utim-cli 2.5.0__tar.gz → 2.5.1__tar.gz

{utim_cli-2.5.0 → utim_cli-2.5.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.5.1] - 2026-10-18
+
+### 🐛 Fixes
+- **Compression Empty-Response Spam**: `_call_compression_model_with_fallback` now always sets `last_error` on empty/stripped content and logs `model=… routing=… empty_hits=…` diagnostics — eliminates the endless `[COMPRESSION FALLBACK FAILURE] Last error: None` loop and surfaces the real reason (429 / empty content / bad shape).
+- **Admin Portal CORS**: `router.py` now always allows `Origin: null` (downloaded `file://` HTML) and `allow_headers=["*"]` + `max_age=600` so `X-UTIM-Master-Key` / `Authorization` preflights for `/api/admin/*` and `/models` no longer fail with `No 'Access-Control-Allow-Origin'`.
+- **Admin Firewall Bypass**: `firewall.py: _FIREWALL_SKIP_PREFIXES` and `cli_auth.py: PUBLIC_PREFIXES` now include `/admin`, `/admin.html`, `/admin_models.html`, `/static` so the browser-served admin panel bypasses proxy-abuse / burst throttling and CLI HMAC `401` (API auth via master-key session is still enforced).
+
 ## [2.5.0] - 2026-10-18
 
 ### ✨ Credit System → Unlimited UX + Internal Throttling

{utim_cli-2.5.0/utim_cli.egg-info → utim_cli-2.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: utim-cli
-Version: 2.5.0
+Version: 2.5.1
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: Emend AI Proprietary EULA
 Project-URL: Homepage, https://utim.dev

{utim_cli-2.5.0 → utim_cli-2.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "utim-cli"
-version = "2.5.0"
+version = "2.5.1"
 
 description = "UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal."
 readme = "README.md"

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim/__init__.py

@@ -14,7 +14,7 @@ Quickstart:
 try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
-    __version__ = "2.5.0"
+    __version__ = "2.5.1"
 
 # Developer-friendly core classes (similar to `import genai` / `import openai`)
 from utim_cli.sdk.session import UtimSession as Session

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/__init__.py

@@ -5,7 +5,7 @@ try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
     # Fallback during first-install / editable-install edge cases
-    __version__ = "2.5.0"
+    __version__ = "2.5.1"
 
 
 import builtins, os, pathlib, urllib.parse, re

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/_version.py

@@ -11,6 +11,6 @@
 # from here so every surface stays in sync automatically.
 # ─────────────────────────────────────────────────────────────────────────────
 
-VERSION = "2.5.0"
+VERSION = "2.5.1"
 
 

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/context_pruner.py

@@ -2229,6 +2229,7 @@ def _call_compression_model_with_fallback(messages: List[Dict], llm_key: str, ma
     _routing = _resolve_compression_routing(primary_model)
 
     last_error = None
+    empty_hits = 0
     for i, model in enumerate(models_to_try):
         model_retries = 1 if model == primary_model else 2
         for attempt in range(model_retries + 1):
@@ -2251,56 +2252,84 @@ def _call_compression_model_with_fallback(messages: List[Dict], llm_key: str, ma
                     is_reflection=False
                 )
                 if resp.status_code == 429:
-                    # On 429 rate limit, immediately try fallback without blocking
+                    last_error = f"Model {model} rate limited (429)"
                     break
                 resp.raise_for_status()
-                
+
                 if resp.status_code == 200:
-                    result = resp.json()["choices"][0]["message"]["content"]
-                    if not result or not result.strip():
+                    try:
+                        body = resp.json()
+                    except Exception as je:
+                        last_error = f"Model {model} returned non-JSON 200: {je}"
+                        break
+                    try:
+                        result = body["choices"][0]["message"]["content"]
+                    except Exception as ke:
+                        last_error = f"Model {model} bad 200 shape {list(body.keys()) if isinstance(body, dict) else type(body).__name__}: {ke} body={str(body)[:600]}"
+                        break
+                    if not result or not str(result).strip():
+                        empty_hits += 1
+                        last_error = f"Model {model} returned empty content (hit {empty_hits}/2)"
+                        if empty_hits >= 2:
+                            break
                         continue
                     # Strip thinking tags
-                    result = re.sub(r"<think(?:ing)?>.*?</think(?:ing)?>", "", result, flags=re.DOTALL)
+                    result = re.sub(r"<think(?:ing)?>.*?</think(?:ing)?>", "", str(result), flags=re.DOTALL)
                     result = result.strip()
                     if not result:
+                        empty_hits += 1
+                        last_error = f"Model {model} content empty after stripping thinking tags (hit {empty_hits}/2)"
+                        if empty_hits >= 2:
+                            break
                         continue
-                    
+
                     # FIX #1: Hallucination detection - reject summaries with suspicious patterns
+                    hallucinated = False
                     hallucination_patterns = [
                         r"\[.*added.*\]",  # Made-up additions like "[feature added]"
                         r"\[.*created.*\]",  # Made-up creations
                         r"I have (?:created|modified|deleted|implemented)",  # False claims of action
                         r"Successfully (?:added|removed|integrated)",  # False success claims
                     ]
-                    
-                    # Check if summary makes claims not in source
                     for pattern in hallucination_patterns:
                         if re.search(pattern, result, re.I) and content_hint:
-                            # Check if the claim is actually in the original content
                             if not re.search(pattern.replace(r"\[", r"[^[]*").replace(r"\]", r"[^]]*"), content_hint, re.I):
                                 print(f"[HALLUCINATION PREVENTED] Pattern '{pattern}' detected in summary but not in source", file=__import__('sys'))
-                                # Try next model instead of returning bad summary
-                                continue
-                    
+                                last_error = f"Model {model} hallucination rejected pattern={pattern}"
+                                hallucinated = True
+                                break
+                    if hallucinated:
+                        continue
+
                     return result
-                
-                last_error = f"Model {model} returned status {resp.status_code}"
+
+                last_error = f"Model {model} returned status {resp.status_code}: {str(getattr(resp, 'content_str', '') or '')[:600]}"
                 break # Not 200 and not 429, break attempt loop and try next model
 
             except requests.exceptions.HTTPError as e:
                 code = e.response.status_code if e.response is not None else 0
+                body_snip = ""
+                try:
+                    body_snip = (e.response.text[:600] if getattr(e, "response", None) is not None and hasattr(e.response, "text") else str(e)[:600])
+                except Exception:
+                    body_snip = str(e)[:600]
+                last_error = f"HTTPError {code} model={model}: {body_snip}"
                 if code == 429 and attempt < model_retries:
                     import time
                     time.sleep(5 * (attempt + 1))
                     continue
-                last_error = e
                 break
             except Exception as e:
-                last_error = e
+                last_error = f"{type(e).__name__} model={model}: {e}"
                 break
-    
-    # Log the failure for debugging
+
+    # Log the failure for debugging — include model/routing so "Last error: None" never happens
     import sys
+    diag = f"model={primary_model} routing={_routing} empty_hits={empty_hits}"
+    if last_error is None:
+        last_error = f"No attempt produced a result ({diag})"
+    else:
+        last_error = f"{last_error} ({diag})"
     print(f"[COMPRESSION FALLBACK FAILURE] All models failed. Last error: {last_error}", file=sys.stderr)
     return None
 

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/server/cli_auth.py

@@ -91,6 +91,13 @@ PUBLIC_PREFIXES = (
     "/auth/firebase-login",
     "/auth/register",
     "/auth/reset",
+    # Admin HTML portal — browser-served, authenticated via admin_auth (master key
+    # / session cookie), never via CLI HMAC. Must stay public for signature
+    # purposes or browsers get 401 when UTIM_REQUIRE_CLI_SIGNATURE=1.
+    "/admin",
+    "/admin.html",
+    "/admin_models.html",
+    "/static",
 )
 
 
@@ -363,8 +370,18 @@ async def cli_signature_middleware(request, call_next):
     if is_public_path(path) or request.method == "OPTIONS":
         return await call_next(request)
 
-    # Bypass CLI signature requirement for Admin Agent endpoints and Master Key authenticated calls
-    if request.headers.get("x-utim-master-key") or request.headers.get("X-UTIM-Master-Key") or path.startswith("/api/admin/"):
+    # Bypass CLI signature requirement for Admin Agent endpoints, Master Key
+    # authenticated calls, and any /admin / static HTML (admin portal in browser).
+    if (
+        request.headers.get("x-utim-master-key")
+        or request.headers.get("X-UTIM-Master-Key")
+        or path.startswith("/api/admin/")
+        or path == "/admin"
+        or path == "/admin.html"
+        or path == "/admin_models.html"
+        or path.startswith("/admin/")
+        or path.startswith("/static/")
+    ):
         return await call_next(request)
 
     sig = request.headers.get("x-utim-cli-signature")

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/server/firewall.py

@@ -370,6 +370,10 @@ _FIREWALL_SKIP_PREFIXES = (
     "/openapi.json",
     "/models",
     "/api/releases",
+    "/admin",
+    "/admin.html",
+    "/admin_models.html",
+    "/static",
 )
 
 # Expensive paths that MUST NOT be reachable via open proxies

{utim_cli-2.5.0 → utim_cli-2.5.1}/utim_cli/server/router.py

@@ -408,18 +408,30 @@ else:
             "http://127.0.0.1:8080",
         ]
 
-# Deduplicate while preserving order
+# Deduplicate while preserving order, then always allow `null` (file://) so
+# downloading admin_models.html and double-clicking it doesn't brick CORS.
+# ALLOWED_ORIGINS env override must not accidentally drop it.
 _seen = set()
 allowed_origins = [o for o in allowed_origins if not (o in _seen or _seen.add(o))]
-
+if "null" not in allowed_origins:
+    allowed_origins.append("null")
+
+# Admin portal (admin_models.html) sends X-UTIM-Master-Key / X-Admin-Key /
+# Authorization which MUST be in allow_headers or every preflight fails with
+# "No 'Access-Control-Allow-Origin'" — that's what your screenshot shows.
+# Starlette's CORSMiddleware with allow_headers=["*"] + allow_credentials=True
+# echoes Access-Control-Request-Headers correctly on modern browsers, but we
+# also keep an explicit fallback list for older engines. Using ["*"] covers
+# any future X-UTIM-* headers without another CORS breakage.
 app.add_middleware(
     CORSMiddleware,
     allow_origins=allowed_origins,
     allow_origin_regex=r"^https://([a-zA-Z0-9_\-]+\.)*(utim\.dev)(:\d+)?$",
     allow_credentials=True,
     allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-    allow_headers=["Authorization", "Content-Type", "X-Requested-With", "X-CSRF-Token", "Accept"],
-    expose_headers=["Content-Length", "Content-Type"],
+    allow_headers=["*"],
+    expose_headers=["Content-Length", "Content-Type", "X-Total-Count"],
+    max_age=600,
 )
 
 app.include_router(auth_router)

{utim_cli-2.5.0 → utim_cli-2.5.1/utim_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: utim-cli
-Version: 2.5.0
+Version: 2.5.1
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: Emend AI Proprietary EULA
 Project-URL: Homepage, https://utim.dev