fix: safe CWD fallback, shell read() limit, wire recorder isolation

- Add _safe_cwd() to pythinkersoul: falls back to session.work_dir when
  the process CWD has been deleted mid-session (FileNotFoundError)
- Replace readline() with read(65536) in Shell._read_stream to avoid
  asyncio's 64 KB per-line LimitOverrunError
- Isolate wire recorder _record() exceptions so a persist failure no
  longer silently drops the unprocessed message
- Downgrade LLMNotSet from logger.exception to logger.warning in session,
  print, and shell UIs (no stack trace needed for a config-level error)
- Gitignore .pythinker-review-flow/ (local agent state)
- CHANGELOG entry for session/plan sweeper (session_retention_days)
- Update tests: session_retention_days default, oversized-line shell test,
  FakeStream.read() stub for cancellation test

Author: elkaix

.gitignore

@@ -68,3 +68,5 @@ blackbox/
 
 # pythinker-review
 .pythinker-review/
+# pythinker — local agent state (do not commit)
+.pythinker-review-flow/

CHANGELOG.md

@@ -17,6 +17,7 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 - **`pythinker mcp add` no longer crashes on Windows and Linux native builds.** The PyInstaller specs were using `collect_data_files()` which silently omits the `fastmcp-*.dist-info/` sibling directory; fastmcp calls `importlib.metadata.version("fastmcp")` at import time, so every `mcp add` / `mcp list` invocation raised `PackageNotFoundError`. Switched all three specs (Windows installer, Linux installer, macOS/tarball) to `copy_metadata()` — the PyInstaller-standard hook for bundling dist-info.
 - **Pythinker work directories are automatically gitignored on startup.** When the agent starts inside a git repository, `.pythinker/`, `.pythinker-review/`, and `.pythinker-review-flow/` are silently appended to the project's `.gitignore` if missing, preventing local agent state from making the working tree dirty.
+- **Old sessions and plan files are swept on startup.** Archived session directories under `~/.pythinker/sessions/` and hero-name plan files under `~/.pythinker/plans/` older than `session_retention_days` (default 30) are removed non-interactively at startup. Set `session_retention_days = 0` to disable.
 - **Windows upgrade version display fix.** In-place upgrades no longer show a stale version number or re-trigger the update prompt. Inno Setup now wipes `_internal` before installing new files, preventing old `dist-info` directories from accumulating and causing `importlib.metadata` to report the previous version.
 
 ## 0.31.0 (2026-06-02)

src/pythinker_code/acp/session.py

@@ -215,7 +215,7 @@ async def prompt(self, prompt: list[ACPContentBlock]) -> acp.PromptResponse:
                     case _:
                         pass
         except LLMNotSet as e:
-            logger.exception("LLM not set:")
+            logger.warning("LLM not set — user has no provider configured")
             raise acp.RequestError.auth_required() from e
         except LLMNotSupported as e:
             logger.exception("LLM not supported:")

src/pythinker_code/soul/pythinkersoul.py

@@ -129,6 +129,18 @@ def type_check(soul: PythinkerSoul):
 DEFAULT_MAX_FLOW_MOVES = 1000
 
 
+def _safe_cwd(fallback: str) -> str:
+    """Return the current working directory as a string.
+
+    Falls back to *fallback* if the process CWD has been deleted (e.g. the
+    project directory was removed mid-session by a shell command).
+    """
+    try:
+        return str(Path.cwd())
+    except FileNotFoundError:
+        return str(fallback)
+
+
 def classify_llm_system(chat_provider: object | None) -> str:
     """Classify a chat provider into a stable gen_ai.system telemetry value."""
     try:
@@ -875,7 +887,7 @@ async def run(
                     matcher_value=text_input_for_hook,
                     input_data=events.user_prompt_submit(
                         session_id=self._runtime.session.id,
-                        cwd=str(Path.cwd()),
+                        cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                         prompt=text_input_for_hook,
                     ),
                 )
@@ -917,7 +929,7 @@ async def run(
                     "Stop",
                     input_data=events.stop(
                         session_id=self._runtime.session.id,
-                        cwd=str(Path.cwd()),
+                        cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                         stop_hook_active=False,
                     ),
                 )
@@ -1298,7 +1310,7 @@ async def _agent_loop(self) -> TurnOutcome:
                     matcher_value=type(e).__name__,
                     input_data=_hook_events.stop_failure(
                         session_id=self._runtime.session.id,
-                        cwd=str(Path.cwd()),
+                        cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                         error_type=type(e).__name__,
                         error_message=str(e),
                     ),
@@ -1361,7 +1373,7 @@ async def _append_notification(view: NotificationView) -> None:
                     matcher_value=view.event.type,
                     input_data=events.notification(
                         session_id=self._runtime.session.id,
-                        cwd=str(Path.cwd()),
+                        cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                         sink="llm",
                         notification_type=view.event.type,
                         title=view.event.title,
@@ -1706,7 +1718,7 @@ async def _compact_with_retry() -> CompactionResult:
             matcher_value=trigger_reason,
             input_data=events.pre_compact(
                 session_id=self._runtime.session.id,
-                cwd=str(Path.cwd()),
+                cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                 trigger=trigger_reason,
                 token_count=before_tokens,
                 custom_instructions=custom_instruction,
@@ -1763,7 +1775,7 @@ async def _compact_with_retry() -> CompactionResult:
                 matcher_value=trigger_reason,
                 input_data=events.post_compact(
                     session_id=self._runtime.session.id,
-                    cwd=str(Path.cwd()),
+                    cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                     trigger=trigger_reason,
                     estimated_token_count=estimated_token_count,
                     compact_summary=summary_text,
@@ -1774,7 +1786,7 @@ async def _compact_with_retry() -> CompactionResult:
                 matcher_value="compact",
                 input_data=events.session_start(
                     session_id=self._runtime.session.id,
-                    cwd=str(Path.cwd()),
+                    cwd=_safe_cwd(str(self._runtime.session.work_dir)),
                     source="compact",
                 ),
             )

src/pythinker_code/tools/shell/__init__.py

@@ -281,12 +281,12 @@ async def _run_shell_command(
         timeout: int,
     ) -> int:
         async def _read_stream(stream: AsyncReadable, cb: Callable[[bytes], None]):
-            while True:
-                line = await stream.readline()
-                if line:
-                    cb(line)
-                else:
-                    break
+            # Use read() instead of readline() to avoid asyncio's 64 KB per-line
+            # limit (raises LimitOverrunError / ValueError depending on Python
+            # version). The callbacks only accumulate text, so chunk boundaries
+            # do not matter for correctness.
+            while chunk := await stream.read(65536):
+                cb(chunk)
 
         process = await pythinker_host.exec(
             *self._shell_args(command), env=get_noninteractive_env()

src/pythinker_code/ui/print/__init__.py

@@ -408,7 +408,7 @@ def _handler():
 
                 command = None
         except LLMNotSet as e:
-            logger.exception("LLM not set:")
+            logger.warning("LLM not set — user has no provider configured")
             print(str(e))
             return ExitCode.FAILURE
         except LLMNotSupported as e:

src/pythinker_code/ui/shell/__init__.py

@@ -1275,7 +1275,7 @@ def _on_view_ready(view: Any) -> None:
             return True
         except LLMNotSet:
             _t = _get_tui_tokens()
-            logger.exception("LLM not set:")
+            logger.warning("LLM not set — user has no provider configured")
             console.print(f'[{_t.error}]LLM not set, send "/login" to login[/]')
         except LLMNotSupported as e:
             # actually unsupported input/mode should already be blocked by prompt session

src/pythinker_code/wire/__init__.py

@@ -140,9 +140,12 @@ async def _consume_loop(self, queue: Queue[WireMessage]) -> None:
         while True:
             try:
                 msg = await queue.get()
-                await self._record(msg)
             except QueueShutDown:
                 break
+            try:
+                await self._record(msg)
+            except Exception:
+                logger.exception("Wire recorder failed to persist message:")
 
     async def _record(self, msg: WireMessage) -> None:
         await self._wire_file.append_message(msg)

tests/core/test_config.py

@@ -82,6 +82,7 @@ def test_default_config_dump():
             "merge_all_available_skills": True,
             "extra_skill_dirs": [],
             "telemetry": True,
+            "session_retention_days": 30,
             "skip_auto_prompt_injection": False,
             "tui": {
                 "style": "card",

tests/tools/test_shell_bash.py

@@ -194,6 +194,19 @@ async def test_output_truncation_on_failure(shell_tool: Shell):
     assert "Command failed with exit code:" in result.message
 
 
+async def test_oversized_output_line(shell_tool: Shell):
+    """A single output line exceeding asyncio's 64 KB readline limit must not crash the tool."""
+    # asyncio.StreamReader's default limit is 65536 bytes; emit a 70 KB line.
+    result = await shell_tool(
+        Params(command="python3 -c \"print('X' * 70000)\""),
+    )
+    # The tool must return a result (not raise), and the oversized content must
+    # appear in the output rather than being silently dropped.
+    assert not result.is_error
+    assert isinstance(result.output, str)
+    assert "X" in result.output
+
+
 async def test_timeout_parameter_validation_bounds(shell_tool: Shell):
     """Test timeout parameter validation (bounds checking)."""
     # Test timeout < 1 (should fail validation)
@@ -254,6 +267,11 @@ async def readline(self) -> bytes:
             await asyncio.Event().wait()
             raise AssertionError("unreachable")
 
+        async def read(self, n: int = -1) -> bytes:
+            started.set()
+            await asyncio.Event().wait()
+            raise AssertionError("unreachable")
+
     class FakeStdin:
         def close(self) -> None:
             pass