zames_pro 2.73.1 → 2.73.3

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.73.3] - 2026-10-11
+
+### Fixed
+
+- harden SSRF guard, sandbox, git args, mcp lifecycle and editor
+
+## [2.73.2] - 2026-10-11
+
+### Changed
+
+- docs(readme): document Qwen everywhere and refresh the diagram
+
 ## [2.73.1] - 2026-10-11
 
 ### Fixed

package/README.md

@@ -63,27 +63,31 @@ zames does not call the model API. It launches a headless Chromium with a
 persistent profile, signs in to a chat web app like a human, types the task
 into the chat box, and reads the answer back.
 
-Two chat backends are available, switched with `/provider <deepseek|qwen>`
-(restart required): **DeepSeek** (`chat.deepseek.com`, the default) and
-**Qwen** (`chat.qwen.ai`). Each keeps its own persistent profile, so switching
-never signs the other one out.
+Two chat backends are available, switched with `/provider <deepseek|qwen>`:
+**DeepSeek** (`chat.deepseek.com`, the default) and **Qwen** (`chat.qwen.ai`).
+The switch is **live** — zames closes the current backend and opens the other
+one in place, no restart needed. Each keeps its own persistent profile
+(`~/.zames/profile` and `~/.zames/qwen-profile`), so switching never signs the
+other one out.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/Viqto0r/zames_pro/master/docs/how-it-works.png" alt="how zames works" width="860">
 </p>
 
 In text: you type a task → zames sends the system prompt plus the task into
-the DeepSeek web chat → the model answers → zames parses the tool call, runs
-the tool locally, feeds the result back, and prints the final answer for you.
+the active chat web app (DeepSeek or Qwen) → the model answers → zames parses
+the tool call, runs the tool locally, feeds the result back, and prints the
+final answer for you.
 
 Key pieces:
 
 - **The answer is read from the raw network stream** (SSE), not the rendered
   DOM, so tool-call JSON with template strings and escapes survives intact.
-- **A persistent profile** (`~/.zames/profile`) keeps you signed in; the
-  headless User-Agent is patched so DeepSeek's CDN does not 403 the login.
-- **A send throttle** (15 s by default) keeps the web chat's rate limit happy
-  during long tool-heavy runs.
+- **A persistent per-provider profile** (`~/.zames/profile` for DeepSeek,
+  `~/.zames/qwen-profile` for Qwen) keeps you signed in; the headless
+  User-Agent is patched so the site's CDN does not 403 the login.
+- **A send throttle** (15 s on DeepSeek, ~1 s on Qwen, which tolerates rapid
+  sends) keeps the web chat's rate limit happy during long tool-heavy runs.
 - **The agent is sandboxed** to the directory it was started in — no tool can
   read or write above it.
 
@@ -174,7 +178,7 @@ zames can drive either **DeepSeek** (`chat.deepseek.com`, the default) or
 **Qwen** (`chat.qwen.ai`):
 
 ```bash
-/provider qwen      # switch to Qwen (persisted); restart zames to take effect
+/provider qwen      # switch to Qwen (persisted) — applied live, no restart
 /provider deepseek  # switch back
 /provider status    # show the active provider / model / login state
 /provider login     # (re)run the sign-in check
@@ -184,15 +188,18 @@ zames can drive either **DeepSeek** (`chat.deepseek.com`, the default) or
 
 Notes:
 
-- The two backends use **separate persistent profiles**
-  (`~/.zames/profile` for DeepSeek, `~/.zames/qwen-profile` for Qwen), so
-  switching never signs the other one out. A provider switch takes effect on
-  the next launch — the browser is created once at startup.
+- The switch is **live**: zames closes the current backend and opens the other
+  one in place, so no restart is needed. The two backends use **separate
+  persistent profiles** (`~/.zames/profile` for DeepSeek, `~/.zames/qwen-profile`
+  for Qwen), so switching never signs the other one out.
+- A chat id belongs to ONE backend, so the new provider opens a **fresh chat**.
+  If the previous chat had messages they are summarized and posted as a
+  handoff with the next task; an empty chat is switched silently.
 - Qwen works in **guest mode** without an account, but a guest is limited to a
   handful of messages per day; for long agent runs sign in (email / Google /
   GitHub — no phone required). zames auto-logins from the saved credentials or
   asks in the terminal, exactly like DeepSeek. `/model` changes the Qwen model
-  at runtime (no restart).
+  at runtime.
 - File attachments on Qwen go through the mode menu's **Upload attachment**
   item; DeepSeek uses its own paperclip.
 - `/doctor` shows the active provider and the UI health of that provider's
@@ -343,9 +350,10 @@ Codex CLI:
   (zames-export-<stamp>.md by default).
 - /doctor — diagnose node, git, config, browser, clipboard, MCP and the
   active chat provider (it also reports that provider's UI health).
-- /provider <deepseek|qwen> — switch the chat backend (restart to apply);
-  /provider status shows the active provider/model/login; /provider login
-  re-runs the sign-in check. /model [id] lists or picks a Qwen model at runtime.
+- /provider <deepseek|qwen> — switch the chat backend (applied live, no
+  restart); /provider status shows the active provider/model/login; /provider
+  login re-runs the sign-in check. /model [id] lists or picks a Qwen model at
+  runtime.
 - /add-dir <path> — validate an extra directory (the sandbox is fixed at
   startup; relaunch with --dir to write there).
 - /resume <n> (after /chats) and /resume-id <id> — open a chat and PRINT its
@@ -582,30 +590,33 @@ zames не вызывает API модели. Он запускает headless C
 профилем, входит в веб-чат как человек, печатает задачу в поле чата и читает
 ответ обратно.
 
-Доступны два бэкенда, переключаются командой `/provider <deepseek|qwen>`
-(нужен перезапуск): **DeepSeek** (`chat.deepseek.com`, по умолчанию) и
-**Qwen** (`chat.qwen.ai`). У каждого свой постоянный профиль, поэтому
-переключение не разлогинивает другой.
+Доступны два бэкенда, переключаются командой `/provider <deepseek|qwen>`:
+**DeepSeek** (`chat.deepseek.com`, по умолчанию) и **Qwen** (`chat.qwen.ai`).
+Переключение **живое** — zames закрывает текущий бэкенд и открывает другой на
+месте, без перезапуска. У каждого свой постоянный профиль
+(`~/.zames/profile` и `~/.zames/qwen-profile`), поэтому переключение не
+разлогинивает другой.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/Viqto0r/zames_pro/master/docs/how-it-works.png" alt="как работает zames" width="860">
 </p>
 
 Словами: вы вводите задачу → zames отправляет системный промпт и задачу в
-веб-чат DeepSeek → модель отвечает → zames разбирает вызов инструмента,
-выполняет его локально, возвращает результат обратно и печатает финальный
-ответ.
+активный веб-чат (DeepSeek или Qwen) → модель отвечает → zames разбирает
+вызов инструмента, выполняет его локально, возвращает результат обратно и
+печатает финальный ответ.
 
 Ключевые детали:
 
 - **Ответ читается из сырого сетевого потока** (SSE), а не из отрендеренного
   DOM, поэтому JSON вызова инструмента с шаблонными строками и экранированием
   остаётся целым.
-- **Постоянный профиль** (`~/.zames/profile`) держит вас залогиненным;
-  User-Agent headless-браузера подменяется, чтобы CDN DeepSeek не отдавал 403
-  на вход.
-- **Троттлинг отправки** (15 с по умолчанию) щадит рейт-лимит веб-чата во
-  время долгих прогонов с инструментами.
+- **Постоянный профиль на каждого провайдера** (`~/.zames/profile` у DeepSeek,
+  `~/.zames/qwen-profile` у Qwen) держит вас залогиненным; User-Agent
+  headless-браузера подменяется, чтобы CDN сайта не отдавал 403 на вход.
+- **Троттлинг отправки** (15 с у DeepSeek, ~1 с у Qwen, который спокойно
+  переносит частые отправки) щадит рейт-лимит веб-чата во время долгих
+  прогонов с инструментами.
 - **Агент запесочен** в директорию запуска — ни один инструмент не может
   читать или писать выше неё.
 
@@ -698,7 +709,7 @@ zames умеет работать с **DeepSeek** (`chat.deepseek.com`, по у
 **Qwen** (`chat.qwen.ai`):
 
 ```bash
-/provider qwen      # переключиться на Qwen (сохраняется); нужен перезапуск
+/provider qwen      # переключиться на Qwen (сохраняется) — применяется сразу
 /provider deepseek  # вернуться обратно
 /provider status    # активный провайдер / модель / статус входа
 /provider login     # повторно пройти проверку входа
@@ -708,15 +719,17 @@ zames умеет работать с **DeepSeek** (`chat.deepseek.com`, по у
 
 Замечания:
 
-- У бэкендов **разные постоянные профили** (`~/.zames/profile` у DeepSeek,
-  `~/.zames/qwen-profile` у Qwen), поэтому переключение не разлогинивает
-  другой. Смена провайдера применяется при следующем запуске — браузер
-  создаётся один раз на старте.
+- Переключение **живое**: zames закрывает текущий бэкенд и открывает другой на
+  месте, перезапуск не нужен. У бэкендов **разные постоянные профили**
+  (`~/.zames/profile` у DeepSeek, `~/.zames/qwen-profile` у Qwen), поэтому
+  переключение не разлогинивает другой.
+- id чата принадлежит ОДНОМУ бэкенду, поэтому новый провайдер открывает
+  **свежий чат**. Если в прошлом чате были сообщения, они сжимаются и
+  подставляются как handoff в следующую задачу; пустой чат переключается молча.
 - Qwen работает в **гостевом режиме** без аккаунта, но гостю доступно всего
   несколько сообщений в день; для долгих прогонов войдите (email / Google /
   GitHub — телефон не нужен). zames сам логинится по сохранённым кредам или
-  спросит в терминале, как и с DeepSeek. `/model` меняет модель Qwen на лету
-  (без перезапуска).
+  спросит в терминале, как и с DeepSeek. `/model` меняет модель Qwen на лету.
 - Вложения в Qwen идут через пункт **Upload attachment** в меню режима; в
   DeepSeek — своя скрепка.
 - `/doctor` показывает активный провайдер и состояние UI его страницы.
@@ -872,9 +885,10 @@ zames --task "..." --output-format jsonl \
   (по умолчанию zames-export-<stamp>.md).
 - /doctor — диагностика node, git, конфига, браузера, буфера обмена, MCP и
   активного провайдера чата (плюс состояние UI его страницы).
-- /provider <deepseek|qwen> — сменить бэкенд чата (нужен перезапуск);
-  /provider status показывает активный провайдер/модель/вход; /provider login
-  повторно проверяет вход. /model [id] покажет или выберет модель Qwen на лету.
+- /provider <deepseek|qwen> — сменить бэкенд чата (применяется сразу, без
+  перезапуска); /provider status показывает активный провайдер/модель/вход;
+  /provider login повторно проверяет вход. /model [id] покажет или выберет
+  модель Qwen на лету.
 - /add-dir <path> — проверить дополнительную директорию (песочница
   фиксируется при старте; для записи туда перезапустите с --dir).
 - /resume <n> (после /chats) и /resume-id <id> — открыть чат и НАПЕЧАТАТЬ его

package/dist/attachments.js

@@ -197,18 +197,22 @@ export function looksLikeFileName(name) {
 export async function saveToTemp(tmpDir, name, data) {
     await fs.mkdir(tmpDir, { recursive: true });
     const base = sanitize(name);
-    let target = path.join(tmpDir, base);
-    if (await fs.stat(target).catch(() => null)) {
-        const ext = path.extname(base);
-        const stem = base.slice(0, base.length - ext.length);
-        let i = 1;
-        while (await fs.stat(target).catch(() => null)) {
-            target = path.join(tmpDir, stem + '-' + i + ext);
-            i++;
+    const ext = path.extname(base);
+    const stem = base.slice(0, base.length - ext.length);
+    // O_EXCL ('wx'): pick the first free name and CREATE it atomically. A
+    // stat-then-write raced with another attach and silently overwrote a file.
+    for (let i = 0; i < 10_000; i++) {
+        const target = path.join(tmpDir, i === 0 ? base : stem + '-' + i + ext);
+        try {
+            await fs.writeFile(target, data, { flag: 'wx' });
+            return target;
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
         }
     }
-    await fs.writeFile(target, data);
-    return target;
+    throw new Error('could not find a free temp name for ' + base);
 }
 // True if any OS clipboard tool is available on this machine.
 export function hasClipboardTool() {

package/dist/checkpoint.js

@@ -2,6 +2,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
 import { execFile } from 'child_process';
+import { randomBytes } from 'crypto';
 import { writeJsonAtomic } from './fsutil.js';
 // Checkpoints / rewind (BACKLOG B3).
 //
@@ -120,7 +121,11 @@ export class CheckpointStore {
             return null;
         await this._ensure();
         const stamp = Date.now();
-        const file = path.join(this.dir, `${stamp}.tgz`);
+        // Two checkpoints in the SAME millisecond would share `${stamp}.tgz` and
+        // the second would overwrite the first (losing a snapshot). Add a random
+        // suffix so an archive name is unique.
+        const uniq = randomBytes(3).toString('hex');
+        const file = path.join(this.dir, `${stamp}-${uniq}.tgz`);
         const res = await runTar(tarCreateArgs(file, workdir), workdir);
         if (res.code !== 0) {
             await fs.rm(file, { force: true }).catch(() => { });
@@ -187,7 +192,19 @@ export class CheckpointStore {
                     .rm(path.join(record.workdir, e), { recursive: true, force: true })
                     .catch(() => { });
             }
-            await copyTree(tmp, record.workdir);
+            // A copy failure here must NOT surface as an uncaught throw that leaves
+            // the (already wiped) tree half-restored: report it as a failure so the
+            // caller can tell the operator to /rewind from the pre-rewind backup.
+            try {
+                await copyTree(tmp, record.workdir);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    reason: 'copy_failed',
+                    detail: e.message,
+                };
+            }
             return { ok: true, record, backup };
         }
         finally {

package/dist/config.js

@@ -119,6 +119,12 @@ export function providerAskDeadlineMs(cfg) {
 }
 function deepMerge(target, source) {
     for (const key of Object.keys(source)) {
+        // A `.zamesrc.json` (possibly shared/copied from elsewhere) could carry a
+        // `__proto__` / `constructor` / `prototype` key; assigning those to a
+        // plain object mutates Object.prototype (prototype pollution). Skip them.
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+        }
         if (source[key] &&
             typeof source[key] === 'object' &&
             !Array.isArray(source[key])) {

package/dist/context.js

@@ -211,7 +211,17 @@ export function skillBody(raw) {
     const end = norm.indexOf(NL + '---', 3);
     if (end === -1)
         return norm.trim();
-    return norm.slice(norm.indexOf(NL, end + 1) + 1).trim();
+    // The closing `---` may be the LAST line with no trailing newline; then
+    // indexOf(NL, …) is -1 and slice(0) returned the WHOLE file (frontmatter
+    // included). Guard the -1 -> the body is everything after the closing ---.
+    const after = norm.indexOf(NL, end + 1);
+    if (after === -1) {
+        // No newline after the closing delimiter: the body is empty (or just the
+        // rest of that final line, which IS the `---`).
+        const rest = norm.slice(end + 1);
+        return rest.replace(/^-*$/, '').trim();
+    }
+    return norm.slice(after + 1).trim();
 }
 async function findSkillFiles(root, depth = 3) {
     const out = [];
@@ -500,11 +510,17 @@ async function loadScopedAgents(workdir, touchPaths) {
     const out = [];
     const seen = new Set();
     for (const dir of dirs) {
+        // AGENTS.md is head-clipped; MEMORY.md is append-only so it uses the
+        // memory budget and keeps its TAIL (same rule as the main memory chain) —
+        // otherwise the newest notes in a large nested MEMORY.md were lost.
         for (const names of [AGENT_NAMES, MEMORY_NAMES]) {
+            const isMemory = names === MEMORY_NAMES;
             const p = await findNamedFile(dir, names);
             if (!p || seen.has(p))
                 continue;
-            const f = await readIfFile(p, MAX_FILE_BASE);
+            const f = isMemory
+                ? await readIfFile(p, MAX_MEMORY_FILE, true)
+                : await readIfFile(p, MAX_FILE_BASE);
             if (!f)
                 continue;
             seen.add(p);

package/dist/gitTools.js

@@ -150,7 +150,11 @@ export function createGitTools(workdir) {
                 const err = await ensureRepo();
                 if (err)
                     return err;
-                return runGitArgs(['log', '--oneline', '--decorate', '-n', String(Number(count) || 10)], workdir, 10_000);
+                // Guard the count: `Number(count)||10` let -3 and Infinity through as
+                // literal `-n -3` / `-n Infinity`. Keep a positive integer only.
+                const n = Math.trunc(Number(count));
+                const lim = Number.isFinite(n) && n > 0 ? n : 10;
+                return runGitArgs(['log', '--oneline', '--decorate', '-n', String(lim)], workdir, 10_000);
             },
         },
         {
@@ -238,14 +242,17 @@ export function createGitTools(workdir) {
                 const fs = await import('fs/promises');
                 const path = await import('path');
                 const os = await import('os');
-                const tmp = path.join(os.tmpdir(), `dsa-commit-${Date.now()}.txt`);
-                await fs.writeFile(tmp, msg, 'utf-8');
+                // O_EXCL ('wx') so a pre-created symlink at this predictable path
+                // cannot redirect the write to another file (TOCTOU on a shared /tmp).
+                const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'zames-commit-'));
+                const tmp = path.join(tmpDir, 'msg.txt');
+                await fs.writeFile(tmp, msg, { encoding: 'utf-8', flag: 'wx' });
                 try {
                     const result = await runGitArgs(['commit', '-F', tmp], workdir, 30_000);
                     return `add: ${addResult}\ncommit: ${result}`;
                 }
                 finally {
-                    await fs.unlink(tmp).catch(() => { });
+                    await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
             },
         },
@@ -269,6 +276,15 @@ export function createGitTools(workdir) {
                 if (!/^[A-Za-z0-9._/-]+$/.test(b) || b.startsWith('-')) {
                     return `Error: invalid branch name: ${b}`;
                 }
+                // The regex above allows `..` and `@{`, which git parses as a REFSPEC
+                // RANGE (`git push origin a..b`), not a branch. Ask git itself so the
+                // name is valid by construction.
+                const refCheck = await runGitArgs(['check-ref-format', '--branch', b], workdir, 5000);
+                // On success git echoes the branch name; on failure it prints an
+                // `Exit code: <n>` / `fatal:` block instead.
+                if (refCheck.trim() !== b) {
+                    return `Error: invalid branch name: ${b}`;
+                }
                 const args = ['push'];
                 if (setUpstream)
                     args.push('-u');

package/dist/index.js

@@ -85,7 +85,13 @@ const headless = hasFlag('--headed')
     : hasFlag('--headless') || config.headless;
 const debug = hasFlag('--debug') || config.debug;
 const maxIterArg = getArg('--max-iter', null);
-const maxIter = maxIterArg !== null ? Number(maxIterArg) : config.maxIterations;
+// A non-numeric `--max-iter abc` yields NaN, which the loop treats as
+// "unlimited" (NaN > 0 is false). Fall back to the configured value instead
+// of silently disabling the cap.
+const maxIterParsed = maxIterArg !== null ? Number(maxIterArg) : NaN;
+const maxIter = Number.isFinite(maxIterParsed)
+    ? maxIterParsed
+    : config.maxIterations;
 const positional = getPositional();
 const task = getArg('--task', positional.join(' ').trim() || null);
 const chatIdArg = getArg('--chat', null);

package/dist/input.js

@@ -892,28 +892,17 @@ export class LineEditor {
         }
         const cols = process.stdout.columns || 80;
         const lay = layoutInput(this.promptStr, this.buf, this.cursor, cols);
-        const sugg = this._suggestions();
-        const shown = sugg.slice(0, 8);
-        this._suggestCount = shown.length;
-        const linesBelow = shown.length
-            ? shown.length + (sugg.length > shown.length ? 1 : 0)
-            : 0;
+        // Reuse the SAME windowed+highlighted suggestion lines as _writeBlock.
+        // Before, this used a hardcoded `sugg.slice(0, 8)`, so navigating past
+        // page 1 (Ctrl+N/P) left the repaint showing the first page without the
+        // highlight, and linesBelow drifted from the real row count.
+        const sug = this._suggestionLines(this._suggestOffset);
+        const linesBelow = sug.rows;
         // Move up to the INPUT top using the OLD cursor row (on screen right now).
         this._eraseInputOnly(this.cursorRowFromTop - this._statusTop);
         let out = lay.rows.map((r) => r.prefix + r.text).join(NL);
-        if (shown.length) {
-            const maxName = Math.max(...shown.map((c) => c.name.length));
-            const lines = shown.map((c) => {
-                const name = theme.prompt(c.name.padEnd(maxName));
-                const desc = theme.dim('  ' + c.description);
-                return '   ' + name + desc;
-            });
-            out += NL + lines.join(NL);
-            const hidden = sugg.length - shown.length;
-            if (hidden > 0)
-                out +=
-                    NL +
-                        theme.dim('   ' + translate(this.locale)('editor.more', { n: hidden }));
+        if (sug.lines.length) {
+            out += NL + sug.lines.join(NL);
         }
         // A buffer change can UNWRAP the input (backspace on a wrapped line), so
         // the block can get shorter here too — push it back to the bottom BEFORE

package/dist/mcp.js

@@ -44,9 +44,9 @@ export function hardenPlaywrightArgs(command, args) {
     const hay = (String(command || '') + ' ' + args.join(' ')).toLowerCase();
     if (!hay.includes('playwright') || !hay.includes('mcp'))
         return args;
-    if (args.some((a) => a === '--isolated' ||
+    if (args.some((a) => a.startsWith('--isolated') ||
         a.startsWith('--user-data-dir') ||
-        a === '--extension' ||
+        a.startsWith('--extension') ||
         a.startsWith('--cdp-endpoint'))) {
         return args;
     }
@@ -292,10 +292,15 @@ export function dedupeToolNames(tools) {
 }
 // Connect to ONE server and return a ready connection (or an error).
 async function connectServer(name, cfg, debug) {
+    // Declared OUTSIDE the try so the catch can close a half-open server: a
+    // stdio transport SPAWNS a child process on connect, and if connect() or
+    // listTools() throws we would otherwise leak an orphan process on every run.
+    let client = null;
+    let transport = null;
     try {
         const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
-        const client = new Client({ name: 'zames', version: packageVersion() }, { capabilities: {} });
-        let transport;
+        const c = new Client({ name: 'zames', version: packageVersion() }, { capabilities: {} });
+        client = c;
         if (cfg.url) {
             if (cfg.transport === 'sse') {
                 const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
@@ -320,8 +325,8 @@ async function connectServer(name, cfg, debug) {
                 stderr: 'pipe',
             });
         }
-        await client.connect(transport);
-        const listed = await client.listTools();
+        await c.connect(transport);
+        const listed = await c.listTools();
         const tools = (listed.tools || []).map((t) => {
             const tool = t;
             return {
@@ -331,11 +336,22 @@ async function connectServer(name, cfg, debug) {
             };
         });
         debug?.(`MCP: connected to ${name} (${tools.length} tools)`);
-        return { name, client, tools };
+        return { name, client: c, tools };
     }
     catch (e) {
         const msg = e.message || String(e);
         debug?.(`MCP: failed to connect to ${name}: ${msg}`);
+        // Close a half-open connection so a spawned stdio child is not orphaned.
+        try {
+            if (client)
+                await client.close().catch(() => { });
+        }
+        catch { }
+        try {
+            if (transport?.close)
+                await Promise.resolve(transport.close()).catch(() => { });
+        }
+        catch { }
         return { error: msg };
     }
 }

package/dist/sessions.js

@@ -98,11 +98,16 @@ function writeIndex({ id, workdir }) {
         if (!index.byWorkdir || typeof index.byWorkdir !== 'object') {
             index.byWorkdir = {};
         }
+        // An EMPTY workdir must not become a byWorkdir key: it would make every
+        // project fall back to `index.last` and restore a chat from ANOTHER
+        // project on the next launch. Only track a real directory.
         const key = workdir || '';
-        index.byWorkdir[key] = id;
-        index.last = id;
-        index.updatedAt = new Date().toISOString();
-        writeJsonAtomic(INDEX_FILE, index);
+        if (key) {
+            index.byWorkdir[key] = id;
+            index.last = id;
+            index.updatedAt = new Date().toISOString();
+            writeJsonAtomic(INDEX_FILE, index);
+        }
     }
     catch { }
 }

package/dist/shell.js

@@ -23,6 +23,15 @@ export function assertCommandInsideRoot(root, command) {
         const raw = m[1].trim().replace(/^["']|["']$/g, '');
         if (!raw || raw === '-')
             continue;
+        // A `cd` target we cannot RESOLVE statically is rejected: the shell would
+        // expand it AFTER this scan, so `d=/; cd $d` would otherwise slip past as
+        // root/$d. `$HOME`/`${HOME}` is the one variable we CAN expand (below), so
+        // it is allowed; any OTHER `$var`, a backtick substitution or `~user` is
+        // refused outright.
+        const withoutHome = raw.replace(/\$\{?HOME\}?/g, '');
+        if (/[$`]/.test(withoutHome) || /^~[^/\\]/.test(raw)) {
+            throw new Error('Sandbox: cannot verify cd target ' + raw + ' (variable/substitution)');
+        }
         // sh expands ~ and $HOME AFTER this check, so expand them here as well —
         // otherwise `cd ~` passes the guard and then leaves the root.
         const expanded = raw

package/dist/transcript.js

@@ -64,10 +64,10 @@ export class Transcript {
         if (!stream)
             return Promise.resolve();
         return new Promise((resolve) => {
-            stream.end(() => resolve());
-            // A write error must not hang the exit; the error listener is installed
-            // in the constructor.
+            // Attach the error handler BEFORE end(): an error emitted synchronously
+            // by end() would otherwise reach no listener on this tick.
             stream.on('error', () => resolve());
+            stream.end(() => resolve());
         });
     }
 }

package/dist/undo.js

@@ -1,6 +1,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
+import { randomBytes } from 'crypto';
 import { writeJsonAtomic } from './fsutil.js';
 const UNDO_DIR = path.join(os.homedir(), '.zames', 'undo');
 const INDEX = path.join(UNDO_DIR, 'index.json');
@@ -44,7 +45,12 @@ export class UndoStore {
         const hash = Buffer.from(filePath).toString('hex').slice(0, 16);
         let backupFile = null;
         if (existed) {
-            backupFile = path.join(UNDO_DIR, `${stamp}-${hash}.bak`);
+            // The stamp is only ms-precision and the hash is the first 8 bytes of
+            // the path, so two SIBLING files edited in the same millisecond would
+            // collide and the second write would clobber the first (losing the
+            // backup). Add a random suffix so a backup name is unique.
+            const uniq = randomBytes(4).toString('hex');
+            backupFile = path.join(UNDO_DIR, `${stamp}-${hash}-${uniq}.bak`);
             await fs.writeFile(backupFile, content);
         }
         const history = await this._readIndex();

package/dist/web.js

@@ -71,12 +71,34 @@ export function isPrivateIp(ip) {
     const low = ip.toLowerCase();
     if (low === '::1' || low === '::')
         return true;
-    if (low.startsWith('fe80') || low.startsWith('fc') || low.startsWith('fd')) {
+    // IPv6 link-local is fe80::/10, i.e. fe80..febf (the old `startsWith('fe80')`
+    // missed fe90::, fea0:: and febf::). ULA is fc00::/7 (fc..fd). fec0::/10
+    // (deprecated site-local) is also treated as non-public.
+    if (/^fe[89abcde]/.test(low) ||
+        low.startsWith('fc') ||
+        low.startsWith('fd')) {
         return true;
     }
+    // IPv4-mapped in DOTTED form (::ffff:127.0.0.1).
     const mapped = low.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
     if (mapped)
         return isPrivateIp(mapped[1]);
+    // IPv4-mapped in HEX form (::ffff:7f00:1 == 127.0.0.1) and the NAT64
+    // well-known prefix 64:ff9b::/96 (which can encode 127.0.0.1 too).
+    const mappedHex = low.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mappedHex) {
+        const hi = parseInt(mappedHex[1], 16);
+        const lo = parseInt(mappedHex[2], 16);
+        return isPrivateIp(((hi >> 8) & 0xff) +
+            '.' +
+            (hi & 0xff) +
+            '.' +
+            ((lo >> 8) & 0xff) +
+            '.' +
+            (lo & 0xff));
+    }
+    if (low.startsWith('64:ff9b:'))
+        return true;
     return false;
 }
 export function isPrivateHostname(host) {
@@ -87,6 +109,13 @@ export function isPrivateHostname(host) {
         return true;
     if (h === 'metadata.google.internal')
         return true;
+    // Internal/mDNS/service names that never belong to the public internet.
+    if (h.endsWith('.internal') || h === 'internal')
+        return true;
+    if (h.endsWith('.local') || h === 'local')
+        return true;
+    if (h.endsWith('.home.arpa'))
+        return true;
     return false;
 }
 export async function assertPublicUrl(rawUrl) {
@@ -191,6 +220,10 @@ export async function httpFetch(url, { timeout = DEFAULT_TIMEOUT, headers = {},
                     const next = new URL(loc, current).toString();
                     // Validate the TARGET before requesting it.
                     await assertPublicUrl(next);
+                    // Drain/close the redirect body: otherwise each hop leaks a socket
+                    // (up to MAX_REDIRECTS per fetch), which exhausts the pool on a long
+                    // series of fetches.
+                    await res.body?.cancel().catch(() => { });
                     current = next;
                     continue;
                 }
@@ -310,7 +343,7 @@ export function createWebTools() {
                 if (!/^https?:\/\//i.test(String(url))) {
                     return `Error: URL must start with http:// or https://`;
                 }
-                const limit = Math.min(Number(maxChars) || MAX_TEXT, 60_000);
+                const limit = Math.max(1, Math.min(Number(maxChars) || MAX_TEXT, 60_000));
                 try {
                     await assertPublicUrl(String(url));
                     if (render) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.73.1",
+  "version": "2.73.3",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {
@@ -35,6 +35,8 @@
     "self-smoke": "tsx scripts/self-smoke.mts",
     "qwen-smoke": "tsx scripts/qwen-smoke.mts",
     "render-demo": "tsx scripts/render-demo.mts",
+    "render-how": "tsx scripts/render-how-it-works.mts",
+    "render-how": "tsx scripts/render-how-it-works.mts",
     "build:readme": "tsx scripts/build-readme.mts",
     "postinstall": "node scripts/postinstall.mjs",
     "prepare": "husky"

package/scripts/render-how-it-works.mts

@@ -0,0 +1,129 @@
+// Render docs/how-it-works.png — the architecture diagram used in README.md.
+//
+// Why a generator: the README must show BOTH chat backends (DeepSeek and
+// Qwen), not just DeepSeek. A hand-drawn PNG drifts; this renders a fixed
+// HTML page with headless Chromium so the diagram is reproducible and easy to
+// update when a provider is added.
+//
+// Run:  npm run render-how  (tsx scripts/render-how-it-works.mts)
+//
+// Isolation: chromium.launch() uses a THROWAWAY in-memory context, never
+// ~/.zames/profile (see AGENTS.md — never touch the live agent's browser).
+
+import { chromium } from 'playwright'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const out = path.join(root, 'docs', 'how-it-works.png')
+
+const C = {
+  bg: '#23272e',
+  panel: '#2b303a',
+  border: '#3b4250',
+  text: '#cfc9b0',
+  dim: '#8a9bb5',
+  user: '#b4b8d0',
+  accent: '#7fc4f0',
+  ds: '#6f8ed0',
+  qwen: '#6fd0b0',
+  tool: '#c6a97e',
+}
+
+const W = 1300
+const H = 360
+
+const box = (
+  title: string,
+  sub: string,
+  color: string,
+): string =>
+  '<div class="box" style="border-color:' +
+  color +
+  '">' +
+  '<div class="box-t" style="color:' +
+  color +
+  '">' +
+  title +
+  '</div>' +
+  '<div class="box-s">' +
+  sub +
+  '</div></div>'
+
+const html =
+  '<!doctype html><html><head><meta charset="utf-8"><style>' +
+  '@font-face{font-family:ZM;src:local("DejaVu Sans Mono")}' +
+  'html,body{margin:0;padding:0;background:' +
+  C.bg +
+  '}' +
+  'body{font-family:"DejaVu Sans Mono",monospace;color:' +
+  C.text +
+  ';-webkit-font-smoothing:antialiased}' +
+  '.wrap{box-sizing:border-box;width:' +
+  W +
+  'px;height:' +
+  H +
+  'px;padding:26px 30px}' +
+  '.row{display:flex;align-items:center;justify-content:space-between;gap:8px}' +
+  '.box{box-sizing:border-box;border:2px solid;border-radius:10px;padding:14px 16px;' +
+  'background:' +
+  C.panel +
+  ';min-width:150px;text-align:center}' +
+  '.box-t{font-size:18px;font-weight:700;margin-bottom:6px}' +
+  '.box-s{font-size:12px;color:' +
+  C.dim +
+  ';line-height:1.5}' +
+  '.arrow{font-size:26px;color:' +
+  C.dim +
+  '}' +
+  '.flow-label{font-size:12px;color:' +
+  C.dim +
+  ';text-align:center;margin-top:4px}' +
+  '.providers{display:flex;flex-direction:column;gap:10px}' +
+  '.col{display:flex;flex-direction:column;align-items:center;gap:4px}' +
+  '.legend{margin-top:20px;font-size:12px;color:' +
+  C.dim +
+  ';text-align:center}' +
+  '.legend b{color:' +
+  C.text +
+  '}' +
+  '</style></head><body><div class="wrap">' +
+  '<div class="row">' +
+  // left: the operator
+  '<div class="col">' +
+  box('Operator', 'terminal task<br/>+ tool approval', C.user) +
+  '<div class="flow-label">types a task</div>' +
+  '</div>' +
+  '<div class="arrow">&#8594;</div>' +
+  // middle: zames
+  '<div class="col">' +
+  box(
+    'zames',
+    'sandboxed tools<br/>parses tool-calls<br/>runs them locally',
+    C.accent,
+  ) +
+  '<div class="flow-label">system prompt + task</div>' +
+  '</div>' +
+  '<div class="arrow">&#8644;</div>' +
+  // right: the two backends
+  '<div class="providers">' +
+  box('DeepSeek', 'chat.deepseek.com<br/>~/.zames/profile', C.ds) +
+  box('Qwen', 'chat.qwen.ai<br/>~/.zames/qwen-profile', C.qwen) +
+  '</div>' +
+  '</div>' +
+  '<div class="legend">zames drives a <b>real browser</b> over a persistent per-provider profile &mdash; no API key. ' +
+  'Switch live with <b>/provider &lt;deepseek|qwen&gt;</b> (each chat id belongs to one backend).</div>' +
+  '</div></body></html>'
+
+const browser = await chromium.launch({ headless: true })
+try {
+  const page = await browser.newPage({
+    viewport: { width: W, height: H },
+    deviceScaleFactor: 2,
+  })
+  await page.setContent(html, { waitUntil: 'load' })
+  await page.screenshot({ path: out })
+  console.log('wrote', path.relative(root, out))
+} finally {
+  await browser.close()
+}