zames_pro 2.73.8 → 2.73.10

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.73.10] - 2026-10-12
+
+### Fixed
+
+- **tools:** reject invalid base64 instead of writing garbage
+
+## [2.73.9] - 2026-10-12
+
+### Fixed
+
+- **qwen:** raise the default send pause to 4s (rate limit is real)
+- **qwen:** read the real history shape (map) + handle quota_limit
+- **cli:** honor --provider <id>; stop blocking bash -c in the sandbox
+
 ## [2.73.8] - 2026-10-12
 
 ### Fixed

package/README.md

@@ -467,6 +467,32 @@ Their tools show up in the agent as `server__tool` (e.g.
 A server that fails to connect is skipped with a warning and never breaks the
 agent.
 
+### Recommended servers (verified)
+
+A few small, high-value servers tested end to end with zames (both the
+DeepSeek and Qwen backends):
+
+- **Context7** (`@upstash/context7-mcp`) — fetches CURRENT, version-specific
+documentation for a library before the agent writes code, instead of relying
+on a stale training snapshot. Tools: `resolve_library_id` then `query_docs`.
+Verified live on DeepSeek AND Qwen: the agent called both tools and got the
+current Zod API. This is the one to add first.
+
+  ```json
+  { "context7": { "command": "npx", "args": ["-y", "@upstash/context7-mcp@latest"] } }
+  ```
+
+- **Sequential Thinking** (`@modelcontextprotocol/server-sequential-thinking`)
+— one `sequentialthinking` tool that gives the model an explicit, revisable
+plan before it acts; useful for long multi-step tasks.
+
+- **Memory** (`@modelcontextprotocol/server-memory`) — a local knowledge graph
+(9 tools) for durable facts across chats. NOTE: zames already has `MEMORY.md`
++ `AGENTS.md`; add this only if you want a queryable graph.
+
+Keep the stack SMALL: every server loads its tool definitions into the model's
+context. Add one when you feel its absence, not before.
+
 ## Configuration
 
 Global config: `~/.zames/config.json`
@@ -1010,6 +1036,32 @@ MCP-браузер и браузер агента подерутся за оди
 Сервер, который не смог подключиться, пропускается с предупреждением и
 никогда не роняет агента.
 
+### Рекомендованные серверы (проверены)
+
+Несколько небольших полезных серверов, протестированных вживую с zames
+(на обоих бэкендах — DeepSeek и Qwen):
+
+- **Context7** (`@upstash/context7-mcp`) — подтягивает АКТУАЛЬНУЮ
+документацию библиотеки (для конкретной версии) до того, как агент пишет код,
+вместо устаревших знаний из обучения. Инструменты: `resolve_library_id`, затем
+`query_docs`. Проверено вживую на DeepSeek И Qwen: агент вызвал оба инструмента
+и получил актуальный API Zod. Именно его стоит подключить первым.
+
+  ```json
+  { "context7": { "command": "npx", "args": ["-y", "@upstash/context7-mcp@latest"] } }
+  ```
+
+- **Sequential Thinking** (`@modelcontextprotocol/server-sequential-thinking`)
+— один инструмент `sequentialthinking`, дающий модели явный пересматриваемый
+план перед действием; полезно для длинных многошаговых задач.
+
+- **Memory** (`@modelcontextprotocol/server-memory`) — локальный граф знаний
+(9 инструментов) для долговременных фактов между чатами. ВНИМАНИЕ: у zames уже
+есть `MEMORY.md` + `AGENTS.md`; подключайте, только если нужен граф с запросами.
+
+Держите набор МАЛЕНЬКИМ: каждый сервер грузит описания своих инструментов в
+контекст модели. Добавляйте, когда почувствовали нехватку, а не заранее.
+
 ## Конфигурация
 
 Глобальный конфиг: `~/.zames/config.json`

package/dist/cli-args.js

@@ -17,6 +17,7 @@ export const SKIP_VALUE_FLAGS = [
     '--max-iter',
     '--chat',
     '--output-format',
+    '--provider',
 ];
 export function createCliArgs(argv) {
     const args = Array.isArray(argv) ? argv : [];

package/dist/config.js

@@ -21,9 +21,11 @@ export const DEFAULTS = {
     qwen: {
         model: '',
         enabled: false,
-        // Qwen tolerates back-to-back sends (verified live: 4 sends at 0 ms gap,
-        // no rate limit), so the DeepSeek 15 s throttle is pure latency here.
-        minSendIntervalMs: 1000,
+        // Qwen DOES rate-limit a rapid burst: measured live, the 5th back-to-back
+        // send at 0 ms gap hit "too frequent" and needed a 5-min back-off. A 1 s
+        // gap was too small for a real editing session, so the default is now 4 s
+        // — enough to stay under the limit while keeping the agent responsive.
+        minSendIntervalMs: 4000,
         // The first send after a cold load can take minutes ("Model loading…" +
         // thinking); a GUEST turn measured up to ~9 min live on a cold profile, so
         // give it generous room. A signed-in session answers in seconds; this only

package/dist/extraTools.js

@@ -12,7 +12,15 @@ import { safePath } from './sandbox.js';
 const NL = String.fromCharCode(10);
 function decodeContent(content, contentBase64) {
     if (typeof contentBase64 === 'string' && contentBase64.length) {
-        return Buffer.from(contentBase64, 'base64').toString('utf-8');
+        // Reject undecodable base64: Buffer.from(..., 'base64') silently drops
+        // invalid characters and returns garbage, which would patch with corrupt
+        // text and no error (same guard as tools.ts).
+        const compact = contentBase64.replace(/\s+/g, '');
+        if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) {
+            throw new Error('base64 argument is not valid (expected only A-Za-z0-9+/=). ' +
+                'Re-send as plain text or as clean base64.');
+        }
+        return Buffer.from(compact, 'base64').toString('utf-8');
     }
     return String(content ?? '');
 }

package/dist/i18n/help.js

@@ -38,6 +38,10 @@ export const helpMessages = {
         ru: 'показать окно браузера (отладка/вход)',
         en: 'show the browser window (debug/sign-in)',
     },
+    'help.opt.provider': {
+        ru: 'выбрать провайдера чата (deepseek | qwen) на этот запуск',
+        en: 'select the chat provider (deepseek | qwen) for this run',
+    },
     'help.opt.debug': { ru: 'подробный лог', en: 'verbose log' },
     'help.opt.dev': {
         ru: 'режим разработки: авто-перечитывание модулей',

package/dist/index.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'url';
 import { theme } from './theme.js';
 import { DeepSeekBrowser, headlessUACacheReady } from './browser.js';
 import { QwenBrowser } from './qwen-browser.js';
-import { isProviderId, asProviderId, providerChatUrlPrefix, providerLabel, } from './providers.js';
+import { isProviderId, asProviderId, providerChatUrlPrefix, providerLabel, PROVIDER_IDS, } from './providers.js';
 import { createTools, mergeTools, filterToolsForReadOnly, filterToolsByAllowList, } from './tools.js';
 import { createTodoStore, getTodos, setTodos, resetTodos, renderTodos, } from './extraTools.js';
 import { runAgentLoop } from './agent-loop.js';
@@ -69,6 +69,26 @@ const { getArg, hasFlag, getPositional } = createCliArgs(process.argv.slice(2));
 // compaction).
 const COMPACT_FALLBACK_LIMIT = 40;
 const config = loadConfig();
+// A `--provider <deepseek|qwen>` CLI flag selects the backend for THIS run,
+// mirroring the /provider command (which changes it live). Without this an
+// operator who typed `--provider qwen` got the DEFAULT backend — the flag was
+// silently treated as free-form task text and DeepSeek opened instead of Qwen.
+const providerArg = getArg('--provider', null);
+if (providerArg !== null) {
+    if (isProviderId(providerArg)) {
+        config.provider = providerArg;
+        config.qwen.enabled = providerArg === 'qwen';
+    }
+    else {
+        console.error(theme.warn('Unknown --provider "' +
+            providerArg +
+            '" (expected: ' +
+            PROVIDER_IDS.join(' | ') +
+            '). Using ' +
+            config.provider +
+            '.'));
+    }
+}
 // Apply the configured answer width to the markdown renderer (0 = auto).
 setAnswerWidth(config.ui?.answerWidth ?? 0);
 // Current interface/agent language. Changed by the /config lang <ru|en> command.
@@ -383,6 +403,7 @@ ${theme.bold(t('help.options'))}
   --max-iter <n>     ${t('help.opt.max_iter', { n: config.maxIterations })}
   --headless         ${t('help.opt.headless')}
   --headed           ${t('help.opt.headed')}
+  --provider <id>    ${t('help.opt.provider')}
   --plan             ${t('help.opt.plan')}
   --output-format <f> ${t('help.opt.output_format')}
   --debug            ${t('help.opt.debug')}

package/dist/qwen-chats.js

@@ -132,26 +132,36 @@ export function parseQwenChatList(json) {
 export function parseQwenHistory(json) {
     const root = json;
     const data = root && typeof root === 'object' ? root.data : null;
+    // The REAL shape (verified live) is a MAP, not an array:
+    //   data.chat.history.messages = { <id>: { role, content, timestamp, ... } }
+    // An array is accepted too (older shape).
     let arr = null;
+    const asArr = (v) => Array.isArray(v) ? v : v && typeof v === 'object' ? Object.values(v) : null;
     if (Array.isArray(data))
         arr = data;
     else if (data && typeof data === 'object') {
         const d = data;
-        if (Array.isArray(d.messages))
-            arr = d.messages;
+        if (d.messages)
+            arr = asArr(d.messages);
         else if (d.chat && typeof d.chat === 'object') {
             const chat = d.chat;
-            if (Array.isArray(chat.messages))
-                arr = chat.messages;
+            const hist = chat.history && typeof chat.history === 'object'
+                ? chat.history
+                : null;
+            if (hist && hist.messages)
+                arr = asArr(hist.messages);
+            else if (chat.messages)
+                arr = asArr(chat.messages);
         }
     }
-    if (!Array.isArray(arr))
+    if (!arr)
         return [];
+    // The map is UNORDERED; `timestamp` (seconds) restores the dialogue order.
+    const sorted = arr
+        .filter((x) => !!x && typeof x === 'object')
+        .sort((a, b) => (Number(a.timestamp) || 0) - (Number(b.timestamp) || 0));
     const out = [];
-    for (const raw of arr) {
-        if (!raw || typeof raw !== 'object')
-            continue;
-        const m = raw;
+    for (const m of sorted) {
         // Role detection is DEFENSIVE: the field has been `role` (string,
         // case-insensitive), a numeric flag, or `is_user`. Anything that is not
         // clearly the user is treated as the assistant (the restored dialogue
@@ -175,6 +185,15 @@ export function parseQwenHistory(json) {
                 }
             }
         }
+        // `content_list` (phase-split output) is used when `content` is empty.
+        if (!text && Array.isArray(m.content_list)) {
+            for (const part of m.content_list) {
+                if (part && typeof part.content === 'string')
+                    text += part.content;
+            }
+        }
+        // `reasoning_content` is the THINK phase and must never leak into the
+        // restored dialogue as the answer.
         text = text.trim();
         if (text)
             out.push({ role, text });

package/dist/qwen-net-capture.js

@@ -199,7 +199,11 @@ export function isRateLimitText(body) {
     const b = String(body || '');
     if (!b)
         return false;
-    return /too many requests|rate limit|too frequent|please try again later|слишком часто/i.test(b);
+    // `quota_limit` is a SEPARATE code Qwen returns in the SSE error field
+    // ("The service is currently experiencing high demand. Please try again
+    // later.") — a TRANSIENT capacity limit, so it belongs with the rate-limit
+    // family (back off and retry), not with the guest DAILY limit.
+    return /too many requests|rate limit|too frequent|please try again later|quota_limit|high demand|слишком часто/i.test(b);
 }
 // The GUEST daily limit is a DIFFERENT failure from a transient rate limit:
 // Qwen answers `RateLimited` with "You've reached the guest chat limit for

package/dist/shell.js

@@ -43,22 +43,15 @@ export function assertCommandInsideRoot(root, command) {
             throw new Error('Sandbox: leaving ' + root + ' is forbidden (cd ' + raw + ')');
         }
     }
-    // Indirect re-parse / chdir that a static `cd` scan cannot follow. These are
-    // the documented escape hatches (`sh -c 'cd /'`, `python -c
-    // "os.chdir('/')"`): they execute a fresh interpreter which reads the target
-    // only at RUNTIME, so no static scan can prove it stays inside the root.
-    // Refusing them is the honest barrier — best-effort, not OS isolation.
-    if (/\b(?:sh|bash|dash|zsh|ksh)\b[^\n]*\s-[a-z]*c\b/i.test(cmd)) {
-        throw new Error('Sandbox: running a shell via -c is forbidden (cannot verify the root)');
-    }
+    // chroot switches the process root outright — always a barrier violation.
+    // NOTE: `sh -c '…'` and an in-process `chdir` are deliberately NOT blocked:
+    // `bash -c` / `nohup bash -c` is a legitimate way to run a background job,
+    // and a blanket ban broke real commands (the operator runs scripts that way).
+    // They remain a documented best-effort hole (a static scan cannot follow a
+    // runtime target); full isolation needs bwrap/containers.
     if (/\bchroot\b/i.test(cmd)) {
         throw new Error('Sandbox: chroot is forbidden');
     }
-    // A chdir performed by an interpreter (Python/Perl/Ruby/Node) or by a raw
-    // syscall wrapper. Matched loosely on the common spellings.
-    if (/\bos\.chdir\s*\(|\bchdir\s*\(|\bProcess\.chdir\b|process\.chdir\s*\(|\bchdir\b\s*['"]?\//i.test(cmd)) {
-        throw new Error('Sandbox: an in-process directory change (chdir) is forbidden');
-    }
 }
 function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
     const out = (stdout || '').toString();

package/dist/tools.js

@@ -19,7 +19,16 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
     // subject to corruption.
     const decodeContent = (content, contentBase64) => {
         if (typeof contentBase64 === 'string' && contentBase64.length) {
-            return Buffer.from(contentBase64, 'base64').toString('utf-8');
+            // Reject a base64 string that is not decodable: Buffer.from(..., 'base64')
+            // SILENTLY drops invalid characters and returns garbage (verified), which
+            // would write a corrupt file with no error. The alphabet check catches a
+            // truncated/garbled payload early with a clear message.
+            const compact = contentBase64.replace(/\s+/g, '');
+            if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) {
+                throw new Error('content_base64 is not valid base64 (expected only A-Za-z0-9+/=). ' +
+                    'Re-send the content as plain `content` or as clean base64.');
+            }
+            return Buffer.from(compact, 'base64').toString('utf-8');
         }
         return String(content ?? '');
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.73.8",
+  "version": "2.73.10",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {