zames_pro 2.67.3 → 2.68.0

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.68.0] - 2026-10-08
+
+### Changed
+
+- **git:** every git invocation (GitStatus/GitLog/GitBranchList/GitAdd/
+  GitCommit and the `/diff`, `/diffstat`, `/doctor` helpers) now goes
+  through `runGitArgs()` (`execFile` with an argument array, no shell). The
+  last shell-string variant (`runGit`) is gone, so no git argument can ever
+  be interpreted by a shell. `diffGitArgs()` now returns an array.
+- **cleanup:** removed the dead `shellQuote` export (nothing used it after
+  the move to `execFile`).
+- **build:** `prepublishOnly` now runs `build:readme` before `build`, so a
+  published README.md can never drift from `docs/readme.*.md`.
+
+## [2.67.4] - 2026-10-08
+
+### Fixed
+
+- **readme:** `npm run build:readme` generated a `README.ru.md` again even
+  though it is no longer published (removed from `files[]` in 2.67.1) and a
+  test asserted it must not exist — so a local build wrote an untracked file
+  and could trip the drift test. The generator now writes ONLY `README.md`.
+
 ## [2.67.3] - 2026-10-08
 
 ### Fixed

package/dist/commands.js

@@ -22,8 +22,10 @@ export function formatDiff(diffText, opts = {}, t = translate('en')) {
     const rest = lines.length - maxLines;
     return head + NL + t('diff.more_lines', { n: String(rest) });
 }
+// Git arguments for the `/diff` command. An ARRAY (no shell): the caller runs
+// them through runGitArgs(), so nothing is interpreted by a shell. Pure.
 export function diffGitArgs(staged = false) {
-    return staged ? 'git diff --staged' : 'git diff';
+    return staged ? ['diff', '--staged'] : ['diff'];
 }
 // ---------- /diffstat ----------
 /** Render `git diff --stat` output (a compact change summary) for display. */

package/dist/gitTools.js

@@ -1,44 +1,9 @@
-import { exec, execFile } from 'child_process';
+import { execFile } from 'child_process';
 const BS = String.fromCharCode(92);
-export function runGit(cmd, cwd, timeout = 15_000) {
-    return new Promise((resolve) => {
-        exec(cmd, {
-            cwd,
-            timeout,
-            windowsHide: true,
-            maxBuffer: 1024 * 1024 * 8,
-            env: {
-                ...process.env,
-                GIT_TERMINAL_PROMPT: '0',
-                GIT_PAGER: 'cat',
-                PAGER: 'cat',
-            },
-        }, (err, stdout, stderr) => {
-            const out = (stdout || '').toString();
-            const errStr = (stderr || '').toString();
-            if (!err) {
-                const combined = (out + errStr).trim();
-                resolve(combined || '(command produced no output)');
-                return;
-            }
-            const parts = [];
-            if (err.killed)
-                parts.push(`⏱ Timeout ${timeout}ms`);
-            else if (err.code !== undefined && err.code !== null)
-                parts.push(`Exit code: ${err.code}`);
-            else
-                parts.push(`Error: ${err.message}`);
-            if (out.trim())
-                parts.push(out.trim());
-            if (errStr.trim())
-                parts.push(errStr.trim());
-            resolve(parts.join(String.fromCharCode(10)));
-        });
-    });
-}
-// Run git with an argument ARRAY (no shell). Use this whenever an argument
-// comes from the model: the shell never sees it, so $(...), backticks and a
-// leading `-` (option injection) cannot turn a read-only call into a command.
+// Run git with an argument ARRAY (no shell). ALL git invocations go through
+// this: an argument from the model can never be seen by a shell, so $(...),
+// backticks and a leading `-` (option injection) cannot turn a read-only call
+// into a command. There is deliberately NO shell-string variant left.
 export function runGitArgs(args, cwd, timeout = 15_000) {
     return new Promise((resolve) => {
         execFile('git', args, {
@@ -76,13 +41,13 @@ export function runGitArgs(args, cwd, timeout = 15_000) {
     });
 }
 export async function getGitContext(workdir) {
-    const probe = await runGit('git rev-parse --is-inside-work-tree', workdir, 5000);
+    const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], workdir, 5000);
     if (probe.trim() !== 'true')
         return null;
-    const branchR = await runGit('git branch --show-current', workdir, 5000);
-    const statusR = await runGit('git status --porcelain', workdir, 5000);
-    const remoteR = await runGit('git remote', workdir, 5000);
-    const aheadR = await runGit('git rev-list --left-right --count @{upstream}...HEAD', workdir, 5000);
+    const branchR = await runGitArgs(['branch', '--show-current'], workdir, 5000);
+    const statusR = await runGitArgs(['status', '--porcelain'], workdir, 5000);
+    const remoteR = await runGitArgs(['remote'], workdir, 5000);
+    const aheadR = await runGitArgs(['rev-list', '--left-right', '--count', '@{upstream}...HEAD'], workdir, 5000);
     const branch = branchR.trim() || '(detached HEAD)';
     const statusLines = statusR
         .split(String.fromCharCode(10))
@@ -136,7 +101,7 @@ export function formatGitContext(ctx) {
 }
 export function createGitTools(workdir) {
     const ensureRepo = async () => {
-        const probe = await runGit('git rev-parse --is-inside-work-tree', workdir, 5000);
+        const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], workdir, 5000);
         if (probe.trim() !== 'true') {
             return (`Not a git repository: ${workdir}\n` +
                 `Hint: run \`git init\` here, or cd into an existing repo.\n` +
@@ -153,7 +118,7 @@ export function createGitTools(workdir) {
                 const err = await ensureRepo();
                 if (err)
                     return err;
-                return runGit('git status', workdir, 10_000);
+                return runGitArgs(['status'], workdir, 10_000);
             },
         },
         {
@@ -185,7 +150,7 @@ export function createGitTools(workdir) {
                 const err = await ensureRepo();
                 if (err)
                     return err;
-                return runGit(`git log --oneline --decorate -n ${Number(count) || 10}`, workdir, 10_000);
+                return runGitArgs(['log', '--oneline', '--decorate', '-n', String(Number(count) || 10)], workdir, 10_000);
             },
         },
         {
@@ -220,10 +185,13 @@ export function createGitTools(workdir) {
                 const err = await ensureRepo();
                 if (err)
                     return err;
-                // The format string contains parentheses/brackets, which the POSIX
-                // shell would treat as syntax — quote it as one JSON arg.
-                const format = JSON.stringify('%(HEAD) %(refname:short) %(committerdate:relative) %(subject)');
-                return runGit('git branch --sort=-committerdate --format=' + format, workdir, 10_000);
+                // The format string contains parentheses/brackets; as ONE array
+                // element it is passed literally (no shell to choke on it).
+                return runGitArgs([
+                    'branch',
+                    '--sort=-committerdate',
+                    '--format=%(HEAD) %(refname:short) %(committerdate:relative) %(subject)',
+                ], workdir, 10_000);
             },
         },
         {
@@ -244,7 +212,7 @@ export function createGitTools(workdir) {
                     }
                     return runGitArgs(['add', '--', ...list], workdir, 20_000);
                 }
-                return runGit('git add -A', workdir, 20_000);
+                return runGitArgs(['add', '-A'], workdir, 20_000);
             },
         },
         {
@@ -260,13 +228,13 @@ export function createGitTools(workdir) {
                     return 'Error: message is empty.';
                 }
                 // We stage everything only if the index is empty (as the description promises).
-                const staged = await runGit('git diff --cached --name-only', workdir, 10_000);
+                const staged = await runGitArgs(['diff', '--cached', '--name-only'], workdir, 10_000);
                 const stagedTrimmed = staged.trim();
                 const hasStaged = stagedTrimmed !== '' &&
                     stagedTrimmed !== '(command produced no output)';
                 const addResult = hasStaged
                     ? '(index is not empty — add -A skipped)'
-                    : await runGit('git add -A', workdir, 20_000);
+                    : await runGitArgs(['add', '-A'], workdir, 20_000);
                 const fs = await import('fs/promises');
                 const path = await import('path');
                 const os = await import('os');
@@ -291,13 +259,13 @@ export function createGitTools(workdir) {
                     return err;
                 const b = branch && String(branch).trim()
                     ? String(branch).trim()
-                    : (await runGit('git branch --show-current', workdir, 5000)).trim();
+                    : (await runGitArgs(['branch', '--show-current'], workdir, 5000)).trim();
                 if (!b)
                     return 'Error: could not determine the branch to push.';
-                // The branch name reaches the shell command below. Validate it as a
-                // real ref so a model-supplied value cannot smuggle shell metacharacters
-                // (`;`, backticks, `$()`) into `git push`. The remote stays a literal
-                // 'origin' and is not user-controlled.
+                // The branch name reaches git as an argument. Validate it as a real ref
+                // so a model-supplied value cannot smuggle shell metacharacters or a
+                // leading dash. The remote stays a literal 'origin' and is not
+                // user-controlled.
                 if (!/^[A-Za-z0-9._/-]+$/.test(b) || b.startsWith('-')) {
                     return `Error: invalid branch name: ${b}`;
                 }

package/dist/index.js

@@ -2854,24 +2854,24 @@ async function main() {
         }
         if (lower === '/diff' || lower.startsWith('/diff ')) {
             const staged = lower.indexOf('--staged') !== -1;
-            const { runGit } = await import('./gitTools.js');
-            const probe = await runGit('git rev-parse --is-inside-work-tree', currentWorkdir, 5000);
+            const { runGitArgs } = await import('./gitTools.js');
+            const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], currentWorkdir, 5000);
             if (probe.trim() !== 'true') {
                 console.error(theme.error(t('diff.not_repo')));
                 continue;
             }
-            const out = await runGit(mod.commands.diffGitArgs(staged), currentWorkdir, 20_000);
+            const out = await runGitArgs(mod.commands.diffGitArgs(staged), currentWorkdir, 20_000);
             console.log(theme.system(mod.commands.formatDiff(out, { maxLines: 400 }, t)));
             continue;
         }
         if (lower === '/diffstat') {
-            const { runGit } = await import('./gitTools.js');
-            const probe = await runGit('git rev-parse --is-inside-work-tree', currentWorkdir, 5000);
+            const { runGitArgs } = await import('./gitTools.js');
+            const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], currentWorkdir, 5000);
             if (probe.trim() !== 'true') {
                 console.error(theme.error(t('diff.not_repo')));
                 continue;
             }
-            const out = await runGit('git diff --stat', currentWorkdir, 20_000);
+            const out = await runGitArgs(['diff', '--stat'], currentWorkdir, 20_000);
             console.log(theme.system(mod.commands.formatDiffStat(out, { maxLines: 60 }, t)));
             continue;
         }
@@ -2917,14 +2917,14 @@ async function main() {
             continue;
         }
         if (lower === '/doctor') {
-            const { runGit } = await import('./gitTools.js');
+            const { runGitArgs } = await import('./gitTools.js');
             let gitOk = false;
             let gitBranch = null;
             try {
-                const probe = await runGit('git rev-parse --is-inside-work-tree', currentWorkdir, 5000);
+                const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], currentWorkdir, 5000);
                 gitOk = probe.trim() === 'true';
                 if (gitOk) {
-                    gitBranch = (await runGit('git branch --show-current', currentWorkdir, 5000)).trim();
+                    gitBranch = (await runGitArgs(['branch', '--show-current'], currentWorkdir, 5000)).trim();
                 }
             }
             catch {
@@ -2955,7 +2955,7 @@ async function main() {
                 authSaved: authMarkerExists(),
                 contextLimit: config.ui.contextLimit,
                 hasOrigin: gitOk
-                    ? (await runGit('git remote', currentWorkdir, 5000)).includes('origin')
+                    ? (await runGitArgs(['remote'], currentWorkdir, 5000)).includes('origin')
                     : undefined,
                 minSendIntervalMs: config.browser.minSendIntervalMs,
                 sshRemote: !!(process.env.SSH_CONNECTION || process.env.SSH_TTY),

package/dist/shell.js

@@ -4,14 +4,6 @@ import os from 'os';
 // Shared shell runner for the Bash tool and the operator's `!command` escape.
 // Kept in its own module so both call sites use the SAME sandbox guard and the
 // SAME abort wiring; a second, ad-hoc runner would drift from the real one.
-// Quote one argument for POSIX sh: wrap in single quotes and turn every inner
-// single quote into '\''. Inside single quotes sh expands NOTHING, so a value
-// carrying $(...), backticks or $VAR is passed through literally. A plain
-// JSON.stringify is NOT a safe substitute: it produces double quotes, inside
-// which sh still performs command substitution.
-export function shellQuote(arg) {
-    return "'" + String(arg).replace(/'/g, "'\\''") + "'";
-}
 // Sandbox (option A): don't let a shell command go above the project root.
 // This is a protective barrier, not full OS isolation.
 export function assertCommandInsideRoot(root, command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.67.3",
+  "version": "2.68.0",
   "description": "Terminal coding agent that drives chat.deepseek.com through Playwright — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "lint:fix": "node scripts/eslint-ts6.mjs --fix",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\" \"*.{js,json,md}\"",
     "format:check": "prettier --check \"src/**/*.ts\" \"test/**/*.ts\"",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run build:readme && npm run build",
     "test": "tsx --test test/*.test.ts",
     "test:watch": "tsx --test --watch test/*.test.ts",
     "self-smoke": "tsx scripts/self-smoke.mjs",

package/scripts/build-readme.mts

@@ -1,22 +1,21 @@
-// Assemble README.md and README.ru.md from two language sources.
+// Assemble README.md from the two language sources.
 //
 // Why: npm renders exactly ONE readme per package (README.md in the root) and
-// has no language tabs, so a separate README.ru.md is invisible on the npm
-// page. But npm renders the readme with GitHub Flavored Markdown (via
-// GitHub's API), so a <details> block DOES work there -- and on GitHub too.
-// We therefore keep the English text on top and fold the other language into
-// a collapsible block at the bottom. README.ru.md is generated too so the
-// GitHub switcher can point at it directly, but it is NOT published to npm
-// (see "files" in package.json):
-// it would just duplicate the folded block.
+// has no language tabs. npm renders the readme with GitHub Flavored Markdown
+// (via GitHub's API), so a <details> block DOES work there -- and on GitHub
+// too. We keep the English text on top and fold the Russian translation into
+// a collapsible block at the bottom. The language switcher is an in-page
+// `#readme-ru` anchor, so one README.md serves both languages -- there is
+// no separate README.ru.md anymore (it was invisible on npm and just
+// duplicated the folded block).
 //
 // The two sources (docs/readme.en.md, docs/readme.ru.md) are the single point
 // of edit for each language; this script wires the switcher and the collapsible
-// cross-language block so neither README has to be maintained by hand. The
-// generated files are committed; test/readme-built.test.ts re-runs buildReadmes()
-// and fails if they drift from the sources.
+// cross-language block so neither language has to be maintained by hand. The
+// generated file is committed; test/readme-built.test.ts re-runs buildReadmes()
+// and fails if it drifts from the sources.
 //
-// Usage:  npm run build:readme
+// Usage:  npom run build:readme
 
 import fs from 'node:fs'
 import path from 'node:path'
@@ -70,19 +69,14 @@ function details(summary: string, body: string): string {
   ].join(NL)
 }
 
-// Returns the two generated readmes WITHOUT touching the disk, so a test can
-// compare them against the committed files. Both files carry the SAME content
-// (English on top, Russian folded): README.md is what npm publishes, and
-// README.ru.md exists only so the GitHub language switcher has a target. The
-// switcher is an IN-PAGE `#readme-ru` anchor, so it works from either file
-// without fetching the other one.
-export function buildReadmes(rootDir: string): {
-  readmeEn: string
-  readmeRu: string
-} {
+// Returns the generated README.md WITHOUT touching the disk, so a test can
+// compare it against the committed file. Only README.md is generated: the
+// Russian translation lives inside it as a <details> block, and the switcher
+// is an in-page `#readme-ru` anchor.
+export function buildReadmes(rootDir: string): { readmeEn: string } {
   const en = readSource(rootDir, 'readme.en.md')
   const ru = readSource(rootDir, 'readme.ru.md')
-  const doc = [
+  const readmeEn = [
     en.head,
     '',
     EN_SWITCH,
@@ -93,7 +87,7 @@ export function buildReadmes(rootDir: string): {
     details('🇷🇺 Читать по-русски (Russian)', ru.body),
     '',
   ].join(NL)
-  return { readmeEn: doc, readmeRu: doc }
+  return { readmeEn }
 }
 
 // Run only when invoked directly (not when imported by a test).
@@ -101,8 +95,7 @@ const invoked =
   process.argv[1] &&
   path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
 if (invoked) {
-  const { readmeEn, readmeRu } = buildReadmes(root)
+  const { readmeEn } = buildReadmes(root)
   fs.writeFileSync(path.join(root, 'README.md'), readmeEn)
-  fs.writeFileSync(path.join(root, 'README.ru.md'), readmeRu)
-  console.log('build-readme: wrote README.md and README.ru.md')
+  console.log('build-readme: wrote README.md')
 }