utim-cli 2.0.4__tar.gz → 2.1.0__tar.gz

{utim_cli-2.0.4 → utim_cli-2.1.0}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [2.1.0] - 2026-08-05
+
+### ⚡ Performance
+- **Added `UTIM_LITE_MODE=1` for low-spec PCs**: Skip loading heavy ML models (ChromaDB, sentence-transformers, MiniLM embeddings, local Qwen/torch download). CLI now starts instantly with no model-download lag. Enabled by default for users on `bin\utimlite.cmd`.
+- **New `utimlite` launcher** alongside `utim` (full mode) — `bin\utimlite.cmd` sets `UTIM_LITE_MODE=1` and runs the same app with a lightweight backend.
+- **Heavy dependencies are now opt-in**: `chromadb` + `sentence-transformers` moved out of core deps into the new `memory` extra (`pip install "utim-cli[memory]"`). Core install is now 11 lightweight deps only.
+
+### 🛠️ Fixes
+- **Fixed Parasail `400 'Expecting value: char 200'` error**: Python's `json.dumps` emits `NaN`/`Infinity` which strict providers (Parasail) reject with a JSON parse error. Added recursive `_sanitize_json()` in `client_utils.py` and wired it into `proxy_openrouter_request()` so every outbound LLM payload is now strict-JSON-safe (non-finite floats → `null`).
+- **Fixed `Wrong color format 'dim'` crash in publish dialog** (carried from 2.0.4).
+
+### 🔐 Security Hardening
+- **CLI signature middleware** with HMAC-SHA256 per-build secrets, install-id binding, and atomic nonce consumption (replay-attack resistant).
+- **Pluggable CAPTCHA** (reCAPTCHA / Turnstile / hCaptcha) on `/auth/*` endpoints.
+- **OpenRouter attribution centralized** via `OPENROUTER_HEADERS` and propagated to all client entry points (`proxy_openrouter_request`, `orchestrator.py` streaming path, `agent.py` ReActAgent, `server/routes/completion_routes.py` primary `/completions` server path, `server/router.py`, `security_routes.py`).
+- **Audit logging** with automatic PII/sensitive-data sanitization.
+- **Body-stream caching middleware** + atomic nonce DB updates bound to `(install_id, ip)`.
+- **`provision_build.py`** for release-time secret generation/rotation.
+- **Hardened CORS**: replaced permissive `*.utim.dev` regex with explicit allowlist (`www.utim.dev`, `api.utim.dev`).
+- **Request size limits**: 4MB default, 16MB marketplace; **web search sandboxing** (64KB response cap, 500-char query limit, host allow-list).
+- **Fixed abort-then-print bug** in `orchestrator.abort()`: removed premature `self.cancel_event.clear()` that re-enabled stream printing after abort — event now stays set until turn-reset paths clear it.
+
 ## [2.0.4] - 2026-08-05
 
 ### 🛠️ Fixes

{utim_cli-2.0.4/utim_cli.egg-info → utim_cli-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: utim-cli
-Version: 2.0.4
+Version: 2.1.0
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: MIT
 Project-URL: Homepage, https://utim.dev
@@ -57,6 +57,9 @@ Requires-Dist: mcp>=0.1.0; (platform_system != "Linux" or (platform_machine != "
 Requires-Dist: openai>=1.30.0; (platform_system != "Linux" or (platform_machine != "aarch64" and platform_machine != "arm64" and platform_machine != "armv7l" and platform_machine != "armv8l" and platform_machine != "arm" and platform_machine != "armv7")) and extra == "full"
 Provides-Extra: legacy-agent
 Requires-Dist: openai>=1.30.0; extra == "legacy-agent"
+Provides-Extra: memory
+Requires-Dist: chromadb>=0.4.0; extra == "memory"
+Requires-Dist: sentence-transformers>=2.2.0; extra == "memory"
 
 # UTIM CLI Agent: Enterprise Coder Assistant
 

{utim_cli-2.0.4 → utim_cli-2.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "utim-cli"
-version = "2.0.4"
+version = "2.1.0"
 description = "UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -75,6 +75,16 @@ full = [
 legacy-agent = [
     "openai>=1.30.0",
 ]
+# Heavy / memory-heavy features — intentionally NOT in core dependencies.
+# Installing these downloads several hundred MB (chromadb + sentence-transformers
+# + the MiniLM model) and can lag low-spec PCs. The CLI works fully without them:
+#   - Set UTIM_LITE_MODE=1 to force lightweight fallbacks (deterministic mock
+#     embeddings, no local Qwen/torch download).
+#   - Use `pip install "utim-cli[memory]"` on machines that can afford it.
+memory = [
+    "chromadb>=0.4.0",
+    "sentence-transformers>=2.2.0",
+]
 
 [project.scripts]
 utim = "utim_cli.utim:main_cli_entry"

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/__init__.py

@@ -5,7 +5,7 @@ try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
     # Fallback during first-install / editable-install edge cases
-    __version__ = "2.0.4"
+    __version__ = "2.1.0"
 
 import builtins, os, pathlib, urllib.parse, re
 

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/_version.py

@@ -11,4 +11,4 @@
 # from here so every surface stays in sync automatically.
 # ─────────────────────────────────────────────────────────────────────────────
 
-VERSION = "2.0.4"
+VERSION = "2.1.0"

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/agent.py

@@ -61,6 +61,11 @@ class ReActAgent:
         self.client = OpenAI(
             base_url="https://openrouter.ai/api/v1",
             api_key=api_key or "sk-fake-key-for-init",
+            default_headers={
+                "HTTP-Referer": "https://utim.dev",
+                "X-Title": "UTIM CLI Agent",
+                "User-Agent": "UTIM-CLI/2.0 (+https://utim.dev)",
+            },
         )
         self.messages = [{"role": "system", "content": system_prompt}]
         self.start_time = None

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/client_utils.py

@@ -1,5 +1,6 @@
 import os
 import json
+import math
 import requests
 from utim_cli.config import config
 
@@ -37,6 +38,32 @@ def get_server_url() -> str:
     return "https://api.utim.dev"
 
 
+def _sanitize_json(obj):
+    """Recursively scrub a payload for values that break strict JSON parsers.
+
+    Python's json.dumps emits NaN/Infinity as literal `NaN` / `Infinity`,
+    which is NOT valid JSON — strict providers (e.g. Parasail) reject the
+    whole request with 'Expecting value' at the exact offending character.
+    This replaces non-finite floats with None (safe in API payloads) and
+    drops anything that cannot round-trip through JSON.
+    """
+    if isinstance(obj, dict):
+        return {k: _sanitize_json(v) for k, v in obj.items()
+                if isinstance(k, (str, int, float, bool)) or k is None}
+    if isinstance(obj, (list, tuple)):
+        return [_sanitize_json(v) for v in obj]
+    if isinstance(obj, float):
+        return obj if math.isfinite(obj) else None
+    if isinstance(obj, (str, int, bool)) or obj is None:
+        return obj
+    # Anything else (bytes, objects, sets…) can't survive JSON serialisation.
+    try:
+        json.dumps(obj)
+        return obj
+    except (TypeError, ValueError):
+        return None
+
+
 # ─── Model catalog cache ──────────────────────────────────────────────────────
 _catalog_cache: dict | None = None
 _catalog_cache_ts: float = 0.0
@@ -84,6 +111,10 @@ def proxy_openrouter_request(json_data: dict, stream: bool = False, timeout=None
     """Routes LLM request to UTIM server /completions, or falls back to direct OpenRouter."""
     if timeout is None:
         timeout = (15, 900)
+    # Scrub payload for NaN/Infinity/non-JSON types BEFORE it leaves the
+    # machine. Providers like Parasail do a strict parse and reject the whole
+    # request (400 'Expecting value') if even one value is malformed.
+    json_data = _sanitize_json(json_data)
     # Ensure environment variables are loaded (orchestrator handles this, but tools.py is independent)
     _cwd_env = os.path.join(os.getcwd(), ".env")
     if os.path.isfile(_cwd_env):
@@ -98,19 +129,63 @@ def proxy_openrouter_request(json_data: dict, stream: bool = False, timeout=None
     llm_key = os.getenv("OPENROUTER_API_KEY")
 
     if llm_key:
+        # Direct path to OpenRouter — must always carry canonical attribution
+        # headers so OpenRouter shows "UTIM CLI Agent" (NOT "unknown") in its
+        # analytics. The user-agent and install-id are added by the global
+        # session patcher in config.py.
         headers = {
             "Authorization": f"Bearer {llm_key}",
             "Content-Type": "application/json",
             "HTTP-Referer": "https://utim.dev",
             "X-Title": "UTIM CLI Agent",
+            "User-Agent": "UTIM-CLI/2.0 (+https://utim.dev)",
         }
-        return requests.post("https://openrouter.ai/api/v1/chat/completions", json=json_data, headers=headers, stream=stream or json_data.get("stream"), timeout=timeout, verify=config.verify_ssl)
+        return requests.post(
+            "https://openrouter.ai/api/v1/chat/completions",
+            json=json_data,
+            headers=headers,
+            stream=stream or json_data.get("stream"),
+            timeout=timeout,
+            verify=config.verify_ssl,
+        )
 
     if api_key:
+        # Path via UTIM server. We attach CLI identity headers (version,
+        # install-id) so the server can correlate calls and (when enforcement
+        # is on) verify the request signature. The session-level UA patch in
+        # config.py adds the User-Agent too.
+        try:
+            from utim_cli._version import VERSION as _CLI_VERSION
+        except Exception:
+            _CLI_VERSION = "unknown"
+
+        try:
+            from utim_cli.config import get_install_id
+            _INSTALL_ID = get_install_id()
+        except Exception:
+            _INSTALL_ID = ""
+
         headers = {
             "X-API-Key": api_key,
-            "Content-Type": "application/json"
+            "Content-Type": "application/json",
+            "X-UTIM-CLI-Version": _CLI_VERSION,
+            "X-UTIM-Install-ID": _INSTALL_ID,
+            "User-Agent": f"UTIM-CLI/{_CLI_VERSION} (+https://utim.dev)",
         }
+
+        # Optional: attach CLI signature if the server is enforcing
+        # signatures. The signing flow (challenge → sign) is implemented in
+        # config.py's global session patcher so it works for every request,
+        # not just this one. If unavailable, we still send the headers above
+        # so the server can at least identify the caller.
+        try:
+            from utim_cli.config import sign_request_for_server
+            signed = sign_request_for_server(method="POST", path="/completions", body=json_data)
+            if signed:
+                headers.update(signed)
+        except Exception:
+            pass
+
         payload = {
             "messages": json_data.get("messages"),
             "model_id": json_data.get("model"),
@@ -237,7 +312,10 @@ def parse_xml_tool_calls(content: str) -> tuple[str | None, list[dict]]:
     import re
     import uuid
     tool_calls = []
-    tool_call_pattern = re.compile(r'<tool_call>([\s\S]*?)</tool_call>')
+    # Match BOTH <tool_call> and the pipe-delimited <|tool_call|> variant.
+    # Some models emit <|tool_call|> (Claude/Ollama style); the old regex only
+    # matched <tool_call>, so those calls leaked raw into chat as text.
+    tool_call_pattern = re.compile(r'<\|?tool_call\|?>([\s\S]*?)<\|?/tool_call\|?>')
     
     matches = list(tool_call_pattern.finditer(content))
     if not matches:
@@ -506,4 +584,4 @@ def update_session_usage(
         entry["tools_credits"]       = entry.get("tools_credits",       0.0) + credits_used
 
     all_sessions[eff_id] = entry
-    _write_all_usage(all_sessions)
+    _write_all_usage(all_sessions)

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/config.py

@@ -3,10 +3,160 @@ import logging
 import os
 import pathlib
 import shutil
+import time
+import hashlib
+import hmac
 from typing import Any, Dict, Optional
 
 logger = logging.getLogger("utim.config")
 
+
+# ── CLI install identity & request signing ───────────────────────────────────
+# Used by client_utils.py to attach X-UTIM-* headers to every server-bound
+# request and (when the server enforces signing) to compute X-UTIM-CLI-Signature.
+# The server defines the canonical string in utim_cli/server/cli_auth.py.
+
+_INSTALL_ID: str = ""
+_HMAC_SECRET: bytes = b""               # populated lazily from environment / config
+_LAST_CHALLENGE_FETCH: float = 0.0
+_CHALLENGE_CACHE: dict = {"nonce": "", "expires_at": 0}
+
+
+def _load_install_id() -> str:
+    """Read or generate the persistent install ID (uuid4 stored on disk)."""
+    global _INSTALL_ID
+    if _INSTALL_ID:
+        return _INSTALL_ID
+    try:
+        uid_path = get_utim_dir() / "install_id"
+        if uid_path.exists():
+            _INSTALL_ID = uid_path.read_text(encoding="utf-8").strip() or _generate_install_id()
+        else:
+            _INSTALL_ID = _generate_install_id()
+            uid_path.parent.mkdir(parents=True, exist_ok=True)
+            uid_path.write_text(_INSTALL_ID, encoding="utf-8")
+    except Exception:
+        _INSTALL_ID = _generate_install_id()
+    return _INSTALL_ID
+
+
+def _generate_install_id() -> str:
+    import uuid
+    return f"inst-{uuid.uuid4().hex}"
+
+
+def get_install_id() -> str:
+    """Public accessor — returns the per-install UUID."""
+    return _load_install_id()
+
+
+def get_cli_version() -> str:
+    try:
+        from utim_cli._version import VERSION  # type: ignore
+        return VERSION
+    except Exception:
+        return "unknown"
+
+
+def get_hmac_secret() -> bytes:
+    """Return the build-embedded HMAC secret used to sign requests.
+
+    Source priority:
+      1. UTIM_CLI_HMAC_SECRET environment variable (dev / override)
+      2. Persisted config value (set by the CLI on first launch from a baked-in default)
+      3. A stable derived default — sufficient for the server to log but NOT to
+         authenticate (server treats unknown secrets as "unsigned legacy client")
+    """
+    global _HMAC_SECRET
+    if _HMAC_SECRET:
+        return _HMAC_SECRET
+    env_secret = os.environ.get("UTIM_CLI_HMAC_SECRET", "").strip()
+    if env_secret:
+        _HMAC_SECRET = env_secret.encode("utf-8")
+        return _HMAC_SECRET
+    try:
+        stored = config.get("cli_hmac_secret")
+        if stored:
+            _HMAC_SECRET = stored.encode("utf-8")
+            return _HMAC_SECRET
+    except Exception:
+        pass
+    # Stable fallback derived from install_id — server rejects but client code
+    # still works without raising. The server logs these as "unsigned legacy".
+    _HMAC_SECRET = hashlib.sha256(("utim-legacy:" + get_install_id()).encode("utf-8")).digest()
+    return _HMAC_SECRET
+
+
+def _fetch_challenge(server_url: str) -> dict:
+    """Ask the server for a fresh nonce. Cached for 30s to avoid spamming."""
+    global _LAST_CHALLENGE_FETCH, _CHALLENGE_CACHE
+    now = time.time()
+    if _CHALLENGE_CACHE.get("nonce") and _CHALLENGE_CACHE.get("expires_at", 0) > now + 5:
+        if (now - _LAST_CHALLENGE_FETCH) < 30:
+            return _CHALLENGE_CACHE
+    try:
+        import requests as _req
+        r = _req.get(
+            f"{server_url.rstrip('/')}/auth/cli-challenge",
+            headers={
+                "X-UTIM-Install-ID": get_install_id(),
+                "User-Agent": f"UTIM-CLI/{get_cli_version()} (+https://utim.dev)",
+            },
+            timeout=5,
+        )
+        if r.status_code == 200:
+            data = r.json()
+            _CHALLENGE_CACHE = {
+                "nonce": data.get("nonce", ""),
+                "expires_at": int(data.get("expires_at", 0)),
+                "enforcement_enabled": bool(data.get("enforcement_enabled", False)),
+            }
+            _LAST_CHALLENGE_FETCH = now
+    except Exception:
+        pass
+    return _CHALLENGE_CACHE
+
+
+def sign_request_for_server(method: str, path: str, body: Any) -> dict:
+    """Build the X-UTIM-* signature headers for a server-bound request.
+
+    Returns {} silently if signing is not available (no network, no secret).
+    """
+    try:
+        from utim_cli.client_utils import get_server_url
+        server_url = get_server_url()
+    except Exception:
+        return {}
+
+    challenge = _fetch_challenge(server_url)
+    nonce = (challenge or {}).get("nonce") or ""
+    if not nonce:
+        return {}
+
+    if body is None:
+        body_bytes = b""
+    elif isinstance(body, (bytes, bytearray)):
+        body_bytes = bytes(body)
+    else:
+        try:
+            body_bytes = json.dumps(body, separators=(",", ":"), sort_keys=True).encode("utf-8")
+        except Exception:
+            body_bytes = str(body).encode("utf-8")
+
+    body_hash = hashlib.sha256(body_bytes).hexdigest()
+    install_id = get_install_id()
+    canonical = f"{method.upper()}\n{path}\n{nonce}\n{install_id}\n{body_hash}"
+
+    secret = get_hmac_secret()
+    signature = hmac.new(secret, canonical.encode("utf-8"), hashlib.sha256).hexdigest()
+
+    return {
+        "X-UTIM-Nonce": nonce,
+        "X-UTIM-CLI-Signature": signature,
+        "X-UTIM-CLI-Version": get_cli_version(),
+        "X-UTIM-Install-ID": install_id,
+    }
+
 # ── SSL session patch ─────────────────────────────────────────────────────────
 # Keeps a reference to the true original so toggling works correctly in both
 # directions without chaining patches on top of each other.

{utim_cli-2.0.4 → utim_cli-2.1.0}/utim_cli/orchestrator.py

@@ -490,6 +490,10 @@ _qwen_downloading = False
 def _trigger_qwen_download_bg():
     """Trigger background download and caching of Qwen local model if not already loaded or downloading."""
     global _qwen_model, _qwen_tokenizer, _qwen_downloading
+    # LITE MODE: never download/load the local Qwen model (torch + ~1GB RAM).
+    # Falls back to the cloud API path (proxy_openrouter_request) instead.
+    if os.environ.get("UTIM_LITE_MODE", "0") in ("1", "true", "TRUE", "yes"):
+        return
     if _qwen_model is None and not _qwen_downloading:
         import sys
         if "pytest" in sys.modules:
@@ -758,16 +762,28 @@ def _get_dynamic_directives(is_compressed: bool, messages: Optional[List[Dict]]
     if not enabled_tools:
         return "### TOOL STATUS: ALL TOOLS DISABLED\nAll tools are disabled. You may only respond in text."
 
-    directives = [
-        "### CORE DIRECTIVES:",
-        "1. **Targeted Search**: Use `grep_search` to locate exact symbol definitions, imports, or error text across codebase files.",
-        "2. **Scoped File Reading**: Use `read_file` with `symbol_name` or line ranges (`start_line`/`end_line`) to inspect target function/class definitions. Avoid reading un-sliced large files.",
-        "3. **Images & Screenshots**: If the prompt includes an image or screenshot path (.png, .jpg, .jpeg, etc.), execute `read_file` immediately on Turn 1 with that exact path. Absolute file paths anywhere on the system are valid — do not question file locations.",
-        "4. **Project & Feature Planning**: Proactively invoke `plan_project` (with `plan_part` set to 'design', 'architecture', 'security', 'database', 'testing', 'deployment', or 'features') for non-trivial tasks, new features, system refactors, or new application builds before implementing.",
-        "5. **Think-Create-Verify**: Execute tools directly without conversational preambles or text planning. Verify edits with `run_command` (compile/build/test).",
-        "6. **Execution**: Invoke native function-calling schemas directly. Never output raw JSON, <think> tags, or conversational text before tool calls.",
-        "7. **Output & Summary**: Be concise, professional, and clear. Upon finishing, provide a comprehensive summary of completion.",
-    ]
+    if is_compressed:
+        # Short, token-efficient directives for steady-state turns. The full
+        # version is only injected on iteration 0 (first turn).
+        directives = [
+            "### CORE DIRECTIVES:",
+            "1. **Targeted Search**: Use `grep_search` for symbols/errors; `read_file` with symbol_name or line ranges — no un-sliced large reads.",
+            "2. **Images**: If the prompt includes an image path (.png/.jpg/.jpeg), `read_file` it immediately on Turn 1 with that exact path.",
+            "3. **Planning**: Invoke `plan_project` for non-trivial tasks/new features/refactors before implementing.",
+            "4. **Think-Create-Verify**: Execute tools directly (no preamble). Verify edits with `run_command` (build/test).",
+            "5. **Output**: Native function-calling only — no raw JSON, <think> tags, or tool markup in text. Finish with a concise summary.",
+        ]
+    else:
+        directives = [
+            "### CORE DIRECTIVES:",
+            "1. **Targeted Search**: Use `grep_search` to locate exact symbol definitions, imports, or error text across codebase files.",
+            "2. **Scoped File Reading**: Use `read_file` with `symbol_name` or line ranges (`start_line`/`end_line`) to inspect target function/class definitions. Avoid reading un-sliced large files.",
+            "3. **Images & Screenshots**: If the prompt includes an image or screenshot path (.png, .jpg, .jpeg, etc.), execute `read_file` immediately on Turn 1 with that exact path. Absolute file paths anywhere on the system are valid — do not question file locations.",
+            "4. **Project & Feature Planning**: Proactively invoke `plan_project` (with `plan_part` set to 'design', 'architecture', 'security', 'database', 'testing', 'deployment', or 'features') for non-trivial tasks, new features, system refactors, or new application builds before implementing.",
+            "5. **Think-Create-Verify**: Execute tools directly without conversational preambles or text planning. Verify edits with `run_command` (compile/build/test).",
+            "6. **Execution**: Invoke native function-calling schemas directly. Never output raw JSON, <think> tags, or conversational text before tool calls.",
+            "7. **Output & Summary**: Be concise, professional, and clear. Upon finishing, provide a comprehensive summary of completion.",
+        ]
     # NOTE: 'Iteration Budget' directive intentionally removed.
     # Iteration limits are now enforced dynamically (window-aware) at runtime
     # via milestone warnings, not hardcoded into the system prompt.
@@ -1278,8 +1294,12 @@ class Orchestrator:
             abort_active_command()
         except Exception:
             pass
-        # Clear cancel_event after abort cleanup so future calls do not hang
-        self.cancel_event.clear()
+        # NOTE: We deliberately do NOT clear cancel_event here. The stream
+        # reader thread may still be draining a socket with buffered chunks,
+        # and the render loops check `cancel_event.is_set()` before printing.
+        # Clearing it here would let those buffered chunks print after abort.
+        # The event is cleared at the START of the next turn (see the
+        # `_run`/turn-reset paths that call self.cancel_event.clear()).
 
 
     # LLM calling
@@ -1755,10 +1775,22 @@ class Orchestrator:
                             current_model,
                             is_primary=current_is_primary and not override_model,
                         )
+                        # Attribution headers — OpenRouter shows "UTIM CLI Agent"
+                        # in its activity log ONLY when HTTP-Referer + X-Title are
+                        # present on every outbound call. Without them the app
+                        # shows as "unknown".
+                        try:
+                            from utim_cli.server.attribution import OPENROUTER_HEADERS as _OR_ATTR
+                        except Exception:
+                            _OR_ATTR = {
+                                "HTTP-Referer": "https://utim.dev",
+                                "X-Title": "UTIM CLI Agent",
+                            }
                         _headers = {
                             "Authorization": f"Bearer {_endpoint_key}",
                             "Content-Type": "application/json",
                             "User-Agent": _browser_ua,
+                            **_OR_ATTR,
                         }
                         request_payload = payload
                     else:
@@ -1805,6 +1837,9 @@ class Orchestrator:
                         was_cut_off = False
                         _stream_finish_reason: str = ""
                         _stream_completion_tokens: int = 0
+                        # Buffers raw <tool_call>/<|tool_call|> XML streamed as text
+                        # so it never renders in the live chat output.
+                        _tool_xml_buf: list = [""]
 
                         try:
                             # Dynamic thinking phases — cycle through contextual messages
@@ -1938,7 +1973,18 @@ class Orchestrator:
                                     if t == "content_delta":
                                         text = chunk.get("text", "")
                                         final_content += text
-                                        if not silent and text and not self.cancel_event.is_set():
+                                        # Never print raw tool-call XML tokens live. If the
+                                        # model emits <tool_call>/<|tool_call|> as text (some
+                                        # models do), we buffer it out of the visible stream
+                                        # so schemas don't leak into chat; it's parsed into
+                                        # real tool calls at end-of-stream (see below).
+                                        _looks_like_tool_xml = (
+                                            "<tool_call" in text or "</tool_call" in text
+                                            or "<|tool_call" in text or "</|tool_call" in text
+                                        )
+                                        if _looks_like_tool_xml:
+                                            _tool_xml_buf[0] += text
+                                        elif not silent and text and not self.cancel_event.is_set():
                                             display_buf += text
                                             _line_buf += text
                                             if "\n" in _line_buf:
@@ -2139,6 +2185,12 @@ class Orchestrator:
                                 # Content was already streamed live — just add trailing newline
                                 self.console.print()
 
+                        # Merge any buffered tool-call XML back into final_content so
+                        # parse_xml_tool_calls (which now handles <|tool_call|>) can
+                        # turn it into real tool calls instead of leaked chat text.
+                        if _tool_xml_buf[0]:
+                            final_content += _tool_xml_buf[0]
+
                         clean_content = re.sub(
                             r"<think(?:ing)?>.*?</think(?:ing)?>", "", final_content, flags=re.DOTALL
                         ).strip()

utim_cli-2.1.0/utim_cli/server/attribution.py

@@ -0,0 +1,62 @@
+"""
+OpenRouter Attribution Helper
+=============================
+
+Centralised injection of the HTTP-Referer / X-Title / User-Agent headers that
+OpenRouter uses to identify the calling app. OpenRouter shows "UTIM CLI Agent"
+in its logs only when these are present on every outbound call. Previously
+some code paths (the server's /completions proxy, the CLI's direct fallback)
+were inconsistent — leading to the app showing as "unknown" in analytics.
+
+This module exposes:
+
+    OPENROUTER_HEADERS  : dict of headers every OpenRouter-bound request MUST carry
+    attach_openrouter_headers(headers=None) -> dict
+    attach_openrouter_headers_to_session(session)
+    install_urllib3_user_agent()   # one-time patch for clients that bypass `requests`
+"""
+from __future__ import annotations
+
+from typing import Optional
+
+# ── Constants ────────────────────────────────────────────────────────────────
+
+OPENROUTER_HEADERS = {
+    "HTTP-Referer": "https://utim.dev",
+    "X-Title": "UTIM CLI Agent",
+    "User-Agent": "UTIM-CLI/2.0 (+https://utim.dev)",
+}
+
+
+def attach_openrouter_headers(headers: Optional[dict] = None) -> dict:
+    """Return a new dict with the canonical OpenRouter attribution headers merged in.
+
+    Caller-supplied headers take precedence over the defaults (so a test harness
+    can still override), except HTTP-Referer and X-Title which are forced to
+    the canonical values (otherwise OpenRouter shows the app as 'unknown').
+    """
+    merged = dict(headers or {})
+    for key, val in OPENROUTER_HEADERS.items():
+        merged[key] = val
+    return merged
+
+
+def attach_openrouter_headers_to_session(session) -> None:
+    """Mutate a requests.Session in place to always carry the headers."""
+    session.headers.update(OPENROUTER_HEADERS)
+
+
+def install_urllib3_user_agent() -> None:
+    """Patch urllib3's default User-Agent pool header. Useful for code that
+    goes through the `httpx` or `urllib3` lower layers and bypasses `requests`.
+    """
+    try:
+        import urllib3
+        urllib3.util.make_headers(  # noqa: F841 - intentional side-effect
+            user_agent=OPENROUTER_HEADERS["User-Agent"]
+        )
+        # Note: urllib3 doesn't actually store this globally; this is a stub
+        # for the rare direct-urllib3 caller. Most code uses `requests` and
+        # should be patched via attach_openrouter_headers_to_session().
+    except Exception:
+        pass