zames_pro 2.72.8 → 2.72.9

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.72.9] - 2026-10-10
+
+### Fixed
+
+- **release:** do not duplicate the Unreleased body into the version section
+- **context:** raise the context budget and split agents/memory pools
+- **browser:** handle the DeepSeek email MFA dialog on login
+- **subagent:** fail safe when the parent chat id is unknown
+- **tools:** honor a skill's allowed-tools frontmatter
+- **context:** keep newest MEMORY.md notes and write facts to the project memory
+
 ## [2.72.8] - 2026-10-09
 
 ### Fixed

package/dist/browser-dom.js

@@ -57,6 +57,27 @@ export function readLoginErrorInDom() {
     }
     return out.replace(/\s+/g, ' ').trim();
 }
+/**
+ * Read the account email shown in the MFA verification dialog, so the operator
+ * knows WHERE the one-time code was sent (the code arrives by email; without
+ * this the operator cannot tell which inbox to check). Best-effort: '' when the
+ * dialog or the email line is absent.
+ */
+export function readMfaAccountInDom() {
+    const sels = [
+        '.ds-mfa-verification-account',
+        '.ds-mfa-verification-modal [title*="@"]',
+    ];
+    for (const s of sels) {
+        const el = document.querySelector(s);
+        if (!el)
+            continue;
+        const t = (el.getAttribute('title') || el.innerText || '').trim();
+        if (t)
+            return t;
+    }
+    return '';
+}
 /**
  * The answer as RENDERED on the page, ALWAYS from the DOM (never the network
  * capture). Reasoning blocks (think class) are skipped and must never be

package/dist/browser.js

@@ -2,9 +2,9 @@ import { chromium, } from 'playwright';
 import { extractAnswer, extractTokenUsage, dumpNetBody, isFinishedWithoutAnswer, } from './net-capture.js';
 import { rewriteFailedAttachments } from './commands.js';
 import { parseHistoryMessages, extractChatMessages, scrapeChatList, scrapeChatMessages, } from './browser-chats.js';
-import { CHAT_URL, CHAT_ID_RE, chatUrl, HISTORY_MESSAGES_URL, BUTTON_CLASS_RE, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, CONTINUE_NAME_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, RESTORE_ANSWER_SELECTORS, ASSISTANT_CLASS_RE, ASSISTANT_SELECTOR, ANSWER_MARKDOWN_SELECTOR, MARKDOWN_SELECTOR, CHAT_SIGNAL_NODES_SELECTOR, NEW_CHAT_SELECTOR, NEW_CHAT_TEXT_RE, PASSWORD_SELECTORS, LOGIN_SELECTORS, LOGIN_SUBMIT_SELECTORS, LOGIN_BUTTON_SELECTOR, LOGIN_NAME_RE, LOGIN_FORM_SUBMIT_RE, SIDEBAR_TOGGLE_SELECTORS, TOGGLE_SELECTORS, DEEP_THINKING_RE, WEB_SEARCH_RE, ATTACH_SELECTORS, ANSWER_URL_RE, } from './deepseek-ui.js';
+import { CHAT_URL, CHAT_ID_RE, chatUrl, HISTORY_MESSAGES_URL, BUTTON_CLASS_RE, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, CONTINUE_NAME_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, RESTORE_ANSWER_SELECTORS, ASSISTANT_CLASS_RE, ASSISTANT_SELECTOR, ANSWER_MARKDOWN_SELECTOR, MARKDOWN_SELECTOR, CHAT_SIGNAL_NODES_SELECTOR, NEW_CHAT_SELECTOR, NEW_CHAT_TEXT_RE, PASSWORD_SELECTORS, LOGIN_SELECTORS, LOGIN_SUBMIT_SELECTORS, MFA_CODE_SELECTORS, MFA_SUBMIT_SELECTORS, MFA_SEND_CODE_SELECTORS, MFA_SEND_CODE_RE, LOGIN_BUTTON_SELECTOR, LOGIN_NAME_RE, LOGIN_FORM_SUBMIT_RE, SIDEBAR_TOGGLE_SELECTORS, TOGGLE_SELECTORS, DEEP_THINKING_RE, WEB_SEARCH_RE, ATTACH_SELECTORS, ANSWER_URL_RE, } from './deepseek-ui.js';
 import { probeUiHealth, } from './ui-health.js';
-import { readPageToastsInDom, readLoginErrorInDom, readLastAnswerInDom, chatSignalInDom, continueVisibleCheapInDom, stopButtonVisibleInDom, clickStopInDom, continueVisibleInDom, clickContinueInDom, readUserAgentInDom, findLoginInputIndexInDom, submitLoginFormInDom, setBusyTitleInDom, pasteTextIntoElement, readElementText, elementTagNameInDom, isElementEnabledInDom, readInputTrimmedTextInDom, dumpDomCountsInDom, } from './browser-dom.js';
+import { readPageToastsInDom, readLoginErrorInDom, readMfaAccountInDom, readLastAnswerInDom, chatSignalInDom, continueVisibleCheapInDom, stopButtonVisibleInDom, clickStopInDom, continueVisibleInDom, clickContinueInDom, readUserAgentInDom, findLoginInputIndexInDom, submitLoginFormInDom, setBusyTitleInDom, pasteTextIntoElement, readElementText, elementTagNameInDom, isElementEnabledInDom, readInputTrimmedTextInDom, dumpDomCountsInDom, } from './browser-dom.js';
 import path from 'path';
 import os from 'os';
 import fs from 'fs/promises';
@@ -554,10 +554,17 @@ export class DeepSeekBrowser {
         const filled = await this._fillLoginForm(this.auth.username, this.auth.password);
         if (!filled)
             return false;
-        const ok = await this._waitLoggedIn(20_000);
-        if (ok)
+        const ok = await this._waitLoggedInOrMfa(20_000);
+        if (ok) {
             await this._persistSessionIfNeeded();
-        return ok;
+            return true;
+        }
+        // Password accepted but DeepSeek now wants an email one-time code: ask the
+        // operator for it instead of failing the whole auto-login.
+        if (process.stdin.isTTY && (await this._mfaVisible())) {
+            return await this._handleMfaIfPresent();
+        }
+        return false;
     }
     /**
      * Ask the operator for login/password in the terminal (only in a TTY) and
@@ -602,7 +609,7 @@ export class DeepSeekBrowser {
             console.log(theme.warn(this._t('auth.form_not_found')));
             return false;
         }
-        const ok = await this._waitLoggedIn(20_000);
+        const ok = await this._waitLoggedInOrMfa(20_000);
         if (ok) {
             // Remember the credentials so the next launch can re-login silently.
             this.auth.username = user;
@@ -610,10 +617,23 @@ export class DeepSeekBrowser {
             await this._persistSessionIfNeeded();
             this.onAuthSave?.(user, password);
             console.log(theme.assistant(this._t('auth.auto_login_ok')));
+            return true;
         }
-        else {
-            // Detect a credentials error shown by DeepSeek, otherwise report a
-            // generic failure with the page hint so the operator can react.
+        // Password accepted, but DeepSeek wants an email one-time code. Ask the
+        // operator for it and submit the dialog.
+        if (await this._mfaVisible()) {
+            // The credentials are valid — remember them even before MFA completes,
+            // so the next launch can skip straight to the code dialog.
+            this.auth.username = user;
+            this.auth.password = password;
+            this.onAuthSave?.(user, password);
+            const mfaOk = await this._handleMfaIfPresent();
+            if (mfaOk)
+                return true;
+        }
+        // Detect a credentials error shown by DeepSeek, otherwise report a
+        // generic failure with the page hint so the operator can react.
+        {
             const reason = await this._readLoginError();
             if (reason) {
                 console.log(theme.error(this._t('auth.login_rejected', { v: reason })));
@@ -622,7 +642,7 @@ export class DeepSeekBrowser {
                 console.log(theme.warn(this._t('auth.auto_login_failed', { v: this._t('auth.no_reason') })));
             }
         }
-        return ok;
+        return false;
     }
     /**
      * Read a visible login/credentials error message from the page, if any.
@@ -677,7 +697,11 @@ export class DeepSeekBrowser {
         // After each attempt we give the login a short window and stop as soon as
         // it succeeds, so a stray click does not fire on an already-logged-in page.
         const tryLogin = async () => {
-            if (await this._waitLoggedIn(3000))
+            if (await this._waitLoggedInOrMfa(3000))
+                return true;
+            // An MFA dialog also means the password step was ACCEPTED — stop
+            // submitting, the caller will ask the operator for the one-time code.
+            if (await this._mfaVisible())
                 return true;
             return false;
         };
@@ -734,6 +758,121 @@ export class DeepSeekBrowser {
         }
         return false;
     }
+    /**
+     * Like `_waitLoggedIn`, but the input field ALSO appears right after the
+     * password step even when DeepSeek demands an MFA one-time code — the code
+     * dialog only BLOCKS the first message. A plain `_waitLoggedIn` would then
+     * report success, swallow the real login failure (the next send would hit the
+     * dialog and hang), and never ask the operator for the code. Detect the MFA
+     * input first and treat it as "not logged in yet".
+     */
+    async _waitLoggedInOrMfa(timeoutMs) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            if (await this._mfaVisible())
+                return false;
+            if (await this.isLoggedIn().catch(() => false))
+                return true;
+            await this.page.waitForTimeout(500);
+        }
+        return false;
+    }
+    /** Is the email one-time-code (MFA) dialog currently shown? */
+    async _mfaVisible() {
+        return await this._findVisible(MFA_CODE_SELECTORS, 300)
+            .then((l) => !!l)
+            .catch(() => false);
+    }
+    /**
+     * Handle DeepSeek's email MFA dialog ("Verify your account"). It appears
+     * after a correct password when the account has two-step verification on. The
+     * code is sent by email; we ask the operator for it in the terminal and type
+     * it into the dialog. Returns true when the session became active, false when
+     * there is no dialog or the operator could not complete it.
+     */
+    async _handleMfaIfPresent() {
+        const codeInput = await this._findVisible(MFA_CODE_SELECTORS, 1000);
+        if (!codeInput)
+            return false;
+        const account = await this.page
+            .evaluate(readMfaAccountInDom)
+            .catch(() => '');
+        // The dialog opens with an EMPTY field: the email is only sent after
+        // "Send code" is clicked. Press it first (only when it is not already
+        // counting down), then ask the operator for the code that just arrived.
+        const clicked = await this._clickMfaSendCode();
+        console.log('\n' +
+            theme.warn(this._t(clicked ? 'auth.mfa_code_sent' : 'auth.mfa_required', {
+                v: account || '—',
+            })));
+        const readline = await import('readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+            terminal: true,
+        });
+        const code = (await new Promise((resolve) => rl.question(this._t('auth.mfa_prompt'), (a) => resolve(a))))
+            .trim()
+            .replace(/\s+/g, '');
+        rl.close();
+        if (!code)
+            return false;
+        await this._setInputText(codeInput, code);
+        await this.page.waitForTimeout(150);
+        // Submit the code. Prefer the dialog's own submit button; fall back to
+        // Enter in the code field (the form submits on Enter).
+        let submitted = false;
+        for (const sel of MFA_SUBMIT_SELECTORS) {
+            const btn = this.page.locator(sel).last();
+            try {
+                if ((await btn.count()) === 0)
+                    continue;
+                if (!(await btn.isVisible().catch(() => false)))
+                    continue;
+                await btn.click({ timeout: 2000 });
+                submitted = true;
+                break;
+            }
+            catch { }
+        }
+        if (!submitted)
+            await codeInput.press('Enter').catch(() => { });
+        const ok = await this._waitLoggedIn(20_000);
+        if (ok) {
+            await this._persistSessionIfNeeded();
+            console.log(theme.assistant(this._t('auth.auto_login_ok')));
+        }
+        else {
+            const reason = await this._readLoginError();
+            console.log(theme.warn(this._t('auth.mfa_failed', {
+                v: reason || this._t('auth.no_reason'),
+            })));
+        }
+        return ok;
+    }
+    /**
+     * Click the dialog's "Send code" button. Returns false when it is absent or
+     * already counting down (a resend cooldown), so we never hammer the endpoint.
+     */
+    async _clickMfaSendCode() {
+        for (const sel of MFA_SEND_CODE_SELECTORS) {
+            const btn = this.page.locator(sel).last();
+            try {
+                if ((await btn.count()) === 0)
+                    continue;
+                if (!(await btn.isVisible().catch(() => false)))
+                    continue;
+                const label = ((await btn.innerText().catch(() => '')) || '').trim();
+                // Only click a REAL request button, never the countdown that replaces it.
+                if (label && !MFA_SEND_CODE_RE.test(label))
+                    continue;
+                await btn.click({ timeout: 2000 });
+                return true;
+            }
+            catch { }
+        }
+        return false;
+    }
     /**
      * Persist the authenticated session. The persistent profile already keeps
      * cookies on disk; `saveSession` (config) is kept as an explicit toggle for

package/dist/config-command.js

@@ -0,0 +1,118 @@
+// The /config subcommand DISPATCH (BACKLOG C3). The PURE text rendering lives
+// in config-commands.ts; this module owns the parsing/routing of the text
+// subcommands (list/get/set/reset/lang/path) and prints through injected
+// callbacks. Everything that touches live state (the runtime config object,
+// the browser toggles, the LineEditor, the interactive menu) is injected, so
+// the dispatch itself is unit-tested without a live agent.
+//
+// The interactive menu (`/config` bare or `menu`) is delegated to openMenu()
+// because it pauses the editor and reads keys itself.
+import { theme } from './theme.js';
+import { configGetValue, configValueHint } from './config-commands.js';
+/**
+ * Handle a `/config <sub>` text command. Never throws for a bad subcommand or
+ * argument: it prints a message and returns, so the caller can `await` it
+ * blindly from the main loop and from the live mid-run interception.
+ */
+export async function handleConfigCommand(input, deps) {
+    const { t, print, printErr, getValue, setValue, resetField, showList, openMenu, currentLocale, normalizeLocale, localeDisplayName, homeConfigPath, projectConfigPath, } = deps;
+    const schema = deps.schema;
+    const parts = input.trim().split(/\s+/);
+    const sub = (parts[1] || '').toLowerCase();
+    // With no subcommand - the menu (or a text list in non-TTY).
+    if (!sub || sub === 'menu' || sub === 'ui') {
+        await openMenu();
+        return;
+    }
+    if (sub === 'list' || sub === 'show' || sub === 'ls') {
+        showList();
+        return;
+    }
+    if (sub === 'path' || sub === 'paths') {
+        print(theme.system(t('cfg.paths', { global: homeConfigPath, project: projectConfigPath })));
+        return;
+    }
+    // /config lang <ru|en> - quick access to ui.locale
+    if (sub === 'lang' || sub === 'language' || sub === 'язык') {
+        const val = parts[2];
+        if (!val) {
+            print(theme.system(t('status.locale', { v: localeDisplayName(currentLocale()) })));
+            print(theme.dim(t('cfg.lang_usage')));
+            return;
+        }
+        const field = schema.find((f) => f.path === 'ui.locale');
+        if (!field)
+            return;
+        const loc = normalizeLocale(val);
+        try {
+            setValue(field, loc);
+        }
+        catch (e) {
+            printErr(theme.error(t('cfg.write_error', { v: e.message })));
+            return;
+        }
+        print(theme.assistant(t('cfg.lang_set', { v: localeDisplayName(loc) })));
+        return;
+    }
+    if (sub === 'get') {
+        const key = parts[2];
+        if (!key) {
+            print(theme.dim(t('cfg.usage')));
+            return;
+        }
+        const field = schema.find((f) => f.path === key);
+        if (!field) {
+            printErr(theme.error(t('cfg.unknown_key', { v: key })));
+            return;
+        }
+        const cur = getValue(key);
+        print(theme.system(t('cfg.value', { v: key, value: configGetValue(key, cur, t) })));
+        return;
+    }
+    if (sub === 'set') {
+        const key = parts[2];
+        const raw = parts.slice(3).join(' ');
+        const field = schema.find((f) => f.path === key);
+        if (!field) {
+            printErr(theme.error(t('cfg.unknown_key', { v: key || '' })));
+            return;
+        }
+        if (!raw) {
+            print(theme.dim(t('cfg.usage')));
+            return;
+        }
+        try {
+            setValue(field, raw);
+        }
+        catch {
+            printErr(theme.error(t('cfg.bad_value', { v: key, type: configValueHint(field, t) })));
+            return;
+        }
+        print(theme.assistant(t('cfg.saved', {
+            v: key,
+            value: JSON.stringify(getValue(key)),
+            file: homeConfigPath,
+        })));
+        return;
+    }
+    if (sub === 'reset' || sub === 'unset') {
+        const key = parts[2];
+        const field = schema.find((f) => f.path === key);
+        if (!field) {
+            printErr(theme.error(t('cfg.unknown_key', { v: key || '' })));
+            return;
+        }
+        try {
+            resetField(field);
+        }
+        catch (e) {
+            printErr(theme.error(t('cfg.write_error', { v: e.message })));
+            return;
+        }
+        print(theme.assistant(t('cfg.reset', { v: key })));
+        return;
+    }
+    // Unknown subcommand - show the list.
+    printErr(theme.error(t('cfg.unknown_key', { v: sub })));
+    showList();
+}

package/dist/context.js

@@ -58,25 +58,45 @@ const BUILTIN_SKILLS = [
             '4. Do NOT change code. Answer in the operator language.',
     },
 ];
-const MAX_FILE_BASE = 60000;
-const MAX_TOTAL = 240000;
+// Per-file budgets. AGENTS.md/MEMORY.md are hand-maintained and grow over
+// time, so the caps are generous: an AGENTS.md of a real project (this repo's
+// own file is ~69k) must NOT be silently cut. The old 60k cap already
+// truncated it. Set higher and split per kind so a huge AGENTS.md can no
+// longer starve MEMORY.md of the shared pool (the old single pool filled on
+// agents first, so memory was dropped WHOLE when agents were large).
+export const MAX_FILE_BASE = 120000;
+/** MEMORY.md is append-only, so it gets its own (larger) budget. */
+export const MAX_MEMORY_FILE = 200000;
+/** Total spent on the AGENTS.md chain (project instructions + scoped). */
+const MAX_AGENTS_TOTAL = 240000;
+/** Total spent on the MEMORY.md chain, independent of the agents pool. */
+const MAX_MEMORY_TOTAL = 200000;
 const CRLF_RE = /\r\n/g;
 const NL = String.fromCharCode(10);
-function clipIf(name, content, budget) {
+function clipIf(name, content, budget, fromTail = false) {
     const cleaned = content.replace(CRLF_RE, NL).trim();
     if (cleaned.length <= budget)
         return cleaned;
     const keep = Math.max(0, budget - 120);
-    return (cleaned.slice(0, keep) +
-        NL +
-        NL +
-        '[... ' +
+    const marker = '[... ' +
         name +
         ' truncated (' +
         (cleaned.length - keep) +
-        ' chars omitted) ...]');
+        ' chars omitted) ...]';
+    // MEMORY.md is APPENDED to over time, so its newest (most relevant) notes
+    // live at the TAIL — a head clip would drop exactly those. Keep the tail
+    // for memory files, the head for AGENTS.md (whose top is the summary).
+    if (!fromTail)
+        return cleaned.slice(0, keep) + NL + NL + marker;
+    let slice = cleaned.slice(cleaned.length - keep);
+    // Cut at a NOTE boundary, not mid-note: start the kept tail at the next line
+    // that begins a bullet or a heading, so a half-sentence note is not left.
+    const m = slice.search(/\n(?=[-*] |#{1,6} )/);
+    if (m > 0)
+        slice = slice.slice(m + 1);
+    return marker + NL + NL + slice;
 }
-async function readIfFile(p, budget) {
+async function readIfFile(p, budget, fromTail = false) {
     try {
         const st = await fs.stat(p);
         if (!st.isFile())
@@ -85,7 +105,7 @@ async function readIfFile(p, budget) {
         // An EXISTING but empty file is still present: keep it so the prompt
         // shows an (empty) AGENTS.md/MEMORY.md section instead of silently
         // dropping the file. Only a read failure returns null.
-        const content = clipIf(path.basename(p), raw, budget);
+        const content = clipIf(path.basename(p), raw, budget, fromTail);
         return { path: p, content };
     }
     catch {
@@ -367,7 +387,8 @@ async function loadMemoryChain(workdir) {
         path.join(os.homedir(), '.zames', 'MEMORY.md'),
         path.join(os.homedir(), '.claude', 'MEMORY.md'),
     ]) {
-        const f = await readIfFile(p, MAX_FILE_BASE);
+        // Memory is append-only, so clip from the TAIL to keep the newest notes.
+        const f = await readIfFile(p, MAX_MEMORY_FILE, true);
         if (f && !seen.has(f.path)) {
             seen.add(f.path);
             out.push(f);
@@ -378,7 +399,7 @@ async function loadMemoryChain(workdir) {
         const p = await findNamedFile(dir, MEMORY_NAMES);
         if (!p || seen.has(p))
             continue;
-        const f = await readIfFile(p, MAX_FILE_BASE);
+        const f = await readIfFile(p, MAX_MEMORY_FILE, true);
         if (f) {
             seen.add(p);
             out.push(f);
@@ -394,24 +415,31 @@ export async function loadProjectContext(workdir, touchPaths = []) {
         loadCommands(workdir).catch(() => []),
     ]);
     const scopedAgents = await loadScopedAgents(workdir, touchPaths).catch(() => []);
-    let used = 0;
-    const withinBudget = (files) => {
+    // SEPARATE pools for agents and memory: the old single pool filled on the
+    // agents chain first, so a large AGENTS.md dropped MEMORY.md WHOLE. Each
+    // category now has its own budget, and memory can never be starved by
+    // project instructions (or vice versa).
+    const takeWithin = (files, total) => {
+        let used = 0;
         const kept = [];
         for (const f of files) {
-            if (used + f.content.length > MAX_TOTAL)
+            if (used + f.content.length > total)
                 break;
             used += f.content.length;
             kept.push(f);
         }
         return kept;
     };
+    const keptAgents = takeWithin(agents, MAX_AGENTS_TOTAL);
+    const agentsUsed = keptAgents.reduce((n, f) => n + f.content.length, 0);
+    const keptScoped = takeWithin(scopedAgents, MAX_AGENTS_TOTAL - agentsUsed);
     return {
-        agents: withinBudget(agents),
-        // Scoped files are dropped silently when the total budget is already spent
+        agents: keptAgents,
+        // Scoped files are dropped silently when the AGENTS pool is already spent
         // on the main chain: a nested AGENTS.md is an optimization, not a hard
         // requirement, and must never push out a top-level instruction.
-        scopedAgents: withinBudget(scopedAgents),
-        memory: withinBudget(memory),
+        scopedAgents: keptScoped,
+        memory: takeWithin(memory, MAX_MEMORY_TOTAL),
         skills,
         commands,
     };

package/dist/deepseek-ui.js

@@ -164,6 +164,39 @@ export const LOGIN_SUBMIT_SELECTORS = [
     'div[role="button"]:has-text("Sign in")',
     'div[role="button"]:has-text("Войти")',
 ];
+// ---------- MFA / email verification ----------
+//
+// After a correct password DeepSeek may demand a one-time code sent to the
+// account email (the `.ds-mfa-verification-modal` dialog). The code input is
+// the reliable anchor: `autocomplete=one-time-code` is a semantic attribute
+// that survives class renames, so detection does not depend on DeepSeek's CSS.
+// The submit button is matched both by its own class and by its label, since
+// the modal is a newer component whose classes we cannot pin down.
+export const MFA_CODE_SELECTORS = [
+    'input[autocomplete="one-time-code"]',
+    '.ds-mfa-verification-modal input[type="tel"]',
+    'input[inputmode="numeric"][maxlength="6"]',
+];
+export const MFA_MODAL_SELECTOR = '.ds-mfa-verification-modal, [role="dialog"]';
+export const MFA_SUBMIT_SELECTORS = [
+    'div[role="button"].ds-mfa-verification-submit',
+    '.ds-mfa-verification-modal div[role="button"].ds-button--primary',
+    'div[role="button"]:has-text("Verify and log in")',
+    'div[role="button"]:has-text("Verify")',
+    'div[role="button"]:has-text("Подтвердить")',
+    'div[role="button"]:has-text("Войти")',
+];
+// The email is NOT sent until the operator clicks "Send code" — the dialog only
+// shows an empty field and a request button. The button lives inside the code
+// field suffix and turns into a countdown ("Resend in 60s") once clicked, so we
+// match it by its TEXT and skip it when it is already counting down.
+export const MFA_SEND_CODE_RE = /^(send code|resend|отправить\s*код|отправить\s*повторно|выслать\s*код)\s*$/i;
+export const MFA_SEND_CODE_SELECTORS = [
+    '.ds-verify-code-input-countdown',
+    '.ds-mfa-verification-modal div[role="button"]',
+    'div[role="button"]:has-text("Send code")',
+    'div[role="button"]:has-text("Отправить код")',
+];
 // ---------- sidebar / chats ----------
 export const SIDEBAR_TOGGLE_SELECTORS = [
     'button[aria-label*="sidebar" i]',

package/dist/i18n/common.js

@@ -29,10 +29,6 @@ export const commonMessages = {
         ru: 'System prompt на след. задаче: {v}',
         en: 'System prompt next task: {v}',
     },
-    'status.resend': {
-        ru: 'Resend prompt (--resend-prompt): {v}',
-        en: 'Resend prompt (--resend-prompt): {v}',
-    },
     'status.last_chat': { ru: 'Last chat: {v}', en: 'Last chat: {v}' },
     'status.sessions': { ru: 'Сессии: {v}', en: 'Sessions: {v}' },
     'status.dev': {
@@ -145,14 +141,6 @@ export const commonMessages = {
         ru: 'Транскрипт: {transcript} · чат: {chat}',
         en: 'Transcript: {transcript} · chat: {chat}',
     },
-    'msg.abort_gen': {
-        ru: '⏹ Esc — прерываю генерацию...',
-        en: '⏹ Esc — aborting generation...',
-    },
-    'msg.abort_ctrlc': {
-        ru: '⏹ Ctrl+C — прерываю генерацию...',
-        en: '⏹ Ctrl+C — aborting generation...',
-    },
     'msg.queued': { ru: '📨 В очередь ({n}): ', en: '📨 Queued ({n}): ' },
     // TTY variant: the editor already echoed the message text, so only the
     // count is shown (no repeated text).
@@ -301,10 +289,6 @@ export const commonMessages = {
         en: 'undo is disabled in the config',
     },
     'rewind.empty': { ru: 'Чекпойнтов нет.', en: 'No checkpoints.' },
-    'rewind.created': {
-        ru: '📸 Чекпойнт: {v}',
-        en: '📸 Checkpoint: {v}',
-    },
     'rewind.list_title': { ru: 'Чекпойнты:', en: 'Checkpoints:' },
     'rewind.reverted': {
         ru: '↶ Откатили рабочее дерево к чекпойнту {v}',

package/dist/i18n/config.js

@@ -148,7 +148,6 @@ export const configMessages = {
         en: 'Persist the login session in the profile',
     },
     'cfg.title': { ru: 'Настройки zames', en: 'zames settings' },
-    'cfg.current': { ru: 'Текущий конфиг:', en: 'Current config:' },
     'cfg.usage': {
         ru: 'Использование: /config [menu | list | get <путь> | set <путь> <значение> | reset <путь> | path | lang <ru|en>]',
         en: 'Usage: /config [menu | list | get <path> | set <path> <value> | reset <path> | path | lang <ru|en>]',
@@ -179,7 +178,6 @@ export const configMessages = {
         ru: 'Конфиг (глобальный): {global}\nКонфиг (проект): {project}',
         en: 'Config (global): {global}\nConfig (project): {project}',
     },
-    'cfg.keys': { ru: 'Доступные параметры:', en: 'Available settings:' },
     'cfg.lang_set': {
         ru: 'Язык переключён на {v}.',
         en: 'Language switched to {v}.',
@@ -188,20 +186,4 @@ export const configMessages = {
         ru: 'Использование: /config lang <ru|en>',
         en: 'Usage: /config lang <ru|en>',
     },
-    'cfg.scope_current': {
-        ru: 'Запись конфига: {v} ({file})',
-        en: 'Config write scope: {v} ({file})',
-    },
-    'cfg.scope_usage': {
-        ru: 'Использование: /config scope <project|home>. project = .zamesrc.json (в git), home = ~/.zames/. Для личных настроек выбери home, чтобы не коммитить их.',
-        en: 'Usage: /config scope <project|home>. project = .zamesrc.json (committed), home = ~/.zames/. Use home for personal settings so they are not committed.',
-    },
-    'cfg.scope_set': {
-        ru: 'Запись конфига: {v} ({file})',
-        en: 'Config write scope: {v} ({file})',
-    },
-    'cfg.scope_bad': {
-        ru: 'Неизвестный scope: {v}. Используй project или home.',
-        en: 'Unknown scope: {v}. Use project or home.',
-    },
 };

package/dist/i18n/deepseek.js

@@ -88,10 +88,6 @@ export const deepseekMessages = {
         ru: '⏳ Агент не распознал ответ модели — прошу продолжить ({attempt}/{max})...',
         en: '⏳ The agent did not recognize the model answer — asking it to continue ({attempt}/{max})...',
     },
-    'ds.stalled': {
-        ru: '⚠ Агент остановился, не завершив задачу (модель перестала вызывать инструменты). Проверь чат DeepSeek — задача может быть не выполнена.',
-        en: '⚠ The agent stopped before finishing (the model stopped calling tools). Check the DeepSeek chat — the task may be incomplete.',
-    },
     'ds.not_launched': {
         ru: '✖ Браузер не запущен.',
         en: '✖ The browser is not launched.',
@@ -145,17 +141,21 @@ export const deepseekMessages = {
         ru: 'Войдите в DeepSeek: откройте https://chat.deepseek.com/ в своём браузере. Если включён headless — задайте логин/пароль через /config или запустите с --headed.',
         en: 'Sign in to DeepSeek: open https://chat.deepseek.com/ in your browser. If headless is on — set the login/password via /config or run with --headed.',
     },
-    'auth.session_saved': {
-        ru: 'Сессия DeepSeek сохранена.',
-        en: 'DeepSeek session saved.',
+    'auth.mfa_required': {
+        ru: '🔐 DeepSeek требует код подтверждения на почту {v}.',
+        en: '🔐 DeepSeek requires a verification code sent to {v}.',
+    },
+    'auth.mfa_code_sent': {
+        ru: '🔐 DeepSeek требует код подтверждения. Запросил код на почту {v} — проверь почту.',
+        en: '🔐 DeepSeek requires a verification code. Requested a code to {v} — check your inbox.',
     },
-    'auth.session_restored': {
-        ru: 'Сессия DeepSeek восстановлена.',
-        en: 'DeepSeek session restored.',
+    'auth.mfa_prompt': {
+        ru: 'Код из письма: ',
+        en: 'Code from the email: ',
     },
-    'auth.enter_to_continue': {
-        ru: 'Нажмите Enter, чтобы продолжить...',
-        en: 'Press Enter to continue...',
+    'auth.mfa_failed': {
+        ru: 'Код подтверждения не принят: {v}',
+        en: 'The verification code was not accepted: {v}',
     },
     'cfg.menu.title': {
         ru: '⚙ Настройки — выбери параметр',

package/dist/i18n/doctor.js

@@ -127,10 +127,6 @@ export const doctorMessages = {
         ru: 'Часть модулей не перезагрузилась:',
         en: 'Some modules failed to reload:',
     },
-    'msg.reload_done': {
-        ru: 'Перезагружено модулей: {n}. Браузер и чат не тронуты.',
-        en: 'Reloaded modules: {n}. Browser and chat untouched.',
-    },
     'msg.reload_error': { ru: 'Ошибка reload:', en: 'Reload error:' },
     'msg.abort_gen_short': {
         ru: '⏹ Esc — прерываю генерацию...',

package/dist/i18n/help.js

@@ -377,10 +377,6 @@ export const helpMessages = {
         ru: '🗜️ Сжимаю историю чата (DeepSeek)...',
         en: '🗜️ Compacting the chat history (DeepSeek)...',
     },
-    'compact.empty': {
-        ru: 'Нечего сжимать: в чате ещё нет ответов.',
-        en: 'Nothing to compact: the chat has no answers yet.',
-    },
     'compact.summary_failed': {
         ru: 'Не удалось получить резюме от модели: {v}',
         en: 'Could not get the summary from the model: {v}',
@@ -461,10 +457,6 @@ export const helpMessages = {
         ru: '🧠 Заметка добавлена в {v}',
         en: '🧠 Note appended to {v}',
     },
-    'init.exists': {
-        ru: 'AGENTS.md уже существует: {v}',
-        en: 'AGENTS.md already exists: {v}',
-    },
     'init.created': { ru: 'Создан {v}', en: 'Created {v}' },
     'init.analyzing': {
         ru: 'Изучаю проект и готовлю AGENTS.md...',

package/dist/i18n/prompt.js

@@ -4,10 +4,6 @@ export const promptMessages = {
         ru: 'ВАЖНО: отвечай оператору на русском языке. Весь текст в поле message инструмента respond, а также любые пояснения — на русском.',
         en: 'IMPORTANT: reply to the operator in English. All text in the respond tool message field, and any explanations, must be in English.',
     },
-    'prompt.tools_header': {
-        ru: 'You have access to the following tools:',
-        en: 'You have access to the following tools:',
-    },
     // The hard "ONLY TOOL CALLS" block. All prose around a tool call is a
     // protocol violation: the operator never sees it (only tool calls and the
     // final respond reach the terminal), so it is pure pollution. We cannot

package/dist/i18n/self-review.js

@@ -112,7 +112,6 @@ export const selfReviewMessages = {
         ru: '\nИспользуй /resume <n> для продолжения.\n',
         en: '\nUse /resume <n> to continue.\n',
     },
-    'chats.none': { ru: 'Чатов не найдено.', en: 'No chats found.' },
     'chats.none_hint': {
         ru: 'Чатов не найдено. Возможно, сайдбар свёрнут или селекторы устарели.',
         en: 'No chats found. The sidebar may be collapsed or the selectors are outdated.',
@@ -142,10 +141,6 @@ export const selfReviewMessages = {
         en: 'No chat #{n}. Total: {total}.',
     },
     'chats.opening': { ru: 'Открываю: {v}', en: 'Opening: {v}' },
-    'chats.context_kept': {
-        ru: ' Контекст чата сохранён. Системный промпт будет переслан на следующей задаче.\n',
-        en: ' Chat context kept. The system prompt will be resent on the next task.\n',
-    },
     'chats.prompt_will_resend': {
         ru: ' Системный промпт будет переслан на следующей задаче.\n',
         en: ' System prompt will be resent on the next task.\n',

package/dist/index.js

@@ -6,7 +6,7 @@ import { existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { theme } from './theme.js';
 import { DeepSeekBrowser, headlessUACacheReady } from './browser.js';
-import { createTools, mergeTools, filterToolsForReadOnly } from './tools.js';
+import { createTools, mergeTools, filterToolsForReadOnly, filterToolsByAllowList, } from './tools.js';
 import { createTodoStore, getTodos, setTodos, resetTodos, renderTodos, } from './extraTools.js';
 import { runAgentLoop } from './agent-loop.js';
 import { createSubagentRunner } from './subagent.js';
@@ -16,7 +16,8 @@ import { promptOnce } from './prompt.js';
 import { parseImagePaste, extForMime, saveToTemp, guessMime, formatSize, readClipboardImageDetailed, sniffMime, readWindowsClipboardFiles, hasClipboardTool, writeClipboardText, contentHash, } from './attachments.js';
 import { loadConfig, DEFAULTS, CONFIG_PATHS, ZAMES_HOME, CONFIG_SCHEMA, getByPath, validateConfigValue, writeConfigValue, resetConfigValue, } from './config.js';
 import { runConfigMenu } from './config-menu.js';
-import { configGetValue, configValueHint, formatConfigList, } from './config-commands.js';
+import { formatConfigList } from './config-commands.js';
+import { handleConfigCommand as runConfigCommand } from './config-command.js';
 import { translate, normalizeLocale, localeDisplayName, isLocale, } from './i18n.js';
 import { Transcript } from './transcript.js';
 import { UndoStore } from './undo.js';
@@ -31,7 +32,7 @@ import { parseBacklogNote } from './backlog.js';
 import { askOperatorConfirm, } from './run-task.js';
 import { closeWeb } from './web.js';
 import { assertCommandInsideRoot, runShell, killAllBackground, } from './shell.js';
-import { saveSession, loadLastSession, readSession, listSessions, sessionsDir, loadHistory, saveHistory, } from './sessions.js';
+import { saveSession, loadLastSession, readSession, listSessions, sessionsDir, loadHistory, saveHistory, isInternalChat, } from './sessions.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const NL = String.fromCharCode(10);
 // The last final assistant message, for the /copy command. Module-level
@@ -536,7 +537,15 @@ async function expandSlashTarget(workdir, name, rest) {
             const extra = rest
                 ? '\n\nAdditional instructions from the operator: ' + rest
                 : '';
-            return { text: header + '\n\n' + body + extra };
+            // A skill may declare allowed-tools (Claude Code frontmatter): the
+            // operator expects the skill to run with ONLY those tools. Carry the
+            // list to the task so the main loop can narrow the tool set.
+            return {
+                text: header + '\n\n' + body + extra,
+                allowedTools: skill.allowedTools && skill.allowedTools.length
+                    ? skill.allowedTools
+                    : undefined,
+            };
         }
     }
     catch {
@@ -1574,108 +1583,22 @@ async function main() {
         }
     }
     async function handleConfigCommand(input) {
-        const parts = input.trim().split(/\s+/);
-        const sub = (parts[1] || '').toLowerCase();
-        // With no subcommand — the menu (or a text list in non-TTY).
-        if (!sub || sub === 'menu' || sub === 'ui') {
-            await configOpenMenu();
-            return;
-        }
-        if (sub === 'list' || sub === 'show' || sub === 'ls') {
-            configShowList();
-            return;
-        }
-        if (sub === 'path' || sub === 'paths') {
-            console.log(theme.system(t('cfg.paths', {
-                global: CONFIG_PATHS.HOME_CONFIG,
-                project: CONFIG_PATHS.PROJECT_CONFIG,
-            })));
-            return;
-        }
-        // /config lang <ru|en> — quick access to ui.locale
-        if (sub === 'lang' || sub === 'language' || sub === 'язык') {
-            const val = parts[2];
-            if (!val) {
-                console.log(theme.system(t('status.locale', { v: localeDisplayName(currentLocale) })));
-                console.log(theme.dim(t('cfg.lang_usage')));
-                return;
-            }
-            const field = CONFIG_SCHEMA.find((f) => f.path === 'ui.locale');
-            const loc = normalizeLocale(val);
-            try {
-                configSetRaw(field, loc);
-            }
-            catch (e) {
-                console.error(theme.error(t('cfg.write_error', { v: e.message })));
-                return;
-            }
-            console.log(theme.assistant(t('cfg.lang_set', { v: localeDisplayName(loc) })));
-            return;
-        }
-        if (sub === 'get') {
-            const key = parts[2];
-            if (!key) {
-                console.log(theme.dim(t('cfg.usage')));
-                return;
-            }
-            const field = CONFIG_SCHEMA.find((f) => f.path === key);
-            if (!field) {
-                console.error(theme.error(t('cfg.unknown_key', { v: key })));
-                return;
-            }
-            const cur = getByPath(config, key);
-            console.log(theme.system(t('cfg.value', { v: key, value: configGetValue(key, cur, t) })));
-            return;
-        }
-        if (sub === 'set') {
-            const key = parts[2];
-            const raw = parts.slice(3).join(' ');
-            const field = CONFIG_SCHEMA.find((f) => f.path === key);
-            if (!field) {
-                console.error(theme.error(t('cfg.unknown_key', { v: key || '' })));
-                return;
-            }
-            if (!raw) {
-                console.log(theme.dim(t('cfg.usage')));
-                return;
-            }
-            try {
-                configSetRaw(field, raw);
-            }
-            catch {
-                console.error(theme.error(t('cfg.bad_value', {
-                    v: key,
-                    type: configValueHint(field, t),
-                })));
-                return;
-            }
-            console.log(theme.assistant(t('cfg.saved', {
-                v: key,
-                value: JSON.stringify(getByPath(config, key)),
-                file: CONFIG_PATHS.HOME_CONFIG,
-            })));
-            return;
-        }
-        if (sub === 'reset' || sub === 'unset') {
-            const key = parts[2];
-            const field = CONFIG_SCHEMA.find((f) => f.path === key);
-            if (!field) {
-                console.error(theme.error(t('cfg.unknown_key', { v: key || '' })));
-                return;
-            }
-            try {
-                configResetField(field);
-            }
-            catch (e) {
-                console.error(theme.error(t('cfg.write_error', { v: e.message })));
-                return;
-            }
-            console.log(theme.assistant(t('cfg.reset', { v: key })));
-            return;
-        }
-        // Unknown subcommand — show the list.
-        console.error(theme.error(t('cfg.unknown_key', { v: sub })));
-        configShowList();
+        await runConfigCommand(input, {
+            t,
+            print: (line) => console.log(line),
+            printErr: (line) => console.error(line),
+            getValue: (p) => getByPath(config, p),
+            setValue: (field, raw) => configSetRaw(field, raw),
+            resetField: (field) => configResetField(field),
+            showList: () => configShowList(),
+            openMenu: () => configOpenMenu(),
+            currentLocale: () => currentLocale,
+            normalizeLocale,
+            localeDisplayName,
+            schema: CONFIG_SCHEMA,
+            homeConfigPath: CONFIG_PATHS.HOME_CONFIG,
+            projectConfigPath: CONFIG_PATHS.PROJECT_CONFIG,
+        });
     }
     while (running) {
         let input;
@@ -1975,7 +1898,11 @@ async function main() {
                 editor.lock(t('msg.input_locked'));
             spin.thinking();
             try {
-                lastChats = await browser.listChats(30);
+                const all = await browser.listChats(30);
+                // Hide subagent chats: they are real DeepSeek chats, but they are
+                // internal context-isolation artifacts whose report already lives in
+                // the parent chat, so resuming one is never what the operator wants.
+                lastChats = all.filter((c) => !isInternalChat(c.id));
                 spin.stop();
                 // An optional query filters by title (substring, case-insensitive),
                 // so a long chat list does not have to be scanned by eye.
@@ -3145,14 +3072,19 @@ async function main() {
         // prompt templates with $ARGUMENTS / {{args}} placeholders.
         let expandedTask = null;
         let missingArgs = null;
+        let skillAllowedTools = null;
         if (lower.startsWith('/')) {
             const name = trimmed.slice(1).split(/\s+/)[0];
             const rest = trimmed.slice(1 + name.length).trim();
             const res = await expandSlashTarget(currentWorkdir, name, rest);
             if (res && 'missing' in res)
                 missingArgs = res.missing;
-            else if (res)
+            else if (res) {
                 expandedTask = res.text;
+                if ('allowedTools' in res && res.allowedTools) {
+                    skillAllowedTools = res.allowedTools;
+                }
+            }
         }
         // B7: a custom command with mandatory `arguments:` refuses to run until the
         // operator supplies them (by position).
@@ -3209,7 +3141,13 @@ async function main() {
             // plan (read-only) mode — a `general` subagent could write otherwise.
             subagents: config.browser.subagents && !planMode,
         });
-        const tools = mergeTools(baseTools, mcpPool?.tools, planMode);
+        let tools = mergeTools(baseTools, mcpPool?.tools, planMode);
+        // A skill invoked via /skill with `allowed-tools:` narrows the tool set to
+        // that allow-list (Claude Code contract). respond is always kept so the run
+        // can still finish.
+        if (skillAllowedTools) {
+            tools = filterToolsByAllowList(tools, skillAllowedTools);
+        }
         if (editor)
             editor.busy = true;
         try {

package/dist/sessions.js

@@ -9,6 +9,40 @@ import { writeJsonAtomic } from './fsutil.js';
 const SESSIONS_DIR = path.join(os.homedir(), '.zames', '.sessions');
 const INDEX_FILE = path.join(SESSIONS_DIR, 'last.json');
 export const SESSIONS_FORMAT_VERSION = 1;
+// Subagent chats are real DeepSeek chats, but they are INTERNAL: they exist
+// only to isolate a sub-task's context and their report is already folded back
+// into the parent chat. They must never be resumable. DeepSeek's own sidebar
+// (`/chats`, which scrapes the DOM) still shows them under auto-generated
+// titles, so we cannot hide them there; but we CAN hide them from `/sessions`
+// (our own store) by keeping an id denylist here and filtering every read path.
+const INTERNAL_FILE = path.join(SESSIONS_DIR, 'internal.json');
+function readInternal() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(INTERNAL_FILE, 'utf-8'));
+        return new Set(Array.isArray(raw) ? raw.filter((x) => typeof x === 'string') : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+/** Remember a chat id as internal (a subagent chat) so it is never resumed. */
+export function markInternalChat(id) {
+    if (!id)
+        return;
+    try {
+        ensureDir();
+        const set = readInternal();
+        set.add(String(id));
+        writeJsonAtomic(INTERNAL_FILE, Array.from(set));
+    }
+    catch { }
+}
+/** True when `id` is a known internal (subagent) chat. */
+export function isInternalChat(id) {
+    if (!id)
+        return false;
+    return readInternal().has(String(id));
+}
 function ensureDir() {
     fs.mkdirSync(SESSIONS_DIR, { recursive: true });
 }
@@ -78,9 +112,12 @@ export function loadLastSession(workdir = '') {
         const index = JSON.parse(fs.readFileSync(INDEX_FILE, 'utf-8'));
         const byWorkdir = index && index.byWorkdir ? index.byWorkdir : {};
         const candidates = [byWorkdir[workdir], index.last].filter((x) => Boolean(x));
+        const internal = readInternal();
         for (const id of candidates) {
             // The session file may have been deleted — the index is then stale and
             // the session cannot be restored. We try the next candidate.
+            if (internal.has(id))
+                continue;
             const s = readSession(id);
             if (s)
                 return s;
@@ -102,18 +139,19 @@ export function readSession(id) {
         return null;
     }
 }
-// List all sessions, newest first.
+// List all sessions, newest first. Internal (subagent) chats are excluded.
 export function listSessions() {
     try {
         ensureDir();
+        const internal = readInternal();
         const files = fs
             .readdirSync(SESSIONS_DIR)
-            .filter((f) => f.endsWith('.json') && f !== 'last.json');
+            .filter((f) => f.endsWith('.json') && f !== 'last.json' && f !== 'internal.json');
         const out = [];
         for (const f of files) {
             try {
                 const data = JSON.parse(fs.readFileSync(path.join(SESSIONS_DIR, f), 'utf-8'));
-                if (data && data.id)
+                if (data && data.id && !internal.has(String(data.id)))
                     out.push(data);
             }
             catch { }

package/dist/subagent.js

@@ -1,4 +1,5 @@
 import { loadHooks, runLifecycleHooks } from './hooks.js';
+import { markInternalChat } from './sessions.js';
 // Subagent runner (BACKLOG N36). A `Task` tool call from the model is handled
 // by the agent loop as a SEAM (like onAutoCompact): it calls back into the
 // caller, which owns the whole lifecycle. This module builds that callback.
@@ -69,7 +70,27 @@ export function createSubagentRunner(opts) {
             };
         }
         used++;
-        const parentChatId = await browser.getCurrentChatId().catch(() => null);
+        // Resolve the parent chat id BEFORE anything else. The runner restores the
+        // parent chat in its finally block, and that restore is what keeps the
+        // subagent's isolated context from swallowing the parent's turn. If the id
+        // cannot be resolved we must NOT run the nested loop: without it the finally
+        // would skip openChat and the parent would continue INSIDE the subagent
+        // chat. A couple of quick retries cover the "id not known yet" window on a
+        // freshly opened chat; after that we fail safe and tell the model.
+        let parentChatId = null;
+        for (let attempt = 0; attempt < 3 && !parentChatId; attempt++) {
+            parentChatId = await browser.getCurrentChatId().catch(() => null);
+            if (!parentChatId)
+                await new Promise((r) => setTimeout(r, 300));
+        }
+        if (!parentChatId) {
+            return {
+                ok: false,
+                text: 'Cannot start a subagent: the current chat id is unknown, so the ' +
+                    'parent chat could not be restored afterwards (context isolation ' +
+                    'would be lost). Do the work yourself with the other tools.',
+            };
+        }
         const subTools = buildTools(req.type === 'explore');
         const taskText = subagentPersona(req.type) + '\n\n--- SUB-TASK ---\n' + req.prompt;
         // Save the parent's send hooks: the nested loop OVERWRITES them on
@@ -104,8 +125,12 @@ export function createSubagentRunner(opts) {
                 selfImprovement: false,
                 // No recursion: the subagent cannot spawn its own subagents.
                 onSubagent: null,
-                // Do not persist the subagent chat as a session.
-                onChatReady: () => { },
+                // Do not persist the subagent chat as a session, but REMEMBER its id
+                // as internal so it is hidden from /sessions and never resumed.
+                onChatReady: (chatId) => {
+                    if (chatId)
+                        markInternalChat(chatId);
+                },
                 // Keep the PARENT's UI alive during the nested run. The nested loop
                 // OVERWRITES browser.onSendStart/… with its own callbacks; without
                 // forwarding the parent's hooks the spinner and the throttle countdown

package/dist/system-prompt.js

@@ -34,14 +34,18 @@ its OWN separate chat with an ISOLATED context and returns ONLY a final
 report. The subagent does NOT see this conversation, so the prompt you pass
 must be fully self-contained (goal, exact questions, file paths, context).
 
-Use it to PROTECT this chat's context and to parallelize independent work:
+Use it to PROTECT this chat's context — that is its ONLY purpose. zames
+runs subagents SEQUENTIALLY (one browser, one shared send slot), so a Task
+call does NOT speed anything up; it only keeps this chat's context small.
 
 - Broad exploration whose raw hits would flood this chat ("find every use of
   X", "map how module Y works end to end"): delegate it with
   subagent_type "explore" (read-only) and keep only the report.
 - A self-contained research or verification sub-task you can specify in a
-  paragraph: delegate it and continue the main line meanwhile.
-- Several INDEPENDENT investigations: emit several Task calls in ONE batch.
+  paragraph.
+- A long investigation, or several unrelated ones: call Task again for each.
+  EVERY call opens a FRESH isolated chat (a new subagent) — there is no
+  "reuse" of a previous subagent, so pass everything it needs in the prompt.
 
 Do NOT use it for:
 - work that depends on this conversation's history (the subagent cannot see
@@ -90,10 +94,17 @@ export function renderContextSection(context) {
                 '\n';
     }
     if (context.memory.length) {
+        // Point at the DEEPEST memory file (last in the chain: the loader pushes
+        // globals first, then the dir chain root->workdir). Before, this used
+        // memory[0] — the GLOBAL ~/.zames/MEMORY.md whenever it existed — so
+        // project-specific facts leaked into the global file and then loaded for
+        // every unrelated project. Fall back to the global file only when no
+        // project-level MEMORY.md exists.
+        const memoryTarget = context.memory[context.memory.length - 1].path;
         out +=
             '\nWhen you learn a durable fact about this project or the operator preferences (build quirks, ' +
                 'conventions, gotchas), append a short bullet to ' +
-                context.memory[0].path +
+                memoryTarget +
                 ' via Edit/Write so it survives ' +
                 'into future sessions. Keep entries concise.\n';
     }

package/dist/tools.js

@@ -279,12 +279,14 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
         name: 'Task',
         description: 'Delegate a self-contained sub-task to a SUBAGENT that works in its own ' +
             'separate chat with an isolated context, then returns ONLY a final ' +
-            'report. Use it to keep heavy research out of the main context. ' +
-            'subagent_type: "explore" (read-only: search/read, cannot modify) or ' +
-            '"general" (full tools). The subagent does NOT see this conversation, so ' +
-            '`prompt` must be fully self-contained: state the goal, the exact ' +
-            'questions, and any file paths/context it needs. Returns the subagent ' +
-            'report as text.',
+            'report. Use it to keep heavy research out of the main context — it ' +
+            'does NOT run in parallel (one browser, one send slot), so it saves ' +
+            'context, not time. subagent_type: "explore" (read-only: search/read, ' +
+            'cannot modify) or "general" (full tools). Each call opens a FRESH ' +
+            'subagent chat; nothing is reused between calls. The subagent does NOT ' +
+            'see this conversation, so `prompt` must be fully self-contained: state ' +
+            'the goal, the exact questions, and any file paths/context it needs. ' +
+            'Returns the subagent report as text.',
         parameters: {
             description: 'string',
             prompt: 'string',
@@ -324,6 +326,17 @@ export const MUTATING_TOOLS = new Set([
 export function filterToolsForReadOnly(tools) {
     return tools.filter((t) => !MUTATING_TOOLS.has(t.name));
 }
+// A skill may declare `allowed-tools:` in its SKILL.md frontmatter (the Claude
+// Code contract): the skill then runs with ONLY those tools. We keep the
+// `respond` seam so the run can still finish, and match names case-insensitively
+// (frontmatter is human-written). PURE; unit-tested.
+export function filterToolsByAllowList(tools, allowed) {
+    if (!allowed || !allowed.length)
+        return tools;
+    const allow = new Set(allowed.map((n) => n.toLowerCase()));
+    allow.add('respond');
+    return tools.filter((t) => allow.has(t.name.toLowerCase()));
+}
 // MCP tool names are opaque (server + '__' + tool), so the exact-name
 // MUTATING_TOOLS set cannot classify them. Instead we match the common
 // mutating VERBS in the tool name. It is a heuristic deny-list, not a proof:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.72.8",
+  "version": "2.72.9",
   "description": "Terminal coding agent that drives chat.deepseek.com through Playwright — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {

package/scripts/coverage-gate.mts

@@ -32,6 +32,9 @@ const FLOORS = {
   'permissions.ts': 85,
   'changelog.ts': 85,
   'attach-refs.ts': 85,
+  // C3: the pure /config subcommand dispatcher — silent routing regressions
+  // (a wrong subcommand branch) are invisible without tests.
+  'config-command.ts': 85,
   // N12: web.ts holds the SSRF guard and the DuckDuckGo/HTML parsers — a
   // regression there is silent. Floors sit below the current values.
   'web.ts': 40,

package/scripts/release.mts

@@ -160,19 +160,21 @@ if (dryRun) {
   process.exit(0)
 }
 
-// 5. Insert the section right after the `## [Unreleased]` heading.
+// 5. Insert the version section in place of the Unreleased BODY. The
+// Unreleased body is auto-synced from commits (see changelog:sync), so it is
+// the same content as the new section — leaving it in place duplicated every
+// entry (the real "### Fixed" block twice). Replace the whole body up to the
+// next version heading with the new section.
 const changelogPath = path.join(root, 'CHANGELOG.md')
 const changelog = fs.readFileSync(changelogPath, 'utf-8')
 const anchor = '## [Unreleased]'
 const idx = changelog.indexOf(anchor)
 if (idx < 0) fail('CHANGELOG.md has no "' + anchor + '" heading')
 const afterAnchor = idx + anchor.length
-const updated =
-  changelog.slice(0, afterAnchor) +
-  NL +
-  NL +
-  section +
-  changelog.slice(afterAnchor).replace(/^\n+/, NL)
+const rest = changelog.slice(afterAnchor)
+const nextHeading = rest.search(/\n## \[/)
+const tail = nextHeading < 0 ? NL : rest.slice(nextHeading)
+const updated = changelog.slice(0, afterAnchor) + NL + NL + section + tail
 fs.writeFileSync(changelogPath, updated)
 
 // 6. Bump package.json, preserving its exact formatting (single-line replace