feat(shell): add thinking effort controls and auto-mode deliberation (#50)

* test(auth): guard committed login-brand assets against source drift

web/static/ is a build output (scripts/build_web.py rmtree's + repopulates it
from the vite build, whose brand files come from web/public/brand). The two
brand assets are force-committed only so the test job — which doesn't run the
web build — has the files the OAuth callback reads. Add a guard asserting those
committed copies stay byte-identical to web/public/brand, so a brand-source
change can't silently leave the branding tests validating a stale fixture.

* fix(auth): fail soft when a browser-login brand asset is missing

The OAuth callback page embeds icon.svg/favicon.ico as data URIs. These are
build outputs (web/static) and normally always present, but a broken build
shouldn't crash login over a cosmetic asset. Catch OSError in the data-uri
helper, log a warning, and embed an empty source so the callback still renders.
Add a test for the degraded path.

* feat(approval): deliberate before destructive auto-approved actions

Under auto_deliberate, an irreversible shell action (rm -rf, git push
--force, git reset --hard, dd, truncate) is bounced once before running --
even under auto/yolo -- so the agent weighs alternatives first. One-shot:
the identical re-issue runs, so deliberation never permanently whitelists
the command. ApprovalResult gains a deliberation variant whose feedback is
not framed as a user rejection.

* feat(ui): thinking-level cycle + frame-color helpers for Shift+Tab

Pure helpers for the Shift+Tab thinking feature: next_thinking_level()
cycles off->minimal->low->medium->high->xhigh->off, and thinking_frame_color/
thinking_frame_style map each level to a prompt border color (grey->blue->
violet->purple) per theme. Keymap + prompt-handler wiring follows.

* fix(tui): avoid prompt resize artifacts

* feat(ui): continue thinking effort selector port

* docs: spec for shimmer traveling-waves redesign

* feat(ui): traveling-wave shimmer with center-out splash

Restructure the active-work shimmer into a four-phase loop: a wave
sweeps right-to-left, splashes outward from the middle, sweeps back
left-to-right, splashes again, then repeats. Replaces the previous
single-direction repeating sweep. Stays purely time-derived so the
prompt, activity tree, and pinned-todo renderers animate in sync.

* feat(ui): silver shimmer sheen over muted orange-yellow verb

Recolor the active-work shimmer: highlight is now silver (#D8DCE2)
instead of violet, and the verb-spinner/pinned-todo base is a muted
orange-yellow (#D49E5A) instead of golden amber. Point palette tests at
the motion constants so future shade tweaks don't churn test literals.

* fix(recap): summarize turn outcome instead of opening intent

The per-turn '※ recap:' line quoted the assistant's first sentence,
which is always an intent preamble ('I'll start by gathering...') rather
than what the turn accomplished. Add an outcome-sentence heuristic that
skips intent/offer/question/path-noise lines and prefers the closing
summary, and append factual deltas (N files changed · M steps). Wire the
live view to count files changed per turn from diff display blocks.

Also improve /recap: session bullets lead with the session outcome
instead of the first user message, and a single short no-op session is
reported plainly as a light day rather than padded into a bullet list.

* feat(thinking): support minimal reasoning effort across providers

Make "minimal" a first-class ThinkingEffort: OpenAI round-trips it
natively, the Pythinker provider preserves it instead of collapsing to
low, Anthropic clamps it down to its floor (low) rather than up to high,
and Gemini maps it to its lowest thinking level/budget.

* feat(thinking): make thinking effort a first-class config and runtime setting

Add a persisted default_thinking_effort alongside the legacy
default_thinking bool, with the effort string as the source of truth
(falling back to the bool only for pre-existing configs). create_llm now
takes an explicit effort, clamps it to model capabilities, preserves
levels like xhigh/minimal instead of collapsing every enabled request to
high, and threads the effort through the CLI, ACP, review, web API,
subagents, login flows, setup, and the /model and /thinking selectors.
Always-thinking models surface native reasoning instead of an effort
dial.

* feat(ui): cycle thinking effort with Shift+Tab and color the prompt by effort

Repurpose Shift+Tab from plan-mode toggle to a thinking-effort cycle over
the model's available levels, with a toast and telemetry. The prompt
separator and bottom-toolbar label now reflect the active effort (or
"native reasoning"), and the effort color ramp moves from a grey/violet
scale to a cool-to-warm slate→pink ramp. Tips and keybinding help updated
to match.

* feat(auto): auto-deliberate policy with blind advisor for AskUserQuestion

Add an "auto_deliberate" ask-user policy: in auto mode, instead of
silently dismissing AskUserQuestion, run an independent tool-less advisor
that blind-ranks the agent's own options and hand the verdict back so the
agent self-decides. Destructive auto-approved actions are bounced once for
deliberation via a tool-agnostic classifier, and the auto-mode prompt
invites the tool at genuine forks under this policy.

* fix(ui): render reports as padded panels and preserve report-fence seams

Render report blocks as a rounded, padded Rich panel (a standalone
reading surface) with hanging-indented wrapped locations, and keep a
one-row seam when a report fence follows streamed prose. Ask-question
cards gain blank-row separation between header and questions.

* fix(ui): keep status shimmer animating during quiet wire periods

Add a prompt-scoped refresh loop so the pinned-status shimmer stays
frame-based when wire events are sparse (e.g. a long-running subagent),
honoring reduced-motion with a slower interval.

* feat(shell): no-arg /logout selector and provider login status

Map each login/logout entry to the managed provider keys that signal it is
configured, so /login and /logout report real status and a bare /logout
opens a selector over only the logged-in providers (with a single OpenAI
entry covering both OAuth and API-key credentials).

* fix(agent): include base_prompt in run-agents fingerprint

Two RunAgents calls differing only in base_prompt produced the same
fingerprint; include it so distinct launches are not deduplicated.

* test(ui): align compaction-seam and recap spacing expectations

Update rendering tests to match the committed compaction/recap seam
behavior: compaction commits a leading blank row plus block, and turn
recaps are framed by blank rows.

* docs(changelog): note thinking effort controls

* test(ui): address report fence review feedback

Author: elkaix

CHANGELOG.md

@@ -15,6 +15,7 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+- **Thinking effort controls and safer auto-mode decisions.** Thinking effort is now a first-class setting across the CLI, ACP, web config, and supported providers; Shift+Tab cycles available efforts in the shell, and auto-mode can deliberate with advisor feedback before sensitive or destructive approval flows.
 - **Shell sessions get cleaner recaps and rendering.** The interactive shell can show turn recaps, includes hook stdout/stderr in the transcript, improves prompt/file-mention and tool-output spacing, and uses branded browser-login result pages.
 - **MiniMax Token Plan model availability stays current.** MiniMax login and startup refresh now use the authenticated model catalog so Token Plan keys only keep models actually available to that key, while preserving user model preferences and isolating discovery failures from other provider refreshes.
 

docs/superpowers/specs/2026-06-01-shimmer-traveling-waves-design.md

@@ -0,0 +1,130 @@
+# Shimmer traveling-waves redesign
+
+**Date:** 2026-06-01
+**Status:** Approved design, pending implementation
+**Scope:** `src/pythinker_code/ui/shell/motion.py` (plus tests)
+
+## Problem
+
+The active-work shimmer (`_shimmer_segments`) sweeps a single bright highlight
+right-to-left across a label, then jumps back and repeats in the same direction.
+It loops in one direction only — there is no sense of the light bouncing or
+reaching the end of the word.
+
+We want the shimmer to read like **traveling waves**: a wave crosses the word,
+splashes outward from the middle when it reaches the end, then a wave travels
+back the other way, splashes again, and repeats.
+
+## Goal
+
+Restructure the per-character shimmer into a four-phase loop while keeping:
+
+- the existing 3-color palette (`#D49E5A` muted orange-yellow base / `#E2C18A`
+  warm sheen-trail mid / `#D8DCE2` silver highlight) and
+  `_SHIMMER_INTERVAL_S = 0.22` tick;
+- the **purely time-derived** model — every frame is a function of `elapsed_s`
+  alone, so the prompt, activity tree, and pinned-todo renderers stay in sync
+  with no shared animation state;
+- the public surface: `shimmer_text`, `shimmer_prompt_fragments`, and the
+  per-char path inside `activity_status_line` call the same engine with no
+  signature changes;
+- the `colors_disabled()` (plain text) and reduced-motion (static base amber)
+  short-circuits exactly as today.
+
+## Animation cycle
+
+`L = len(label)`. One loop is four phases, indexed by
+`frame = int(max(0.0, elapsed_s) / 0.22)`, `phase_index = frame % CYCLE_LEN`.
+
+| Phase | Name            | Behavior                                                     | Frames           |
+|-------|-----------------|-------------------------------------------------------------|------------------|
+| A     | Wave → (R→L)    | Current sweep, unchanged: violet head + asymmetric coral trail | `L + 6`        |
+| B     | Splash          | Wave blooms from center char outward to both edges, settles | `ceil(L/2) + 3`  |
+| C     | Wave ← (L→R)    | Mirror of A: head travels the other way, trail flips side   | `L + 6`          |
+| D     | Splash          | Same center-out bloom as B                                  | `ceil(L/2) + 3`  |
+
+`CYCLE_LEN = 2*(L + 6) + 2*(ceil(L/2) + 3)`. After phase D the loop returns to A.
+
+### Phase A — wave right-to-left (preserve current look)
+
+Unchanged from today: `head = L + 2 - local_phase`; for each non-space char at
+index `i`, `offset = i - head`:
+
+- `offset == 0` → highlight
+- `offset in (-1, 1, 2, 3)` → mid (asymmetric trailing edge)
+- else → base
+
+### Phase C — wave left-to-right (mirror)
+
+`head` travels from the left edge to past the right edge as `local_phase`
+increases. The trail is mirrored to the opposite side so the sheen still trails
+*behind* the direction of travel:
+
+- `offset == 0` → highlight
+- `offset in (1, -1, -2, -3)` → mid
+- else → base
+
+### Phase B / D — splash (center-out traveling wave)
+
+`center = (L - 1) / 2` (fractional for even `L`). On local splash frame `f`
+(0-based), wavefront radius `r = f`. For each non-space char at index `i`,
+`d = abs(i - center)`. The wavefront is a half-cell band so odd and even
+lengths behave identically:
+
+- `r - 0.5 <= d <= r + 0.5` → highlight — the expanding wavefront
+- `d < r - 0.5` → mid — already-filled interior
+- `d > r + 0.5` → base — not yet reached
+
+For even `L` the two center chars (`d == 0.5`) light up together on `f == 0`;
+for odd `L` the single center char (`d == 0`) lights up on `f == 0`.
+
+The final settle frames (after the wavefront passes both edges) paint the whole
+word base amber, giving a brief calm beat before the next wave launches.
+
+Spaces remain uncolored (`None`) in every phase, exactly as today.
+
+## Implementation shape
+
+Refactor `_shimmer_segments(label, elapsed_s, *, reduced_motion)` into a small
+dispatcher:
+
+- keep the early returns (`not label`, `colors_disabled`, reduced-motion);
+- compute `L`, the four phase lengths, `CYCLE_LEN`, and `phase_index`;
+- delegate to one of two helpers that return a `list[str | None]` of per-char
+  colors:
+  - `_wave_colors(chars, local_phase, direction)` — phases A and C;
+  - `_splash_colors(chars, local_phase)` — phases B and D;
+- coalesce equal-color runs into `(color, text)` segments (existing logic).
+
+No changes to `shimmer_text`, `shimmer_prompt_fragments`,
+`shimmer_spinner_style`, or any call site.
+
+## Edge cases
+
+- `L == 0` → `[]` (existing guard).
+- `L == 1` → `center == 0`, splash highlights the single char on `f == 0` then
+  settles; waves degenerate gracefully (single char cycles base/mid/highlight).
+- Labels with spaces / multi-word ("Reticulating splines") → positional math is
+  unaffected; spaces stay `None`.
+
+## Verification (TDD)
+
+New tests in `tests/ui_and_conv/test_shell_motion_shimmer.py`:
+
+1. **Splash originates at center and widens** — at a splash-phase frame, the
+   highlighted indices are centered and the highlighted/filled span grows over
+   consecutive frames.
+2. **Phase C trail is mirrored vs phase A** — for a head at the same offset, the
+   mid-colored trail sits on the opposite side.
+3. **Cycle returns to start** — colors at `frame` and `frame + CYCLE_LEN`
+   (for a fixed label) are identical.
+4. **Palette + plain-text invariants preserved** — existing three-color and
+   reduced-motion assertions still pass.
+
+Plus: `make check-pythinker-code` (ruff check + ruff format) green.
+
+## Out of scope
+
+- `shimmer_spinner_style` (single-color whole-word path) keeps its current
+  simple 4-step palette cycle.
+- No new config flags, no palette changes, no timing knobs exposed.

packages/pythinker-core/src/pythinker_core/chat_provider/__init__.py

@@ -119,9 +119,13 @@ def input(self) -> int:
         return self.input_other + self.input_cache_read + self.input_cache_creation
 
 
-type ThinkingEffort = Literal["off", "low", "medium", "high", "xhigh", "max"]
+type ThinkingEffort = Literal["off", "minimal", "low", "medium", "high", "xhigh", "max"]
 """The effort level for thinking.
 
+``minimal`` is the lowest user-facing reasoning level and maps to providers
+that support it natively (for example OpenAI reasoning_effort) or to the
+smallest available budget/effort otherwise.
+
 Support for levels above ``high`` varies by provider:
 
 - **Anthropic**: ``xhigh`` is accepted only on Claude Opus 4.7; ``max`` is

packages/pythinker-core/src/pythinker_core/chat_provider/openai_common.py

@@ -119,6 +119,8 @@ def thinking_effort_to_reasoning_effort(effort: ThinkingEffort) -> ReasoningEffo
     match effort:
         case "off":
             return None
+        case "minimal":
+            return "minimal"
         case "low":
             return "low"
         case "medium":
@@ -137,7 +139,9 @@ def thinking_effort_to_reasoning_effort(effort: ThinkingEffort) -> ReasoningEffo
 
 def reasoning_effort_to_thinking_effort(effort: ReasoningEffort) -> ThinkingEffort:
     match effort:
-        case "low" | "minimal":
+        case "minimal":
+            return "minimal"
+        case "low":
             return "low"
         case "medium":
             return "medium"

packages/pythinker-core/src/pythinker_core/chat_provider/pythinker.py

@@ -140,6 +140,8 @@ def thinking_effort(self) -> ThinkingEffort | None:
         if reasoning_effort is None:
             return None
         match reasoning_effort:
+            case "minimal":
+                return "minimal"
             case "low":
                 return "low"
             case "medium":
@@ -197,6 +199,8 @@ def with_thinking(self, effort: ThinkingEffort) -> Self:
         match effort:
             case "off":
                 reasoning_effort = None
+            case "minimal":
+                reasoning_effort = "minimal"
             case "low":
                 reasoning_effort = "low"
             case "medium":

packages/pythinker-core/src/pythinker_core/contrib/chat_provider/anthropic.py

@@ -175,6 +175,11 @@ def _clamp_effort(effort: "ThinkingEffort", model: str) -> "ThinkingEffort":
         return effort
     if effort in _supported_efforts(model):
         return effort
+    if effort == "minimal":
+        # Anthropic has no 'minimal' effort; 'low' is the floor of every
+        # _supported_efforts() set. Map down to it rather than clamping up to
+        # 'high', which would request a far larger budget than the user asked for.
+        return "low"
     return "high"
 
 

packages/pythinker-core/src/pythinker_core/contrib/chat_provider/google_genai.py

@@ -178,7 +178,8 @@ def with_thinking(self, effort: "ThinkingEffort") -> Self:
                 case "off":
                     # use default thinking config
                     pass
-                case "low":
+                case "minimal" | "low":
+                    # Gemini has no 'minimal'; map to its lowest level.
                     thinking_config.thinking_level = ThinkingLevel.LOW
                 case "medium":
                     # FIXME: medium not supported yet, use high
@@ -191,7 +192,8 @@ def with_thinking(self, effort: "ThinkingEffort") -> Self:
                 case "off":
                     thinking_config.thinking_budget = 0
                     thinking_config.include_thoughts = False
-                case "low":
+                case "minimal" | "low":
+                    # Gemini has no 'minimal'; use its lowest thinking budget.
                     thinking_config.thinking_budget = 1024
                     thinking_config.include_thoughts = True
                 case "medium":

packages/pythinker-core/tests/api_snapshot_tests/test_pythinker.py

@@ -467,3 +467,21 @@ async def test_pythinker_with_extra_body_non_thinking_key_shallow_merge():
             pass
         body = json.loads(mock.calls.last.request.content.decode())
         assert body["custom"] == snapshot({"b": 2})
+
+
+def test_with_thinking_minimal_round_trips():
+    from pythinker_core.chat_provider.pythinker import Pythinker
+
+    provider = Pythinker(model="pythinker-ai", api_key="test-key", stream=False).with_thinking(
+        "minimal"
+    )
+    assert provider.thinking_effort == "minimal"
+
+
+def test_with_thinking_low_unchanged():
+    from pythinker_core.chat_provider.pythinker import Pythinker
+
+    provider = Pythinker(model="pythinker-ai", api_key="test-key", stream=False).with_thinking(
+        "low"
+    )
+    assert provider.thinking_effort == "low"

packages/pythinker-core/tests/test_anthropic_thinking.py

@@ -103,6 +103,11 @@ def test_supports_adaptive_thinking(model: str, expected: bool) -> None:
         ("claude-opus-4-7", "low", "low"),
         ("claude-opus-4-6", "medium", "medium"),
         ("claude-sonnet-4-20250514", "low", "low"),
+        # minimal has no Anthropic equivalent; clamp DOWN to the lowest ('low'),
+        # not up to 'high' (which would request a far larger budget).
+        ("claude-opus-4-5", "minimal", "low"),
+        ("claude-sonnet-4-6", "minimal", "low"),
+        ("claude-opus-4-7", "minimal", "low"),
         # Future 4.8+ inherits Opus 4.7-like behavior only if name signals opus-4-7+
         # 4.8 is not automatically assumed to support xhigh; only guaranteed max.
         ("claude-opus-4-8", "xhigh", "high"),

packages/pythinker-core/tests/test_openai_common.py

@@ -22,14 +22,16 @@
 class TestThinkingEffortMapping:
     """OpenAI's reasoning_effort accepts: none, minimal, low, medium, high, xhigh
     (xhigh added for models after gpt-5.1-codex-max). Pythinker Core's ThinkingEffort
-    is: off, low, medium, high, xhigh, max. The bidirectional mapping must
-    preserve xhigh round-trip and clamp max sensibly.
+    is: off, minimal, low, medium, high, xhigh, max. The bidirectional mapping must
+    preserve the minimal and xhigh round-trips and clamp max sensibly.
     """
 
     @pytest.mark.parametrize(
         "thinking_effort,expected_reasoning",
         [
             ("off", None),
+            # OpenAI supports minimal natively — first-class round-trip.
+            ("minimal", "minimal"),
             ("low", "low"),
             ("medium", "medium"),
             ("high", "high"),
@@ -56,7 +58,8 @@ def test_thinking_to_reasoning(
         [
             (None, "off"),
             ("none", "off"),
-            ("minimal", "low"),
+            # OpenAI supports minimal natively — first-class round-trip.
+            ("minimal", "minimal"),
             ("low", "low"),
             ("medium", "medium"),
             ("high", "high"),