superqode 2.4.22__tar.gz → 2.4.23__tar.gz

{superqode-2.4.22 → superqode-2.4.23}/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.23] - 2026-09-28
+
+### Added
+
+- Reviewed, opt-in managed install recipes for bundled agents and open
+  harnesses (fail-closed on registry identity mismatch), including new
+  omp.sh, mistral-vibe, and deepagents-code entries.
+- Harness Hub template support with refreshed hub catalog export.
+- Expanded TUI coverage: mounted-app, smoke, harness hub/connect screen, and
+  clickable-command tests.
+
+### Changed
+
+- Harden Harness Hub / Connect pickers, dialogs, formatting, and startup
+  helpers across TUI mixins and widgets.
+- Refresh Harness Hub docs, modes, TUI, and hub CLI reference.
+
+### Fixed
+
+- Block remote registries from self-granting automatic install execution;
+  only reviewed SuperQode recipes are runnable, with explicit rejection
+  reasons on identity mismatch.
+
 ## [2.4.22] - 2026-09-27
 
 ### Added

{superqode-2.4.22 → superqode-2.4.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.4.22
+Version: 2.4.23
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -295,7 +295,7 @@ superqode connect a2a --url https://a2a.superqode.dev
 
 ## The Harness Hub
 
-`:hub` opens a browsable catalog of **104 harnesses**: SuperQode's native
+`:hub` opens a browsable catalog of **115 harnesses**: SuperQode's native
 harnesses, vendor coding agents, the full ACP registry, optional runtimes,
 model presets, and the HarnessSpecs your own repository defines. The same
 catalog is on the web at [superqode.dev/hub](https://superqode.dev/hub).
@@ -306,7 +306,7 @@ catalog is on the web at [superqode.dev/hub](https://superqode.dev/hub).
 :harness switch rlm --fork   # or branch into an independent attempt
 ```
 
-**64 of those harnesses are open source**, across every route. Press `o` in the
+**71 of those harnesses are open source**, across every route. Press `o` in the
 Hub, or ask from the command line:
 
 ```bash

{superqode-2.4.22 → superqode-2.4.23}/README.md

@@ -138,7 +138,7 @@ superqode connect a2a --url https://a2a.superqode.dev
 
 ## The Harness Hub
 
-`:hub` opens a browsable catalog of **104 harnesses**: SuperQode's native
+`:hub` opens a browsable catalog of **115 harnesses**: SuperQode's native
 harnesses, vendor coding agents, the full ACP registry, optional runtimes,
 model presets, and the HarnessSpecs your own repository defines. The same
 catalog is on the web at [superqode.dev/hub](https://superqode.dev/hub).
@@ -149,7 +149,7 @@ catalog is on the web at [superqode.dev/hub](https://superqode.dev/hub).
 :harness switch rlm --fork   # or branch into an independent attempt
 ```
 
-**64 of those harnesses are open source**, across every route. Press `o` in the
+**71 of those harnesses are open source**, across every route. Press `o` in the
 Hub, or ask from the command line:
 
 ```bash

{superqode-2.4.22 → superqode-2.4.23}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.4.22"
+version = "2.4.23"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.4.22"
+__version__ = "2.4.23"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/agent_output.py

@@ -365,20 +365,13 @@ def render_thinking_section(lines: List[ThinkingLine], collapsed: bool = False)
 
 
 def _code_theme_name() -> str:
-    """Pygments style matching the active TUI theme."""
+    """Pygments style for agent output (brand-fixed, never cyan/blue)."""
     try:
-        from superqode.app.theme_bridge import active_theme_name
+        from superqode.rendering.markdown import active_code_theme
+
+        return active_code_theme()
     except Exception:
         return "superqode"
-    return {
-        "superqode": "superqode",
-        "tokyonight": "github-dark",
-        "dracula": "dracula",
-        "nord": "nord",
-        "monokai": "monokai",
-        "gruvbox": "gruvbox-dark",
-        "high-contrast": "github-dark",
-    }.get(active_theme_name(), "superqode")
 
 
 def _code_background() -> str:

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/agents/data/deepagents-code.langchain.com.toml

@@ -28,7 +28,7 @@ runs it as an ACP server over standard input and output.
 ## Installation
 
 ```bash
-curl -LsSf https://langch.in/dcode | bash
+uv tool install deepagents-code
 ```
 
 Model provider extras are selected at install time:
@@ -44,5 +44,5 @@ and Gemini are included by default.
 '''
 
 [actions."*".install]
-command = "curl -LsSf https://langch.in/dcode | bash"
+command = "uv tool install deepagents-code"
 description = "Install Deep Agents Code"

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/agents/data/mistral-vibe.mistral.ai.toml

@@ -45,5 +45,5 @@ See https://github.com/mistralai/mistral-vibe for details.
 '''
 
 [actions."*".install]
-command = "pip install mistral-vibe"
+command = "uv tool install mistral-vibe"
 description = "Install Mistral Vibe"

superqode-2.4.23/src/superqode/agents/data/omp.sh.toml

@@ -0,0 +1,36 @@
+identity = "omp.sh"
+name = "Oh My Pi"
+short_name = "omp"
+url = "https://github.com/can1357/oh-my-pi"
+protocol = "acp"
+author_name = "Stencil Labs"
+author_url = "https://stencil.so"
+publisher_name = "SuperQode"
+publisher_url = "https://github.com/SuperagenticAI/superqode"
+type = "coding"
+description = "MIT-licensed, batteries-included Pi fork with native ACP and RPC modes, LSP, debugging, subagents, and broad model-provider support."
+tags = ["official-acp", "open-source", "coding", "featured"]
+recommended = true
+catalog_tier = "featured"
+run_command."*" = "omp acp"
+
+help = '''
+# Oh My Pi (OMP)
+
+Oh My Pi is an MIT-licensed TypeScript/Rust coding agent and a batteries-included fork of Pi.
+
+## Installation
+
+OMP requires Bun 1.3.14 or newer:
+
+```bash
+bun install -g @oh-my-pi/pi-coding-agent
+omp acp
+```
+
+SuperQode can run this reviewed package-manager installation after explicit confirmation. It does not run OMP's remote shell installer.
+'''
+
+[actions."*".install]
+command = "bun install -g @oh-my-pi/pi-coding-agent"
+description = "Install the Oh My Pi CLI with Bun"

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/agents/install_commands.py

@@ -19,9 +19,16 @@ stops rather than escalating to sudo or editing PATH.
 from __future__ import annotations
 
 import shlex
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
+from typing import Any, Mapping
 
-__all__ = ["InstallCommand", "classify_install_command"]
+__all__ = [
+    "InstallCommand",
+    "classify_install_command",
+    "managed_agent_install",
+    "managed_agent_install_rejection_reason",
+    "managed_harness_install",
+]
 
 #: Leading tokens of commands whose artifact is explicitly named.
 _RUNNABLE_PREFIXES: tuple[tuple[str, ...], ...] = (
@@ -29,6 +36,7 @@ _RUNNABLE_PREFIXES: tuple[tuple[str, ...], ...] = (
     ("npm", "i"),
     ("pnpm", "add"),
     ("yarn", "global"),
+    ("bun", "install"),
     ("cargo", "install"),
     ("go", "install"),
     ("uv", "tool"),
@@ -51,6 +59,12 @@ class InstallCommand:
     runnable: bool
     #: Why the command is not runnable, shown to the user.
     reason: str = ""
+    #: True only for a recipe reviewed and shipped by SuperQode. Registry
+    #: metadata alone can never opt a command into automatic execution.
+    managed: bool = False
+    repository: str = ""
+    license: str = ""
+    executable: str = ""
 
     @property
     def argv(self) -> list[str]:
@@ -139,6 +153,7 @@ def classify_install_command(raw: str) -> InstallCommand:
                 "npm": "npm",
                 "pnpm": "npm",
                 "yarn": "npm",
+                "bun": "npm",
                 "cargo": "cargo",
                 "go": "go",
                 "uv": "python",
@@ -155,3 +170,142 @@ def classify_install_command(raw: str) -> InstallCommand:
         runnable=False,
         reason="SuperQode only runs recognised package-manager installs.",
     )
+
+
+# Automatic external installs are deliberately opt-in. A remote registry can
+# describe and display a command, but cannot grant itself execution rights by
+# claiming an ``open-source`` tag. Each recipe below is reviewed and released
+# with SuperQode; its exact command is re-derived here at click time.
+_MANAGED_AGENT_INSTALLS: dict[str, tuple[str, str, str, str]] = {
+    "opencode": (
+        "npm install -g opencode-ai",
+        "https://github.com/anomalyco/opencode",
+        "MIT",
+        "opencode",
+    ),
+    "qwen": (
+        "npm install -g @qwen-code/qwen-code",
+        "https://github.com/QwenLM/qwen-code",
+        "Apache-2.0",
+        "qwen",
+    ),
+    "fast-agent": (
+        "uv tool install -U fast-agent-mcp",
+        "https://github.com/evalstate/fast-agent",
+        "Apache-2.0",
+        "fast-agent-acp",
+    ),
+    "pi": (
+        "npm install -g @earendil-works/pi-coding-agent pi-acp",
+        "https://github.com/earendil-works/pi",
+        "MIT",
+        "pi-acp",
+    ),
+    "omp": (
+        "bun install -g @oh-my-pi/pi-coding-agent",
+        "https://github.com/can1357/oh-my-pi",
+        "MIT",
+        "omp",
+    ),
+    "cline": (
+        "npm install -g @cline/cli",
+        "https://github.com/cline/cline",
+        "Apache-2.0",
+        "cline",
+    ),
+    "mistral-vibe": (
+        "uv tool install mistral-vibe",
+        "https://github.com/mistralai/mistral-vibe",
+        "Apache-2.0",
+        "vibe-acp",
+    ),
+    "hermes": (
+        "uv tool install 'hermes-agent[acp]'",
+        "https://github.com/nousresearch/hermes-agent",
+        "MIT",
+        "hermes",
+    ),
+    "deepagents-code": (
+        "uv tool install deepagents-code",
+        "https://github.com/langchain-ai/deepagents",
+        "MIT",
+        "dcode",
+    ),
+    # Subscription authentication remains vendor-owned. SuperQode only
+    # installs the named CLI package, then hands off to Junie's own login.
+    "junie": (
+        "npm install -g @jetbrains/junie",
+        "https://www.jetbrains.com/junie/",
+        "Proprietary",
+        "junie",
+    ),
+}
+
+_MANAGED_AGENT_IDENTITIES = {
+    "opencode": "opencode.ai",
+    "qwen": "qwenlm.github.io",
+    "fast-agent": "fastagent.ai",
+    "pi": "pi.dev",
+    "omp": "omp.sh",
+    "cline": "cline.bot",
+    "mistral-vibe": "mistral-vibe.mistral.ai",
+    "hermes": "hermes-agent.nousresearch.com",
+    "deepagents-code": "deepagents-code.langchain.com",
+    "junie": "junie.jetbrains.com",
+}
+
+_MANAGED_HARNESS_INSTALLS: dict[str, tuple[str, str, str, str]] = {
+    "letta": (
+        "npm install -g @letta-ai/letta-code",
+        "https://github.com/letta-ai/letta-code",
+        "Apache-2.0",
+        "letta",
+    ),
+}
+
+
+def _managed_install(
+    integration_id: str, recipes: Mapping[str, tuple[str, str, str, str]]
+) -> InstallCommand | None:
+    recipe = recipes.get((integration_id or "").strip())
+    if recipe is None:
+        return None
+    command, repository, license_name, executable = recipe
+    classified = classify_install_command(command)
+    if not classified.runnable:
+        return None
+    return replace(
+        classified,
+        managed=True,
+        repository=repository,
+        license=license_name,
+        executable=executable,
+    )
+
+
+def managed_agent_install(agent: Mapping[str, Any]) -> InstallCommand | None:
+    """Return a reviewed install recipe for a bundled agent."""
+    short_name = str(agent.get("short_name") or "").strip()
+    identity = str(agent.get("identity") or "").strip()
+    if identity != _MANAGED_AGENT_IDENTITIES.get(short_name):
+        return None
+    return _managed_install(short_name, _MANAGED_AGENT_INSTALLS)
+
+
+def managed_agent_install_rejection_reason(agent: Mapping[str, Any]) -> str:
+    """Explain why a known recipe did not pass its fail-closed identity check."""
+    short_name = str(agent.get("short_name") or "").strip()
+    identity = str(agent.get("identity") or "").strip()
+    expected = _MANAGED_AGENT_IDENTITIES.get(short_name)
+    if expected and identity != expected:
+        actual = identity or "<missing>"
+        return (
+            f"Managed install blocked: registry identity mismatch for {short_name!r}; "
+            f"expected {expected!r}, received {actual!r}."
+        )
+    return ""
+
+
+def managed_harness_install(harness_id: str) -> InstallCommand | None:
+    """Return a reviewed recipe for an open harness without an agent route."""
+    return _managed_install(harness_id, _MANAGED_HARNESS_INSTALLS)

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/constants.py

@@ -60,8 +60,8 @@ THEME = {
     "orange": "#f97316",
     "gold": "#fbbf24",
     "yellow": "#eab308",
-    "cyan": "#06b6d4",
-    "teal": "#14b8a6",
+    "cyan": "#a855f7",
+    "teal": "#a855f7",
     "green": "#22c55e",
     "success": "#22c55e",
     "error": "#ef4444",
@@ -285,6 +285,10 @@ THINKING_MSGS = [
 # Commands for autocompletion - ordered by priority (most common first)
 COMMANDS = [
     ":connect",
+    ":free",
+    ":free ready",
+    ":free live",
+    ":free live openrouter",
     ":connect agents",
     ":connect harness",
     ":connect models",

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/harness_picker.py

@@ -30,6 +30,17 @@ VENDOR_HARNESS_IDS = (
 VENDOR_ACP_AGENT_NAMES = frozenset({"kimi", "qwen", "deepagents-code"})
 ACP_BROWSER_ID = "acp:all"
 
+# Optional first-party harness integrations installed into SuperQode's active
+# Python environment. Keeping this mapping beside the picker model gives both
+# direct ``:harness switch`` and picker selection the same install-and-resume
+# behavior.
+_OPTIONAL_HARNESS_EXTRAS = {
+    "optional:tau": "tau",
+    "optional:deepseek-harness": "deepseek-harness",
+    "optional:deepagents": "deepagents",
+    "optional:rlm-code": "rlm-code",
+}
+
 
 @dataclass(frozen=True)
 class HarnessPickerItem:
@@ -65,6 +76,13 @@ def _native_group(entry) -> str:
     return "Model and task presets"
 
 
+def harness_install_extra(entry) -> str:
+    """Return the controlled SuperQode extra for an unavailable harness."""
+    if bool(getattr(entry, "available", False)):
+        return ""
+    return _OPTIONAL_HARNESS_EXTRAS.get(str(getattr(entry, "source", "") or ""), "")
+
+
 def _native_item(entry) -> HarnessPickerItem:
     return HarnessPickerItem(
         id=entry.id,
@@ -81,7 +99,7 @@ def _native_item(entry) -> HarnessPickerItem:
         path=entry.path,
         kind="harness",
         target=entry,
-        install_extra="tau" if entry.source == "optional:tau" and not entry.available else "",
+        install_extra=harness_install_extra(entry),
         warning=str(entry.spec.metadata.get("selection_warning") or ""),
     )
 

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/inputs.py

@@ -147,6 +147,7 @@ class SelectionAwareInput(TextArea):
             or getattr(app, "_awaiting_session_resume", False)
             or getattr(app, "_awaiting_mode_selection", False)
             or getattr(app, "_awaiting_harness_selection", False)
+            or getattr(app, "_awaiting_free_selection", False)
             # Excluded: _awaiting_byok_model, _awaiting_local_model
             # Users should type in the input for model selection
         )
@@ -324,6 +325,7 @@ class SelectionAwareInput(TextArea):
                 or getattr(app, "_awaiting_byok_model", False)
                 or getattr(app, "_awaiting_local_model", False)
                 or getattr(app, "_awaiting_harness_selection", False)
+                or getattr(app, "_awaiting_free_selection", False)
             ):
                 event.stop()
                 event.prevent_default()
@@ -445,6 +447,15 @@ class SelectionAwareInput(TextArea):
                     app.action_navigate_mode_down()
                 return
 
+            if getattr(app, "_awaiting_free_selection", False):
+                event.stop()
+                event.prevent_default()
+                if event.key == "up":
+                    app.action_navigate_free_up()
+                else:
+                    app.action_navigate_free_down()
+                return
+
             # Handle local provider/model arrows here too. Relying on the event
             # bubbling to the app-level handler is unreliable because the
             # underlying TextArea consumes up/down for cursor movement first.
@@ -550,6 +561,7 @@ class SelectionAwareInput(TextArea):
             ("_awaiting_runtime_selection", "action_select_highlighted_runtime"),
             ("_awaiting_session_resume", "action_select_highlighted_session_resume"),
             ("_awaiting_mode_selection", "action_select_highlighted_mode"),
+            ("_awaiting_free_selection", "action_select_highlighted_free"),
             ("_awaiting_harness_confirmation", "action_confirm_harness_switch"),
             ("_awaiting_harness_selection", "action_select_highlighted_harness"),
             ("_awaiting_local_provider", "action_select_highlighted_local_provider"),

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/mixins/agent_run.py

@@ -766,26 +766,7 @@ class AgentRunMixin:
                 _safe_call(self._calm_tool_running, name, args, log)
                 return
             file_path = args.get("path", args.get("file_path", args.get("filePath", "")))
-            command = (
-                extract_tool_command(args)
-                if any(
-                    marker in name.lower()
-                    for marker in ("bash", "shell", "terminal", "exec", "run", "command")
-                )
-                or any(
-                    args.get(key)
-                    for key in (
-                        "command",
-                        "cmd",
-                        "commandLine",
-                        "command_line",
-                        "shellCommand",
-                        "script",
-                        "argv",
-                    )
-                )
-                else ""
-            )
+            command = extract_tool_command(args)
             if not file_path and not command:
                 command = (
                     args.get("query")
@@ -808,6 +789,8 @@ class AgentRunMixin:
                 _complete_tool_activity(name, status)
                 if self._is_calm_output():
                     meta = result.metadata or {}
+                    if meta.get("partial"):
+                        return
                     done_args = {**call_args, **meta}
                     _safe_call(self._calm_tool_done, name, done_args, log, result.success)
                     return
@@ -817,26 +800,7 @@ class AgentRunMixin:
                 display_args = {**call_args, **metadata}
                 from superqode.tools.display import extract_tool_command
 
-                result_command = (
-                    extract_tool_command(display_args)
-                    if any(
-                        marker in name.lower()
-                        for marker in ("bash", "shell", "terminal", "exec", "run", "command")
-                    )
-                    or any(
-                        display_args.get(key)
-                        for key in (
-                            "command",
-                            "cmd",
-                            "commandLine",
-                            "command_line",
-                            "shellCommand",
-                            "script",
-                            "argv",
-                        )
-                    )
-                    else ""
-                )
+                result_command = extract_tool_command(display_args)
                 result_path = str(
                     display_args.get("path")
                     or display_args.get("file_path")
@@ -4150,16 +4114,17 @@ class AgentRunMixin:
         from superqode.tools.display import extract_tool_command
 
         args = args or {}
+        command = extract_tool_command(args)
         try:
             log = self.query_one("#log", ConversationLog)
-            verb = log._format_tool_name(name)
+            verb = "run" if command else log._format_tool_name(name)
         except Exception:
-            verb = (name or "tool").replace("_", " ").split(" ")[0].lower()
+            verb = "run" if command else (name or "tool").replace("_", " ").split(" ")[0].lower()
         target = (
             args.get("path")
             or args.get("file_path")
             or args.get("filePath")
-            or extract_tool_command(args)
+            or command
             or args.get("pattern")
             or args.get("query")
             or args.get("url")
@@ -4206,10 +4171,10 @@ class AgentRunMixin:
     def _calm_tool_running(self, name: str, args: Optional[dict], log: ConversationLog) -> None:
         """Update the live throbber with the in-progress action."""
         verb, _target = self._calm_verb_target(name, args)
-        if any(
-            marker in name.lower()
-            for marker in ("bash", "shell", "terminal", "exec", "run", "command")
-        ):
+        # add_tool_call(running) only updates the #active-tools strip (it
+        # returns before writing a transcript row), so this stays single-row:
+        # live state here, transcript row once in _calm_tool_done.
+        if verb == "run":
             log.add_tool_call(name, "running", arguments=args or {})
         icons = getattr(self, "_CALM_VERB_ICONS", {})
         icon = icons.get(verb, "⚡")
@@ -4222,13 +4187,10 @@ class AgentRunMixin:
         self, name: str, args: Optional[dict], log: ConversationLog, ok: bool = True
     ) -> None:
         """Commit one tidy line for a finished tool (no raw output/diff)."""
-        if any(
-            marker in name.lower()
-            for marker in ("bash", "shell", "terminal", "exec", "run", "command")
-        ):
+        verb, target = self._calm_verb_target(name, args)
+        if verb == "run":
             log.add_tool_call(name, "success" if ok else "error", arguments=args or {})
             return
-        verb, target = self._calm_verb_target(name, args)
         self._calm_actions = getattr(self, "_calm_actions", 0) + 1
         icon = "✓" if ok else "✗"
         color = THEME["success"] if ok else THEME["error"]

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/mixins/build_harness.py

@@ -235,7 +235,7 @@ class BuildHarnessMixin:
     def _show_import_success(self, log: ConversationLog, spec, note: str, written) -> None:
         t = Text()
         t.append("\n  ✓ ", style=f"bold {THEME['success']}")
-        t.append(f"Imported {label}\n\n", style=f"bold {THEME['text']}")
+        t.append(f"Imported {spec.name}\n\n", style=f"bold {THEME['text']}")
         t.append("    Harness   ", style=THEME["dim"])
         t.append(f"{spec.name}\n", style=THEME["text"])
         t.append("    Written   ", style=THEME["dim"])

{superqode-2.4.22 → superqode-2.4.23}/src/superqode/app/mixins/clickable_commands.py

@@ -23,6 +23,7 @@ CLICKABLE_COMMANDS: frozenset[str] = frozenset(
         "eval",
         "exit",
         "explore",
+        "free",
         "harness",
         "help",
         "home",