DeepTutor v1.5.7 Release Notes

Release Date: 2026.07.31

A follow-up to v1.5.6 that opens the tutor up to tools DeepTutor never shipped: a curated store of hosted MCP services each person installs for themselves, and 101 command-line apps from the CLI-Anything catalog the chat agent can call directly. Both arrive with the authorisation and isolation a shared deployment actually needs — installing is a privileged action, running is not, and nothing that authorises a person stays anywhere the code sandbox can read. Drop-in — no migrations.

What's New

An MCP store you install from yourself

Learning Space → MCP Services is a store of 45 curated hosted servers you add for yourself in one click, plus any remote server you configure by URL. Every catalog endpoint was verified by sending it a real MCP initialize, and no logo CDN is contacted — rendering the store would otherwise ship your installed-service list to a third party on every paint. Servers that answer 401 (Notion, Linear, Sentry, Asana, monday, Canva, Prisma) sign in over OAuth 2.1 with PKCE and dynamic client registration; a background reconnect never blocks on a consent screen, it just reports needs_auth so the UI can offer a Connect button. Static keys are stored by reference and resolved in memory at connect time, so a token never lands in a config file that gets displayed, returned by an API, or copied into a log. stdio entries are refused for self-service: a command is host execution as the app user.

MCP is no longer configured under Settings — /settings/mcp redirects to the store — and the tool pickers now fold hundreds of tools into one row per service.

CLI apps the tutor can run

Learning Space → CLI Apps catalogs 101 tools snapshotted from the two CLI-Anything registries, and the chat agent calls an installed one directly, with that app's own usage guide loaded only when it is needed. Installing is administrator-only, because pip install runs the package's own setup.py in the application container — no amount of care makes that self-service. The registry's install_cmd is never executed: it is parsed into a plan whose argv DeepTutor builds (the registries already contain curl … | bash), npm install scripts are forced off, and an update that fails to build rolls the working environment back. 66 first-party harness entries are pinned to one reviewed CLI-Anything commit; anything pointing at a different upstream is labelled third-party so installing it is an informed choice.

Apps land in data/cli-apps, one environment each, mounted read-only into the sandbox runner. That split is the point: an escaped command cannot overwrite an app's entry point and have every later turn, for every account, run the replacement.

Credentials the sandbox cannot reach

Everything that authorises a person moved to data/system — the one branch of the data tree that is never bind-mounted into the runner. Codex OAuth tokens now live in data/system/user-secrets/<owner>/private/openai-codex/, per-user MCP configs in data/system/user-mcp/<owner>.json, and MCP tokens and API keys beside them. Existing Codex logins relocate themselves on first use, and the move refuses to run through a symlinked directory rather than risk relocating another account's store.

This closes a real exposure rather than a theoretical one: the per-user mount the runner receives is a whole user root, so a credential kept under data/users/<uid>/ was readable — and writable — from every other account's sandboxed shell.

Plugged-in tools, governed per person

Grants gain a cli_apps whitelist with the same deny-by-default posture MCP tools already had: an installed app is third-party code running in the sandbox, and a deployment installing one is not the same decision as every account being allowed to run it. Behind that, a per-turn registry view keeps one user's provider tools out of the process-global registry entirely — two tenants whose servers share a tool name can no longer clobber each other — and refuses an unauthorised tool at execute, not just in the manifest, because a text-protocol fallback can synthesise a name that was never offered.

A composer that tells you how full the window is

A chip in the composer reports what this turn actually put in the model's context window and what is filling it, measured from the already-assembled prompt blocks, tool schemas, and message list rather than re-derived — so the readout cannot drift from what was sent. Long conversations also get a rail of ticks in the transcript's left gutter, one per question you asked, for jumping back through the history.

DeepTutor on a phone

The workspace and utility layouts now collapse to a single-column shell with a slide-over sidebar on small screens instead of rendering a desktop three-pane layout off the edge of the viewport.

Assorted fixes

• The composer keeps focus after you send, and gets it back when you switch tabs away and return (#720).
• Released container images carry provenance and SBOM attestations (#722).
• git is installed in the application image and the Node runtime in the runner image, both required by the app installer and by npm-packaged apps' console scripts.

Upgrade Notes

Drop-in from v1.5.6: pip install -U deeptutor; Docker users pull ghcr.io/hkuds/deeptutor:latest. No schema or config changes, and an existing Codex login carries over — its credentials relocate themselves the first time they are resolved.

• docker-compose deployments should re-up, not just restart: the runner service gains a read-only ./data/cli-apps mount, and without it installed CLI apps are catalogued but cannot execute.
• MCP servers configured under Settings stay where they are — the deployment-wide mcp.json is unchanged and still admin-owned. The new store is a parallel, per-account one; /settings/mcp now redirects to it.
• Installing a CLI app is administrator-only, and assigning it is a second step. A non-admin account sees no installed app until a grant names it, the same way MCP tools and skills already work.

Full Changelog: v1.5.6...v1.5.7