli build, validating Visual Studio 2026 / MSVC v144 forward-compat before GitHub eventually deprecates `windows-2022`.
+
+### Feedback
+
+- New `feedback` config block: `endpoint_url`, `api_key`, `custom_headers`. The `/feedback` slash command now routes user submissions to a user-configured HTTP endpoint instead of being a no-op.
+
+### UI
+
+- Pythinker version is shown on the welcome screen.
+
+### CI
+
+- Pre-push hooks mirror CI's `check` target (`ruff format --check`, `ruff check`, `pyright`) so local pushes catch the same regressions CI does.
+- README + CHANGELOG release-validate gate hardened; the GitHub Release publish step is now resilient to transient upstream failures.
+- Spell-check vocabulary fix in `soul/permission.py` for an internal error string the typos crate flagged; experimental `windows-2025-vs2026` build no longer collides with `windows-2022` on the shared `pythinker-x86_64-pc-windows-msvc` artifact name.
+
+### Compatibility
+
+- `pythinker_core.contrib.chat_provider.anthropic`: handle the six new tool-result block types added by anthropic SDK 0.101 (`web_fetch_tool_result`, `code_execution_tool_result`, `bash_code_execution_tool_result`, `text_editor_code_execution_tool_result`, `tool_search_tool_result`, `container_upload`). pyright is exhaustive again.
+
+Upgrade with `pythinker update` or `pip install --upgrade pythinker-code==2.5.0`.
+
 ## 2.4.0 (2026-05-11)
 
 Subagent roles overhaul, Moonshot/Kimi K2 provider support, and a ripgrep-free Grep fallback.

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/acp/tools.py

@@ -8,6 +8,7 @@ from pythinker_host.local import local_host
 
 from pythinker_code.soul.agent import Runtime
 from pythinker_code.soul.approval import Approval
+from pythinker_code.soul.permission import check_shell_command_allowed
 from pythinker_code.soul.toolset import PythinkerToolset
 from pythinker_code.tools.shell import Params as ShellParams
 from pythinker_code.tools.shell import Shell
@@ -35,6 +36,7 @@ def replace_tools(
                 acp_conn,
                 acp_session_id,
                 runtime.approval,
+                runtime,
             )
         )
 
@@ -52,6 +54,7 @@ class Terminal(CallableTool2[ShellParams]):
         acp_conn: acp.Client,
         acp_session_id: str,
         approval: Approval,
+        runtime: Runtime,
     ) -> None:
         # Use the `name`, `description`, and `params` from the existing Shell tool,
         # so that when this is added to the toolset, it replaces the original Shell tool.
@@ -59,6 +62,7 @@ class Terminal(CallableTool2[ShellParams]):
         self._acp_conn = acp_conn
         self._acp_session_id = acp_session_id
         self._approval = approval
+        self._runtime = runtime
 
     async def __call__(self, params: ShellParams) -> ToolReturnValue:
         from pythinker_code.acp.session import get_current_acp_tool_call_id_or_none
@@ -71,6 +75,9 @@ class Terminal(CallableTool2[ShellParams]):
         if not params.command:
             return builder.error("Command cannot be empty.", brief="Empty command")
 
+        if err := check_shell_command_allowed(self._runtime, params.command):
+            return err
+
         approval_result = await self._approval.request(
             self.name,
             "run shell command",

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/agent.yaml

@@ -18,6 +18,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.file:WriteFile"
     - "pythinker_code.tools.file:StrReplaceFile"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/coder.yaml

@@ -28,6 +28,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.file:WriteFile"
     - "pythinker_code.tools.file:StrReplaceFile"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/explore.yaml

@@ -45,6 +45,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.web:SearchWeb"
     - "pythinker_code.tools.web:FetchURL"
   exclude_tools:

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/implementer.yaml

@@ -32,6 +32,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.file:WriteFile"
     - "pythinker_code.tools.file:StrReplaceFile"
     - "pythinker_code.tools.web:SearchWeb"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/plan.yaml

@@ -27,6 +27,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.web:SearchWeb"
     - "pythinker_code.tools.web:FetchURL"
   exclude_tools:

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/review.yaml

@@ -33,6 +33,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
     - "pythinker_code.tools.web:SearchWeb"
     - "pythinker_code.tools.web:FetchURL"
   exclude_tools:

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/agents/default/verifier.yaml

@@ -32,6 +32,7 @@ agent:
     - "pythinker_code.tools.file:ReadMediaFile"
     - "pythinker_code.tools.file:Glob"
     - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
   exclude_tools:
     - "pythinker_code.tools.agent:Agent"
     - "pythinker_code.tools.ask_user:AskUserQuestion"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/app.py

@@ -38,6 +38,9 @@ if TYPE_CHECKING:
     from fastmcp.mcp_config import MCPConfig
 
 
+_CWD_LOCK = asyncio.Lock()
+
+
 def _patch_session_id(record: dict[str, Any]) -> None:
     """Inject the current session ID (from ContextVar) into log records."""
     try:
@@ -522,15 +525,16 @@ class PythinkerCLI:
 
     @contextlib.asynccontextmanager
     async def _env(self) -> AsyncGenerator[None]:
-        original_cwd = HostPath.cwd()
-        await pythinker_host.chdir(self._runtime.session.work_dir)
-        try:
-            # to ignore possible warnings from dateparser
-            warnings.filterwarnings("ignore", category=DeprecationWarning)
-            async with self._runtime.oauth.refreshing(self._runtime):
-                yield
-        finally:
-            await pythinker_host.chdir(original_cwd)
+        async with _CWD_LOCK:
+            original_cwd = HostPath.cwd()
+            await pythinker_host.chdir(self._runtime.session.work_dir)
+            try:
+                # to ignore possible warnings from dateparser
+                warnings.filterwarnings("ignore", category=DeprecationWarning)
+                async with self._runtime.oauth.refreshing(self._runtime):
+                    yield
+            finally:
+                await pythinker_host.chdir(original_cwd)
 
     async def run(
         self,
@@ -703,9 +707,13 @@ class PythinkerCLI:
         from pythinker_code.ui.shell import Shell, WelcomeInfoItem
 
         if command is None:
-            from pythinker_code.ui.shell.update import print_update_banner
+            from pythinker_code.ui.shell.update import (
+                print_update_banner,
+                schedule_auto_update_check,
+            )
 
             print_update_banner()
+            schedule_auto_update_check()
 
         welcome_info = [
             WelcomeInfoItem(

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/background/manager.py

@@ -215,6 +215,9 @@ class BackgroundTaskManager:
         model_override: str | None,
         timeout_s: int | None = None,
         resumed: bool = False,
+        dependencies: list[str] | None = None,
+        budget_seconds: int | None = None,
+        isolation: str | None = None,
     ) -> TaskView:
         from .agent_runner import BackgroundAgentRunner
 
@@ -244,12 +247,19 @@ class BackgroundTaskManager:
             # an explicit per-agent timeout instead of always falling back to
             # ``config.background.agent_task_timeout_s``.
             timeout_s=effective_timeout,
+            dependencies=list(dependencies or ()),
+            budget_seconds=budget_seconds,
+            synthesis_state="pending",
+            isolation=isolation,
             kind_payload={
                 "agent_id": agent_id,
                 "subagent_type": subagent_type,
                 "prompt": prompt,
                 "model_override": model_override,
                 "launch_mode": "background",
+                "dependencies": list(dependencies or ()),
+                "budget_seconds": budget_seconds,
+                "isolation": isolation,
             },
         )
         self._store.create_task(spec)
@@ -427,10 +437,15 @@ class BackgroundTaskManager:
                 runtime = view.runtime.model_copy()
                 runtime.finished_at = now
                 runtime.updated_at = now
-                runtime.status = "lost"
-                runtime.failure_reason = "In-process background agent is no longer running"
-                self._store.write_runtime(view.spec.id, runtime)
                 agent_id = (view.spec.kind_payload or {}).get("agent_id")
+                runtime.status = "recoverable" if isinstance(agent_id, str) else "lost"
+                runtime.failure_reason = (
+                    "In-process background agent is no longer running; resume the stored agent "
+                    f"instance {agent_id} to continue."
+                    if isinstance(agent_id, str)
+                    else "In-process background agent is no longer running"
+                )
+                self._store.write_runtime(view.spec.id, runtime)
                 if (
                     isinstance(agent_id, str)
                     and self._runtime is not None
@@ -438,7 +453,7 @@ class BackgroundTaskManager:
                 ):
                     record = self._runtime.subagent_store.get_instance(agent_id)
                     if record is not None and record.status == "running_background":
-                        self._runtime.subagent_store.update_instance(agent_id, status="failed")
+                        self._runtime.subagent_store.update_instance(agent_id, status="idle")
                 continue
             last_progress_at = (
                 view.runtime.heartbeat_at
@@ -506,6 +521,9 @@ class BackgroundTaskManager:
                 case "lost":
                     severity = "warning"
                     title = f"Background task lost: {view.spec.description}"
+                case "recoverable":
+                    severity = "warning"
+                    title = f"Background task recoverable: {view.spec.description}"
                 case _:
                     severity = "info"
                     title = f"Background task updated: {view.spec.description}"

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/background/models.py

@@ -15,10 +15,17 @@ type TaskStatus = Literal[
     "failed",
     "killed",
     "lost",
+    "recoverable",
 ]
 type TaskOwnerRole = Literal["root", "subagent"]
 
-TERMINAL_TASK_STATUSES: tuple[TaskStatus, ...] = ("completed", "failed", "killed", "lost")
+TERMINAL_TASK_STATUSES: tuple[TaskStatus, ...] = (
+    "completed",
+    "failed",
+    "killed",
+    "lost",
+    "recoverable",
+)
 
 
 def is_terminal_status(status: TaskStatus) -> bool:
@@ -50,6 +57,12 @@ class TaskSpec(BaseModel):
     shell_path: str | None = None
     cwd: str | None = None
     timeout_s: int | None = None
+    parent_task_id: str | None = None
+    child_task_ids: list[str] = Field(default_factory=list)
+    dependencies: list[str] = Field(default_factory=list)
+    budget_seconds: int | None = None
+    synthesis_state: str | None = None
+    isolation: str | None = None
     kind_payload: dict[str, Any] | None = None
 
 

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/background/store.py

@@ -17,6 +17,7 @@ from .models import (
     TaskSpec,
     TaskStatus,
     TaskView,
+    is_terminal_status,
 )
 
 _VALID_TASK_ID = re.compile(r"^[a-z0-9][a-z0-9\-]{1,24}$")
@@ -101,7 +102,12 @@ class BackgroundTaskStore:
         return TaskSpec.model_validate_json(self.spec_path(task_id).read_text(encoding="utf-8"))
 
     def write_runtime(self, task_id: str, runtime: TaskRuntime) -> None:
-        atomic_json_write(runtime.model_dump(mode="json"), self.runtime_path(task_id))
+        path = self.runtime_path(task_id)
+        if path.exists():
+            current = self.read_runtime(task_id)
+            if is_terminal_status(current.status) and not is_terminal_status(runtime.status):
+                return
+        atomic_json_write(runtime.model_dump(mode="json"), path)
 
     def read_runtime(self, task_id: str) -> TaskRuntime:
         path = self.runtime_path(task_id)

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/config.py

@@ -168,6 +168,30 @@ class Services(BaseModel):
     """Pythinker AI Fetch configuration."""
 
 
+class FeedbackConfig(BaseModel):
+    """User-submitted feedback endpoint configuration."""
+
+    endpoint_url: str = Field(
+        default="",
+        description=(
+            "Full URL for the /feedback slash command. Overrides the built-in "
+            "Pythinker platform endpoint when set."
+        ),
+    )
+    api_key: SecretStr | None = Field(
+        default=None,
+        description="Optional bearer token for the feedback endpoint.",
+    )
+    custom_headers: dict[str, str] | None = Field(
+        default=None,
+        description="Optional extra headers for feedback endpoint requests.",
+    )
+
+    @field_serializer("api_key", when_used="json")
+    def dump_secret(self, v: SecretStr | None):
+        return v.get_secret_value() if v is not None else None
+
+
 class MCPClientConfig(BaseModel):
     """MCP client configuration."""
 
@@ -251,6 +275,10 @@ class Config(BaseModel):
         default_factory=NotificationConfig, description="Notification configuration"
     )
     services: Services = Field(default_factory=Services, description="Services configuration")
+    feedback: FeedbackConfig = Field(
+        default_factory=FeedbackConfig,
+        description="User-submitted feedback endpoint configuration",
+    )
     mcp: MCPConfig = Field(default_factory=MCPConfig, description="MCP configuration")
     tui: TUIConfig = Field(default_factory=TUIConfig, description="TUI rendering configuration")
     hooks: list[HookDef] = Field(default_factory=list, description="Hook definitions")  # pyright: ignore[reportUnknownVariableType]
@@ -274,9 +302,9 @@ class Config(BaseModel):
         ),
     )
     telemetry: bool = Field(
-        default=False,
+        default=True,
         description=(
-            "Enable anonymous telemetry to help improve pythinker-code. Set to true to enable."
+            "Enable anonymous telemetry to help improve pythinker-code. Set to false to opt out."
         ),
     )
 

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/llm.py

@@ -371,6 +371,7 @@ def clone_llm_with_model_alias(
     *,
     session_id: str,
     oauth: OAuthManager | None,
+    thinking: bool | None = None,
 ) -> LLM | None:
     if model_alias is None:
         return llm
@@ -378,7 +379,8 @@ def clone_llm_with_model_alias(
         raise KeyError(f"Unknown model alias: {model_alias}")
     model = config.models[model_alias]
     provider = config.providers[model.provider]
-    thinking: bool | None = llm.thinking if llm is not None else None
+    if thinking is None and llm is not None:
+        thinking = llm.thinking
     if thinking is None and llm is not None:
         effort = getattr(llm.chat_provider, "thinking_effort", None)
         if effort is not None:

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/plugin/manager.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import re
 import shutil
 import tempfile
 from pathlib import Path
@@ -12,7 +13,6 @@ from pythinker_code.plugin import (
     PluginError,
     PluginRuntime,
     PluginSpec,
-    inject_config,
     parse_plugin_json,
     write_runtime,
 )
@@ -51,14 +51,26 @@ def collect_host_values(config: Config, oauth: OAuthManager) -> dict[str, str]:
     return values
 
 
+_PLUGIN_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+
+
 def _validate_name(name: str, plugins_dir: Path) -> Path:
     """Resolve and validate plugin name, returning the safe destination path."""
+    if not _PLUGIN_NAME_RE.fullmatch(name):
+        raise PluginError(f"Invalid plugin name: {name}")
     dest = (plugins_dir / name).resolve()
-    if not dest.is_relative_to(plugins_dir.resolve()):
+    plugins_root = plugins_dir.resolve()
+    if dest == plugins_root or not dest.is_relative_to(plugins_root):
         raise PluginError(f"Invalid plugin name: {name}")
     return dest
 
 
+def _validate_inject_values(spec: PluginSpec, host_values: dict[str, str]) -> None:
+    for source_key in spec.inject.values():
+        if source_key not in host_values:
+            raise PluginError(f"Host does not provide required inject key '{source_key}'")
+
+
 def install_plugin(
     *,
     source: Path,
@@ -87,8 +99,9 @@ def install_plugin(
         staging_plugin = staging / spec.name
         shutil.copytree(source, staging_plugin)
 
-        # Apply inject + runtime on the staged copy
-        inject_config(staging_plugin, spec, host_values)
+        # Validate required host values, but do not persist credentials into plugin files.
+        # Plugin tools receive fresh credentials through environment variables at runtime.
+        _validate_inject_values(spec, host_values)
         runtime = PluginRuntime(host=host_name, host_version=host_version)
         write_runtime(staging_plugin, runtime)
 
@@ -123,8 +136,8 @@ def refresh_plugin_configs(plugins_dir: Path, host_values: dict[str, str]) -> No
             continue
         try:
             spec = parse_plugin_json(plugin_json)
-            if spec.inject and spec.config_file:
-                inject_config(child, spec, host_values)
+            if spec.inject:
+                _validate_inject_values(spec, host_values)
         except Exception:
             continue
 

{pythinker_code-2.4.0 → pythinker_code-2.5.0}/src/pythinker_code/soul/agent.py

@@ -439,7 +439,7 @@ async def load_agent(
             )
         )
 
-    toolset = PythinkerToolset()
+    toolset = PythinkerToolset(runtime)
     tool_deps = {
         PythinkerToolset: toolset,
         Runtime: runtime,