DeepTutor v1.5.6 Release Notes

Release Date: 2026.07.29

A follow-up to v1.5.5 that finishes what it started: the Codex sign-in it shipped now actually completes on a remote or containerized deployment, and for partners and non-administrators too. Alongside that, a knowledge base can point at a library you already keep in Tencent IMA, the files a conversation produced stop hiding in the transcript, and a Japanese book no longer comes back with Chinese quizzes. Drop-in — no migrations.

What's New

Connect a Tencent IMA library

A knowledge base can now be a pointer to a library you curate in Tencent IMA rather than an index DeepTutor builds. It follows the lightrag-server shape exactly: nothing is copied and nothing is stored locally — documents are added in IMA, retrieval calls IMA's OpenAPI, and the chat loop still writes the answer. Credentials (client_id + api_key) and the library id live per-KB, so on a shared deployment each user retrieves through their own IMA account instead of one global key, and connecting is self-contained with no settings surface to fill in first. Connecting probes the library once, so a mistyped id fails at connect time rather than silently at every later query.

Generated files, where you can find them again

Files the tutor produced were only reachable through the one assistant bubble that made them, so finding a deck or a spreadsheet again meant scrolling the transcript. The Activity panel now splits what a conversation produced from what you uploaded: generated files get their own card above attachments, with a size and a hover title showing where the file sits under the data root. Rows reuse the existing open-in-viewer path.

Remote Codex sign-in that completes

v1.5.5 shipped OpenAI Codex OAuth with a caveat — on a remote box, sign in from the server instead. That caveat is gone. The browser's localhost and the server's localhost are different machines, so a reverse proxy alone can never carry the callback; DeepTutor now forwards only the exact callback path through the Web origin to a state-validating broker, and the settings card and CLI print the real callback address, the SSH tunnel command, an explicit authorize action, and a countdown that survives a page reload (#716).

Two follow-ups make it work for everyone else on the deployment. The callback is delivered by OAuth state — a secret this process minted for one login, compared in constant time — rather than by the request's user, because the browser arrives through your own tunnel and carries no session cookie; without this, remote sign-in returned login_not_active for every non-administrator. And a partner turn now resolves Codex credentials to the owner's root instead of the partner's synthetic workspace, so chatting with a partner no longer fails with "Sign in to Codex before using this model" (#713).

The listener stays bound to loopback, ports 1455 and 1457 are never published, callback responses never echo the code or state, and PKCE and the token exchange are unchanged.

Every language stays its own language

parse_language() ended in a bare return "zh", so ja/ko/fr/de/ru/ar all resolved to Chinese — which is why a Japanese book came back with Chinese quizzes (#712). It now delegates to the existing normalizer and passes unknown codes through, and the two fallback chains that assumed the answer was zh or en follow suit: prompts try [code, base locale, "en"], so zh-tw reuses the Chinese files and ja lands on English rather than Chinese.

Assorted fixes

• Book creation and block regeneration run over WebSocket instead of a request that a proxy could time out, and spine synthesis and Visualize's analysis stage use non-streaming calls so a single-chapter fallback or a truncated code block stops happening (#707). All three now route through the agent seam, which restores the image attachments, trace metadata, and per-agent routing the direct factory calls were dropping.
• deeptutor start on a fresh source checkout installs web/node_modules for you instead of crashing with a missing-module error (#710).
• Admin user management, sign-out, confirm dialogs, and toasts are localized, so switching the UI to Chinese no longer leaves account management in English (#718).
• The service lazy-loader uses literal import paths (#717) — behaviour-neutral, but it makes the module graph statically analyzable.

Upgrade Notes

Drop-in from v1.5.5: pip install -U deeptutor; Docker users pull ghcr.io/hkuds/deeptutor:latest. No migrations, no schema or config changes.

• Remote Codex sign-in now uses an SSH tunnel, and the v1.5.5 advice to run deeptutor provider login openai-codex on the server is no longer the only path. DeepTutor prints the exact ssh -N -L … command; run only the one matching the callback port it reports, and note that 3782 in that command is an example — replace it with the Web port actually listening on the SSH host's loopback.
• A Tencent IMA knowledge base needs a client_id and API key from ima.qq.com/agent-interface plus the library id. Documents are added in IMA, not through DeepTutor.

Full Changelog: v1.5.5...v1.5.6