chore(deps): bump the minor-and-patch group across 1 directory with 3 updates

[dependabot]

Summary

Routine Dependabot group bump — agent-client-protocol 0.8.0 → 0.10.1, aiohttp 3.13.5 → 3.14.0, typer 0.21.1 → 0.26.5 — plus the fixes required to absorb the two effectively-breaking 0.x bumps.

Changes

• Workspace resolution. Align the pythinker-review typer pin to 0.26.5 so the uv workspace resolves (root required 0.26.5 while the member still pinned 0.21.1).
• agent-client-protocol 0.10 migration. AuthMethod is gone — migrate the ACP server to the typed TerminalAuthMethod. Per the ACP 0.10 spec the per-method command field was removed for security (the client invokes the agent binary directly), so only args/env/type are advertised. Conform to the expanded Agent protocol: additional_directories on the session methods, message_id on prompt, new close_session/set_config_option, and updated return types. set_session_mode now returns invalid_params for an unknown session or non-default mode instead of relying on a stripped-under--O assert.
• typer 0.26 argument parsing. typer reimplemented option parsing with a parser that always consumes the next token, which silently broke the optional value of --session/--resume (the old click _flag_needs_value trick became dead code). Restore it via argv preprocessing so --session without an ID still opens the interactive picker.

Testing

• make check (ruff + pyright) passes across all packages.
• make test passes across all packages (pythinker-code incl. tests_e2e, core, host, review, sdk).
• Added a close_session test and re-targeted the ACP auth/initialize tests to the 0.10 contract.

Related

No linked issue — Dependabot-initiated group update; breaking-change handling added on top.

[coderabbitai]

📝 Walkthrough

Walkthrough

Pins for agent-client-protocol (→0.10.1), aiohttp (→3.14.0), and typer (→0.26.5) were updated; ACP server auth/model and session RPC signatures were changed to match ACP 0.10; CLI argv handling for --session/--resume was adjusted for Typer 0.26; UI handlers and tests were updated accordingly.

Changes

Dependency Updates & Release Notes

Layer / File(s)	Summary
Runtime dependency upgrades pyproject.toml, packages/pythinker-review/pyproject.toml, CHANGELOG.md, docs/en/release-notes/changelog.md	Bump agent-client-protocol → 0.10.1, aiohttp → 3.14.0, and typer → 0.26.5; update changelog/release notes entries.

ACP server, CLI, UI, and tests

Layer / File(s)	Summary
ACP server auth model and session API changes src/pythinker_code/acp/server.py	Add ACPAuthMethod union; rebuild terminal auth as TerminalAuthMethod; change prompt signature (add message_id); update load/resume/fork/list session signatures to accept additional_directories and new return shapes; add close_session and set_config_option handlers; adjust _check_auth payload construction.
CLI argv normalization and typing src/pythinker_code/cli/_lazy_group.py	Inject empty-string sentinels for --session/--resume when used without values to restore picker-mode behavior; add typed alias import and update get_command return typing to Typer's vendored Click Command.
ACP UI handler signatures and deprecations src/pythinker_code/ui/acp/__init__.py	Expand single-session RPC signatures with additional_directories and message_id; add deprecated close_session and set_config_option RPC handlers wired to existing deprecation path.
Tests updated for new auth shape and session handling tests/acp/test_server_initialize.py, tests/ui_and_conv/test_acp_server_auth.py	Replace argv-derived initialize test with a check that initialize advertises a TerminalAuthMethod (id "login", args ["login"], empty env); add test verifying close_session removes registry entries; update fixtures to mock TerminalAuthMethod directly.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels: documentation

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.71% which is insufficient. The required threshold is 70.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format (chore type) and accurately describes dependency version bumps.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description covers all required template sections: related issue (acknowledged as Dependabot-initiated), detailed changes breakdown, and testing validation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/uv/minor-and-patch-5aa53082a2

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/en/release-notes/changelog.md`:
- Around line 20-24: Remove the manual edits from
docs/en/release-notes/changelog.md and revert the file to the auto-synced state;
instead make any changelog updates in the root CHANGELOG.md so the sync script
can propagate them, and ensure no further direct changes are committed to
docs/en/release-notes/changelog.md (verify by running the repo's sync script or
CI validation that updates the file).

In `@src/pythinker_code/acp/server.py`:
- Around line 367-371: The set_session_mode handler currently ignores session_id
and uses assert for mode validation; replace the assert with explicit
validation: in set_session_mode check that mode_id == "default" and if not
return the proper invalid_params response, then verify the session exists (e.g.
via the server's session store or self.sessions using session_id) and if the
session is missing return invalid_params as well; do not use assert so the
checks always run and reference the set_session_mode method, the mode_id and
session_id parameters when locating and validating the session and mode.

In `@tests/ui_and_conv/test_acp_server_auth.py`:
- Around line 20-27: The test uses a TerminalAuthMethod fixture with args set to
["pythinker", "login"] which no longer matches the real payload advertised by
ACPServer.initialize(); update the fixture (the acp.schema.TerminalAuthMethod
instance) so its args reflect only the extra argv tail (e.g., ["login"]) to
mirror ACPServer.initialize() behavior and ensure auth-error tests use the real
shape.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 49445af7-7f14-43b3-be78-325f494c046d

📥 Commits

Reviewing files that changed from the base of the PR and between b4679c0 and efdd391.

📒 Files selected for processing (8)

• CHANGELOG.md
• docs/en/release-notes/changelog.md
• packages/pythinker-review/pyproject.toml
• src/pythinker_code/acp/server.py
• src/pythinker_code/cli/_lazy_group.py
• src/pythinker_code/ui/acp/__init__.py
• tests/acp/test_server_initialize.py
• tests/ui_and_conv/test_acp_server_auth.py