[elkaix]

Requirement or Bug

Bring in the next batch of engine, server, and TUI fixes and features, plus TypeScript 7.

Bug Reproduction Steps

N/A

Root Cause

N/A

Code Changes

Engine (packages/agent-core-v2):

• idle session reclaim on the server; session-lock takeover for locks left by exited processes; zombie-lock reclaim
• Plan mode: only the user leaves Plan mode, and every plan goes to review
• MCP: auto-reconnect after transient failures, wait for discovery before tool announcements, idle OAuth callback cleanup
• LLM core moved into human/llm (protocols, requester composition, media); our native fixes moved with it: DSML/Hermes text tool-call recovery now lives in the OpenAI decoder, and OpenAI 401/402/403 billing rejections still map to a provider error
• media recovery kept across turns and compaction; images can upload through the provider Files API
• subagents limited to the [secondary_model] pool; force removed (a lone default_model pins)
• workspace registry with several source folders; append-log recovery after disk-full; code-point-safe tool-result truncation
• turn-start model fallback (resolveModelContext(turnId)) and the OpenCode x-opencode-session header kept

Server (packages/agent-gateway):

• subscribe_v2 replaces subscribe/unsubscribe; approvals and questions arrive as interaction frames; snapshot route and roster tracker removed
• WebSocket limits re-applied on the new path: 4 MiB payload, 64 subscriptions, 32 queued controls, outbound overflow and slow-consumer disconnects; a subscription that completes after the socket closed is released
• PTY terminal routes removed; config-domain allowlist and reload quiescence kept

CLI (apps/pythinker-code):

• import Claude Code and Codex sessions (/import-sessions, new packages/session-import), /provider refresh, expandable streaming thinking, todo list as a transcript card, compacting spinner, OSC 7501 program status
• login prompts now settle when another panel replaces them (a pending /login could hang)
• Dynamic Workflow naming fixed in prompts and command help

Tooling: TypeScript 7.0.2 and tsdown 0.23.1 across the workspace; apps/pythinker-web stays on TypeScript 6.0.3 because vue-tsc needs the compiler API that TypeScript 7 removed. flake.nix pnpmDeps hash refreshed.

Behavior Changes and Affected Users

Behavior	Before	After	Who relies on the old behavior	Escape hatch
WebSocket session subscription	subscribe / unsubscribe frames, /sessions/{id}/snapshot	subscribe_v2 / unsubscribe_v2 only; snapshot route removed	External pythinker web clients built on the old frames	None (major, approved); in-repo web, desktop, VS Code clients updated
PTY terminals	/api/v1/sessions/{id}/terminals on loopback	Removed	Scripts using the terminal API	None (major, approved)
Plan mode exit	Agent could leave Plan mode itself	Only the user leaves; every plan is reviewed	Unattended runs that relied on self-exit	None; approve the plan in review
[secondary_model] force	Pinned subagents	Ignored with a warning; a lone default_model pins	Configs with force = true	Remove force; behavior is the same
Idle pythinker web sessions	Stayed in memory	Unloaded after 30 minutes idle, resumed on access	Long-idle web sessions	PYTHINKER_CODE_SESSION_IDLE_RECLAIM_MS
Session lock held by an exited process	Blocked the session	Offers a takeover	Nobody	n/a
Workspace local.toml additional dirs	Loaded only for trusted workspaces	Loaded regardless of trust (matches the engine's current trust model)	Untrusted workspaces with a committed local.toml	Do not commit additional_dir in untrusted repos
OpenAI-compatible providers that write tool calls as text	Recovered	Still recovered (moved into the new decoder)	DeepSeek/Hermes-style endpoints	n/a

Affected modules and coverage: full suite 19,117 passed, 0 failed (1,035 files); targeted suites for the WebSocket limits, DSML recovery (147), billing errors, subagent policy (108), and survey/session rating.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: issue must have a maintainer's /approve).
• I have added tests that prove my feature works.
• The behavior-change table above is complete, and every removed behavior or flipped default is named in the changeset and either has an escape hatch or was explicitly approved by a maintainer in this PR.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[coderabbitai]

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.