zames_pro 2.60.0 → 2.63.0

package/dist/input.js

@@ -692,10 +692,11 @@ export class LineEditor {
         const shown = sugg.slice(off, off + pageSize);
         this._suggestOffset = off;
         this._suggestCount = sugg.length;
-        const maxName = Math.max(...shown.map((c) => c.name.length));
+        const label = (c) => c.hint ? c.name + ' ' + c.hint : c.name;
+        const maxName = Math.max(...shown.map((c) => label(c).length));
         const lines = shown.map((c, i) => {
             const selected = off + i === this._suggestSelected && this._suggestSelected > 0;
-            const name = theme.prompt(c.name.padEnd(maxName));
+            const name = theme.prompt(label(c).padEnd(maxName));
             const desc = theme.dim('  ' + c.description);
             return (selected ? theme.prompt(' ▸ ') : '   ') + name + desc;
         });

package/dist/path-token.js

@@ -51,6 +51,81 @@ function stripPunct(tok) {
         t = t.slice(1);
     return t;
 }
+// Characters that may directly precede an '@' for it to count as a file
+// reference rather than a decorator/email. Without this guard `user@host` and
+// `@Component` would be misread as paths.
+function isRefBoundary(ch) {
+    return (ch === ' ' ||
+        ch === '\t' ||
+        ch === '\n' ||
+        ch === '\r' ||
+        ch === '(' ||
+        ch === '[' ||
+        ch === '{' ||
+        ch === String.fromCharCode(34) ||
+        ch === String.fromCharCode(39) ||
+        ch === '<');
+}
+// End of a reference token: whitespace, a closing bracket/quote, or an
+// angle bracket (so `@a.ts>` stops at `>`).
+function isRefEnd(ch) {
+    return (ch === ' ' ||
+        ch === '\t' ||
+        ch === '\n' ||
+        ch === '\r' ||
+        ch === ')' ||
+        ch === ']' ||
+        ch === '}' ||
+        ch === String.fromCharCode(34) ||
+        ch === String.fromCharCode(39) ||
+        ch === '<' ||
+        ch === '>');
+}
+// Strip trailing punctuation a path may have picked up from prose, e.g.
+// "see @src/a.ts, please" -> `src/a.ts`.
+function stripRefPunct(tok) {
+    let t = tok;
+    while (t.length && ',.;:!?'.includes(t[t.length - 1]))
+        t = t.slice(0, -1);
+    return t;
+}
+// Find all `@path` references in a task text (B5). Returns the unique paths in
+// order of appearance. A reference is an '@' at a word boundary followed by a
+// token that looks like a file name/path (a known extension). Implemented
+// without regular expressions, like extractPathToken, to keep the source free
+// of escaping pitfalls.
+export function extractAtFileRefs(text) {
+    const s = String(text || '');
+    const chars = Array.from(s);
+    const n = chars.length;
+    const out = [];
+    const seen = new Set();
+    let i = 0;
+    while (i < n) {
+        if (chars[i] !== '@') {
+            i++;
+            continue;
+        }
+        const prev = i > 0 ? chars[i - 1] : '';
+        if (prev && !isRefBoundary(prev)) {
+            i++;
+            continue;
+        }
+        let j = i + 1;
+        let tok = '';
+        while (j < n && !isRefEnd(chars[j])) {
+            tok += chars[j];
+            j++;
+        }
+        const cleaned = stripRefPunct(tok);
+        if (cleaned && looksLikeToken(cleaned) && !seen.has(cleaned)) {
+            seen.add(cleaned);
+            out.push(cleaned);
+        }
+        i = j > i + 1 ? j : i + 1;
+    }
+    return out;
+}
 function looksLikeToken(tok) {
     const t = String(tok || '');
     if (!t || t.length > 500)

package/dist/permissions.js

@@ -0,0 +1,98 @@
+import fs from 'fs';
+import path from 'path';
+export function permissionsPath(workdir) {
+    return path.join(workdir, '.zames', 'permissions.json');
+}
+const ACTIONS = ['allow', 'deny', 'ask'];
+function normAltion(v) {
+    if (typeof v !== 'string')
+        return null;
+    const s = v.toLowerCase();
+    return ACTIONS.includes(s) ? s : null;
+}
+/** Parse the JSON of a permissions file into a policy, or null when empty/broken. */
+export function parsePermissions(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const obj = raw;
+    const defAction = normAltion(obj['default']) ?? 'allow';
+    const rules = Array.isArray(obj['rules']) ? obj['rules'] : [];
+    const out = [];
+    for (const item of rules) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const e = item;
+        const action = normAltion(e['action']);
+        if (!action)
+            continue;
+        out.push({
+            action,
+            tool: typeof e['tool'] === 'string' ? e['tool'] : undefined,
+            command: typeof e['command'] === 'string' ? e['command'] : undefined,
+            path: typeof e['path'] === 'string' ? e['path'] : undefined,
+        });
+    }
+    if (!out.length && defAction === 'allow')
+        return null;
+    return { default: defAction, rules: out };
+}
+/** Read `.zames/permissions.json`. Missing/broken => null (no policy). */
+export function loadPermissions(workdir) {
+    let raw;
+    try {
+        raw = fs.readFileSync(permissionsPath(workdir), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    try {
+        return parsePermissions(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+function safeRegex(source) {
+    try {
+        return new RegExp(source);
+    }
+    catch {
+        return null;
+    }
+}
+// A file path may arrive in any of these keys depending on the tool.
+// We collect them all and match the path regex against ANY of them.
+const PATH_KEYS = ['path', 'file_path', 'notebook_path', 'from', 'to'];
+export function decidePermission(policy, tool, args) {
+    if (!policy)
+        return { action: 'allow', reason: 'no policy' };
+    const a = (args ?? {});
+    const command = typeof a['command'] === 'string' ? a['command'] : '';
+    const paths = PATH_KEYS.map((k) => a[k]).filter((v) => typeof v === 'string');
+    for (const r of policy.rules) {
+        if (r.tool) {
+            const re = safeRegex(r.tool);
+            if (!re || !re.test(tool))
+                continue;
+        }
+        if (r.command) {
+            const re = safeRegex(r.command);
+            if (!re || !command || !re.test(command))
+                continue;
+        }
+        if (r.path) {
+            const re = safeRegex(r.path);
+            if (!re || !paths.some((p) => re.test(p)))
+                continue;
+        }
+        const desc = [
+            r.tool ? 'tool=' + r.tool : '',
+            r.command ? 'command=' + r.command : '',
+            r.path ? 'path=' + r.path : '',
+        ]
+            .filter(Boolean)
+            .join(' ');
+        return { action: r.action, reason: 'rule ' + desc };
+    }
+    return { action: policy.default, reason: 'default' };
+}

package/dist/system-prompt.js

@@ -1,4 +1,26 @@
+import path from 'path';
 import { translate } from './i18n.js';
+// The dev-mode BACKLOG instruction. English (agent-facing) like the rest of the
+// prompt. Deliberately narrow: one short note at most, and only when the idea
+// is OUTSIDE the current task — otherwise the model documents trivia instead
+// of doing the work, and BACKLOG.md grows on every run.
+const BACKLOG_SECTION = `## Self-improvement notes (dev mode)
+
+You are running in the operator's dev mode, so this project is zames itself
+and you may improve it. While working, if you notice a concrete improvement
+that is OUTSIDE the current task — a bug in another module, a cleanup, a
+missing test — append ONE short bullet to BACKLOG.md (Write/Edit) instead of
+silently forgetting it, then continue the task.
+
+Rules for that note:
+- at most one or two per task; do NOT let it distract from the task;
+- do NOT duplicate an item already in BACKLOG.md (read it first if unsure);
+- keep it to a single line: what, why it matters, and a one-line fix sketch;
+- put it under the matching priority section (P0 bug/data loss, P1 noticeable
+  pain, P2 quality, P3 nice-to-have);
+- this is the ONE exception to "do not touch unrelated files". If nothing
+  worth noting, add nothing.
+`;
 /** Render the AGENTS.md / MEMORY / skills / commands blocks of the prompt. */
 export function renderContextSection(context) {
     if (!context)
@@ -24,6 +46,20 @@ export function renderContextSection(context) {
                 f.content +
                 '\n';
     }
+    // B6: nested AGENTS.md/MEMORY.md from the directories this task touches.
+    // Deliberately a SEPARATE section: these apply only to part of the tree and
+    // must not be mistaken for project-wide rules.
+    for (const f of context.scopedAgents || []) {
+        out +=
+            '\n## Scoped instructions (' +
+                f.path +
+                ')\n\n' +
+                'These rules apply ONLY to files under ' +
+                path.dirname(f.path) +
+                ' (the current task touches that directory). Follow them for those files, in addition to the project instructions above.\n\n' +
+                f.content +
+                '\n';
+    }
     if (context.memory.length) {
         out +=
             '\nWhen you learn a durable fact about this project or the operator preferences (build quirks, ' +
@@ -62,7 +98,7 @@ export function renderContextSection(context) {
     }
     return out;
 }
-export function buildSystemPrompt({ workdir, tools, gitContext = null, locale = 'ru', attachments = [], context = null, }) {
+export function buildSystemPrompt({ workdir, tools, gitContext = null, locale = 'ru', attachments = [], context = null, selfImprovement = false, }) {
     const t = translate(locale);
     const toolDescriptions = tools
         .map((t2) => `### ${t2.name}\n${t2.description}\nParameters: ${JSON.stringify(t2.parameters)}`)
@@ -75,6 +111,7 @@ export function buildSystemPrompt({ workdir, tools, gitContext = null, locale =
             `Each [image#N] / [file#N] marker corresponds to a file the user pasted into the terminal; the file was uploaded to the chat and also saved under <project>/tmp. Look at the images in the chat; for files, read the copy in tmp if you need the contents.\n`
         : '';
     const contextSection = renderContextSection(context);
+    const selfSection = selfImprovement ? '\n' + BACKLOG_SECTION + '\n' : '';
     return `You are a coding agent running in a terminal. You help the user with software engineering tasks by reading files, writing code, running commands, and iterating until the task is done.
 
 You work in the directory: ${workdir}
@@ -127,7 +164,7 @@ task is done (or when you must ask the operator), not between tool calls.
 You have access to the following tools:
 
 ${toolDescriptions}
-${gitSection}${attachSection}${contextSection}
+${gitSection}${attachSection}${contextSection}${selfSection}
 ## Choosing the right tool
 
 Prefer the most specific tool; a wrong choice wastes a turn:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.60.0",
+  "version": "2.63.0",
   "description": "Terminal coding agent that drives chat.deepseek.com through Playwright: reads and edits files, runs commands, commits to git.",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
-    "logo.jpg"
+    "logo.jpg",
+    "logo-small.jpg"
   ],
   "scripts": {
     "start": "node ./dist/index.js",

package/scripts/coverage-gate.mjs

@@ -28,6 +28,8 @@ const FLOORS = {
   'tools.ts': 90,
   'system-prompt.ts': 90,
   'undo.ts': 85,
+  'checkpoint.ts': 80,
+  'permissions.ts': 85,
 }
 
 const run = spawnSync(