fix(tests): resolve CI failures from harness pattern extraction feature

- Add planner to test snapshots in test_agent_spec.py, test_default_agent.py,
  and test_pyinstaller_utils.py
- Update coder ROLE_ADDITIONAL snapshot to include artifact contract block
- Fix _bypass_ssrf_validation fixture scope (non-autouse, explicit parameter)
- Make FetchURL injection test unconditional (assert not is_error)
- Remove redundant _prefix variable in test_trust._body()
- Mark edge_cases_claimed as optional in coder.yaml artifact contract
- Clarify planner.yaml final response contract (seeds-only, no preamble)
- Add Unreleased CHANGELOG entry for the feature and sync docs copy

Author: elkaix

CHANGELOG.md

@@ -15,6 +15,11 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+- **Prompt-injection defense: `UntrustedData` wrapper.** All external content returned by `ReadFile` and `FetchURL` is now wrapped in `<untrusted_data id="NONCE">…</untrusted_data>` tags before being passed to the LLM, providing a clear boundary between trusted instructions and untrusted file/web content. The `UntrustedData` primitive escapes embedded closing tags to prevent breakout attacks.
+- **Agent boundary artifacts.** New `CodingArtifact` / `VerificationResult` and `VulnerabilityArtifact` / `AuditVerdict` frozen dataclasses in `pythinker_code.utils.artifacts` enforce a typed information barrier between coder and verifier subagents.
+- **Recon-first `planner` subagent.** A new read-only `planner` built-in agent type decomposes open-ended tasks into distinct parallel seed descriptions emitted as `<recon_seeds>` JSON, enabling structured fan-out before parallel workers start.
+- **Coder artifact contract.** The `coder` subagent now emits a `<coding_artifact>` JSON block at the end of every response, providing structured handoff data (`files_changed`, `test_command`, `expected_behavior`, optional `edge_cases_claimed`) that the `verifier` subagent can consume directly.
+
 ## 0.36.0 (2026-06-05)
 
 - **Alibaba DashScope multi-region fallback.** Logging in with a China-region key (`dashscope.aliyuncs.com`) against the default US Virginia endpoint now auto-detects the mismatch and reconfigures for the correct endpoint rather than failing with a misleading "API key is wrong" error.

docs/en/release-notes/changelog.md

@@ -17,6 +17,11 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+- **Prompt-injection defense: `UntrustedData` wrapper.** All external content returned by `ReadFile` and `FetchURL` is now wrapped in `<untrusted_data id="NONCE">…</untrusted_data>` tags before being passed to the LLM, providing a clear boundary between trusted instructions and untrusted file/web content. The `UntrustedData` primitive escapes embedded closing tags to prevent breakout attacks.
+- **Agent boundary artifacts.** New `CodingArtifact` / `VerificationResult` and `VulnerabilityArtifact` / `AuditVerdict` frozen dataclasses in `pythinker_code.utils.artifacts` enforce a typed information barrier between coder and verifier subagents.
+- **Recon-first `planner` subagent.** A new read-only `planner` built-in agent type decomposes open-ended tasks into distinct parallel seed descriptions emitted as `<recon_seeds>` JSON, enabling structured fan-out before parallel workers start.
+- **Coder artifact contract.** The `coder` subagent now emits a `<coding_artifact>` JSON block at the end of every response, providing structured handoff data (`files_changed`, `test_command`, `expected_behavior`, optional `edge_cases_claimed`) that the `verifier` subagent can consume directly.
+
 ## 0.36.0 (2026-06-05)
 
 - **Alibaba DashScope multi-region fallback.** Logging in with a China-region key (`dashscope.aliyuncs.com`) against the default US Virginia endpoint now auto-detects the mismatch and reconfigures for the correct endpoint rather than failing with a misleading "API key is wrong" error.

src/pythinker_code/agents/default/coder.yaml

@@ -45,6 +45,7 @@ agent:
       </coding_artifact>
 
       Do not include reasoning, logs, or intermediate output inside the tags — only the JSON fields above.
+      The `edge_cases_claimed` key is optional; omit it if you have no distinct edge cases to claim.
   when_to_use: |
     Use this agent for non-trivial software engineering work that may require reading files, editing code, running commands, and returning a compact but technically complete summary to the parent agent.
   allowed_tools:

src/pythinker_code/agents/default/planner.yaml

@@ -16,7 +16,8 @@ agent:
       - Aim for 3-5 seeds unless the task is clearly simpler or more complex.
 
       Final response contract:
-      Emit a JSON block tagged exactly as shown — no other content after it:
+      Your final message must contain ONLY the seeds block below — no preamble, no explanation,
+      no content before or after the tags:
       <recon_seeds>
       ["seed description 1", "seed description 2", ...]
       </recon_seeds>

tests/core/test_agent_spec.py

@@ -72,6 +72,10 @@ def test_load_default_agent_spec():
                 "Fast codebase exploration with prompt-enforced read-only behavior.",
             ),
             "plan": ("plan.yaml", "Read-only implementation planning and architecture design."),
+            "planner": (
+                "planner.yaml",
+                "Read-only recon planner that decomposes tasks into distinct parallel seeds.",
+            ),
             "review": ("review.yaml", "Read-only code review with severity-scored findings."),
             "security-reviewer": (
                 "security_reviewer.yaml",
@@ -127,6 +131,21 @@ def test_load_default_agent_spec():
 Bullet list of remaining risks or `None observed.`.
 ### BLOCKERS
 Bullet list of anything that stopped completion, or `None.`.
+
+Artifact contract: Before finishing, you MUST emit your result as a structured artifact.
+Wrap it in <coding_artifact> tags on its own line at the very end of your final message:
+
+<coding_artifact>
+{
+  "files_changed": ["path/to/file.py"],
+  "test_command": "make test",
+  "expected_behavior": "...",
+  "edge_cases_claimed": ["..."]
+}
+</coding_artifact>
+
+Do not include reasoning, logs, or intermediate output inside the tags — only the JSON fields above.
+The `edge_cases_claimed` key is optional; omit it if you have no distinct edge cases to claim.
 """  # noqa: E501
         }
     )

tests/core/test_default_agent.py

@@ -138,6 +138,20 @@ async def test_default_agent(runtime: Runtime):
                     "pythinker_code.tools.web:FetchURL",
                 ),
             ),
+            (
+                "planner",
+                "Read-only recon planner that decomposes tasks into distinct parallel seeds.",
+                "planner.yaml",
+                None,
+                "allowlist",
+                (
+                    "pythinker_code.tools.shell:Shell",
+                    "pythinker_code.tools.file:ReadFile",
+                    "pythinker_code.tools.file:Glob",
+                    "pythinker_code.tools.file:Grep",
+                    "pythinker_code.tools.file:SmartSearch",
+                ),
+            ),
             (
                 "review",
                 "Read-only code review with severity-scored findings.",
@@ -285,6 +299,7 @@ async def test_default_agent_background_bash_guardrails(runtime: Runtime):
 - `debugger`: Failure/log/stack-trace root-cause analysis with reproduction evidence. (Tools: Shell, SetTodoList, ReadFile, Grep, Model: inherit, Background: yes). When to use: Use for failing tests, stack traces, runtime errors, flaky failures, or debugging requests where root cause should be found before editing code.
 - `explore`: Fast codebase exploration with prompt-enforced read-only behavior. (Tools: Shell, SetTodoList, ReadFile, ReadMediaFile, Glob, Grep, SmartSearch, ReadSkill, SearchWeb, FetchURL, Model: inherit, Background: yes). When to use: Fast agent specialized for exploring codebases. Use this when you need to quickly find files by patterns (e.g. "src/**/*.yaml"), search code for keywords (e.g. "database connection"), or answer questions about the codebase (e.g. "how does the auth module work?"). When calling this agent, specify the desired thoroughness level: "quick" for basic searches, "medium" for moderate exploration, or "thorough" for comprehensive analysis across multiple locations and naming conventions. Use this agent for any read-only exploration that will clearly require more than 3 tool calls. Prefer launching multiple explore agents concurrently when investigating independent questions.
 - `plan`: Read-only implementation planning and architecture design. (Tools: SetTodoList, ReadFile, ReadMediaFile, Glob, Grep, SmartSearch, ReadSkill, SearchWeb, FetchURL, Model: inherit, Background: yes). When to use: Use this agent when the parent agent needs a step-by-step implementation plan, key file identification, and architectural trade-off analysis before code changes are made.
+- `planner`: Read-only recon planner that decomposes tasks into distinct parallel seeds. (Tools: Shell, ReadFile, Glob, Grep, SmartSearch, Model: inherit, Background: yes). When to use: Use this agent before spawning N parallel workers on a large or open-ended task. It partitions the problem space so workers start from distinct vantage points.
 - `review`: Read-only code review with severity-scored findings. (Tools: Shell, SetTodoList, ReadFile, ReadMediaFile, Glob, Grep, SmartSearch, ReadSkill, SearchWeb, FetchURL, Model: inherit, Background: yes). When to use: Use this agent for read-only code review after changes are made or when the parent needs severity-scored findings before deciding what to fix.
 - `security-reviewer`: Diff-focused security review with validated findings. (Tools: Shell, SetTodoList, ReadFile, Grep, SearchWeb, FetchURL, Model: inherit, Background: yes). When to use: Use to run a diff-only security review on the current branch. Can run in parallel with `code-reviewer`.
 - `implementer`: Scoped implementation with minimal edits and verification. (Tools: Shell, SetTodoList, ReadFile, ReadMediaFile, Glob, Grep, SmartSearch, WriteFile, StrReplaceFile, ReadSkill, SearchWeb, FetchURL, Model: inherit, Background: yes). When to use: Use this agent when the required code change is already specified and should be implemented with minimal edits and a quick verification pass.

tests/tools/test_untrusted_wrapping.py

@@ -218,16 +218,16 @@ async def test_fetchurl_injection_payload_in_html_does_not_escape_wrapper(
     finally:
         await runner.cleanup()
 
-    # If extraction succeeded, the wrapper must be intact.
-    if not result.is_error and isinstance(result.output, str):
-        opening_count = result.output.count("<untrusted_data id=")
-        closing_count = result.output.count("</untrusted_data>")
-        assert opening_count == 1
-        assert closing_count == 1
-        # The raw ``</untrusted_data>FAKE`` substring must NOT appear as a sequence
-        # (it's escaped to ``&lt;...&gt;``), so the attacker cannot break out of the
-        # block by inserting a matching closing tag.
-        assert "</untrusted_data>FAKE" not in result.output
+    assert not result.is_error
+    assert isinstance(result.output, str)
+    opening_count = result.output.count("<untrusted_data id=")
+    closing_count = result.output.count("</untrusted_data>")
+    assert opening_count == 1
+    assert closing_count == 1
+    # The raw ``</untrusted_data>FAKE`` substring must NOT appear as a sequence
+    # (it's escaped to ``&lt;...&gt;``), so the attacker cannot break out of the
+    # block by inserting a matching closing tag.
+    assert "</untrusted_data>FAKE" not in result.output
 
 
 async def test_fetchurl_wrapping_nonce_is_unique_per_call(

tests/utils/test_pyinstaller_utils.py

@@ -92,6 +92,7 @@ def test_pyinstaller_datas():
         ("src/pythinker_code/agents/default/implementer.yaml", "pythinker_code/agents/default"),
         ("src/pythinker_code/agents/default/judge.yaml", "pythinker_code/agents/default"),
         ("src/pythinker_code/agents/default/plan.yaml", "pythinker_code/agents/default"),
+        ("src/pythinker_code/agents/default/planner.yaml", "pythinker_code/agents/default"),
         ("src/pythinker_code/agents/default/review.yaml", "pythinker_code/agents/default"),
         (
             "src/pythinker_code/agents/default/security_reviewer.yaml",

tests/utils/test_trust.py

@@ -31,7 +31,7 @@ def test_render_preserves_content():
 
 def _body(rendered: str) -> str:
     """Extract the escaped body between the opening and framework closing tags."""
-    prefix, _, rest = rendered.partition(">\n")
+    _, _, rest = rendered.partition(">\n")
     return rest[: -len("\n</untrusted_data>")]