zames_pro 2.73.7 → 2.73.9

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.73.9] - 2026-10-12
+
+### Fixed
+
+- **qwen:** raise the default send pause to 4s (rate limit is real)
+- **qwen:** read the real history shape (map) + handle quota_limit
+- **cli:** honor --provider <id>; stop blocking bash -c in the sandbox
+
+## [2.73.8] - 2026-10-12
+
+### Fixed
+
+- bound qwen net body, share attach flow, count transcript backpressure, buffer split paste
+- lose fewer tool args, unstick the arg-error loop, harden launch
+
 ## [2.73.7] - 2026-10-12
 
 ### Changed

package/dist/agent-loop.js

@@ -232,6 +232,18 @@ export async function runAgentLoop({ browser, tools, task, workdir, maxIteration
     let repeatCallCount = 0;
     const MAX_REPEAT_CALLS = 4;
     let repeatWarned = false;
+    // Consecutive tool calls that fail with an ARGUMENT error (`Missing required
+    // argument`, `Invalid required argument`). Such a call has a DIFFERENT
+    // signature each turn (a long `content` changes), so the identical-signature
+    // detector above never fires and the model can burn many iterations on the
+    // same omission. Track the tool + the error text instead; after a few in a
+    // row, nudge with the exact missing field and stop re-running it.
+    let argErrSig = '';
+    let argErrCount = 0;
+    const MAX_ARG_ERRORS = 3;
+    // Set when the argument-error series hits the cap; appended to the message
+    // AFTER the tool results are formatted (they rebuild `message`).
+    let argErrNudge = '';
     let afterToolRetries = 0;
     // toolsRanInTask: how many tools actually ran in THIS task. The protocol
     // guard uses it to tell "started, then slipped into chat mode" (a reasoning
@@ -976,6 +988,45 @@ ${diag}`;
                     durationMs: toolMs,
                 });
                 results.push({ tool: call.tool, result });
+                // Argument-error series: `Missing required argument`/`Invalid required
+                // argument` from the req() guard. The signature changes each turn when
+                // the model forgets one field but rewrites the rest, so the identical
+                // detector misses it. Count by tool + error text; at the cap, tell the
+                // model EXACTLY which field is missing instead of re-running the call.
+                const resStr = String(result);
+                const argErr = resStr.match(/(?:Missing|Invalid) required argument[: ]+([A-Za-z0-9_]+)/);
+                if (argErr) {
+                    const sig = call.tool + ':' + argErr[0];
+                    if (sig === argErrSig)
+                        argErrCount++;
+                    else {
+                        argErrSig = sig;
+                        argErrCount = 1;
+                    }
+                    if (argErrCount >= MAX_ARG_ERRORS) {
+                        argErrCount = 0;
+                        argErrSig = '';
+                        safeWarning(translate(locale)('msg.arg_error_loop'));
+                        // The message the model sees is REBUILT from `results` after the
+                        // batch loop, so a nudged `message` here would be overwritten.
+                        // Record the nudge and append it after the results are formatted.
+                        argErrNudge =
+                            'IMPORTANT: the tool `' +
+                                call.tool +
+                                '` failed with "' +
+                                argErr[0] +
+                                '". You keep calling it WITHOUT the required argument `' +
+                                argErr[1] +
+                                '`. Add `' +
+                                argErr[1] +
+                                '` to the arguments of the SAME call and retry — do NOT repeat ' +
+                                'the identical invocation.';
+                    }
+                }
+                else {
+                    argErrSig = '';
+                    argErrCount = 0;
+                }
                 // The operator pressed Esc/Ctrl+C while the tool was running. The tool
                 // itself has finished (we cannot kill an arbitrary child process from
                 // here), but we must NOT feed its result back to the model and must NOT
@@ -1023,6 +1074,13 @@ ${diag}`;
             })
                 .join('\n\n');
         }
+        // Append the argument-error nudge (set inside the batch loop) now that
+        // `message` has been rebuilt from `results`. Cleared so it fires once per
+        // series, not on every later turn.
+        if (argErrNudge) {
+            message = message + '\n\n' + argErrNudge;
+            argErrNudge = '';
+        }
         // Auto-compact at the ONLY safe seam — after a tool result and before
         // the next send. Never mid-generation, never during a rate-limit wait, and
         // never between the task and the first send (this block runs only after a

package/dist/attach-flow.js

@@ -0,0 +1,48 @@
+import fs from 'fs/promises';
+/**
+ * Read every file into a Playwright `setFiles` payload. A file that cannot be
+ * read is pushed onto `failed` (with a notice through `onReadError`) instead of
+ * throwing, so a single unreadable file never aborts the whole attach. Returns
+ * the successfully read payloads.
+ */
+export async function readAttachBuffers(files, onReadError) {
+    const payload = [];
+    const failed = [];
+    for (const f of files) {
+        try {
+            const buffer = await fs.readFile(f.path);
+            payload.push({ name: f.name, mimeType: f.mime, buffer });
+        }
+        catch (e) {
+            failed.push({ path: f.path, name: f.name });
+            onReadError(f.name, e.message);
+        }
+    }
+    return { payload, failed };
+}
+/**
+ * Wait for the upload preview (the attached-file chip above the input) to
+ * appear, instead of a fixed sleep. The signal is the FILE NAME showing up on
+ * the page: files are attached BEFORE the text is typed, so the name cannot
+ * appear there for any other reason. `timeoutMs` is the ceiling, so a build
+ * where the name is not detected behaves exactly like the old fixed sleep.
+ */
+export async function awaitUploadPreview(page, names, timeoutMs) {
+    const clean = names.map((n) => String(n || '').trim()).filter(Boolean);
+    if (!clean.length) {
+        await page.waitForTimeout(timeoutMs);
+        return;
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        for (const name of clean) {
+            const n = await page
+                .getByText(name, { exact: false })
+                .count()
+                .catch(() => 0);
+            if (n > 0)
+                return;
+        }
+        await page.waitForTimeout(150);
+    }
+}

package/dist/browser.js

@@ -1,6 +1,7 @@
 import { chromium, } from 'playwright';
 import { extractAnswer, extractTokenUsage, dumpNetBody, isFinishedWithoutAnswer, } from './net-capture.js';
 import { rewriteFailedAttachments } from './commands.js';
+import { awaitUploadPreview, readAttachBuffers } from './attach-flow.js';
 import { parseHistoryMessages, extractChatMessages, scrapeChatList, scrapeChatMessages, } from './browser-chats.js';
 import { CHAT_URL, CHAT_ID_RE, chatUrl, HISTORY_MESSAGES_URL, BUTTON_CLASS_RE, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, CONTINUE_NAME_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, RESTORE_ANSWER_SELECTORS, ASSISTANT_CLASS_RE, ASSISTANT_SELECTOR, ANSWER_MARKDOWN_SELECTOR, MARKDOWN_SELECTOR, CHAT_SIGNAL_NODES_SELECTOR, NEW_CHAT_SELECTOR, NEW_CHAT_TEXT_RE, PASSWORD_SELECTORS, LOGIN_SELECTORS, LOGIN_SUBMIT_SELECTORS, MFA_CODE_SELECTORS, MFA_SUBMIT_SELECTORS, MFA_SEND_CODE_SELECTORS, MFA_SEND_CODE_RE, LOGIN_BUTTON_SELECTOR, LOGIN_NAME_RE, LOGIN_FORM_SUBMIT_RE, SIDEBAR_TOGGLE_SELECTORS, TOGGLE_SELECTORS, DEEP_THINKING_RE, WEB_SEARCH_RE, ATTACH_SELECTORS, ANSWER_URL_RE, } from './deepseek-ui.js';
 import { probeUiHealth, } from './ui-health.js';
@@ -360,7 +361,13 @@ export class DeepSeekBrowser {
         }
         this.page = this.context.pages()[0] || (await this.context.newPage());
         this._installNetHook();
-        await this.page.goto(CHAT_URL, { waitUntil: 'domcontentloaded' });
+        // A slow network / cold CDN can exceed Playwright's 30s goto timeout.
+        // That must NOT abort launch(): the page is usually already usable and
+        // waitForLogin() polls. Bailing out made a transient slowness a hard
+        // startup failure.
+        await this.page
+            .goto(CHAT_URL, { waitUntil: 'domcontentloaded' })
+            .catch(() => { });
     }
     _installNetHook() {
         const pg = this['page'];
@@ -1516,21 +1523,7 @@ export class DeepSeekBrowser {
     // message to [attach-failed: name]. The model must not believe a file was
     // attached when it was not.
     async _attachFiles(files) {
-        const failed = [];
-        const bufPayload = [];
-        for (const f of files) {
-            try {
-                const buffer = await fs.readFile(f.path);
-                bufPayload.push({ name: f.name, mimeType: f.mime, buffer });
-            }
-            catch (e) {
-                failed.push({ path: f.path, name: f.name });
-                this._notice(theme.warn(this._t('ds.attach_read_failed', {
-                    name: f.name,
-                    error: e.message,
-                })));
-            }
-        }
+        const { payload: bufPayload, failed } = await readAttachBuffers(files, (name, error) => this._notice(theme.warn(this._t('ds.attach_read_failed', { name, error }))));
         if (!bufPayload.length)
             return failed;
         // Preferred path: click the attach button and let the file chooser event
@@ -1575,30 +1568,11 @@ export class DeepSeekBrowser {
         await this._awaitUploadPreview(files.map((f) => f.name), 2000);
         return failed;
     }
-    // Wait for the upload preview (the attached-file chip above the
-    // input) to appear, instead of a fixed 2.5s/2s sleep. The signal is the
-    // FILE NAME showing up on the page: we attach files BEFORE typing the text,
-    // so the name cannot appear there for any other reason. The old fixed value
-    // stays as the TIMEOUT CEILING, so a build where the name is not detected
-    // behaves exactly as before.
+    // Wait for the upload preview (the attached-file chip above the input) to
+    // appear, instead of a fixed sleep. Delegates to the shared helper so both
+    // providers use the SAME preview policy.
     async _awaitUploadPreview(names, timeoutMs) {
-        const clean = names.map((n) => String(n || '').trim()).filter(Boolean);
-        if (!clean.length) {
-            await this.page.waitForTimeout(timeoutMs);
-            return;
-        }
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            for (const name of clean) {
-                const n = await this.page
-                    .getByText(name, { exact: false })
-                    .count()
-                    .catch(() => 0);
-                if (n > 0)
-                    return;
-            }
-            await this.page.waitForTimeout(150);
-        }
+        await awaitUploadPreview(this.page, names, timeoutMs);
     }
     // Wait out a rate-limit pause, showing an animated countdown through
     // onSendPause so the operator sees the agent is alive (not frozen). Returns

package/dist/cli-args.js

@@ -17,6 +17,7 @@ export const SKIP_VALUE_FLAGS = [
     '--max-iter',
     '--chat',
     '--output-format',
+    '--provider',
 ];
 export function createCliArgs(argv) {
     const args = Array.isArray(argv) ? argv : [];

package/dist/commands.js

@@ -1044,8 +1044,12 @@ export const SLASH_COMMANDS = [
 export function buildSlashCommandHints(opts) {
     const { devMode, t } = opts;
     const table = opts.commands ?? SLASH_COMMANDS;
+    // `/model` picks a QWEN model; DeepSeek has no such command. Hide it unless
+    // the Qwen provider is active (or the caller did not pass a provider).
+    const hideModel = opts.provider !== undefined && opts.provider !== 'qwen';
     const base = table
         .filter((c) => devMode || !isDevOnlyCommand(c.name))
+        .filter((c) => !(hideModel && c.name === '/model'))
         .map((c) => ({ name: c.name, description: t(c.key) }));
     const known = new Set(base.map((c) => c.name.toLowerCase()));
     for (const d of opts.dynamic ?? []) {

package/dist/config.js

@@ -21,9 +21,11 @@ export const DEFAULTS = {
     qwen: {
         model: '',
         enabled: false,
-        // Qwen tolerates back-to-back sends (verified live: 4 sends at 0 ms gap,
-        // no rate limit), so the DeepSeek 15 s throttle is pure latency here.
-        minSendIntervalMs: 1000,
+        // Qwen DOES rate-limit a rapid burst: measured live, the 5th back-to-back
+        // send at 0 ms gap hit "too frequent" and needed a 5-min back-off. A 1 s
+        // gap was too small for a real editing session, so the default is now 4 s
+        // — enough to stay under the limit while keeping the agent responsive.
+        minSendIntervalMs: 4000,
         // The first send after a cold load can take minutes ("Model loading…" +
         // thinking); a GUEST turn measured up to ~9 min live on a cold profile, so
         // give it generous room. A signed-in session answers in seconds; this only

package/dist/extraTools.js

@@ -178,11 +178,11 @@ export function createExtraTools(workdir, { undo, todos } = {}) {
     // "undefined" in the working directory.
     const req = (v, name) => {
         if (v === undefined || v === null) {
-            throw new Error(`Missing required argument: ${name}`);
+            throw new Error(`Missing required argument: ${name}. Add "${name}" to the tool call arguments and retry.`);
         }
         const s = String(v);
         if (s === '' || s === 'undefined' || s === 'null') {
-            throw new Error(`Invalid required argument ${name}: ${JSON.stringify(v)}`);
+            throw new Error(`Invalid required argument ${name}: ${JSON.stringify(v)}. Provide a non-empty value for "${name}" and retry.`);
         }
         return s;
     };

package/dist/i18n/common.js

@@ -1,8 +1,8 @@
 // Common UI strings: app/common, status, tasks, messages, diff, context, undo, cd.
 export const commonMessages = {
     'app.tagline': {
-        ru: 'агент поверх chat.deepseek.com / chat.qwen.ai через Playwright',
-        en: 'coding agent over chat.deepseek.com / chat.qwen.ai via Playwright',
+        ru: 'агент поверх {provider} через Playwright',
+        en: 'coding agent over {provider} via Playwright',
     },
     'common.yes': { ru: 'да', en: 'yes' },
     'common.no': { ru: 'нет', en: 'no' },

package/dist/i18n/doctor.js

@@ -91,6 +91,10 @@ export const doctorMessages = {
         ru: 'Агент повторяет один и тот же вызов инструмента — переключаю на другой подход.',
         en: 'The agent keeps repeating the same tool call — switching it to a different approach.',
     },
+    'msg.arg_error_loop': {
+        ru: 'Агент раз за разом вызывает инструмент без обязательного аргумента — прошу добавить его.',
+        en: 'The agent keeps calling a tool without a required argument — asking it to add the field.',
+    },
     'msg.suspicious_stop': {
         ru: 'агент, похоже, остановился, не распознав вызов инструмента. Ответ сохранён в транскрипте (событие suspicious_final). Можно попросить продолжить или переотправить задачу.',
         en: 'the agent seems to have stopped without recognizing a tool call. The response is saved in the transcript (suspicious_final event). You can ask it to continue or resend the task.',

package/dist/i18n/help.js

@@ -38,6 +38,10 @@ export const helpMessages = {
         ru: 'показать окно браузера (отладка/вход)',
         en: 'show the browser window (debug/sign-in)',
     },
+    'help.opt.provider': {
+        ru: 'выбрать провайдера чата (deepseek | qwen) на этот запуск',
+        en: 'select the chat provider (deepseek | qwen) for this run',
+    },
     'help.opt.debug': { ru: 'подробный лог', en: 'verbose log' },
     'help.opt.dev': {
         ru: 'режим разработки: авто-перечитывание модулей',
@@ -103,6 +107,7 @@ export const helpMessages = {
     'help.sec.git': { ru: 'Git', en: 'Git' },
     'help.sec.agent': { ru: 'Агент', en: 'Agent' },
     'help.sec.context': { ru: 'Контекст и настройки', en: 'Context & settings' },
+    'help.sec.provider': { ru: 'Провайдер чата', en: 'Chat provider' },
     'help.sec.files': { ru: 'Файлы и прочее', en: 'Files & misc' },
     'help.cmd.new': {
         ru: '/new, /clear             новый чат (сброс контекста)',

package/dist/i18n/qwen.js

@@ -50,6 +50,14 @@ export const qwenMessages = {
         ru: 'Не удалось получить список моделей Qwen: {v}',
         en: 'Failed to fetch the Qwen model list: {v}',
     },
+    'qwen.model_deepseek_only': {
+        ru: '/model доступен только для провайдера Qwen. Сейчас активен DeepSeek (модель выбирается в веб-UI). Переключиться: /provider qwen',
+        en: '/model is only available for the Qwen provider. DeepSeek is active (its model is chosen in the web UI). Switch with: /provider qwen',
+    },
+    'qwen.age_gate_block': {
+        ru: '✖ Qwen показывает окно "Confirm your age" (гостевой режим) и не даёт отправить сообщение. Войдите в аккаунт Qwen (команда /provider login) — в гостевом режиме первое сообщение блокируется.',
+        en: '✖ Qwen shows the "Confirm your age" dialog (guest mode) and blocks the send. Sign in to Qwen (/provider login) — in guest mode the first message is blocked.',
+    },
     'provider.switched': {
         ru: 'Провайдер чата: {v}.',
         en: 'Chat provider: {v}.',

package/dist/index.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'url';
 import { theme } from './theme.js';
 import { DeepSeekBrowser, headlessUACacheReady } from './browser.js';
 import { QwenBrowser } from './qwen-browser.js';
-import { isProviderId, asProviderId, providerChatUrlPrefix, providerLabel, } from './providers.js';
+import { isProviderId, asProviderId, providerChatUrlPrefix, providerLabel, PROVIDER_IDS, } from './providers.js';
 import { createTools, mergeTools, filterToolsForReadOnly, filterToolsByAllowList, } from './tools.js';
 import { createTodoStore, getTodos, setTodos, resetTodos, renderTodos, } from './extraTools.js';
 import { runAgentLoop } from './agent-loop.js';
@@ -69,6 +69,26 @@ const { getArg, hasFlag, getPositional } = createCliArgs(process.argv.slice(2));
 // compaction).
 const COMPACT_FALLBACK_LIMIT = 40;
 const config = loadConfig();
+// A `--provider <deepseek|qwen>` CLI flag selects the backend for THIS run,
+// mirroring the /provider command (which changes it live). Without this an
+// operator who typed `--provider qwen` got the DEFAULT backend — the flag was
+// silently treated as free-form task text and DeepSeek opened instead of Qwen.
+const providerArg = getArg('--provider', null);
+if (providerArg !== null) {
+    if (isProviderId(providerArg)) {
+        config.provider = providerArg;
+        config.qwen.enabled = providerArg === 'qwen';
+    }
+    else {
+        console.error(theme.warn('Unknown --provider "' +
+            providerArg +
+            '" (expected: ' +
+            PROVIDER_IDS.join(' | ') +
+            '). Using ' +
+            config.provider +
+            '.'));
+    }
+}
 // Apply the configured answer width to the markdown renderer (0 = auto).
 setAnswerWidth(config.ui?.answerWidth ?? 0);
 // Current interface/agent language. Changed by the /config lang <ru|en> command.
@@ -367,7 +387,11 @@ function printHelp() {
             t('help.cmd.exit') +
             '\n';
     console.log(`
-${theme.bold('zames')} — ${t('app.tagline')}
+${theme.bold('zames')} — ${t('app.tagline', {
+        provider: browserProviderUrl()
+            .replace(/^https?:\/\//, '')
+            .split('/')[0],
+    })}
 
 ${theme.bold(t('help.options'))}
   --dir <path>       ${t('help.opt.dir')}
@@ -379,6 +403,7 @@ ${theme.bold(t('help.options'))}
   --max-iter <n>     ${t('help.opt.max_iter', { n: config.maxIterations })}
   --headless         ${t('help.opt.headless')}
   --headed           ${t('help.opt.headed')}
+  --provider <id>    ${t('help.opt.provider')}
   --plan             ${t('help.opt.plan')}
   --output-format <f> ${t('help.opt.output_format')}
   --debug            ${t('help.opt.debug')}
@@ -447,6 +472,9 @@ ${theme.bold(t('help.sec.context'))}
   ${t('help.cmd.config')}
   ${t('help.cmd.lang')}
 
+${theme.bold(t('help.sec.provider'))}
+  ${t('help.cmd.provider')}${config.provider === 'qwen' ? '\n  ' + t('help.cmd.model') : ''}
+
 ${theme.bold(t('help.sec.files'))}
   ${t('help.cmd.transcript')}
   ${t('help.cmd.undo')}
@@ -576,6 +604,7 @@ function buildSlashCommands() {
         devMode,
         t,
         dynamic: dynamicCommands,
+        provider: config.provider,
     });
 }
 // We put the agent's temporary files (one-off scripts, etc.) in
@@ -2208,7 +2237,10 @@ async function main() {
         if (lower === '/model' || lower.startsWith('/model ')) {
             const arg = trimmed.slice('/model'.length).trim();
             if (config.provider !== 'qwen') {
-                console.log(theme.system(t('provider.usage')));
+                // `/model` is Qwen-only: it picks a model in Qwen's header dropdown.
+                // DeepSeek exposes no model selection from zames, so the command is
+                // hidden from the hints and only explains itself when typed by hand.
+                console.log(theme.system(t('qwen.model_deepseek_only')));
                 continue;
             }
             const qb = browser;
@@ -3501,6 +3533,11 @@ async function main() {
     if (mcpPool)
         await mcpPool.close().catch(() => { });
     await transcript.close();
+    // Surface a transcript that hit backpressure (events buffered in memory, not
+    // on disk) instead of leaving it silent.
+    const trNote = transcript.healthNote();
+    if (trNote)
+        console.log(theme.warn(trNote));
     // One dim line so the operator can find the log and the session after
     // the run (previously the path was only available via /transcript).
     console.log(theme.dim(t('msg.exit_summary', {

package/dist/input/layout.js

@@ -367,3 +367,32 @@ export function formatCompactTokens(tokens) {
 }
 // Re-exported for the editor's layout selftest (node src/input.js --selftest).
 export { NL, CR, ESC, PASTE_START, PASTE_END, safeJson };
+/**
+ * Split off a trailing PARTIAL PASTE marker so a control sequence fragmented
+ * across two terminal reads is reassembled by the caller instead of leaking
+ * into the buffer as literal text. A bracketed paste sends `ESC[200~` …
+ * `ESC[201~`; a read can end anywhere inside one of those markers.
+ *
+ * Returns `{ head, tail }` where `tail` is the held-back partial marker (or
+ * null when the string does not end inside a marker). Only tails that START
+ * with ESC and are a genuine PREFIX of PASTE_START / PASTE_END are held, so an
+ * ordinary trailing `[2` typed by hand is NOT swallowed.
+ */
+export function splitPasteTail(s) {
+    const str = String(s ?? '');
+    if (!str)
+        return { head: str, tail: null };
+    // The longest marker prefix to consider is one char short of the marker.
+    const markers = [PASTE_START, PASTE_END];
+    const maxHold = Math.max(...markers.map((m) => m.length)) - 1;
+    const upto = Math.min(maxHold, str.length - 1);
+    for (let len = upto; len >= 1; len--) {
+        const tail = str.slice(str.length - len);
+        if (!tail.startsWith(ESC))
+            continue;
+        if (markers.some((m) => m.length > len && m.startsWith(tail))) {
+            return { head: str.slice(0, str.length - len), tail };
+        }
+    }
+    return { head: str, tail: null };
+}

package/dist/input.js

@@ -4,12 +4,12 @@ import { contentWidth } from './width.js';
 import { randomThinkingPhrase, stripEllipsis, DOTS, renderDots, } from './spinner.js';
 import { translate } from './i18n.js';
 import { AttachmentStore, parseImagePaste, looksLikeFilePath, } from './attachments.js';
-import { NL, CR, ESC, PASTE_START, PASTE_END, SUGGEST_PAGE, pasteReplacement, expandPastes, safeJson, visRows, visLen, charWidth, layoutInput, formatTokenStatus, tokenStatusLevel, truncateToWidth, wrapToWidth, CONTEXT_LIMIT, } from './input/layout.js';
+import { NL, CR, ESC, PASTE_START, PASTE_END, SUGGEST_PAGE, pasteReplacement, expandPastes, safeJson, visRows, visLen, charWidth, layoutInput, formatTokenStatus, tokenStatusLevel, truncateToWidth, wrapToWidth, splitPasteTail, CONTEXT_LIMIT, } from './input/layout.js';
 // The pure layout/formatting helpers (visual rows, cursor position, visible
 // width, paste markers, token formatting) live in ./input/layout.js. They are
 // re-exported here so every existing import from './input.js' keeps working,
 // and so tests can import them from either module (C3 step 3).
-export { PASTE_MIN_LINES, SUGGEST_PAGE, isSubsequence, countPasteLines, formatPasteMarker, pasteReplacement, expandPastes, visRows, visLen, charWidth, layoutInput, tokenStatusLevel, formatTokenStatus, formatCompactTokens, truncateToWidth, wrapToWidth, CONTEXT_LIMIT, CONTEXT_YELLOW_PCT, CONTEXT_RED_PCT, } from './input/layout.js';
+export { PASTE_MIN_LINES, SUGGEST_PAGE, isSubsequence, countPasteLines, formatPasteMarker, pasteReplacement, expandPastes, visRows, visLen, charWidth, layoutInput, tokenStatusLevel, formatTokenStatus, formatCompactTokens, splitPasteTail, truncateToWidth, wrapToWidth, CONTEXT_LIMIT, CONTEXT_YELLOW_PCT, CONTEXT_RED_PCT, } from './input/layout.js';
 // PURE slash-command suggestion logic (match / paging / completion), split out
 // of the class so the fuzzy match is unit-tested without driving the editor.
 import { matchSlashCommands, suggestWindow, completeSlashCommand, } from './input/suggest.js';
@@ -99,6 +99,12 @@ export class LineEditor {
     // head of a control sequence split across two reads. We hold it briefly and
     // fire onEscape only if no tail arrives.
     _escPending;
+    // Tail of a control sequence split across two `data` chunks. Only the
+    // PASTE_START / PASTE_END markers need it: a chunk that ends on `ESC[2` etc.
+    // is stored here and re-joined with the next chunk, so a bracketed paste whose
+    // start marker was fragmented is still recognized (otherwise the paste bytes
+    // leaked into the buffer as literal text).
+    _ctrlTail;
     _escTimer;
     // History of sent messages (for the up/down arrows).
     history;
@@ -219,6 +225,7 @@ export class LineEditor {
         this._resizeTimer = null;
         this._escPending = false;
         this._escTimer = null;
+        this._ctrlTail = '';
         this._onResize = () => {
             // Debounce: a window drag fires a burst of SIGWINCH events. We wait a
             // short moment, then redraw the block at the NEW width.
@@ -1574,6 +1581,20 @@ export class LineEditor {
             }
             s = ESC + s;
         }
+        // Reattach a control-sequence tail held from the PREVIOUS chunk (a
+        // PASTE_START/PASTE_END marker split across reads). See _ctrlTail.
+        if (this._ctrlTail) {
+            s = this._ctrlTail + s;
+            this._ctrlTail = '';
+        }
+        // A chunk may end in the MIDDLE of a PASTE marker (`ESC[2`, `ESC[20`, …).
+        // Hold that tail back so the next chunk completes it; otherwise the
+        // fragment is inserted as literal text and the paste is not bracketed.
+        const held = splitPasteTail(s);
+        if (held.tail) {
+            this._ctrlTail = held.tail;
+            s = held.head;
+        }
         if (!this._inPaste && s === ESC && !this._searchMode) {
             // Bare ESC in its own chunk: wait a moment for the possible tail of a
             // control sequence before treating it as the Escape key.

package/dist/qwen-browser.js

@@ -21,12 +21,13 @@ import os from 'os';
 import { chromium } from 'playwright';
 import { translate, DEFAULT_LOCALE } from './i18n.js';
 import { rewriteFailedAttachments } from './commands.js';
+import { awaitUploadPreview, readAttachBuffers } from './attach-flow.js';
 import { theme } from './theme.js';
 import { scrapeQwenChatList, scrapeQwenChatMessages, parseQwenChatList, parseQwenHistory, } from './qwen-chats.js';
 import { cleanAnswer, headlessEngineKey, readCachedHeadlessUA, writeCachedHeadlessUA, sanitizeHeadlessUA, cleanSingletonFiles, profileLooksLocked, nukeProfile, AUTH_MARKER_FILE, } from './browser-pure.js';
 import { chatSignalInDom, dumpDomCountsInDom, isElementEnabledInDom, readInputTrimmedTextInDom, readLastAnswerInDom, readPageToastsInDom, readUserAgentInDom, setBusyTitleInDom, clickStopInDom, stopButtonVisibleInDom, } from './browser-dom.js';
 import { probeUiHealth, } from './ui-health.js';
-import { CHAT_URL, CHAT_ID_RE, chatUrl, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, NEW_CHAT_SELECTOR, MODEL_TRIGGER_SELECTOR, MODELS_URL, CHAT_LIST_URL, chatHistoryUrl, AGE_GATE_MODAL, AGE_GATE_CONTINUE, COOKIE_ACCEPT_RE, ATTACH_SELECTORS, ATTACH_MENU_TRIGGER, ATTACH_MENU_ITEM_RE, THINKING_SELECTOR, THINKING_MODE_RE, FAST_MODE_RE, WEB_SEARCH_MENU_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, ASSISTANT_CLASS_RE, CHAT_SIGNAL_NODES_SELECTOR, MARKDOWN_SELECTOR, TOGGLE_SELECTORS, } from './qwen-ui.js';
+import { CHAT_URL, CHAT_ID_RE, chatUrl, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, NEW_CHAT_SELECTOR, MODEL_TRIGGER_SELECTOR, MODELS_URL, CHAT_LIST_URL, chatHistoryUrl, AGE_GATE_MODAL, AGE_GATE_CONTINUE, AGE_GATE_YEAR_SELECT, AGE_GATE_YEAR_OPTION, COOKIE_ACCEPT_RE, ATTACH_SELECTORS, ATTACH_MENU_TRIGGER, ATTACH_MENU_ITEM_RE, THINKING_SELECTOR, THINKING_MODE_RE, FAST_MODE_RE, WEB_SEARCH_MENU_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, ASSISTANT_CLASS_RE, CHAT_SIGNAL_NODES_SELECTOR, MARKDOWN_SELECTOR, TOGGLE_SELECTORS, } from './qwen-ui.js';
 import { extractAnswer, extractTokenUsage, isFinishedWithoutAnswer, isRateLimitText, isGuestLimitText, isServerBusyText, } from './qwen-net-capture.js';
 // A SEPARATE profile from DeepSeek's ~/.zames/profile. Two persistent Chromium
 // contexts on ONE --user-data-dir cannot coexist (SingletonLock), and keeping
@@ -40,6 +41,18 @@ function escapeRegExp(s) {
 const CHAT_RE = /chat\.qwen\.ai/i;
 const ANSWER_URL_RE = /\/api\/v2\/chat\/completions/i;
 const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+// Cap the stored RAW SSE body. The truncated/no-answer detectors only read the
+// markers (`quasi_status`, `finish_reason`) and the SLICE shown in errors
+// (first/last 300 chars), so keeping a whole multi-MB stream in memory for the
+// rest of the turn is wasteful. The first 64 KB is plenty for every marker we
+// match; the tail (used in error messages) is kept by cutting the middle.
+const MAX_NET_BODY = 64 * 1024;
+function capNetBody(body) {
+    if (body.length <= MAX_NET_BODY)
+        return body;
+    const head = MAX_NET_BODY - 1024;
+    return body.slice(0, head) + '\n...[truncated]...\n' + body.slice(-1024);
+}
 export class QwenBrowser {
     providerName = 'qwen';
     headless;
@@ -268,7 +281,14 @@ export class QwenBrowser {
         }
         this.page = this.context.pages()[0] || (await this.context.newPage());
         this._installNetHook();
-        await this.page.goto(CHAT_URL, { waitUntil: 'domcontentloaded' });
+        // A slow network (or a cold CDN) can make the initial navigation exceed
+        // Playwright's 30s goto timeout. That must NOT abort launch(): the page is
+        // usually already usable, and every later step (_awaitInput, waitForLogin)
+        // polls. Bailing out here turned a transient slowness into a hard startup
+        // failure.
+        await this.page
+            .goto(CHAT_URL, { waitUntil: 'domcontentloaded' })
+            .catch(() => { });
         await this._dismissOverlays();
     }
     async restart() {
@@ -292,6 +312,22 @@ export class QwenBrowser {
                 .catch(() => { });
             const gate = this.page.locator(AGE_GATE_MODAL);
             if (await gate.count().catch(() => 0)) {
+                // The gate has a YEAR dropdown (default already set) plus Continue.
+                // A raw click on Continue can be a no-op until a year is committed,
+                // so open the dropdown and pick an option FIRST, then Continue — and
+                // finally verify the modal actually closed. Verified live: the year
+                // must be selected via the trigger (clicking the label does nothing).
+                await this.page
+                    .locator(AGE_GATE_YEAR_SELECT)
+                    .first()
+                    .click({ timeout: 2000 })
+                    .catch(() => { });
+                await this.page.waitForTimeout(400);
+                const opt = this.page.locator(AGE_GATE_YEAR_OPTION).first();
+                if (await opt.count().catch(() => 0)) {
+                    await opt.click({ timeout: 2000 }).catch(() => { });
+                    await this.page.waitForTimeout(300);
+                }
                 await this.page
                     .locator(AGE_GATE_CONTINUE)
                     .first()
@@ -360,7 +396,7 @@ export class QwenBrowser {
             // tomorrow).
             if (isGuestLimitText(body)) {
                 this._netGuestLimit = true;
-                this._netBody = body;
+                this._netBody = capNetBody(body);
                 this._netCaptureAt = Date.now();
             }
             const isAnswerUrl = ANSWER_URL_RE.test(url);
@@ -377,7 +413,7 @@ export class QwenBrowser {
                 // sent it by hand. Bump the throttle so our next send waits.
                 this._lastSentAt = Date.now();
             }
-            this._netBody = body;
+            this._netBody = capNetBody(body);
             const cid = body.match(UUID_RE);
             if (cid)
                 this._netChatId = cid[0];
@@ -1323,6 +1359,11 @@ export class QwenBrowser {
                     if (e instanceof QwenGuestLimitError) {
                         throw new Error(this._t('qwen.guest_limit'));
                     }
+                    if (e instanceof QwenAgeGateError) {
+                        // Not retryable: a resend hits the SAME gate. Fail at once with a
+                        // clear "sign in" message instead of burning the retry budget.
+                        throw new Error(this._t('qwen.age_gate_block'));
+                    }
                     if (/rate limit|too frequent/i.test(msg)) {
                         if (rateLimitRetries >= this.maxRateLimitRetries)
                             break;
@@ -1400,21 +1441,7 @@ export class QwenBrowser {
     // the input). Returns the files that FAILED so the prompt can rewrite their
     // markers. Mirrors DeepSeekBrowser._attachFiles.
     async _attachFiles(files) {
-        const failed = [];
-        const bufPayload = [];
-        for (const f of files) {
-            try {
-                const buffer = await fs.readFile(f.path);
-                bufPayload.push({ name: f.name, mimeType: f.mime, buffer });
-            }
-            catch (e) {
-                failed.push({ path: f.path, name: f.name });
-                this._notice(theme.warn(this._t('qwen.attach_read_failed', {
-                    name: f.name,
-                    error: e.message,
-                })));
-            }
-        }
+        const { payload: bufPayload, failed } = await readAttachBuffers(files, (name, error) => this._notice(theme.warn(this._t('qwen.attach_read_failed', { name, error }))));
         if (!bufPayload.length)
             return failed;
         // Primary flow (verified live): click the "+" (`.mode-select-open`) to
@@ -1459,27 +1486,10 @@ export class QwenBrowser {
             failed.push({ path: f.path, name: f.name });
         return failed;
     }
-    // Wait for the upload chip (the file name above the input) instead of a
-    // fixed sleep: files are attached BEFORE the text is typed, so the name
-    // cannot appear on the page for any other reason.
+    // Wait for the upload chip (the file name above the input). Delegates to the
+    // shared helper so both providers use the SAME preview policy.
     async _awaitUploadPreview(names, timeoutMs) {
-        const clean = names.map((n) => String(n || '').trim()).filter(Boolean);
-        if (!clean.length) {
-            await this.page.waitForTimeout(timeoutMs);
-            return;
-        }
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            for (const name of clean) {
-                const n = await this.page
-                    .getByText(name, { exact: false })
-                    .count()
-                    .catch(() => 0);
-                if (n > 0)
-                    return;
-            }
-            await this.page.waitForTimeout(150);
-        }
+        await awaitUploadPreview(this.page, names, timeoutMs);
     }
     async _setInputText(input, text) {
         const tag = await input.evaluate((el) => el.tagName.toLowerCase());
@@ -1572,6 +1582,11 @@ export class QwenBrowser {
         const preSendSignal = await this._chatSignal();
         let sent = false;
         while (!sent && Date.now() < sendDeadline) {
+            // The age-confirmation gate can POP UP on the FIRST send (it is not
+            // present at page load). While it is on screen it swallows the click on
+            // the send button, so the message never goes out. Dismiss it BEFORE each
+            // send attempt; a no-op once it is gone.
+            await this._dismissOverlays();
             // (1) the send button, if present/enabled/visible. We remember whether a
             // click was actually issued: pressing Enter in the SAME round could send
             // the message a SECOND time if the click already worked but the input
@@ -1626,8 +1641,19 @@ export class QwenBrowser {
         this._lastSentAt = Date.now();
         if (!sent) {
             // The text is still in the input after the whole deadline: the message
-            // was NOT sent. Throw so ask() retries the send instead of waiting out
-            // the full answer timeout for a turn that never started.
+            // was NOT sent. A common cause is the age-confirmation gate that pops up
+            // for a GUEST and (verified live) does not always close programmatically
+            // — it swallows the click on the send button. Report that explicitly so
+            // the operator knows to sign in instead of seeing a generic error.
+            const gate = await this.page
+                .locator(AGE_GATE_MODAL)
+                .count()
+                .catch(() => 0);
+            if (gate > 0) {
+                throw new QwenAgeGateError('age-confirmation modal blocks the send');
+            }
+            // Throw so ask() retries the send instead of waiting out the full answer
+            // timeout for a turn that never started.
             throw new Error(this._t('qwen.send_button_missing'));
         }
         // Wait for the answer to start, then for it to settle.
@@ -1729,6 +1755,14 @@ class QwenGuestLimitError extends Error {
         this.name = 'QwenGuestLimitError';
     }
 }
+// The guest age-confirmation gate swallowed the send. NOT retryable: a resend
+// hits the same gate, so ask() fails at once instead of burning its retries.
+class QwenAgeGateError extends Error {
+    constructor(detail) {
+        super('age gate: ' + detail);
+        this.name = 'QwenAgeGateError';
+    }
+}
 class QwenIncompleteError extends Error {
     constructor(detail) {
         super('generation incomplete: ' + detail);

package/dist/qwen-chats.js

@@ -132,26 +132,36 @@ export function parseQwenChatList(json) {
 export function parseQwenHistory(json) {
     const root = json;
     const data = root && typeof root === 'object' ? root.data : null;
+    // The REAL shape (verified live) is a MAP, not an array:
+    //   data.chat.history.messages = { <id>: { role, content, timestamp, ... } }
+    // An array is accepted too (older shape).
     let arr = null;
+    const asArr = (v) => Array.isArray(v) ? v : v && typeof v === 'object' ? Object.values(v) : null;
     if (Array.isArray(data))
         arr = data;
     else if (data && typeof data === 'object') {
         const d = data;
-        if (Array.isArray(d.messages))
-            arr = d.messages;
+        if (d.messages)
+            arr = asArr(d.messages);
         else if (d.chat && typeof d.chat === 'object') {
             const chat = d.chat;
-            if (Array.isArray(chat.messages))
-                arr = chat.messages;
+            const hist = chat.history && typeof chat.history === 'object'
+                ? chat.history
+                : null;
+            if (hist && hist.messages)
+                arr = asArr(hist.messages);
+            else if (chat.messages)
+                arr = asArr(chat.messages);
         }
     }
-    if (!Array.isArray(arr))
+    if (!arr)
         return [];
+    // The map is UNORDERED; `timestamp` (seconds) restores the dialogue order.
+    const sorted = arr
+        .filter((x) => !!x && typeof x === 'object')
+        .sort((a, b) => (Number(a.timestamp) || 0) - (Number(b.timestamp) || 0));
     const out = [];
-    for (const raw of arr) {
-        if (!raw || typeof raw !== 'object')
-            continue;
-        const m = raw;
+    for (const m of sorted) {
         // Role detection is DEFENSIVE: the field has been `role` (string,
         // case-insensitive), a numeric flag, or `is_user`. Anything that is not
         // clearly the user is treated as the assistant (the restored dialogue
@@ -175,6 +185,15 @@ export function parseQwenHistory(json) {
                 }
             }
         }
+        // `content_list` (phase-split output) is used when `content` is empty.
+        if (!text && Array.isArray(m.content_list)) {
+            for (const part of m.content_list) {
+                if (part && typeof part.content === 'string')
+                    text += part.content;
+            }
+        }
+        // `reasoning_content` is the THINK phase and must never leak into the
+        // restored dialogue as the answer.
         text = text.trim();
         if (text)
             out.push({ role, text });

package/dist/qwen-net-capture.js

@@ -199,7 +199,11 @@ export function isRateLimitText(body) {
     const b = String(body || '');
     if (!b)
         return false;
-    return /too many requests|rate limit|too frequent|please try again later|слишком часто/i.test(b);
+    // `quota_limit` is a SEPARATE code Qwen returns in the SSE error field
+    // ("The service is currently experiencing high demand. Please try again
+    // later.") — a TRANSIENT capacity limit, so it belongs with the rate-limit
+    // family (back off and retry), not with the guest DAILY limit.
+    return /too many requests|rate limit|too frequent|please try again later|quota_limit|high demand|слишком часто/i.test(b);
 }
 // The GUEST daily limit is a DIFFERENT failure from a transient rate limit:
 // Qwen answers `RateLimited` with "You've reached the guest chat limit for

package/dist/qwen-ui.js

@@ -80,7 +80,13 @@ export const MODEL_TRIGGER_SELECTOR = '.wms-trigger';
 // A first-time visitor must confirm their birth year before chatting. The
 // dialog is an ant-modal; the Continue button is the black footer button.
 export const AGE_GATE_MODAL = '.age-confirmation-modal';
+// The Continue button inside the age gate (the black footer button).
 export const AGE_GATE_CONTINUE = '.age-confirmation-modal .qwen-chat-v2-btn-black';
+// The year dropdown TRIGGER inside the age gate. It must be clicked to open
+// the year menu; clicking the label alone does not select a year.
+export const AGE_GATE_YEAR_SELECT = '.age-confirmation-year .qwen-chat-v2-dropdown-menu-select';
+// A year OPTION in the opened dropdown (the menu item text is the year).
+export const AGE_GATE_YEAR_OPTION = '.qwen-chat-v2-dropdown-menu-item';
 // The cookie banner's accept button (matched by its visible label).
 export const COOKIE_ACCEPT_RE = /^accept all cookies$/i;
 // ---------- messages / answers ----------

package/dist/shell.js

@@ -43,6 +43,15 @@ export function assertCommandInsideRoot(root, command) {
             throw new Error('Sandbox: leaving ' + root + ' is forbidden (cd ' + raw + ')');
         }
     }
+    // chroot switches the process root outright — always a barrier violation.
+    // NOTE: `sh -c '…'` and an in-process `chdir` are deliberately NOT blocked:
+    // `bash -c` / `nohup bash -c` is a legitimate way to run a background job,
+    // and a blanket ban broke real commands (the operator runs scripts that way).
+    // They remain a documented best-effort hole (a static scan cannot follow a
+    // runtime target); full isolation needs bwrap/containers.
+    if (/\bchroot\b/i.test(cmd)) {
+        throw new Error('Sandbox: chroot is forbidden');
+    }
 }
 function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
     const out = (stdout || '').toString();

package/dist/tools.js

@@ -40,11 +40,11 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
     };
     const req = (v, name) => {
         if (v === undefined || v === null) {
-            throw new Error(`Missing required argument: ${name}`);
+            throw new Error(`Missing required argument: ${name}. Add "${name}" to the tool call arguments and retry.`);
         }
         const s = String(v);
         if (s === '' || s === 'undefined' || s === 'null') {
-            throw new Error(`Invalid required argument ${name}: ${JSON.stringify(v)}`);
+            throw new Error(`Invalid required argument ${name}: ${JSON.stringify(v)}. Provide a non-empty value for "${name}" and retry.`);
         }
         return s;
     };

package/dist/transcript.js

@@ -49,10 +49,19 @@ export class Transcript {
         if (!this.enabled || !this.stream)
             return;
         try {
-            this.stream.write(line);
+            // `write() === false` means the internal buffer is FULL (slow disk /
+            // network mount). Node keeps buffering in memory, so a long run of fast
+            // events can grow unboundedly; we COUNT the backpressured writes so
+            // close() can report them. We still write (dropping trace lines silently
+            // would be worse), but the counter makes the condition visible.
+            const ok = this.stream.write(line);
+            if (!ok)
+                this.backpressure++;
         }
         catch { }
     }
+    /** Number of writes that hit backpressure (write() === false). */
+    backpressure = 0;
     // Flush the stream and resolve once the data reached the file. The callers
     // run on process.exit paths (one-shot --task, browser error, clean exit), and
     // end() without awaiting the callback lets the process die before the buffer
@@ -70,4 +79,16 @@ export class Transcript {
             stream.end(() => resolve());
         });
     }
+    /**
+     * A one-line health note for the operator, or null when the stream stayed
+     * healthy. Callers print it on exit so a slow/broken transcript file (the
+     * events were buffered in memory instead of reaching disk) is not silent.
+     */
+    healthNote() {
+        if (this.backpressure === 0)
+            return null;
+        return ('transcript: ' +
+            this.backpressure +
+            ' write(s) hit backpressure (slow disk?) — events may be delayed');
+    }
 }

package/dist/xml-toolcall.js

@@ -18,6 +18,26 @@ function readAttr(attrs, name) {
     const m = attrs.match(re);
     return m ? m[2] : null;
 }
+// Read EVERY key="value" pair from an <invoke ...> tag. The model sometimes
+// emits a tool argument as an ATTRIBUTE of the invoke tag itself (e.g.
+// `<invoke name="Write" path="chess.html">` with only the big `content` as a
+// <parameter> child). readAttr() kept only the tool name, so such an argument
+// was silently DROPPED and the tool failed with 'Missing required argument'.
+// Keys are returned in source order so the first occurrence wins.
+function readAllAttrs(attrs) {
+    const Q = String.fromCharCode(34);
+    const out = {};
+    const re = new RegExp('([A-Za-z_][A-Za-z0-9_]*)[ ]*=[ ]*[' + Q + ']([^' + Q + ']*)[' + Q + ']', 'g');
+    let m;
+    while ((m = re.exec(attrs)) !== null) {
+        const key = m[1];
+        if (key === 'name')
+            continue;
+        if (!(key in out))
+            out[key] = unescapeXml(m[2]);
+    }
+    return out;
+}
 // The model sometimes produces a "hybrid" call: the tool name is an attribute
 // AND the arguments are inline JSON in the SAME opening tag, without any
 // <parameter> children. A real case from the transcript:
@@ -127,6 +147,15 @@ export function parseXmlToolCalls(text) {
         const closeMatch = closeRe.exec(rest);
         const body = closeMatch ? rest.slice(0, closeMatch.index) : rest;
         const args = parseParameters(body);
+        // Arguments may ALSO arrive as attributes of the invoke tag itself
+        // (`<invoke name="Write" path="chess.html">`); merge them in, letting an
+        // explicit <parameter> of the same name win (it carries string=true and
+        // the exact value). This is what stops `path` from being silently lost.
+        const attrArgs = readAllAttrs(attrs);
+        for (const k of Object.keys(attrArgs)) {
+            if (!(k in args))
+                args[k] = attrArgs[k];
+        }
         // Hybrid form: the arguments are inline JSON in the SAME invoke tag
         // (e.g. `<|DSML|invoke name="GitAdd", "args" {"paths": "..."}>`), with no
         // <parameter> children. Fall back to the raw invoke head + body.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.73.7",
+  "version": "2.73.9",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {

package/scripts/qwen-smoke.mts

@@ -163,6 +163,38 @@ async function main() {
     } catch (e) {
       record('toolCall', false, (e as Error).message)
     }
+
+    // History restore: after the sends above the chat must have messages.
+    try {
+      const id = await browser.getCurrentChatId()
+      const msgs = id ? await browser.fetchChatMessages(id) : []
+      record(
+        'history',
+        msgs.length > 0,
+        'id=' + (id || '-') + ' msgs=' + msgs.length,
+      )
+    } catch (e) {
+      record('history', false, (e as Error).message)
+    }
+
+    // Attachments: a SIGNED-IN session uploads a file; a GUEST cannot, so a
+    // guest failure is reported as a SKIP (not a failure) — the guest limit is
+    // a site restriction, not a regression.
+    try {
+      const tmpFile = path.join(SMOKE_HOME, 'zames-smoke-note.txt')
+      fs.writeFileSync(tmpFile, 'The secret word is BANANA')
+      const failed = await browser._attachFiles([
+        { path: tmpFile, name: 'zames-smoke-note.txt', mime: 'text/plain' },
+      ])
+      const attached = failed.length === 0
+      const isGuest = !(await browser.isLoggedIn().catch(() => false))
+      if (attached) record('attachments', true, '')
+      else if (isGuest)
+        record('attachments', true, 'skipped (guest cannot upload)')
+      else record('attachments', false, JSON.stringify(failed))
+    } catch (e) {
+      record('attachments', false, (e as Error).message)
+    }
   }
 
   await browser.close().catch(() => {})