utim-cli 2.3.19b0__tar.gz → 2.3.20__tar.gz

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/CHANGELOG.md

@@ -1,12 +1,9 @@
 # Changelog
 
-## [2.3.19-beta] - 2026-09-03
+## [2.3.20] - 2026-09-04
 
-### 🚀 Beta Release: Tier Enforcement & Model Access Fixes
-- **Websearch tier gate**: agentic websearch (LLM query synthesis + synthesis) is now paid-plan only; free-tier users always get the fast non-agentic path
-- **Tool registry cleanup**: removed `analyzeimage` from callable tools — vision models receive image bytes directly via `readfile`, non-vision models get internal auto-descriptions
-- **APINEX models ungated**: APINEX models are now available on every plan (paid included) as free models
-- Version tagged as **beta** (`2.3.19-beta`) for beta-channel upload
+### 🛠️ Minor Fixes and Enhancement
+- Minor fixes and enhancement
 
 ## [2.3.19] - 2026-09-02
 

{utim_cli-2.3.19b0/utim_cli.egg-info → utim_cli-2.3.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: utim-cli
-Version: 2.3.19b0
+Version: 2.3.20
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: Emend AI Proprietary EULA
 Project-URL: Homepage, https://utim.dev

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "utim-cli"
-version = "2.3.19-beta"
+version = "2.3.20"
 
 description = "UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal."
 readme = "README.md"

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim/__init__.py

@@ -14,7 +14,7 @@ Quickstart:
 try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
-    __version__ = "2.3.19-beta"
+    __version__ = "2.3.20"
 
 # Developer-friendly core classes (similar to `import genai` / `import openai`)
 from utim_cli.sdk.session import UtimSession as Session

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/__init__.py

@@ -5,7 +5,7 @@ try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
     # Fallback during first-install / editable-install edge cases
-    __version__ = "2.3.19-beta"
+    __version__ = "2.3.20"
 
 
 import builtins, os, pathlib, urllib.parse, re

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/_version.py

@@ -11,10 +11,6 @@
 # from here so every surface stays in sync automatically.
 # ─────────────────────────────────────────────────────────────────────────────
 
-# Beta release: "-beta" is the machine-valid spelling of "2.3.19 beta"
-# (npm semver prerelease tag + PEP 440 pre-release segment; a space would
-# break npm publish and pip). parse_version() strips the suffix so update
-# checks still compare on the numeric core 2.3.19.
-VERSION = "2.3.19-beta"
+VERSION = "2.3.20"
 
 

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/orchestrator.py

@@ -594,6 +594,30 @@ class Orchestrator(LLMTransportMixin, TurnHistoryMixin, ToolExecutionMixin):
             except Exception:
                 pass
 
+            # ── Sanitize: strip base64-encoded binary blobs ─────────────────
+            # On Termux, copying an image file can place raw base64 data into the
+            # clipboard.  If any paste-chip expansion path leaks this binary noise
+            # into the user message, we detect and truncate it here before it
+            # reaches the model context.
+            _B64_RUN_RE = re.compile(r'[A-Za-z0-9+/=]{400,}')
+            if _B64_RUN_RE.search(user_message):
+                # Count total base64-characters vs meaningful content
+                b64_chars = sum(1 for c in user_message if 'A' <= c <= 'Z' or 'a' <= c <= 'z' or '0' <= c <= '9' or c in '+/=')
+                total_chars = max(len(user_message), 1)
+                if total_chars > 600 and (b64_chars / total_chars) > 0.85:
+                    # The message is dominated by binary noise — keep only
+                    # non-base64 lines and any embedded file paths.
+                    clean_lines = []
+                    for line in user_message.split('\n'):
+                        line_stripped = line.strip()
+                        b64_ratio = sum(1 for c in line_stripped if 'A' <= c <= 'Z' or 'a' <= c <= 'z' or '0' <= c <= '9' or c in '+/=') / max(len(line_stripped), 1)
+                        # Keep lines that are paths or have low base64 ratio
+                        if b64_ratio < 0.70 or re.search(r'[A-Za-z]:[\\/]|/[^\s]+\.\w{2,4}', line_stripped):
+                            clean_lines.append(line)
+                    if clean_lines:
+                        user_message = '\n'.join(clean_lines)
+                        user_message += f"\n\n[Pasted binary clipboard data stripped — {total_chars} chars of base64 noise removed]"
+
             # Auto-detect image paths in user_message and send direct multimodal vision payload
             try:
                 img_matches = re.findall(r'(?:[A-Za-z]:[\\/][^\s"\']+\.(?:png|jpg|jpeg|webp|gif)|/[^\s"\']+\.(?:png|jpg|jpeg|webp|gif))', user_message, re.IGNORECASE)
@@ -829,6 +853,17 @@ class Orchestrator(LLMTransportMixin, TurnHistoryMixin, ToolExecutionMixin):
 
                     break  # success
                 except _ServerUnavailableError as exc:
+                    _err_text = str(exc).lower()
+                    if "rate limit" in _err_text or "rate-limit" in _err_text or "429" in _err_text or "too many requests" in _err_text:
+                        self.console.print(f"\n[bold yellow]⏳  Model is temporarily rate-limited by the provider.[/bold yellow]")
+                        self.console.print("  [dim]Please wait a moment before retrying, or switch models using [bold]/model[/bold] (Ctrl+M).[/dim]\n")
+                        if len(self.messages) <= turn_msg_start + 1:
+                            self.messages.append({
+                                "role": "assistant",
+                                "content": "⏳ **Model Rate Limited**: The model is temporarily rate-limited by the provider. Please wait a short moment and retry, or use `/model` to switch models."
+                            })
+                        self._persist_messages()
+                        return
                     if self.cancel_event.is_set():
                         del self.messages[turn_msg_start + 1:]
                         self._persist_messages()
@@ -875,6 +910,17 @@ class Orchestrator(LLMTransportMixin, TurnHistoryMixin, ToolExecutionMixin):
                         self.messages.append({"role": "assistant", "content": "[Aborted by user]"})
                     break
                 except Exception as exc:
+                    _err_text = str(exc).lower()
+                    if "rate limit" in _err_text or "rate-limit" in _err_text or "429" in _err_text or "too many requests" in _err_text:
+                        self.console.print(f"\n[bold yellow]⏳  Model is temporarily rate-limited by the provider.[/bold yellow]")
+                        self.console.print("  [dim]Please wait a moment before retrying, or switch models using [bold]/model[/bold] (Ctrl+M).[/dim]\n")
+                        if len(self.messages) <= turn_msg_start + 1:
+                            self.messages.append({
+                                "role": "assistant",
+                                "content": "⏳ **Model Rate Limited**: The model is temporarily rate-limited by the provider. Please wait a short moment and retry, or use `/model` to switch models."
+                            })
+                        self._persist_messages()
+                        return
                     if self.cancel_event.is_set():
                         if len(self.messages) <= turn_msg_start + 1:
                             self.messages.append({"role": "assistant", "content": "[Aborted by user]"})

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/orchestrator_llm_transport.py

@@ -133,6 +133,11 @@ Contains: _get_configured_model_source, _is_custom_model_selection,
 _resolve_model_endpoint, _call_llm. Behavior-identical; Orchestrator inherits.
 """
 class LLMTransportMixin:
+    _PRE_THINK_PATTERNS = re.compile(
+        r"^\s*(\*\s*Thinking\.\.\.?|\.\.\.(\s*thinking)?|thinking\.\.\.?)\s*$",
+        re.IGNORECASE | re.MULTILINE,
+    )
+
     def _get_configured_model_source(self, model_id: str, *, is_primary: bool = False) -> Optional[str]:
         """Return the selected source for a model id when the picker recorded one."""
         if is_primary:
@@ -736,7 +741,9 @@ class LLMTransportMixin:
                     # 1. Check if quota is exhausted (only for non-custom models)
                     is_5h_exhausted = bool(quota.get("five_hour_quota_exhausted", False))
                     is_monthly_exhausted = bool(quota.get("is_exhausted", False))
-                    is_exhausted = is_5h_exhausted or is_monthly_exhausted
+                    bonus_bal = float(quota.get("bonus_balance", quota.get("free_bonus_balance", 0.0)) or 0.0)
+                    # If the user has available bonus credits, inference is funded by bonus quota
+                    is_exhausted = (is_5h_exhausted or is_monthly_exhausted) and bonus_bal <= 0.0
 
                     if not is_custom and is_exhausted:
                         reset_raw = quota.get("five_hour_reset_at") if is_5h_exhausted else (quota.get("reset_at") or quota.get("five_hour_reset_at", ""))
@@ -771,7 +778,7 @@ class LLMTransportMixin:
                         
                     # 2. Check if chosen model is allowed — skip entirely for BYOK/custom models
                     models_allowed = quota.get("models_allowed", [])
-                    free_bonus_balance = quota.get("free_bonus_balance", 0.0) or 0.0
+                    free_bonus_balance = float(quota.get("bonus_balance", quota.get("free_bonus_balance", 0.0)) or 0.0)
                     chosen_model = override_model if override_model else self.model_id
                     is_custom = self._is_custom_model_selection(chosen_model, is_primary=not override_model)
                     is_free_user = (quota.get("plan") == "free" or str(quota.get("display_name", "")).lower() == "free")
@@ -1348,10 +1355,15 @@ class LLMTransportMixin:
                                     if t == "queue_status":
                                         pos = chunk.get("position", 1)
                                         status = chunk.get("status", "queued")
+                                        tier = chunk.get("tier", "")
+                                        prio = chunk.get("priority", 0)
                                         if status == "queued":
                                             try:
                                                 from utim_cli.state import STATE
-                                                STATE["thinking_topic"] = f"Request Queued Position {pos}"
+                                                if prio > 0 and tier:
+                                                    STATE["thinking_topic"] = f"Request Queued Position {pos} ({str(tier).title()} Priority)"
+                                                else:
+                                                    STATE["thinking_topic"] = f"Request Queued Position {pos}"
                                             except Exception:
                                                 pass
                                         elif status == "processing":
@@ -1514,12 +1526,23 @@ class LLMTransportMixin:
                                                     "tool_calls": None,
                                                 }, False
                                             elif _is_rate_limit:
+                                                rate_limit_display = (
+                                                    f"⏳ **Model Rate Limited**: `{current_model}` is currently experiencing high demand and is temporarily rate-limited by the provider.\n\n"
+                                                    f"- **What to do:** Please wait a moment before retrying, or switch to a different model with `/model` or `Ctrl+M`.\n"
+                                                    f"- **Retry:** You can resend your prompt anytime."
+                                                )
                                                 if not silent:
                                                     self.console.print(
-                                                        f"\n[dim yellow]↪ {_friendly_name} is currently rate-limited — "
-                                                        f"switching to the next available model…[/dim yellow]"
+                                                        f"\n[bold yellow]⏳  Model '{current_model}' is temporarily rate-limited by the provider.[/bold yellow]"
+                                                    )
+                                                    self.console.print(
+                                                        "  [dim]Please wait a moment before retrying, or switch models using [bold]/model[/bold] (Ctrl+M).[/dim]\n"
                                                     )
-                                                raise RuntimeError(f"__RATE_LIMITED__:{current_model}")
+                                                return {
+                                                    "role": "assistant",
+                                                    "content": rate_limit_display,
+                                                    "tool_calls": None,
+                                                }, False
                                             elif _is_provider_upstream:
                                                 if not silent:
                                                     self.console.print(
@@ -1940,7 +1963,8 @@ class LLMTransportMixin:
                                 timeout=5,
                             )
                             if _qr.status_code == 200:
-                                _has_bonus = (_qr.json().get("free_bonus_balance") or 0.0) > 0.0
+                                _data = _qr.json()
+                                _has_bonus = (float(_data.get("bonus_balance", _data.get("free_bonus_balance", 0.0)) or 0.0) > 0.0)
                         except Exception:
                             pass
                         if _has_bonus:
@@ -2059,124 +2083,23 @@ class LLMTransportMixin:
                                 "tool_calls": None,
                             }, False
 
-                        if not msg_str:
-                            msg_str = "Provider is temporarily rate-limiting this model."
-
-                        # Stash the original message so the final-exhaustion branch can use it
-                        _rate_limit_detail = msg_str
-                        _rate_limit_upgrade_url = upgrade_url
-
-                        # Are there more models in the fallback chain to try?
-                        _has_more_models = model_idx < len(models_to_try) - 1
-
-                        if _has_more_models:
-                            # Soft, dim notice — let the next model in the chain take over.
-                            # The user doesn't need to (and shouldn't) see provider jargon.
-                            try:
-                                self.console.print(
-                                    f"\n[dim yellow]↪ {current_model} is busy right now — "
-                                    f"switching to the next available model…[/dim yellow]"
-                                )
-                            except Exception:
-                                pass
-                            # Break the inner retry loop → outer loop will pick the next model
-                            last_exc = exc
-                            break
-                        else:
-                            # Last model in chain also rate-limited — show a CLEAN, friendly
-                            # banner. Mask raw OpenRouter jargon. If the model name looks
-                            # like a free/OpenRouter endpoint, frame it as "all free
-                            # models are momentarily busy" instead of a paid-upgrade CTA.
-                            _is_free_tier_model = (
-                                ":free" in current_model
-                                or "/free" in current_model
-                                or "openrouter" in current_model.lower()
-                            )
-                            _display_msg = _rate_limit_detail
-                            # Strip provider-specific keywords that leak through to users
-                            import re as _re
-                            for _jargon in (
-                                "tokens per minute", "requests per minute",
-                                "free model", "free tier", "provider",
-                            ):
-                                _display_msg = _re.sub(
-                                    _re.escape(_jargon),
-                                    "",
-                                    _display_msg,
-                                    flags=_re.IGNORECASE,
-                                )
-                            # Word-boundary stripping for short tokens (tpm, rpm)
-                            for _jargon in ("tpm", "rpm"):
-                                _display_msg = _re.sub(
-                                    rf"\b{_jargon}\b",
-                                    "",
-                                    _display_msg,
-                                    flags=_re.IGNORECASE,
-                                )
-                            # Collapse leftover whitespace + dangling punctuation
-                            _display_msg = _re.sub(r"\s+", " ", _display_msg).strip(" .,;:—-")
-                            # Drop the generic "returned error:" prefix — it's provider
-                            # boilerplate that adds no value to a human reader.
-                            _display_msg = _re.sub(
-                                r"^(?:returned error|error)\s*[:\-—]?\s*",
-                                "",
-                                _display_msg,
-                                flags=_re.IGNORECASE,
-                            ).strip(" .,;:—-")
-                            # If the sanitized message is too short or doesn't really say
-                            # anything useful, swap in a polished default.
-                            _low = _display_msg.lower()
-                            # Count substantive words (>= 3 chars, alpha) to detect
-                            # sentences that were gutted by jargon stripping.
-                            _substantive = sum(
-                                1 for _w in _re.findall(r"[A-Za-z]{3,}", _display_msg)
-                            )
-                            # Detect a "stranded period" artifact: a period that's now
-                            # surrounded by whitespace because its surrounding words
-                            # were stripped. This is a strong signal that the message
-                            # was gutted by jargon removal and is no longer readable.
-                            _has_stranded_period = bool(_re.search(r"\s\.\s", _display_msg))
-                            _is_uninformative = (
-                                len(_display_msg) < 12
-                                or _substantive < 3
-                                or _has_stranded_period
-                                or _low in ("returned error", "error", "rate limit", "limit")
-                                or _low in ("", ".", "..", "...")
-                            )
-                            if _is_uninformative:
-                                if _is_free_tier_model:
-                                    _display_msg = (
-                                        "All free models are momentarily busy. "
-                                        "This clears automatically within a minute or two."
-                                    )
-                                else:
-                                    _display_msg = "Rate limit reached for this model."
-
+                        rate_limit_display = (
+                            f"⏳ **Model Rate Limited**: `{current_model}` is currently experiencing high demand and is temporarily rate-limited by the provider.\n\n"
+                            f"- **What to do:** Please wait a moment before retrying, or switch to a different model with `/model` or `Ctrl+M`.\n"
+                            f"- **Retry:** You can resend your prompt anytime."
+                        )
+                        if not silent:
                             self.console.print(
-                                f"\n[bold yellow]⏳  {_display_msg}[/bold yellow]"
+                                f"\n[bold yellow]⏳  Model '{current_model}' is temporarily rate-limited by the provider.[/bold yellow]"
                             )
-                            if _is_free_tier_model:
-                                # Free tier → no upgrade CTA, just helpful next steps
-                                self.console.print(
-                                    "  [dim]Free models rotate through a shared capacity pool — "
-                                    "this usually clears in under a minute.[/dim]"
-                                )
-                                self.console.print(
-                                    "  [dim]You can also pick a different model with "
-                                    "[bold]/model[/bold] or press Ctrl+M.[/dim]\n"
-                                )
-                            else:
-                                if not upgrade_url:
-                                    upgrade_url = "https://utim.dev/pricing"
-                                self.console.print(
-                                    f"  [dim]Top up at [bold]{upgrade_url}[/bold] or run "
-                                    f"[bold]/balance[/bold] to check your remaining quota.[/dim]\n"
-                                )
-
-                            raise _FatalClientError(
-                                f"All models in the fallback chain are rate-limited: "
-                                f"{_rate_limit_detail}"
+                            self.console.print(
+                                "  [dim]Please wait a moment before retrying, or switch models using [bold]/model[/bold] (Ctrl+M).[/dim]\n"
                             )
+                        return {
+                            "role": "assistant",
+                            "content": rate_limit_display,
+                            "tool_calls": None,
+                        }, False
                     if attempt < model_retries:
                         delay = 3 * (attempt + 1)
                         # Interruptible wait — so Ctrl+C can abort immediately

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/orchestrator_turn_history.py

@@ -1381,7 +1381,11 @@ class TurnHistoryMixin:
                 with open("package.json", "r", encoding="utf-8") as f:
                     pkg = json.load(f)
                 if "scripts" in pkg and "test" in pkg["scripts"]:
-                    res = subprocess.run(["npm", "test"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=60, shell=True)
+                    from shutil import which as _which_npm
+                    _npm = _which_npm("npm")
+                    if _npm is None:
+                        return "npm not found on PATH"
+                    res = subprocess.run([_npm, "test"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=60)
                     if res.returncode != 0:
                         return _compact_test_err("npm test", res.stdout, res.stderr)
                     return None

{utim_cli-2.3.19b0 → utim_cli-2.3.20}/utim_cli/plugins/hooks.py

@@ -107,11 +107,19 @@ def run_single_hook(
 
         argv = _resolve_interpreter(command, Path.cwd())
         stdin_data = json.dumps(payload)
+        # Clamp per-hook timeout: a misconfigured plugin manifest must not be
+        # able to hold the dispatch thread pool hostage (DoS guard).
+        h_timeout = min(max(float(h_timeout), 0.1), 60.0)
         if argv is None:
-            # Shell mode
-            argv = command
+            # Shell mode — run through an explicit shell argv instead of
+            # shell=True, which is injection-prone and resolves slower. On
+            # Windows, /d also skips AutoRun registry scripts (hijack guard).
+            if os.name == "nt":
+                shell_argv = ["cmd.exe", "/d", "/s", "/c", command]
+            else:
+                shell_argv = ["/bin/sh", "-c", command]
             result = subprocess.run(
-                argv, shell=True, input=stdin_data, capture_output=True,
+                shell_argv, shell=False, input=stdin_data, capture_output=True,
                 text=True, timeout=h_timeout, env=_build_env(plugin_name, event, payload),
             )
         else: