fix: address CodeRabbit review findings on PR #62

- Sanitize ANSI sequences in paced preview text (_blocks.py) to prevent
  control-sequence leaks when the markdown path is bypassed
- Replace brittle Pygments style snapshot with dynamic pkgutil.iter_modules
  check; snapshot now covers only project-owned hiddenimports entries
- Add blank lines around code fence and subsection headings in
  tasks/yolo-auto-mode-analysis.md to satisfy markdownlint (MD031/MD040/MD022)
- Reconcile contradictory B3/section-4b status in the analysis doc

Author: elkaix

src/pythinker_code/app.py

@@ -67,14 +67,17 @@ def _resumed_unsupervised_notice(*, resumed: bool, yolo: bool, auto: bool) -> st
     """Welcome-banner warning when a resumed session is running unsupervised.
 
     Resuming restores ``yolo``/``auto`` from persisted state, so a session can come back
-    auto-approving everything with no prompt. Surface that prominently at startup (it also
-    fires when the modes were passed explicitly on the resume command — acceptable
-    over-notification). ``None`` when not a resume or no unsupervised mode is active.
+    unattended and, under YOLO, auto-approving actions with no prompt. Surface that
+    prominently at startup (it also fires when the modes were passed explicitly on the
+    resume command — acceptable over-notification). ``None`` when not a resume or no
+    unsupervised mode is active.
     """
     if not resumed or not (yolo or auto):
         return None
     modes = " + ".join(name for name, active in (("YOLO", yolo), ("auto", auto)) if active)
-    return f"{modes} active — actions auto-approved; toggle with /yolo /auto"
+    if yolo:
+        return f"{modes} active — actions auto-approved; toggle with /yolo /auto"
+    return "auto active — interactive approvals still required; toggle with /auto"
 
 
 def _patch_session_id(record: dict[str, Any]) -> None:

src/pythinker_code/soul/agent.py

@@ -281,7 +281,8 @@ async def create(
 
         # Merge invocation flags with persisted session state. ``--no-yolo`` is an explicit
         # force-off that beats the flag, config ``default_yolo``, and persisted state.
-        effective_yolo = (yolo or session.state.approval.yolo) and not no_yolo
+        original_persisted_yolo = session.state.approval.yolo
+        effective_yolo = (yolo or original_persisted_yolo) and not no_yolo
         # Do NOT force safe_mode off under yolo: yolo already bypasses safe mode in the
         # decision path (is_auto_approve / _unattended_denial_feedback short-circuit on
         # yolo before reading safe_mode), so there is no deadlock to avoid — and forcing it
@@ -294,7 +295,10 @@ async def create(
         saved_actions = set(session.state.approval.auto_approve_actions)
 
         def _on_approval_change() -> None:
-            session.state.approval.yolo = approval_state.yolo
+            if not no_yolo:
+                session.state.approval.yolo = approval_state.yolo
+            else:
+                session.state.approval.yolo = original_persisted_yolo
             session.state.approval.auto = approval_state.auto
             session.state.approval.auto_approve_actions = set(approval_state.auto_approve_actions)
             session.state.trust.safe_mode = approval_state.safe_mode

src/pythinker_code/ui/shell/visualize/_blocks.py

@@ -453,7 +453,7 @@ def _compose_composing(self) -> RenderableType:
             # partial syntax (``**bol`` → ``**bold``, half-open ``` fences)
             # flicker char-by-char. Render the uncommitted tail as plain text;
             # completed blocks still commit to full markdown via render_agent_body.
-            body: RenderableType = Text(preview)
+            body: RenderableType = Text(sanitize_ansi(preview))
         else:
             body = Markdown(preview)
         return Group(spinner, BLANK_ROW, self._wrap_preview_bullet(body))

src/pythinker_code/utils/rich/syntax.py

@@ -116,7 +116,9 @@ def get_active_code_theme() -> str:
 class PythinkerSyntax(Syntax):
     def __init__(self, code: str, lexer: str, **kwargs: Any) -> None:
         if "theme" not in kwargs or kwargs["theme"] is None:
-            kwargs["theme"] = PYTHINKER_ANSI_THEME
+            kwargs["theme"] = resolve_code_theme(
+                get_active_code_theme() or PYTHINKER_ANSI_THEME_NAME
+            )
         super().__init__(code, lexer, **kwargs)
 
 

tasks/yolo-auto-mode-analysis.md

@@ -16,7 +16,8 @@
 | **Auto** | `ApprovalState.auto` / `runtime_auto` (`soul/approval.py`; `is_auto()` at `approval.py:244`) | "No user is present at the terminal." | `auto` yes (`session_state.py:17`); `runtime_auto` no (`--print` only) |
 
 Key compound: `is_auto_approve()` (`approval.py:223-234`):
-```
+
+```python
 if yolo:        return True      # YOLO overrides everything below
 if safe_mode:   return False     # untrusted workspace blocks auto (but NOT yolo)
 return is_auto()
@@ -120,14 +121,14 @@ YOLO bypasses the `_EDIT_OUTSIDE_ACTION` guard (`approval.py:258,260`) → write
 
 | Hypothesis | Status | Evidence |
 |---|---|---|
-| B1 | **Confirmed** (new test) | `tests/core/test_runtime_auto_state.py::test_default_config_yolo_auto_has_no_destructive_backstop` — default config + yolo+auto → `deliberation_gate(rm -rf) is None` |
-| B2 | **Confirmed** (new test) | `tests/core/test_approval_auto.py::test_plan_mode_enter_exit_predicate_asymmetry` — yolo-only: `is_auto_approve` True, `is_auto` False |
-| B3 | **Confirmed** (new test) | `tests/core/test_runtime_auto_state.py::test_runtime_create_silently_resumes_both_yolo_and_auto` — both flags restored from disk with `yolo=False` |
+| B1 | **Fixed** (new tests) | `tests/core/test_runtime_auto_state.py::test_default_config_yolo_auto_deliberates_destructive_actions` — default config + yolo+auto now bounces destructive shell calls for deliberation |
+| B2 | **Fixed** (new test) | `tests/core/test_plan_mode_auto_approval.py` — Enter/Exit plan-mode tools now use the same unattended predicate |
+| B3 | **Fixed** (new tests) | `tests/core/test_resume_safety_notice.py`; `tests/core/test_runtime_auto_state.py::test_yolo_runtime_does_not_persist_safe_mode_downgrade`; `test_no_yolo_forces_yolo_off_over_persisted_state` |
 | R2 (one-shot/narrow gate) | **Already covered** | `test_approval_auto.py::test_destructive_action_deliberates_once_then_proceeds_under_auto`, `test_same_generation_duplicate...`, `test_subagent_identical_call...`, `test_unscoped_destructive_calls_always_bounce_fail_closed` |
 | R5 (yolo bypasses safe_mode) | **Already covered** | `test_approval_safe_mode.py::test_yolo_overrides_safe_mode`; `test_runtime_auto_state.py::test_unattended_runtime_in_default_safe_mode_denies_without_waiting` (the no-yolo contrast) |
 | R6 (outside-workspace) | **Already covered** | `test_approval_auto.py::test_trusted_auto_denies_outside_workspace_write_without_yolo` + `test_explicit_yolo_allows_outside_workspace_auto_write_boundary` |
 
-3 new tests added; full `test_approval_auto.py` + `test_runtime_auto_state.py` = 34 passed; `ruff check` + `ruff format --check` clean. No production code changed.
+Production fixes and regression tests were added for B1, B2, and B3. Focused approval/runtime tests pass; `ruff check` + `ruff format --check` are clean.
 
 ## 5. Severity summary
 
@@ -159,27 +160,31 @@ YOLO bypasses the `_EDIT_OUTSIDE_ACTION` guard (`approval.py:258,260`) → write
 
 ## 7. Fixes implemented (2026-06-02)
 
-Decided with the user: **B1 = "all unsupervised" scope**, ship **B1 + B2**, defer **B3/B4**.
+Decided with the user: **B1 = "all unsupervised" scope**; ship **B1 + B2 + B3**. **B4** is resolved as correct-as-designed.
 
 ### B1 — destructive backstop now holds whenever unattended
+
 `soul/approval.py` `deliberation_gate`: the early-return changed from
 `if not self._state.auto_deliberate` to `if not (self._state.auto_deliberate or self.is_auto())`.
 A destructive auto-approved action is now bounced once for deliberation whenever **no user
 is present** (`is_auto`), regardless of the config flag. The `auto_deliberate` flag now only
 *extends* deliberation to the interactive-yolo case (user present, approvals skipped).
+
 - Consistency: `soul/dynamic_injections/auto_mode.py` now always injects the
   destructive-deliberation guidance under auto (the bare `_AUTO_PROMPT` was removed as
   orphaned — it could no longer be selected).
 - Effect: plain `--auto` (trusted) and manual `--yolo --auto` now match the
   `autonomous_coding` profile instead of being more dangerous than it.
 
 ### B2 — plan-mode checkpoint preserved under interactive yolo
+
 `soul/pythinkersoul.py`: `EnterPlanMode` is now bound to `self._approval.is_auto` (was
 `is_auto_approve`), matching `ExitPlanMode`. Interactive `--yolo` no longer silently slips
 into plan mode and then blocks the exit; both transitions self-approve only when truly
 unattended (`is_auto`).
 
 ### B3 — persisted-state footguns (all three implemented)
+
 - **B3a (trust corruption — the real bug):** `agent.py` no longer forces
   `effective_safe_mode = False` under `--yolo`. Yolo already bypasses safe mode in the
   decision path (`is_auto_approve` / `_unattended_denial_feedback` short-circuit on yolo
@@ -194,12 +199,14 @@ unattended (`is_auto`).
   `default_yolo`, and persisted/resumed state. `--no-yolo` beats `--yolo` if both are passed.
 
 ### B4 — resolved as correct-as-designed (no change)
+
 `autonomous_coding` keeps `ask_user_question_policy="never"`. Switching to `ask_except_auto`
 is a **no-op** in every headless context the profile is for (auto/`--print`/`runtime_auto`
 → `is_auto` → both dismiss) and would *contradict* the profile's purpose interactively (an
 "autonomous" session would block for input). `"never"` is the deliberate, correct choice.
 
 ### Tests (all RED→GREEN)
+
 - New: `tests/core/test_plan_mode_auto_approval.py` (B2 binding);
   `tests/core/test_resume_safety_notice.py` (B3b).
 - `test_runtime_auto_state.py`: B1 backstop + B3a (yolo doesn't corrupt persisted

tests/core/test_resume_safety_notice.py

@@ -22,9 +22,13 @@ def test_notice_names_active_modes_on_resume() -> None:
     # with "auto-approved" / "/auto" later in the message.
     yolo_only = _resumed_unsupervised_notice(resumed=True, yolo=True, auto=False)
     assert yolo_only is not None and yolo_only.startswith("YOLO active")
+    assert "actions auto-approved" in yolo_only
 
     auto_only = _resumed_unsupervised_notice(resumed=True, yolo=False, auto=True)
     assert auto_only is not None and auto_only.startswith("auto active")
+    assert "interactive approvals still required" in auto_only
+    assert "actions auto-approved" not in auto_only
 
     both = _resumed_unsupervised_notice(resumed=True, yolo=True, auto=True)
     assert both is not None and both.startswith("YOLO + auto active")
+    assert "actions auto-approved" in both

tests/core/test_runtime_auto_state.py

@@ -223,6 +223,9 @@ async def test_no_yolo_forces_yolo_off_over_persisted_state(
 
     assert runtime.approval.is_yolo() is False
 
+    runtime.approval.set_auto(True)
+    assert session.state.approval.yolo is True
+
 
 @pytest.mark.asyncio
 async def test_default_config_yolo_auto_deliberates_destructive_actions(

tests/ui_and_conv/test_code_theme_opt_in.py

@@ -18,6 +18,7 @@
 from pythinker_code.utils.rich.syntax import (
     PYTHINKER_ANSI_THEME,
     PYTHINKER_ANSI_THEME_NAME,
+    PythinkerSyntax,
     get_active_code_theme,
     resolve_code_theme,
     set_active_code_theme,
@@ -68,6 +69,15 @@ def test_active_code_theme_round_trips() -> None:
     assert get_active_code_theme() == "dracula"
 
 
+def test_pythinker_syntax_uses_active_code_theme() -> None:
+    set_active_code_theme("monokai")
+    console = Console(force_terminal=True, color_system="truecolor", width=60)
+    with console.capture() as capture:
+        console.print(PythinkerSyntax("import os", "python"))
+
+    assert _MONOKAI_BG in capture.get()
+
+
 def test_resolve_code_theme_maps_only_the_sentinel() -> None:
     # Sentinel resolves to the ANSI SyntaxTheme instance; stock names stay strings
     # (this string-vs-instance distinction is what the renderer branches on).

tests/ui_and_conv/test_shell_prompt_echo.py

@@ -195,17 +195,17 @@ def test_user_echo_wraps_message_in_tinted_block() -> None:
 
     from pythinker_code.ui.theme import tui_rich_style
 
-    bg = tui_rich_style("user_message_bg").bgcolor
-    assert bg is not None and bg.triplet is not None
-    red, green, blue = bg.triplet
-    expected = f"48;2;{red};{green};{blue}"
+    expected = tui_rich_style("user_message_bg").bgcolor
+    assert expected is not None
 
     console = Console(force_terminal=True, color_system="truecolor", width=40)
-    with console.capture() as capture:
-        console.print(render_user_echo_text("apply"))
+    lines = console.render_lines(render_user_echo_text("apply"), console.options)
 
-    # The submitted message is painted on the shared user_message_bg block.
-    assert expected in capture.get()
+    # The submitted message itself, not just surrounding padding, is painted on
+    # the shared user_message_bg block.
+    apply_segment = next(segment for line in lines for segment in line if "apply" in segment.text)
+    assert apply_segment.style is not None
+    assert apply_segment.style.bgcolor == expected
 
 
 def test_should_echo_agent_input_for_plain_agent_message() -> None:

tests/utils/test_pyinstaller_utils.py

@@ -240,58 +240,23 @@ def test_pyinstaller_datas():
 
 
 def test_pyinstaller_hiddenimports():
+    import pkgutil
+
+    import pygments.styles
+
     from pythinker_code.utils.pyinstaller import hiddenimports
 
-    assert sorted(hiddenimports) == snapshot(
+    # Pygments style list is owned by the Pygments package and changes with upgrades;
+    # enumerate actual sub-modules (matching collect_submodules) rather than the style
+    # registry names (get_all_styles uses hyphens, modules use underscores).
+    expected_pygments = {"pygments.styles"} | {
+        f"pygments.styles.{mod.name}" for mod in pkgutil.iter_modules(pygments.styles.__path__)
+    }
+    assert expected_pygments <= set(hiddenimports)
+
+    project_entries = sorted(set(hiddenimports) - expected_pygments)
+    assert project_entries == snapshot(
         [
-            "pygments.styles",
-            "pygments.styles._mapping",
-            "pygments.styles.abap",
-            "pygments.styles.algol",
-            "pygments.styles.algol_nu",
-            "pygments.styles.arduino",
-            "pygments.styles.autumn",
-            "pygments.styles.borland",
-            "pygments.styles.bw",
-            "pygments.styles.coffee",
-            "pygments.styles.colorful",
-            "pygments.styles.default",
-            "pygments.styles.dracula",
-            "pygments.styles.emacs",
-            "pygments.styles.friendly",
-            "pygments.styles.friendly_grayscale",
-            "pygments.styles.fruity",
-            "pygments.styles.gh_dark",
-            "pygments.styles.gruvbox",
-            "pygments.styles.igor",
-            "pygments.styles.inkpot",
-            "pygments.styles.lightbulb",
-            "pygments.styles.lilypond",
-            "pygments.styles.lovelace",
-            "pygments.styles.manni",
-            "pygments.styles.material",
-            "pygments.styles.monokai",
-            "pygments.styles.murphy",
-            "pygments.styles.native",
-            "pygments.styles.nord",
-            "pygments.styles.onedark",
-            "pygments.styles.paraiso_dark",
-            "pygments.styles.paraiso_light",
-            "pygments.styles.pastie",
-            "pygments.styles.perldoc",
-            "pygments.styles.rainbow_dash",
-            "pygments.styles.rrt",
-            "pygments.styles.sas",
-            "pygments.styles.solarized",
-            "pygments.styles.staroffice",
-            "pygments.styles.stata_dark",
-            "pygments.styles.stata_light",
-            "pygments.styles.tango",
-            "pygments.styles.trac",
-            "pygments.styles.vim",
-            "pygments.styles.vs",
-            "pygments.styles.xcode",
-            "pygments.styles.zenburn",
             "pythinker_code.cli._lazy_group",
             "pythinker_code.cli.debug",
             "pythinker_code.cli.export",