thwip-cli 1.1.2__tar.gz → 1.1.3__tar.gz

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/.github/workflows/publish.yml

@@ -4,17 +4,16 @@ on:
   push:
     tags:
       - 'v*'
-  workflow_dispatch:
 
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -33,14 +32,25 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Verify tag matches package version
+        run: |
+          PACKAGE_VERSION=$(uv run python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          test "${GITHUB_REF_NAME}" = "v${PACKAGE_VERSION}" || {
+            echo "Tag ${GITHUB_REF_NAME} does not match package version v${PACKAGE_VERSION}."
+            exit 1
+          }
 
       - name: Build package
         run: uv build
 
+      - name: Verify package metadata
+        run: uvx twine check dist/*
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: thwip-cli
-Version: 1.1.2
+Version: 1.1.3
 Summary: Universal coding agent multiplexer: detect, switch, and route between AI coding agents seamlessly
 Project-URL: Homepage, https://github.com/tanmayhutt/thwip-cli
 Project-URL: Repository, https://github.com/tanmayhutt/thwip-cli
@@ -39,7 +39,7 @@ Description-Content-Type: text/markdown
 
 > Universal Coding Agent Multiplexer
 > 
-> Detect all installed AI coding agents on your device, combine them in a unified terminal interface, and hot-swap models mid-conversation when hitting rate limits without losing context.
+> Discover supported local AI tools, connect configured model providers in one terminal interface, and switch providers while preserving completed text conversation history.
 
 ---
 

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/README.md

@@ -2,7 +2,7 @@
 
 > Universal Coding Agent Multiplexer
 > 
-> Detect all installed AI coding agents on your device, combine them in a unified terminal interface, and hot-swap models mid-conversation when hitting rate limits without losing context.
+> Discover supported local AI tools, connect configured model providers in one terminal interface, and switch providers while preserving completed text conversation history.
 
 ---
 

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "thwip-cli"
-version = "1.1.2"
+version = "1.1.3"
 description = "Universal coding agent multiplexer: detect, switch, and route between AI coding agents seamlessly"
 readme = "README.md"
 license = "MIT"

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/tests/test_cli.py

@@ -7,7 +7,7 @@ from types import SimpleNamespace
 import pytest
 
 from thwip.agents.base import AgentDone, Capability, TextDelta, ToolUseStart
-from thwip.cli import ThwipCLI
+from thwip.cli import SafeFileHistory, ThwipCLI
 from thwip.session import Session
 from thwip.tools import ToolManager
 
@@ -44,6 +44,10 @@ class ToolCallingAgent:
             yield ToolUseStart(tool_id="read-1", tool_name="read_file", args={"file_path": "note.txt"})
             yield AgentDone()
         else:
+            assert messages[-2]["role"] == "assistant"
+            assert messages[-2]["tool_calls"][0]["id"] == "read-1"
+            assert messages[-1]["role"] == "tool"
+            assert messages[-1]["tool_call_id"] == "read-1"
             assert "known result" in messages[-1]["content"]
             yield TextDelta(content="Used the tool result.")
             yield AgentDone()
@@ -94,3 +98,15 @@ def test_inline_api_key_is_rejected():
 
     assert cli.config.keys == {}
     assert cli.config.key_sources == {}
+
+
+def test_inline_api_key_is_not_stored_in_prompt_history(tmp_path):
+    history_path = tmp_path / "history.txt"
+    history = SafeFileHistory(str(history_path))
+
+    history.store_string("/key openai secret-value")
+    history.store_string("/key openai")
+
+    contents = history_path.read_text()
+    assert "secret-value" not in contents
+    assert "/key openai" in contents

thwip_cli-1.1.3/tests/test_config.py

@@ -0,0 +1,21 @@
+"""Regression tests for secure configuration persistence."""
+
+from __future__ import annotations
+
+import tomllib
+
+from thwip.config import ThwipConfig
+
+
+def test_save_does_not_persist_environment_or_discovered_keys(tmp_path, monkeypatch):
+    monkeypatch.setenv("THWIP_CONFIG_DIR", str(tmp_path))
+    config = ThwipConfig(
+        keys={"openai": "from-env", "anthropic": "explicit"},
+        key_sources={"openai": "env:OPENAI_API_KEY", "anthropic": "config.toml"},
+    )
+
+    config.save()
+
+    data = tomllib.loads((tmp_path / "config.toml").read_text())
+    assert data["keys"] == {"anthropic": "explicit"}
+    assert (tmp_path / "config.toml").stat().st_mode & 0o777 == 0o600

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/tests/test_tools.py

@@ -6,7 +6,10 @@ from __future__ import annotations
 
 import tempfile
 
+import pytest
+
 from thwip.tools import ToolManager
+from thwip.tools.terminal import TerminalRunner
 
 
 def test_file_editor_operations():
@@ -49,3 +52,21 @@ def test_file_editor_blocks_paths_outside_workspace(tmp_path):
     assert "outside the project workspace" in manager.file_editor.read_file(str(outside))
     assert "outside the project workspace" in manager.file_editor.write_file("../outside.txt", "changed")
     assert outside.read_text() == "private"
+
+
+def test_tool_output_is_bounded(tmp_path):
+    manager = ToolManager(project_path=tmp_path)
+    (tmp_path / "large.txt").write_text("x" * 25_000)
+
+    result = manager.execute_tool("read_file", {"file_path": "large.txt", "max_lines": 1})
+
+    assert len(result) <= 20_100
+    assert "Output truncated" in result
+
+
+@pytest.mark.asyncio
+async def test_async_command_timeout_terminates_process(tmp_path):
+    runner = TerminalRunner(tmp_path)
+    result = await runner.run_command_async("sleep 5", timeout=0.01)
+
+    assert "timed out" in result

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/__init__.py

@@ -1,4 +1,4 @@
 """thwip: Universal Coding Agent Multiplexer."""
 
-__version__ = "1.1.2"
+__version__ = "1.1.3"
 __app_name__ = "thwip"

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/agents/claude_agent.py

@@ -313,11 +313,37 @@ class ClaudeAgent(BaseAgent):
         if tools:
             stream = False
 
+        # Convert the portable OpenAI-style tool transcript into Anthropic blocks.
+        anthropic_messages: list[dict[str, Any]] = []
+        for message in messages:
+            if message.get("tool_calls"):
+                blocks: list[dict[str, Any]] = []
+                if message.get("content"):
+                    blocks.append({"type": "text", "text": message["content"]})
+                for call in message["tool_calls"]:
+                    function = call["function"]
+                    arguments = function.get("arguments", {})
+                    blocks.append({
+                        "type": "tool_use", "id": call["id"], "name": function["name"],
+                        "input": json.loads(arguments) if isinstance(arguments, str) else arguments,
+                    })
+                anthropic_messages.append({"role": "assistant", "content": blocks})
+            elif message.get("role") == "tool":
+                anthropic_messages.append({
+                    "role": "user",
+                    "content": [{
+                        "type": "tool_result", "tool_use_id": message["tool_call_id"],
+                        "content": message.get("content", ""),
+                    }],
+                })
+            else:
+                anthropic_messages.append(message)
+
         # Build request kwargs
         model_info = self.get_model_info(model)
         kwargs: dict[str, Any] = {
             "model": model,
-            "messages": messages,
+            "messages": anthropic_messages,
             "max_tokens": model_info.max_output if model_info else 16_384,
         }
 

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/agents/google_agent.py

@@ -286,22 +286,43 @@ class GoogleAgent(BaseAgent):
         client = self._ensure_client()
         model = model or self.get_default_model()
 
+        from google.genai import types
+
         # Convert messages to Gemini format
         gemini_contents = []
         for msg in messages:
-            role = "user" if msg["role"] == "user" else "model"
-            gemini_contents.append({
-                "role": role,
-                "parts": [{"text": msg["content"]}],
-            })
+            if msg.get("tool_calls"):
+                parts = []
+                if msg.get("content"):
+                    parts.append(types.Part.from_text(text=msg["content"]))
+                for call in msg["tool_calls"]:
+                    function = call["function"]
+                    arguments = function.get("arguments", {})
+                    if isinstance(arguments, str):
+                        arguments = json.loads(arguments)
+                    parts.append(types.Part.from_function_call(
+                        name=function["name"], args=arguments,
+                    ))
+                gemini_contents.append(types.Content(role="model", parts=parts))
+            elif msg.get("role") == "tool":
+                gemini_contents.append(types.Content(
+                    role="user",
+                    parts=[types.Part.from_function_response(
+                        name=msg.get("name", "tool"),
+                        response={"result": msg.get("content", "")},
+                    )],
+                ))
+            else:
+                role = "user" if msg["role"] == "user" else "model"
+                gemini_contents.append(types.Content(
+                    role=role, parts=[types.Part.from_text(text=msg["content"])],
+                ))
 
         config: dict[str, Any] = {}
         if system_prompt:
             config["system_instruction"] = system_prompt
 
         try:
-            from google.genai import types
-
             if tools:
                 declarations = []
                 for tool in tools:

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/agents/openai_agent.py

@@ -362,9 +362,31 @@ class OpenAIAgent(BaseAgent):
                         "description": function.get("description", ""),
                         "parameters": function.get("parameters", {}),
                     })
+                response_input: list[dict[str, Any]] = []
+                for message in api_messages:
+                    if message.get("tool_calls"):
+                        if message.get("content"):
+                            response_input.append({"role": "assistant", "content": message["content"]})
+                        for call in message["tool_calls"]:
+                            function = call["function"]
+                            arguments = function.get("arguments", {})
+                            response_input.append({
+                                "type": "function_call", "call_id": call["id"],
+                                "name": function["name"],
+                                "arguments": arguments if isinstance(arguments, str) else json.dumps(arguments),
+                            })
+                    elif message.get("role") == "tool":
+                        response_input.append({
+                            "type": "function_call_output",
+                            "call_id": message["tool_call_id"],
+                            "output": message.get("content", ""),
+                        })
+                    else:
+                        response_input.append(message)
+
                 response_kwargs: dict[str, Any] = {
                     "model": model,
-                    "input": api_messages,
+                    "input": response_input,
                     "max_output_tokens": model_info.max_output if model_info else 16_384,
                 }
                 if response_tools:

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/cli.py

@@ -4,7 +4,7 @@ Main interactive terminal CLI for thwip.
 Universal coding agent multiplexer:
 - Dynamic UI adapting to agent capabilities
 - Seamless mid-conversation agent switching with context preservation
-- Auto-detection of all installed tools & subscriptions
+- Detection of supported installed tools and available credentials
 - Quota / rate limit exhaustion failover
 - Rich live markdown and tool execution
 """
@@ -14,6 +14,7 @@ from __future__ import annotations
 import asyncio
 import getpass
 import os
+import re
 from pathlib import Path
 
 from prompt_toolkit import PromptSession
@@ -59,6 +60,15 @@ from thwip.theme import (
 from thwip.tools import ToolManager
 
 
+class SafeFileHistory(FileHistory):
+    """Keep inline API-key commands out of persistent prompt history."""
+
+    def store_string(self, string: str) -> None:
+        if re.match(r"^\s*/(?:key|auth|config|k)\s+\S+\s+\S+", string, re.IGNORECASE):
+            return
+        super().store_string(string)
+
+
 class ThwipCLI:
     """The interactive terminal CLI REPL."""
 
@@ -127,9 +137,15 @@ class ThwipCLI:
         )
 
         # Setup prompt session
-        history_file = str(get_config_dir() / "history.txt")
+        history_path = get_config_dir() / "history.txt"
+        history_path.touch(mode=0o600, exist_ok=True)
+        try:
+            history_path.chmod(0o600)
+        except OSError:
+            pass
+        history_file = str(history_path)
         prompt_session: PromptSession = PromptSession(
-            history=FileHistory(history_file),
+            history=SafeFileHistory(history_file),
             completer=ThwipCompleter([a.name for a in self.registry.list_agents()]),
             key_bindings=create_keybindings(),
         )
@@ -177,7 +193,7 @@ class ThwipCLI:
 
     async def handle_command(self, cmd_line: str) -> str | None:
         """Handle slash commands."""
-        parts = cmd_line.split(" ", 2)
+        parts = cmd_line.split(maxsplit=2)
         cmd = parts[0].lower()
         arg1 = parts[1] if len(parts) > 1 else ""
         arg2 = parts[2] if len(parts) > 2 else ""
@@ -236,10 +252,20 @@ class ThwipCLI:
             elif sub == "load":
                 loaded = Session.load(arg2)
                 if loaded:
-                    self.session = loaded
+                    project = Path(loaded.project_path).expanduser().resolve()
+                    if not project.is_dir():
+                        print_error(f"Saved project directory '{loaded.project_path}' no longer exists.")
+                        return None
                     agent = self.registry.get_agent(loaded.current_agent)
-                    if agent:
-                        self.current_agent = agent
+                    if not agent:
+                        print_error(f"Saved agent '{loaded.current_agent}' is not available.")
+                        return None
+                    if not agent.get_model_info(loaded.current_model):
+                        loaded.current_model = agent.get_default_model()
+                        print_warning("The saved model is unavailable. Using the provider default.")
+                    self.session = loaded
+                    self.current_agent = agent
+                    self.tool_manager = ToolManager(str(project))
                     print_success(f"Loaded session '{loaded.name}' with {len(loaded.messages)} messages.")
                 else:
                     print_error(f"Session '{arg2}' not found.")
@@ -283,8 +309,8 @@ class ThwipCLI:
             ("edit_file", "Filesystem", "Structured string replacement in local files", "Active"),
             ("write_file", "Filesystem", "Create or overwrite full files", "Active"),
             ("list_dir", "Filesystem", "List directory tree and metadata", "Active"),
-            ("run_command", "Terminal", "Execute non-interactive shell commands safely", "Active"),
-            ("run_code", "Sandbox", "Run inline Python or Node.js code snippets", "Active"),
+            ("run_command", "Terminal", "Execute confirmed shell commands in the project", "Active"),
+            ("run_code", "Execution", "Run confirmed Python snippets with local user permissions", "Active"),
             ("git_status", "Version Control", "Inspect repository changes and staging", "Active"),
             ("git_diff", "Version Control", "View unified unstaged/staged diffs", "Active"),
         ]
@@ -415,7 +441,10 @@ class ThwipCLI:
                 f"  Or add it to ~/.thwip/config.toml"
             )
         else:
-            print_success(f"Now chatting with {new_agent.display_name} ({chosen_model}). Context preserved!")
+            print_success(
+                f"Now chatting with {new_agent.display_name} ({chosen_model}). "
+                "Portable text history preserved."
+            )
 
     def cmd_show_agents(self) -> None:
         """Show table of all detected agents."""
@@ -690,6 +719,8 @@ class ThwipCLI:
             if p.is_dir():
                 self.session.project_path = str(p)
                 self.tool_manager = ToolManager(str(p))
+                self.config.project = str(p)
+                self.config.save()
                 print_success(f"Project path changed to {p}")
             else:
                 print_error(f"Directory '{new_path}' does not exist.")
@@ -728,9 +759,9 @@ class ThwipCLI:
                     Text.from_markup(
                         f"[bold yellow]Missing API Key for {self.current_agent.display_name}[/bold yellow]\n\n"
                         f"An API key is required to send requests to [bold]{self.session.current_model}[/bold].\n\n"
-                        f"  • Configure key now:   [bold cyan]/key {self.current_agent.name}[/bold cyan]\n"
-                        f"  • Or set in shell:     [bold white]export {key_name}=your_key_here[/bold white]\n"
-                        f"  • Or switch agent:     [bold cyan]/switch[/bold cyan]"
+                        f"  - Configure key now:   [bold cyan]/key {self.current_agent.name}[/bold cyan]\n"
+                        f"  - Or set in shell:     [bold white]export {key_name}=your_key_here[/bold white]\n"
+                        f"  - Or switch agent:     [bold cyan]/switch[/bold cyan]"
                     ),
                     title="Setup Required",
                     border_style="yellow",
@@ -819,7 +850,8 @@ class ThwipCLI:
             if limit_hit or not tool_requests:
                 break
 
-            results = []
+            tool_call_messages = []
+            tool_result_messages = []
             for request in tool_requests:
                 display_args = {key: value for key, value in request.args.items() if key != "content"}
                 console.print(
@@ -835,15 +867,25 @@ class ThwipCLI:
                     if approved
                     else "Denied by user."
                 )
-                console.print(f"  [dim green]Result:[/dim green] [dim]{output[:500]}[/dim]")
-                results.append(f"Tool {request.tool_name} ({request.tool_id}) returned:\n{output}")
+                result_preview = Text("  Result: ", style="green")
+                result_preview.append(output[:500], style="dim")
+                console.print(result_preview)
+                tool_call_messages.append({
+                    "id": request.tool_id,
+                    "type": "function",
+                    "function": {"name": request.tool_name, "arguments": request.args},
+                })
+                tool_result_messages.append({
+                    "role": "tool",
+                    "tool_call_id": request.tool_id,
+                    "name": request.tool_name,
+                    "content": output,
+                })
 
-            assistant_note = round_text or "I requested one or more workspace tools."
-            working_messages.append({"role": "assistant", "content": assistant_note})
             working_messages.append({
-                "role": "user",
-                "content": "Workspace tool results follow. Continue the task using these results.\n\n" + "\n\n".join(results),
+                "role": "assistant", "content": round_text, "tool_calls": tool_call_messages,
             })
+            working_messages.extend(tool_result_messages)
         else:
             print_warning("Stopped after 8 consecutive tool rounds to prevent an infinite loop.")
 
@@ -855,18 +897,41 @@ class ThwipCLI:
                 company=self.current_agent.company,
                 tokens=total_tokens,
             )
+            if getattr(self.config, "auto_save", False):
+                if self.session.name == "new-session":
+                    self.session.name = f"session-{self.session.id}"
+                self.session.save()
 
     async def handle_limit_failover(self, event: LimitHit) -> None:
         """Handle rate limit or quota exhaustion with auto-suggested failover."""
+        if not self.config.fallback.enabled:
+            print_warning("Provider fallback is disabled in configuration.")
+            return
+
         # Find ready alternatives
         ready = self.registry.get_ready_agents()
         alternatives = []
-        for a in ready:
-            if a.name != self.current_agent.name:
+        seen: set[str] = set()
+        candidates: list[tuple[BaseAgent, str]] = []
+        for target in self.config.fallback.chain:
+            agent_name, separator, model = target.partition("/")
+            agent = self.registry.get_agent(agent_name)
+            if not agent or agent.name == self.current_agent.name or agent not in ready:
+                continue
+            chosen_model = model if separator and agent.get_model_info(model) else agent.get_default_model()
+            candidates.append((agent, chosen_model))
+            seen.add(agent.name)
+        candidates.extend(
+            (agent, agent.get_default_model())
+            for agent in ready
+            if agent.name != self.current_agent.name and agent.name not in seen
+        )
+
+        for a, chosen_model in candidates:
                 alternatives.append({
                     "agent": a.display_name,
                     "company": a.company,
-                    "model": a.get_default_model(),
+                    "model": chosen_model,
                     "capabilities": [c.value for c in a.capabilities],
                 })
 
@@ -883,7 +948,9 @@ class ThwipCLI:
             print_warning("No other configured agents found. Please add an API key or start Ollama.")
             return
 
-        choice = input("\nSwitch to alternative agent now? [1 to switch, Enter to cancel]: ").strip()
+        choice = "1" if self.config.limits.auto_switch else input(
+            "\nSwitch to alternative agent now? [1 to switch, Enter to cancel]: "
+        ).strip()
         if choice == "1" or choice.lower() == "y":
             target_alt = alternatives[0]
             for a in ready:

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/config.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import json
 import os
+import tempfile
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
@@ -42,7 +43,11 @@ def get_config_dir() -> Path:
 def get_sessions_dir() -> Path:
     """Return ~/.thwip/sessions/, creating it if needed."""
     d = get_config_dir() / "sessions"
-    d.mkdir(parents=True, exist_ok=True)
+    d.mkdir(parents=True, exist_ok=True, mode=0o700)
+    try:
+        d.chmod(0o700)
+    except OSError:
+        pass
     return d
 
 
@@ -158,7 +163,12 @@ def get_key_sources() -> dict[str, str]:
             if path.is_file():
                 try:
                     data = json.loads(path.read_text())
-                    if data.get(agent_conf["key_field"]):
+                    key_field = agent_conf["key_field"]
+                    value = data.get(key_field, "") if isinstance(data, dict) else ""
+                    credentials = data.get("credentials", {}) if isinstance(data, dict) else {}
+                    if not value and isinstance(credentials, dict):
+                        value = credentials.get(key_field, "")
+                    if value:
                         sources[provider] = str(path)
                         break
                 except (json.JSONDecodeError, OSError):
@@ -317,7 +327,12 @@ class ThwipConfig:
                 "auto_save": self.auto_save,
                 "confirm_tools": self.confirm_tools,
             },
-            "keys": {k: v for k, v in self.keys.items()},
+            # Never persist keys discovered from environment variables or another
+            # application's config. Only values explicitly stored in thwip belong here.
+            "keys": {
+                k: v for k, v in self.keys.items()
+                if self.key_sources.get(k) == "config.toml"
+            },
             "ollama": {
                 "host": self.ollama_host,
             },
@@ -342,12 +357,20 @@ class ThwipConfig:
         }
 
         config_path = get_config_path()
-        with open(config_path, "wb") as f:
-            tomli_w.dump(data, f)
+        temporary_path: Path | None = None
         try:
-            config_path.chmod(0o600)
-        except OSError:
-            pass
+            with tempfile.NamedTemporaryFile(
+                mode="wb", dir=config_path.parent, prefix=".config-", delete=False
+            ) as temporary:
+                temporary_path = Path(temporary.name)
+                os.chmod(temporary.name, 0o600)
+                tomli_w.dump(data, temporary)
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            temporary_path.replace(config_path)
+        finally:
+            if temporary_path and temporary_path.exists():
+                temporary_path.unlink()
 
     def get_key(self, provider: str) -> str | None:
         """Get API key for a provider, returning None if not found."""

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/session.py

@@ -7,7 +7,9 @@ Enables seamless context portability across agent switches without losing histor
 from __future__ import annotations
 
 import json
+import os
 import re
+import tempfile
 import time
 import uuid
 from dataclasses import asdict, dataclass, field
@@ -127,10 +129,21 @@ class Session:
             "updated_at": self.updated_at,
             "messages": [m.to_dict() for m in self.messages],
         }
-        temporary_path = file_path.with_suffix(".json.tmp")
-        temporary_path.write_text(json.dumps(data, indent=2), encoding="utf-8")
-        temporary_path.chmod(0o600)
-        temporary_path.replace(file_path)
+        temporary_path: Path | None = None
+        try:
+            with tempfile.NamedTemporaryFile(
+                mode="w", encoding="utf-8", dir=sessions_dir,
+                prefix=f".{self.name}-", suffix=".tmp", delete=False,
+            ) as temporary:
+                temporary_path = Path(temporary.name)
+                os.chmod(temporary.name, 0o600)
+                json.dump(data, temporary, indent=2)
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            temporary_path.replace(file_path)
+        finally:
+            if temporary_path and temporary_path.exists():
+                temporary_path.unlink()
         return file_path
 
     @classmethod

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/theme.py

@@ -199,7 +199,7 @@ def render_about_guide(
     content.append("  1. Auto-Detection:   Scans environment variables, local CLI agents, and existing credentials\n", style="dim")
     content.append("                       in ~/.claude.json, ~/.gemini/config.json, ~/.config/openai/, or Ollama.\n", style="dim")
     content.append("  2. Unified State:    Maintains conversation history and tool outputs in a portable format.\n", style="dim")
-    content.append("  3. Hot-Swapping:     Switch models mid-conversation with zero context loss.\n", style="dim")
+    content.append("  3. Hot-Swapping:     Switch models with completed text history preserved.\n", style="dim")
     content.append("  4. Universal Tools:  Provides safe file editing, shell commands, execution, and git operations.\n", style="dim")
     content.append("  5. Quota Failover:   Catches HTTP 429 errors and offers immediate one-key fallback switching.\n\n", style="dim")
 

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/tools/__init__.py

@@ -217,22 +217,28 @@ class ToolManager:
     def execute_tool(self, tool_name: str, args: dict[str, Any]) -> str:
         """Execute a tool by name with arguments and return output."""
         if tool_name == "read_file":
-            return self.file_editor.read_file(args.get("file_path", ""))
+            result = self.file_editor.read_file(args.get("file_path", ""))
         elif tool_name == "write_file":
-            return self.file_editor.write_file(args.get("file_path", ""), args.get("content", ""))
+            result = self.file_editor.write_file(args.get("file_path", ""), args.get("content", ""))
         elif tool_name == "edit_file":
-            return self.file_editor.edit_file(
+            result = self.file_editor.edit_file(
                 args.get("file_path", ""), args.get("old_str", ""), args.get("new_str", "")
             )
         elif tool_name == "run_command":
-            return self.terminal.run_command(args.get("command", ""))
+            result = self.terminal.run_command(args.get("command", ""))
         elif tool_name == "list_files":
-            return self.file_editor.list_files(args.get("sub_dir", "."))
+            result = self.file_editor.list_files(args.get("sub_dir", "."))
         elif tool_name == "git_status":
-            return self.git.status()
+            result = self.git.status()
         elif tool_name == "git_diff":
-            return self.git.diff(args.get("staged", False))
+            result = self.git.diff(args.get("staged", False))
         elif tool_name == "run_python":
-            return self.code_runner.run_python(args.get("code", ""))
+            result = self.code_runner.run_python(args.get("code", ""))
         else:
-            return f"Error: Unknown tool '{tool_name}'."
+            result = f"Error: Unknown tool '{tool_name}'."
+
+        max_chars = 20_000
+        if len(result) > max_chars:
+            omitted = len(result) - max_chars
+            return f"{result[:max_chars]}\n\n[Output truncated: {omitted} characters omitted]"
+        return result

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/tools/file_editor.py

@@ -7,6 +7,7 @@ Read, write, edit, search files within the project working directory.
 from __future__ import annotations
 
 import os
+import tempfile
 from pathlib import Path
 
 
@@ -49,7 +50,7 @@ class FileEditor:
         try:
             target = self._resolve_path(file_path)
             target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_text(content, encoding="utf-8")
+            self._atomic_write(target, content)
             return f"Successfully wrote {len(content.splitlines())} lines to '{file_path}'."
         except Exception as e:
             return f"Error writing to file '{file_path}': {e}"
@@ -70,11 +71,32 @@ class FileEditor:
             if count > 1:
                 return f"Error: Target text found {count} times. Please specify a more unique target block."
             new_content = content.replace(old_str, new_str, 1)
-            target.write_text(new_content, encoding="utf-8")
+            self._atomic_write(target, new_content)
             return f"Successfully updated '{file_path}'."
         except Exception as e:
             return f"Error editing file '{file_path}': {e}"
 
+    @staticmethod
+    def _atomic_write(target: Path, content: str) -> None:
+        """Replace a file atomically so interrupted writes cannot corrupt it."""
+        temporary_path: Path | None = None
+        existing_mode = target.stat().st_mode & 0o777 if target.exists() else None
+        try:
+            with tempfile.NamedTemporaryFile(
+                mode="w", encoding="utf-8", dir=target.parent,
+                prefix=f".{target.name}-", suffix=".tmp", delete=False,
+            ) as temporary:
+                temporary_path = Path(temporary.name)
+                temporary.write(content)
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            if existing_mode is not None:
+                temporary_path.chmod(existing_mode)
+            temporary_path.replace(target)
+        finally:
+            if temporary_path and temporary_path.exists():
+                temporary_path.unlink()
+
     def list_files(self, sub_dir: str = ".", max_entries: int = 100) -> str:
         """List files and directories within project."""
         try:

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/thwip/tools/terminal.py

@@ -42,6 +42,7 @@ class TerminalRunner:
 
     async def run_command_async(self, command: str, timeout: int = 30) -> str:
         """Run a shell command asynchronously."""
+        proc: asyncio.subprocess.Process | None = None
         try:
             proc = await asyncio.create_subprocess_shell(
                 command,
@@ -60,6 +61,9 @@ class TerminalRunner:
                 res_str += f"STDERR:\n{err}\n"
             return res_str.strip()
         except TimeoutError:
+            if proc and proc.returncode is None:
+                proc.kill()
+                await proc.communicate()
             return f"Error: Command timed out after {timeout} seconds."
         except Exception as e:
             return f"Error executing command: {e}"

{thwip_cli-1.1.2 → thwip_cli-1.1.3}/uv.lock

@@ -1022,7 +1022,7 @@ wheels = [
 
 [[package]]
 name = "thwip-cli"
-version = "1.1.2"
+version = "1.1.3"
 source = { editable = "." }
 dependencies = [
     { name = "anthropic" },