fix: reconcile engine, TUI, Tower and Remote Control fixes

.agents/skills/gen-changesets/SKILL.md

@@ -5,7 +5,7 @@ description: Use when generating changesets in the pythinker-code repository —
 
 # Generate Changesets
 
-The only user-facing published package is the CLI: `@pymodel/pythinker-code`. All other `@pymodel/*` packages (sdk, agent-core, kosong, pyaos, oauth, telemetry, and so on) are internal.
+The only user-facing published package is the CLI: `@pymodel/pythinker-code`. All other `@pymodel/*` packages (sdk, agent-core, kosong, oauth, telemetry, and so on) are internal.
 
 ## 1. Whether to Write
 

.changeset/calm-progress-nudges.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Stop discouraging short progress notes between tool calls, and count NotifyUser reminders per round of tool calls.

.changeset/cancel-video-uploads.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Cancel in-flight video uploads when a media read is interrupted.

.changeset/command-lookup-workspace.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Skip executables inside the workspace during command lookup instead of failing, including when the working directory is the filesystem root.

.changeset/footer-git-refresh.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Stop the footer from waiting on git status; it now refreshes when the repository changes.

.changeset/fork-subagent-cache-prefix.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep forked subagent requests on the same prefix as the parent so they reuse the prompt cache.

.changeset/gemini-thinking-level.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Use thinking levels for Gemini 4 models, and send the lowest level when thinking is off.

.changeset/hooks-session-cwd.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Run agent hooks in the session's working directory in the web and desktop apps.

.changeset/inline-skill-prompts.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show skills invoked in a prompt as highlighted tokens in the message, and let Ctrl+S steer a skill prompt into a running turn.

.changeset/llm-headers-timeout.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Add PYTHINKER_CODE_LLM_HEADERS_TIMEOUT_MS to set how long a request waits for LLM response headers, for slow non-streaming thinking.

.changeset/mcp-default-deferred.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Add `default_deferred` under `[mcp]` in config.toml to load the tools of every MCP server on demand; it requires the experimental tool-select feature.

.changeset/media-tools-after-resume.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Restore the image and video reading tools after resuming a session.

.changeset/model-migration.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+When a provider registry retires your default model, switch to the replacement it declares and show its migration notes.

.changeset/notify-user-title.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Give NotifyUser updates an optional one-line title in the Updates panel. Enable NotifyUser with PYTHINKER_CODE_EXPERIMENTAL_NOTIFY_USER=1.

.changeset/plugin-skill-qualified-names.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Register plugin skills as `<plugin-id>:<skill-name>`; a bare skill name no longer runs a plugin skill and there is no setting to restore that, so use `/skill:<plugin-id>:<skill-name>`. Plugin names can now contain uppercase letters, dots, and an `@` suffix.

.changeset/registry-reimport-default.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep the default model and provider when re-importing a provider registry.

.changeset/relay-offline-exit.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Exit `pythinker web` when the Remote Control relay takes the device offline.

.changeset/remote-control-large-transfers.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Remote Control now sends HTTP responses larger than 10 MiB in 5 MiB chunks, up to about 100 MiB, and cancels a transfer when the relay aborts it.

.changeset/remove-mcp-pyaos-executor.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Remove the never-implemented `executor = "pyaos"` option (and its old `"kaos"` alias) from MCP stdio server configuration; configs that use it now fail validation at load time.

.changeset/select-tools-errors.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Explain why select_tools cannot load a tool, and report tools that are not available in the current session separately.

.changeset/shutdown-progress.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show shutdown progress while shutdown hooks run, and exit at once when you press Ctrl+C again.

.changeset/subagent-tool-descriptions.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Describe only the tools a subagent can actually use.

.changeset/task-notification-answer.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep the previous answer visible when a background task notification turn ends, and show cancelled background agents as stopped.

.changeset/todo-list-nudge.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Remind the agent to update its todo list when items stay open for several steps.

.changeset/tower-deterministic-missions.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Tower now merges and reviews missions through deterministic git checks, adds the TowerComplete and TowerRebase tools, and blocks destructive shell commands in the main checkout. Enable Tower with PYTHINKER_CODE_EXPERIMENTAL_TOWER=1.

.changeset/vscode-question-back.md

@@ -0,0 +1,5 @@
+---
+"pythinker": patch
+---
+
+Add Back navigation to multi-question prompts and keep earlier answers while moving between questions.

.changeset/working-spinner-label.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show Working… instead of Thinking… in the status spinner while the model thinks.

AGENTS.md

@@ -56,7 +56,6 @@ Adding an OpenAI-compatible provider requires **zero code changes** — just add
 | `packages/agent-core-v2` | DI × Scope agent engine (the v2 port behind agent-gateway) | Three `LifecycleScope` tiers — `App` / `Session` / `Agent` (`app/scopes.ts`). Workspace resources use App-owned `WorkspaceInstance` / `Program` lifetimes, not a DI scope. Also includes the L3 unit layer (`Service`/`Fiber` units, collection contribution points, the Feature seam in `src/features/`). See its `AGENTS.md` and use the `agent-core-dev` skill. |
 | `packages/node-sdk` | Public TS SDK & harness | |
 | `packages/kosong` | LLM provider abstraction | Wire types, catalog, capability registry. |
-| `packages/pyaos` | Execution environment | File/process abstractions. |
 | `packages/agent-gateway` | Pythinker Code server | Fastify server backed by `@pymodel/agent-core-v2`; sessions over REST + WebSocket (`/api/v1` + `/api/v1/ws`), plus `/api/v1/debug/*` reflection RPC (`--debug-endpoints`, loopback bind + bearer auth). See its `AGENTS.md`. |
 | `packages/klient` | Client SDK | Contract-driven facade over agent-core-v2 (`global.*` / `session(id).*` / `agent(id).*`, zod-validated); transport via subpath entry (`@pymodel/klient/ipc|memory`); hosts the e2e suites. See its `AGENTS.md`. |
 | `packages/transcript` | Isomorphic transcript rendering data layer | L1 agent-granular store, L2 idempotent operations, L3 `off/turn/block/delta` subscription granularity, L4 framework-free view registry, turn-cursor pagination. Pure TypeScript (browser-safe, no engine imports); sole owner of the transcript contract types (`src/contract/`). See its `AGENTS.md`. |

CONTRIBUTING.md

@@ -28,7 +28,7 @@ This is a pnpm monorepo. The most relevant entry points are:
 - `apps/vis` — session debug visualizer
 - `packages/node-sdk` — public TypeScript SDK (`@pymodel/pythinker-code-sdk`)
 - `packages/agent-core-v2` — the agent engine (v2, DI Scope architecture); `packages/agent-core` is v1 and being phased out
-- `packages/klient`, `agent-gateway`, `protocol`, `transcript`, `kosong`, `pyaos`, `oauth`, `telemetry` — internal engine packages
+- `packages/klient`, `agent-gateway`, `protocol`, `transcript`, `kosong`, `oauth`, `telemetry` — internal engine packages
 - `docs/` — VitePress bilingual docs site
 
 For the full project map, see [AGENTS.md](AGENTS.md).

README.md

@@ -164,7 +164,6 @@ Pythinker Code is a pnpm monorepo. The desktop app and the CLI both talk to the
 | `apps/pythinker-web` | Browser interface that the desktop app renders |
 | `packages/agent-core` | Agent engine: sessions, tools, skills, permissions, plans |
 | `packages/kosong` | LLM and provider abstraction |
-| `packages/pyaos` | Execution environment, file and process abstractions |
 | `packages/server` | REST and WebSocket session host (`/api/v1`) |
 | `packages/node-sdk` | Public TypeScript SDK |
 

apps/pythinker-code/dist-web/.web-bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "sourceHash": "b03226b74b69912ccace38e0a803ee98077478208348852dc4857429e06abc33",
+  "sourceHash": "85ca51758dad0358848603e07154c341133ae7d7f92aca71ecc47039255b4072",
   "sourceFileCount": 497
 }

apps/pythinker-code/package.json

@@ -116,6 +116,7 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
+    "chokidar": "^4.0.3",
     "qrcode": "^1.5.4",
     "ws": "^8.21.3"
   }

apps/pythinker-code/src/cli/sub/provider.ts

@@ -6,10 +6,10 @@
  * a provider, or inspect what is configured without launching the TUI.
  *
  * `add` writes the same `source = { kind: 'apiJson', url, apiKey }` blob the
- * TUI does; the next launch's `refreshAllProviderModels`
- * (apps/pythinker-code/src/tui/utils/refresh-providers.ts) groups by URL, retries
- * available API-key candidates, and re-fetches the model list, so periodic
- * refresh is automatic.
+ * TUI does; the next launch's provider-model refresh
+ * (`PythinkerHarness.refreshProviderModels`, backed by the engine's discovery
+ * service) groups by URL, retries available API-key candidates, and
+ * re-fetches the model list, so periodic refresh is automatic.
  */
 
 import {

apps/pythinker-code/src/cli/sub/web/remote-control.ts

@@ -27,6 +27,7 @@ export {
 } from '@pymodel/remote-control';
 export type {
   ParsedRawHttpRequest,
+  RemoteControlCloseReason,
   RemoteControlHandle,
   RemoteControlLock,
   RemoteControlLockInfo,
@@ -88,6 +89,8 @@ export function formatRemoteControlStatus(status: RemoteControlStatus): string {
       return `  ${value('✓')} ${label('Connected to relay, waiting for remote devices…')}\n`;
     case 'relay_disconnected':
       return `  ${value('!')} ${label('Relay disconnected; reconnecting…')}\n`;
+    case 'relay_terminated':
+      return `  ${value('✕')} ${label('Taken offline from the web; exiting…')}\n`;
     case 'device_connected':
       return `  ${value('✓')} ${label('Remote device connected (1 active session)')}\n`;
     case 'device_disconnected':

apps/pythinker-code/src/cli/sub/web/run.ts

@@ -81,9 +81,14 @@ export interface WebCliOptions extends ServerCliOptions {
   remoteControl?: boolean;
 }
 
+export interface ForegroundControls {
+  /** Ask the foreground runner to shut the server down and exit (like SIGINT). */
+  requestShutdown(reason: string): void;
+}
+
 export interface StartForegroundHooks {
   /** Fires once the server is listening, before the foreground runner blocks. */
-  onReady?: (origin: string) => void | Promise<void>;
+  onReady?: (origin: string, controls?: ForegroundControls) => void | Promise<void>;
   onShutdown?: (reason: string) => void | Promise<void>;
 }
 
@@ -207,7 +212,7 @@ export async function handleWebCommand(
   const run = deps.startServerForeground ?? startServerForeground;
   let remoteControl: RemoteControlHandle | undefined;
   await run(parsed, {
-    onReady: async (origin) => {
+    onReady: async (origin, controls) => {
       // Resolve the persistent token only once the server is up: a fresh
       // server writes `server.token` on first boot, so reading it beforehand
       // would miss first-time starts and the browser would hit the auth gate.
@@ -238,6 +243,19 @@ export async function handleWebCommand(
           stderr: deps.stderr,
           onStatus,
         });
+        void remoteControl.closed.then(
+          (reason) => {
+            if (reason === 'user_requested') {
+              controls?.requestShutdown('remote_control_user_requested');
+            }
+          },
+          (error) => {
+            deps.stderr.write(
+              `Remote Control lock release failed: ${error instanceof Error ? error.message : String(error)}\n`,
+            );
+            controls?.requestShutdown('remote_control_closed');
+          },
+        );
         const qrCode = await generateRemoteControlQr(remoteControl.url, dataDir);
         deps.stdout.write(
           formatRemoteControlOutput({
@@ -410,7 +428,9 @@ async function runServerInProcess(
   running.logger.info({ address: running.address }, 'server ready');
 
   try {
-    await hooks.onReady?.(running.address);
+    await hooks.onReady?.(running.address, {
+      requestShutdown: (reason) => void shutdown(reason),
+    });
   } catch (error) {
     try {
       await hooks.onShutdown?.('startup_failed');

apps/pythinker-code/src/constant/app.ts

@@ -69,6 +69,7 @@ export const PYTHINKER_CODE_BANNER_DIR_NAME = 'banner';
 export const PYTHINKER_CODE_BANNER_STATE_FILE_NAME = 'state.json';
 export const PYTHINKER_CODE_SURVEY_STATE_FILE_NAME = 'feedback-survey-state.json';
 export const PYTHINKER_CODE_RECOMMENDED_EFFORT_STATE_FILE_NAME = 'recommended-effort-state.json';
+export const PYTHINKER_CODE_MODEL_MIGRATION_STATE_FILE_NAME = 'model-migrations.json';
 
 // Managed Pythinker auth provider key shared with OAuth/SDK config.
 export const DEFAULT_OAUTH_PROVIDER_NAME = 'openai';