zames_pro 2.76.0 → 2.77.0

package/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.77.0] - 2026-10-17
+
+### Added
+
+- **scheduler:** start the first /loop tick immediately
+
+### Fixed
+
+- **diff:** show no-changes text instead of the git runner sentinel
+- **config:** refuse prototype-polluting segments in setByPath
+- **net:** read the context counter from history_messages and OpenAI usage
+- **agent-loop:** do not flag a report that explains the work as unfinished
+- **agent-loop:** stop treating prose that mentions invoke/parameter as a tool call
+- **backlog:** ignore headings inside fenced code blocks
+- **subagent:** keep the SubagentStop hook output when the run fails
+- **goal:** parse a markdown-formatted evaluator verdict
+- **qwen:** skip the thinking phase when restoring a chat from content_list
+- **changelog:** keep drafted group headings on their own line
+- **tui:** decode modified and release wheel reports correctly
+- **shell:** normalize an invalid Bash timeout instead of crashing the tool
+- **cost:** keep per-tool stats safe for __proto__/constructor tool names
+- **tui:** mark blocked/aborted tool calls as errors in the result icon
+- **mcp:** do not split a surrogate pair when truncating an MCP result
+- **context:** discover skills at the documented 3 levels deep
+- **commands:** /diffstat accepts --staged like /diff
+- **commands:** /add-dir expands a leading ~ to the home directory
+- **scheduler:** accept the N/step cron form
+- **scheduler:** reject a /loop interval that overflows the 32-bit timer
+- **diagnostics:** never cut the check output inside a surrogate pair
+- **web:** close two SSRF-guard bypasses in WebFetch
+- **scheduler:** flag a job whose next fire could not be computed
+- **subagent:** cap a report without splitting a surrogate pair
+- **qwen:** a retry wait cut short by Esc must stop the retry chain
+- **tui:** a bracketed paste split across reads must not leak its end marker
+- **agent-loop:** do not cut a tool result inside a surrogate pair
+- **web:** a broken numeric HTML entity must not fail the whole WebFetch
+- **scheduler:** keep a scheduled message's jobId through the queue merge; explain an unrecognized /loop interval
+- **tui:** localize the Ink dialog key-hint bars
+- **i18n:** drop the dead /resume <n> hint from /sessions and the docs
+
 ## [2.76.0] - 2026-10-16
 
 ### Added

package/README.md

@@ -374,8 +374,8 @@ Codex CLI:
   runtime.
 - /add-dir <path> — validate an extra directory (the sandbox is fixed at
   startup; relaunch with --dir to write there).
-- /resume <n> (after /chats) and /resume-id <id> — open a chat and PRINT its
-  dialogue into the terminal, so the restored context is visible. Only the
+- /resume-id <id> (or picking a chat in the /chats list) — open a chat and
+  PRINT its dialogue into the terminal, so the restored context is visible. Only the
   last 20 messages are shown (`RESTORED_HISTORY_LIMIT`). /last reopens the last
   chat of the current directory with no lookup step; /sessions shows the saved
   sessions with their relative age.
@@ -400,7 +400,9 @@ Codex CLI:
 tests`). /cron "<min> <hour> <dom> <month> <dow>" <task> — run on a schedule.
   /jobs [rm <id>|clear] lists and stops them. A fired job is put into the same
   message queue you type into, so it runs when the agent is free (never mid-
-  generation) and still respects the send throttle.
+  generation) and still respects the send throttle. The FIRST run of a `/loop`
+  is due at once (and runs as soon as the agent is idle); a `/cron` job waits
+  for its schedule.
 - /thinking [on|off] and /web [on|off] — toggle the reasoning / web-search
   behaviour. On **DeepSeek** these are the "Deep thinking" / "Smart search"
   toggles; on **Qwen** they drive its thinking MODE (Thinking / Fast) and the
@@ -959,8 +961,8 @@ zames --task "..." --output-format jsonl \
   модель Qwen на лету.
 - /add-dir <path> — проверить дополнительную директорию (песочница
   фиксируется при старте; для записи туда перезапустите с --dir).
-- /resume <n> (после /chats) и /resume-id <id> — открыть чат и НАПЕЧАТАТЬ его
-  диалог в терминал, чтобы восстановленный контекст был виден. Показываются
+- /resume-id <id> (или выбор чата в списке /chats) — открыть чат и
+  НАПЕЧАТАТЬ его диалог в терминал, чтобы восстановленный контекст был виден. Показываются
   только последние 20 сообщений (`RESTORED_HISTORY_LIMIT`). /last открывает
   последний чат текущей директории без поиска; /sessions показывает сохранённые
   сессии с их относительным возрастом.
@@ -987,7 +989,8 @@ zames --task "..." --output-format jsonl \
   запуск по расписанию. /jobs [rm <id>|clear] перечисляет и останавливает их.
   Сработавшая задача попадает в ту же очередь сообщений, что и ваш ввод, так
   что выполняется, когда агент свободен (никогда посреди генерации), и всё
-  равно соблюдает троттлинг отправки.
+  равно соблюдает троттлинг отправки. ПЕРВЫЙ запуск `/loop` — сразу же (как
+  только агент свободен); задача `/cron` ждёт своего расписания.
 - /thinking [on|off] и /web [on|off] — переключить режим размышления /
   веб-поиска. В **DeepSeek** это тумблеры «Deep thinking» / «Smart search»;
   в **Qwen** — это режим размышления (Thinking / Fast) и пункт «Web search»

package/dist/answer-parse.js

@@ -25,6 +25,14 @@ export function truncateToolResult(text, limit) {
     // lines — a cut that EXCLUDED the newline left a half line before the marker.
     if (nl >= searchFrom)
         cut = nl + 1;
+    // Never split a surrogate PAIR (an emoji / astral CJK char): the high half
+    // alone is a lone surrogate — a broken code point some channels replace with
+    // '?' or truncate at. Step back one unit so the pair is dropped WHOLE.
+    else {
+        const c = text.charCodeAt(cut - 1);
+        if (c >= 0xd800 && c <= 0xdbff)
+            cut--;
+    }
     const omitted = text.length - cut;
     return text.slice(0, cut) + NL + `[...truncated ${omitted} chars]`;
 }
@@ -37,8 +45,13 @@ export function responseLooksLikeToolCall(rawResponse) {
     const raw = rawResponse || '';
     return (
     // Explicit tool-call format markers: the JSON key "tool", XML/DSML tags,
-    // function_call, etc.
-    /("tool"\s*:|\btool_calls?\b|\binvoke\b|\bparameter\b|DSML|function_call)/i.test(raw) ||
+    // function_call, etc. The BARE words `invoke`/`parameter` are deliberately
+    // NOT markers on their own: an ordinary final report can use them as
+    // English words ("a timeout parameter: …", "the invoke helper …"), and a
+    // false positive rejected a perfectly good answer and re-asked the model
+    // until the retry budget ended the task with an error. A real XML/DSML
+    // call is still caught by the tag pattern below.
+    /("tool"\s*:|\btool_calls?\b|DSML|function_call)/i.test(raw) ||
         // "tool" without an opening quote/bracket, with a junk prefix
         // (`<｜tool":`, `**tool**:`, `- tool:`): a call key, not prose.
         /(^|[^A-Za-z0-9_])(?:\*\*)?tool(?:\*\*)?["'`\u2018\u2019\u201c\u201d]*\s*:/.test(raw) ||
@@ -98,7 +111,10 @@ export function looksLikeUnfinishedWork(text) {
     if (/\b(done|finished|completed|готово|выполнено|завершено)\b/i.test(t)) {
         return false;
     }
-    const en = /\b(now|next|then|let me|let's|i will|i'll|i am going to|i'm going to|going to|about to|will now|time to)\b[^.!?\n]{0,120}\b(update|write|edit|read|run|check|add|fix|create|remove|delete|apply|test|commit|push|install|open|search|look|verify|change|modify|implement|review)\b/i;
+    // `update`/`summarize`/`explain` are REPORT verbs (`I will update you on the
+    // results: …`) — they do not promise a tool call. A colon anywhere in the
+    // gap also means the sentence is explaining a fact, not about to act.
+    const en = /\b(now|next|then|let me|let's|i will|i'll|i am going to|i'm going to|going to|about to|will now|time to)\b[^.!?\n:]{0,120}\b(write|edit|read|run|check|add|fix|create|remove|delete|apply|test|commit|push|install|open|search|look|verify|change|modify|implement|review)\b/i;
     const ru = /(^|[^а-яё])(проверю|обновлю|исправлю|добавлю|запущу|выполню|посмотрю|прочитаю|изменю|попробую|сделаю)([^а-яё]|$)/i;
     return en.test(t) || ru.test(t);
 }

package/dist/changelog.js

@@ -99,6 +99,12 @@ export function syncUnreleased(changelog, body) {
     const tail = next < 0 ? '' : rest.slice(next);
     const cleanBody = String(body || '')
         .replace(/^## \[Unreleased\]\s*/m, '')
+        // A drafted group heading must START a line of its own. When the draft
+        // carries several groups (`## Added` … `## Fixed`) without a blank line
+        // between them, the next group used to stay glued to the last bullet
+        // (`- a### Fixed`) — it was not a heading at all, so the item vanished
+        // from the rendered changelog.
+        .replace(/([^\n])\n?(?=## )/g, '$1' + nl + nl)
         .trim()
         // The draft renders groups as `## Added` (top-level), but INSIDE the file
         // a version's groups are `### Added` (a subsection of the version heading).

package/dist/commands.js

@@ -1,5 +1,6 @@
 import { providerLabel } from './providers.js';
 import path from 'path';
+import os from 'os';
 import { isImageName } from './attachments.js';
 import { translate } from './i18n.js';
 // Helpers for the extra slash commands (/diff, /cost, /export, /doctor,
@@ -14,8 +15,11 @@ export function formatDiff(diffText, opts = {}, t = translate('en')) {
         .split(CR + NL)
         .join(NL)
         .trimEnd();
-    if (!trimmed)
+    // The shared git runner reports an EMPTY result as this sentinel, so a clean
+    // tree must not print it to the operator (formatDiffStat already handles it).
+    if (!trimmed || trimmed.trim() === '(command produced no output)') {
         return t('diff.no_changes');
+    }
     const lines = trimmed.split(NL);
     if (lines.length <= maxLines)
         return trimmed;
@@ -28,6 +32,12 @@ export function formatDiff(diffText, opts = {}, t = translate('en')) {
 export function diffGitArgs(staged = false) {
     return staged ? ['diff', '--staged'] : ['diff'];
 }
+// Git arguments for `/diffstat`. Same shape as diffGitArgs() so the two
+// commands stay symmetric: `/diffstat --staged` used to be impossible (the
+// command hardcoded `git diff --stat`), even though `/diff --staged` worked.
+export function diffStatGitArgs(staged = false) {
+    return staged ? ['diff', '--staged', '--stat'] : ['diff', '--stat'];
+}
 // ---------- /diffstat ----------
 /** Render `git diff --stat` output (a compact change summary) for display. */
 export function formatDiffStat(statText, opts = {}, t = translate('en')) {
@@ -84,9 +94,15 @@ export function summarizeTranscript(entries) {
     const stats = {
         turns: 0,
         toolCalls: 0,
-        toolCounts: {},
+        // Null-prototype maps: a tool NAME is arbitrary text (an MCP server can
+        // advertise anything, the model may emit any name). With a plain {} a name
+        // like '__proto__' assigns the PROTOTYPE (the tool vanishes from the count
+        // and Object.prototype gets mutated), and 'constructor'/'toString' read an
+        // inherited function instead of a number — /cost then printed
+        // "constructor: function Object() { [native code] }1".
+        toolCounts: Object.create(null),
         toolMs: 0,
-        toolTime: {},
+        toolTime: Object.create(null),
         durationMs: 0,
         startedAt: null,
         autoCompacts: 0,
@@ -332,9 +348,18 @@ export function renderDoctor(d, t = translate('en')) {
 }
 // ---------- /add-dir ----------
 export function resolveExtraDir(input, workdir, t = translate('en')) {
-    const raw = String(input ?? '').trim();
+    let raw = String(input ?? '').trim();
     if (!raw)
         return { error: t('adddir.usage') };
+    // A leading `~` means the home directory (a shell convention the operator
+    // expects). Without expansion resolve() treated it as a literal directory
+    // named `~` under the working dir, so /add-dir ~ reported "No such
+    // directory: /w/~". Only a LEADING `~` / `~/` expands; a `~` elsewhere is
+    // an ordinary character.
+    if (raw === '~')
+        raw = os.homedir();
+    else if (raw.startsWith('~/') || raw.startsWith('~' + path.sep))
+        raw = path.join(os.homedir(), raw.slice(2));
     const abs = path.resolve(workdir, raw);
     if (abs === path.resolve(workdir)) {
         return { error: t('adddir.same') };
@@ -828,6 +853,7 @@ export function mergeMessages(msgs) {
         return {
             text: list[0].text,
             attachments: (list[0].attachments || []).slice(),
+            jobId: list[0].jobId,
         };
     }
     let imgOffset = 0;
@@ -861,7 +887,10 @@ export function mergeMessages(msgs) {
         ' messages while you were working. They are listed below in order — ' +
         'treat them as one instruction.';
     const text = header + NL + NL + parts.join(NL + NL + '---' + NL + NL);
-    return { text, attachments };
+    // Keep the FIRST scheduled job id in the batch so the ticker still knows a
+    // copy of that job is in flight (see MergedMessage.jobId).
+    const jobId = list.find((m) => m.jobId !== undefined)?.jobId;
+    return { text, attachments, jobId };
 }
 // Parse BACKLOG.md into actionable items. Recognizes headings of the form
 // `### A1. ...`, `### D7. ...` and marks an item done when its heading carries
@@ -870,8 +899,24 @@ export function mergeMessages(msgs) {
 export function parseBacklogItems(text) {
     const out = [];
     let priority = '';
+    // A fenced code block in an item's body may contain a line that LOOKS like a
+    // heading (an example of the format, a pasted log). Those are not headings:
+    // counting them invented a phantom P0 item that `/improve` picked over the
+    // real backlog. Track the fence (``` or ~~~, at least three) and skip.
+    let fence = '';
     for (const raw of String(text ?? '').split(NL)) {
         const line = raw.trimEnd();
+        const fenceMatch = /^\s*(`{3,}|~{3,})/.exec(line);
+        if (fenceMatch) {
+            const mark = fenceMatch[1][0];
+            if (!fence)
+                fence = mark;
+            else if (mark === fence)
+                fence = '';
+            continue;
+        }
+        if (fence)
+            continue;
         const p = /^##\s+(P[0-3])\b/.exec(line);
         if (p) {
             priority = p[1];

package/dist/config.js

@@ -498,8 +498,15 @@ export function getByPath(obj, path) {
     }
     return cur;
 }
+// Object keys that must NEVER be walked/assigned by a dotted path: they reach
+// the PROTOTYPE chain. deepMerge() already skips them; setByPath did not, so a
+// `__proto__.x` segment polluted Object.prototype for the whole process (and
+// wrote the injected keys into the config file).
+const UNSAFE_PATH_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 export function setByPath(obj, path, value) {
     const parts = path.split('.');
+    if (parts.some((p) => UNSAFE_PATH_KEYS.has(p)))
+        return;
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const p = parts[i];

package/dist/context.js

@@ -340,7 +340,11 @@ async function findSkillFiles(root, depth = 3) {
                 await walk(full, level + 1);
         }
     };
-    await walk(root, 1);
+    // Start at level 0 so `level < depth` admits exactly `depth` levels of
+    // subdirectories: with walk(root, 1) the FIRST level counted as 1 and the
+    // walk stopped one level early, so a skill at the documented "3 levels
+    // deep" (`.zames/skills/<a>/<b>/<skill>/SKILL.md`) was never discovered.
+    await walk(root, 0);
     return out;
 }
 export async function loadSkills(workdir) {

package/dist/diagnostics.js

@@ -35,7 +35,14 @@ export function summarizeDiagnostics(raw, maxChars) {
     const chosen = errLines.length ? errLines : lines;
     let out = chosen.join('\n');
     if (out.length > maxChars) {
-        out = out.slice(0, maxChars) + '\n… [diagnostics truncated]';
+        // Never split a surrogate PAIR (emoji / astral CJK): the high half alone
+        // is a lone surrogate in the model's context. Same rule as
+        // truncateToolResult (agent-loop) and capReport (subagent).
+        let cut = maxChars;
+        const c = out.charCodeAt(cut - 1);
+        if (c >= 0xd800 && c <= 0xdbff)
+            cut--;
+        out = out.slice(0, cut) + '\n… [diagnostics truncated]';
     }
     return out;
 }

package/dist/goal.js

@@ -70,12 +70,21 @@ function argumentReason(reason) {
 // "continue", never as "done").
 export function parseGoalVerdict(text) {
     const t = String(text ?? '');
-    const m = /VERDICT:\s*(`{0,3})?\s*(MET|NOT_MET|IMPOSSIBLE)/i.exec(t);
+    // The label may be bolded/italicised and the colon may carry surrounding
+    // spaces (`**VERDICT:** MET`) — a markdown-model answer did exactly that and
+    // the strict `VERDICT:` matcher returned null, so the goal never parsed and
+    // the loop auto-continued until the turn budget.
+    const m = /VERDICT\s*[*_`]*\s*:\s*[*_`]*\s*(MET|NOT_MET|IMPOSSIBLE)/i.exec(t);
     if (!m)
         return null;
-    const raw = m[2].toUpperCase();
+    const raw = m[1].toUpperCase();
     const status = raw === 'MET' ? 'met' : raw === 'IMPOSSIBLE' ? 'impossible' : 'not_met';
-    const rm = /REASON:\s*(.+)/i.exec(t);
-    const reason = rm ? rm[1].replace(/`{2,}/g, '').trim() : '';
+    const rm = /REASON\s*[*_`]*\s*:\s*(.+)/i.exec(t);
+    const reason = rm
+        ? rm[1]
+            .replace(/`{1,3}/g, '')
+            .replace(/\*{1,2}/g, '')
+            .trim()
+        : '';
     return { status, reason };
 }

package/dist/i18n/deepseek.js

@@ -114,6 +114,19 @@ export const deepseekMessages = {
     'auth.form.hint_field': { ru: 'поле', en: 'field' },
     'auth.form.hint_submit': { ru: 'войти', en: 'sign in' },
     'auth.form.hint_cancel': { ru: 'отмена', en: 'cancel' },
+    // Key-hint labels of the Ink dialogs (SelectList / ConfigMenu /
+    // ConfirmDialog). They used to be hardcoded Russian, so an English UI
+    // still showed a Russian hint bar.
+    'tui.hint.select': { ru: 'выбор', en: 'select' },
+    'tui.hint.edit': { ru: 'правка', en: 'edit' },
+    'tui.hint.ok': { ru: 'ок', en: 'ok' },
+    'tui.hint.cancel': { ru: 'отмена', en: 'cancel' },
+    'tui.hint.search': { ru: 'поиск', en: 'search' },
+    'tui.hint.reset': { ru: 'сброс', en: 'reset' },
+    'tui.hint.quit': { ru: 'выход', en: 'quit' },
+    'tui.hint.change': { ru: 'изменить', en: 'change' },
+    // Marks the CURRENT entry in a list menu (e.g. the active Qwen model).
+    'tui.list.current': { ru: '← текущая', en: '← current' },
     'auth.form.note_saved': {
         ru: 'Enter — использовать сохранённые логин и пароль.',
         en: 'Enter — use the saved login and password.',

package/dist/i18n/help.js

@@ -330,6 +330,10 @@ export const helpMessages = {
         ru: 'Использование: /cron "<мин> <час> <день> <мес> <день недели>" <задача>',
         en: 'Usage: /cron "<min> <hour> <dom> <month> <dow>" <task>',
     },
+    'sched.interval_typo': {
+        ru: 'Интервал «{v}» не распознан — задача НЕ добавлена. Единицы: s/sec, m/min, h (например, /loop 10m проверь тесты). Без единицы — СЕКУНДЫ (120 = 120с), для минут нужен суффикс m.',
+        en: 'Interval "{v}" was not recognized — NO job was added. Units: s/sec, m/min, h (e.g. /loop 10m run the tests). Without a unit it means SECONDS (120 = 120s); use the m suffix for minutes.',
+    },
     'sched.loop_too_short': {
         ru: 'Слишком часто: минимум {min} (троттлинг отправок 15с).',
         en: 'Too frequent: minimum {min} (the send throttle is 15s).',
@@ -338,6 +342,10 @@ export const helpMessages = {
         ru: '⏰ Задача #{id} добавлена ({when}): {task}',
         en: '⏰ Job #{id} added ({when}): {task}',
     },
+    'sched.added_hint': {
+        ru: 'Если агент свободен — запуск сразу, иначе сразу после текущей задачи; дальше — по расписанию. Список — /jobs, удалить — /jobs rm <id>.',
+        en: 'Runs at once if the agent is idle, otherwise right after the current task; then on schedule. List: /jobs, remove: /jobs rm <id>.',
+    },
     'sched.title': { ru: 'Запланированные задачи:', en: 'Scheduled jobs:' },
     'sched.none': { ru: 'Запланированных задач нет.', en: 'No scheduled jobs.' },
     'sched.fired': {

package/dist/i18n/self-review.js

@@ -171,8 +171,8 @@ export const selfReviewMessages = {
         en: 'No saved sessions. They appear after the first task/chat.',
     },
     'sessions.restore_hint': {
-        ru: 'Восстановить: /resume-id <id>  (полный id) или /resume <n> после /chats.',
-        en: 'Restore: /resume-id <id> (full id) or /resume <n> after /chats.',
+        ru: 'Восстановить: /resume-id <id> (полный id) или выбери сессию в списке /sessions.',
+        en: 'Restore: /resume-id <id> (full id) or pick a session from the /sessions list.',
     },
     'sessions.pick_title': {
         ru: 'Выберите сессию (↑/↓, Enter — открыть, Esc — отмена)',

package/dist/index.js

@@ -1108,7 +1108,7 @@ async function main() {
                 if (editor)
                     editor.pause();
                 try {
-                    return await askOperatorConfirm(null, t('perm.ask_sub', { tool: info.tool, reason: info.reason }));
+                    return await askOperatorConfirm(null, t('perm.ask_sub', { tool: info.tool, reason: info.reason }), t, currentLocale);
                 }
                 finally {
                     if (editor)
@@ -1910,6 +1910,7 @@ async function main() {
             getDefault: (path) => getByPath(DEFAULTS, path),
             set: (field, raw) => configSetRaw(field, raw),
             reset: (field) => configResetField(field),
+            locale: currentLocale,
         };
         try {
             // Prefer the Ink menu (nicer, resize-aware) when the TUI is enabled;
@@ -1990,6 +1991,7 @@ async function main() {
             const { selectListInk } = await import('./tui/run-select.js');
             picked = await selectListInk({
                 title: t('chats.pick_title'),
+                locale: currentLocale,
                 items: chats.map((c, i) => ({
                     value: c.id,
                     label: String(i + 1).padStart(2, ' ') + '. ' + c.title,
@@ -2023,6 +2025,7 @@ async function main() {
             const { selectListInk } = await import('./tui/run-select.js');
             picked = await selectListInk({
                 title: t('sessions.pick_title'),
+                locale: currentLocale,
                 items: sessions.map((s, i) => ({
                     value: s.id,
                     label: String(i + 1).padStart(2, ' ') +
@@ -2591,8 +2594,9 @@ async function main() {
                             items: models.map((m) => ({
                                 value: m.id,
                                 label: m.name || m.id,
-                                detail: m.id === config.qwen.model ? '← текущая' : m.id,
+                                detail: m.id === config.qwen.model ? t('tui.list.current') : m.id,
                             })),
+                            locale: currentLocale,
                         });
                     }
                     catch {
@@ -2784,6 +2788,13 @@ async function main() {
             const intervalStr = sp === -1 ? rest : rest.slice(0, sp);
             const taskStr = sp === -1 ? '' : rest.slice(sp + 1).trim();
             const ms = parseInterval(intervalStr);
+            if (!ms && intervalStr) {
+                // Say WHY the job was not added. A bare `10` is not a typo the agent
+                // can spot: it IS a valid interval (10 SECONDS), while an operator who
+                // meant ten minutes needs the `m` suffix.
+                console.error(theme.error(t('sched.interval_typo', { v: intervalStr })));
+                continue;
+            }
             if (!ms || !taskStr) {
                 console.error(theme.error(t('sched.loop_usage')));
                 continue;
@@ -2804,6 +2815,12 @@ async function main() {
                 when: formatInterval(ms),
                 task: taskStr,
             })));
+            // Tell the operator WHEN it will actually run. A scheduled task never
+            // interrupts a running turn: it is queued and starts only when the
+            // agent is idle (or right after the current task). The bare "added"
+            // line made a first /loop look like a no-op, so the operator re-sent the
+            // task by hand (the very report this line answers).
+            console.log(theme.dim(t('sched.added_hint')));
             continue;
         }
         if (lower === '/cron' || lower.startsWith('/cron ')) {
@@ -2833,6 +2850,7 @@ async function main() {
                 when: cronExpr + ' (in ~' + nextIn + ')',
                 task: taskStr,
             })));
+            console.log(theme.dim(t('sched.added_hint')));
             continue;
         }
         if (lower === '/jobs' || lower.startsWith('/jobs ')) {
@@ -3298,14 +3316,15 @@ async function main() {
             console.log(theme.system(mod.commands.formatDiff(out, { maxLines: 400 }, t)));
             continue;
         }
-        if (lower === '/diffstat') {
+        if (lower === '/diffstat' || lower.startsWith('/diffstat ')) {
+            const staged = lower.indexOf('--staged') !== -1;
             const { runGitArgs } = await import('./gitTools.js');
             const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], currentWorkdir, 5000);
             if (probe.trim() !== 'true') {
                 console.error(theme.error(t('diff.not_repo')));
                 continue;
             }
-            const out = await runGitArgs(['diff', '--stat'], currentWorkdir, 20_000);
+            const out = await runGitArgs(mod.commands.diffStatGitArgs(staged), currentWorkdir, 20_000);
             console.log(theme.system(mod.commands.formatDiffStat(out, { maxLines: 60 }, t)));
             continue;
         }

package/dist/input.js

@@ -1601,7 +1601,13 @@ export class LineEditor {
         // A chunk may end in the MIDDLE of a PASTE marker (`ESC[2`, `ESC[20`, …).
         // Hold that tail back so the next chunk completes it; otherwise the
         // fragment is inserted as literal text and the paste is not bracketed.
-        const held = splitPasteTail(s);
+        // EXCEPTION: once inside a bracketed paste the body is appended VERBATIM
+        // to _pasteBuf (it is not parsed by this loop), so a held tail would be
+        // re-attached to `s` and inserted as text BEFORE the body — the tail
+        // (`1~`) leaked into the input line and was not part of the pasted text.
+        const held = this._inPaste
+            ? { head: s, tail: null }
+            : splitPasteTail(s);
         if (held.tail) {
             this._ctrlTail = held.tail;
             s = held.head;

package/dist/mcp.js

@@ -183,7 +183,15 @@ export function truncateMcpResult(s, limit = MCP_RESULT_LIMIT) {
     const str = String(s);
     if (str.length <= limit)
         return str;
-    const head = str.slice(0, limit);
+    let head = str.slice(0, limit);
+    // Never leave a lone HIGH surrogate at the cut: an emoji / astral CJK char
+    // sits on two UTF-16 units, and cutting between them hands the model a
+    // broken code point (same rule as truncateToolResult / capReport).
+    if (head.length > 0) {
+        const last = head.charCodeAt(head.length - 1);
+        if (last >= 0xd800 && last <= 0xdbff)
+            head = head.slice(0, -1);
+    }
     // Prefer a line boundary so a cut does not split a line in half.
     const nl = head.lastIndexOf(String.fromCharCode(10));
     const cut = nl > limit * 0.5 ? head.slice(0, nl + 1) : head;

package/dist/net-capture.js

@@ -280,6 +280,43 @@ export function extractTokenUsage(body) {
                 }
             }
         }
+        // An OpenAI-compatible body reports the turn size as usage.total_tokens.
+        const usage = o.usage;
+        if (usage && typeof usage === 'object') {
+            consider(usage.total_tokens);
+        }
+    }
+    if (found !== null)
+        return found;
+    // A PLAIN JSON body (not SSE): /api/v0/chat/history_messages answers this
+    // way, and every message carries the running counter. Without this a
+    // resumed chat showed no context size until the next completion. The
+    // payload is the whole history, so the LAST value wins.
+    try {
+        const root = JSON.parse(body);
+        const visit = (node) => {
+            if (node == null || typeof node !== 'object')
+                return;
+            if (Array.isArray(node)) {
+                for (const it of node)
+                    visit(it);
+                return;
+            }
+            const o = node;
+            consider(o.accumulated_token_usage);
+            const usage = o.usage;
+            if (usage && typeof usage === 'object')
+                consider(usage.total_tokens);
+            for (const key of Object.keys(o)) {
+                const v = o[key];
+                if (v && typeof v === 'object')
+                    visit(v);
+            }
+        };
+        visit(root);
+    }
+    catch {
+        // not plain JSON — nothing more to read
     }
     return found;
 }

package/dist/qwen-browser.js

@@ -1396,7 +1396,8 @@ export class QwenBrowser {
                             attempt: rateLimitRetries,
                             max: this.maxRateLimitRetries,
                         }));
-                        await this._sleepInterruptible(this.rateLimitWaitMs);
+                        if (await this._sleepInterruptible(this.rateLimitWaitMs))
+                            return '(прервано пользователем)';
                         continue;
                     }
                     if (e instanceof QwenServerBusyError || /server busy/i.test(msg)) {
@@ -1408,7 +1409,8 @@ export class QwenBrowser {
                             attempt: serverBusyRetries,
                             max: this.maxServerBusyRetries,
                         }));
-                        await this._sleepInterruptible(this.serverBusyWaitMs);
+                        if (await this._sleepInterruptible(this.serverBusyWaitMs))
+                            return '(прервано пользователем)';
                         continue;
                     }
                     if (e instanceof QwenIncompleteError) {
@@ -1419,7 +1421,8 @@ export class QwenBrowser {
                             attempt: incompleteRetries,
                             max: this.maxIncompleteRetries,
                         })));
-                        await this._sleepInterruptible(this.incompleteWaitMs);
+                        if (await this._sleepInterruptible(this.incompleteWaitMs))
+                            return '(прервано пользователем)';
                         continue;
                     }
                     // A LOST page/context ("Target page, context or browser has been

package/dist/qwen-chats.js

@@ -186,10 +186,17 @@ export function parseQwenHistory(json) {
             }
         }
         // `content_list` (phase-split output) is used when `content` is empty.
+        // Each part carries its PHASE, and the reasoning phase must never leak
+        // into the restored dialogue as the answer (the live SSE parser skips
+        // `thinking_summary` for the same reason).
         if (!text && Array.isArray(m.content_list)) {
             for (const part of m.content_list) {
-                if (part && typeof part.content === 'string')
-                    text += part.content;
+                if (!part || typeof part.content !== 'string')
+                    continue;
+                const phase = String(part.phase ?? part.type ?? '');
+                if (/think|reason/i.test(phase))
+                    continue;
+                text += part.content;
             }
         }
         // `reasoning_content` is the THINK phase and must never leak into the

package/dist/run-task.js

@@ -2,12 +2,15 @@ import { theme } from './theme.js';
 import { withGoal, mergeMessages, isSlashCommand, formatDuration, } from './commands.js';
 import { buildEvaluatorPrompt, buildContinuationDirective, parseGoalVerdict, GOAL_MAX_TURNS, } from './goal.js';
 import { formatCompactTokens, pasteReplacement, expandPastes } from './input.js';
+import { DEFAULT_LOCALE } from './i18n.js';
 import { providerAskDeadlineMs } from './config.js';
 // Ask the operator to approve a tool call flagged by an `ask` permission rule
 // (C1). While the LineEditor owns the terminal it must be paused first, or the
 // confirmation prompt and the input line fight for the same keys. A non-TTY run
 // has no way to answer, so it DENIES (never silently allows a guarded call).
-export async function askOperatorConfirm(editor, question, t) {
+export async function askOperatorConfirm(editor, question, t, 
+/** Language of the Ink dialog's key-hint bar (the labels use `t`). */
+locale = DEFAULT_LOCALE) {
     if (!(process.stdin.isTTY && process.stdout.isTTY))
         return false;
     // Prefer the Ink modal when the TUI owns the terminal: it keeps the layout
@@ -23,6 +26,9 @@ export async function askOperatorConfirm(editor, question, t) {
                 message: question,
                 yesLabel: tr('confirm.yes'),
                 noLabel: tr('confirm.no'),
+                // The dialog's key-hint bar is operator text: it must follow the SAME
+                // language as the labels above, not a hardcoded one.
+                locale,
             });
         }
         finally {
@@ -386,7 +392,7 @@ export async function runTask(deps, browser, tools, taskText, workdir, opts, att
                     // C1: a rule with action "ask". Show the reason and wait for the
                     // operator. In non-TTY this denies.
                     ui.warning(t('perm.ask', { tool: info.tool, reason: info.reason }));
-                    const ok = await askOperatorConfirm(editor || null, t('perm.confirm'), t);
+                    const ok = await askOperatorConfirm(editor || null, t('perm.confirm'), t, locale);
                     ui.warning(ok ? t('perm.allowed') : t('perm.denied'));
                     transcript?.log('permission_ask', {
                         tool: info.tool,

package/dist/scheduler.js

@@ -16,8 +16,17 @@ export function parseInterval(text) {
         : unit.startsWith('m')
             ? 60_000
             : 1000;
-    return n * mult;
+    const ms = n * mult;
+    // setInterval clamps its delay to a 32-bit signed int (~24.8 days) and Node
+    // warns on every tick, while the scheduler computes a fire time the timer
+    // can never reach — a huge value is a typo, not a schedule. Reject it here
+    // so the operator gets the usage/typo message instead of a silent dead job.
+    if (ms > MAX_TIMER_MS)
+        return null;
+    return ms;
 }
+/** Largest delay setInterval accepts (32-bit signed milliseconds). */
+export const MAX_TIMER_MS = 2_147_483_647;
 // Render an interval back to the shortest human form (used in listings).
 // Non-finite input (a cron job whose next fire could not be computed sets
 // nextAt to Infinity) renders as "-" instead of "Infinityh".
@@ -53,7 +62,10 @@ function parseCronField(field, min, max) {
         }
         else {
             lo = Number(range);
-            hi = lo;
+            // `N/step` (a start with a step, no range) is valid cron: it means from
+            // N up to the field maximum. Treating it as the single value N made a
+            // normal `5/20 * * * *` expression invalid.
+            hi = stepStr === undefined ? lo : max;
         }
         if (!Number.isInteger(lo) || !Number.isInteger(hi))
             return null;
@@ -128,6 +140,13 @@ export function formatJobLine(job, now) {
     const when = job.kind === 'loop'
         ? 'every ' + formatInterval(job.intervalMs || 0)
         : job.cron || '';
+    // A cron job whose next fire could not be computed stores Infinity (see
+    // due()). "next ~-" (formatInterval maps a non-finite value to '-') read
+    // like a normal schedule, so the job looked healthy while it could never
+    // fire again.
+    if (!Number.isFinite(job.nextAt)) {
+        return '  #' + job.id + ' [' + when + ', NEVER fires again] ' + job.task;
+    }
     const nextIn = formatInterval(Math.max(0, job.nextAt - now));
     return '  #' + job.id + ' [' + when + ', next ~' + nextIn + '] ' + job.task;
 }
@@ -142,7 +161,13 @@ export class Scheduler {
             kind: 'loop',
             task,
             intervalMs,
-            nextAt: now + intervalMs,
+            // The FIRST run is due at once: `/loop 30m <task>` means "start now,
+            // then repeat every 30m". Scheduling the first fire one full interval
+            // ahead left the operator staring at half an hour of silence right
+            // after the command — it read as "the loop did nothing". `due()`
+            // reschedules the job a full interval ahead AFTER it fires, so this
+            // does not become a busy loop.
+            nextAt: now,
             createdAt: now,
         };
         this.jobs.push(job);

package/dist/shell.js

@@ -84,10 +84,18 @@ function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
     return parts.join('\n');
 }
 export function runShell(workdir, command, timeout = 30_000, signal) {
+    // The timeout arrives from the MODEL's tool arguments, and exec validates it
+    // SYNCHRONOUSLY: a negative, fractional or non-numeric value throws
+    // ERR_OUT_OF_RANGE out of runShell instead of becoming a tool error string.
+    // Normalize it to the unsigned-integer contract (falling back to the
+    // default) so a sloppy call cannot crash the Bash tool.
+    const safeTimeout = typeof timeout === 'number' && Number.isFinite(timeout) && timeout >= 0
+        ? Math.floor(timeout)
+        : 30_000;
     return new Promise((resolve) => {
         const options = {
             cwd: workdir,
-            timeout,
+            timeout: safeTimeout,
             maxBuffer: 1024 * 1024 * 8,
             windowsHide: true,
             env: { ...process.env },
@@ -102,7 +110,7 @@ export function runShell(workdir, command, timeout = 30_000, signal) {
             options.shell = '/bin/sh';
         }
         exec(command, options, (err, stdout, stderr) => {
-            resolve(formatExecResult(err, stdout, stderr, timeout, []));
+            resolve(formatExecResult(err, stdout, stderr, safeTimeout, []));
         });
     });
 }

package/dist/subagent.js

@@ -23,9 +23,16 @@ export const SUBAGENT_REPORT_CAP = 20_000;
 export function capReport(text, cap = SUBAGENT_REPORT_CAP) {
     if (text.length <= cap)
         return text;
-    return (text.slice(0, cap) +
+    // Never split a surrogate PAIR (an emoji / astral CJK char): the high half
+    // alone is a lone surrogate. The report becomes the parent chat's tool
+    // result, so the same rule as truncateToolResult() applies.
+    let cut = cap;
+    const c = text.charCodeAt(cut - 1);
+    if (c >= 0xd800 && c <= 0xdbff)
+        cut--;
+    return (text.slice(0, cut) +
         '\n… [report truncated: ' +
-        (text.length - cap) +
+        (text.length - cut) +
         ' chars omitted]');
 }
 /**
@@ -171,8 +178,14 @@ export function createSubagentRunner(opts) {
             hookOut = await runLifecycleHooks(loadHooks(workdir), 'SubagentStop', workdir, { type: req.type, ok: failed ? 'false' : 'true' });
         }
         catch { }
-        if (failed)
-            return { ok: false, text: failed };
+        // A failed subagent must NOT lose the hook's stdout: a SubagentStop hook
+        // that reports the broken state is most useful exactly when the run died.
+        if (failed) {
+            return {
+                ok: false,
+                text: capReport(hookOut ? failed + '\n\n' + hookOut : failed),
+            };
+        }
         return {
             ok: true,
             text: capReport(hookOut ? report + '\n\n' + hookOut : report),

package/dist/tool-summary.js

@@ -79,5 +79,18 @@ export function looksLikeToolError(result) {
         head.startsWith('missing required argument') ||
         head.startsWith('failed') ||
         head.includes('command failed') ||
-        head.includes('exit code'));
+        head.includes('exit code') ||
+        // NOT every failure is a THROWN error: a PreToolUse hook, the permission
+        // policy and the operator's denial BLOCK the call and return their message
+        // as the result; an unknown tool and an aborted/timed-out run are reported
+        // in words too. Those calls never did their work, so a green check next to
+        // them lied to the operator.
+        head.startsWith('blocked by') ||
+        head.startsWith('denied by') ||
+        head.startsWith('unknown tool') ||
+        head.startsWith('subagents are not available') ||
+        head.startsWith('subagent failed') ||
+        head.startsWith('subagent error') ||
+        head.includes('process killed') ||
+        head.startsWith('(aborted by the operator)'));
 }

package/dist/tui/ConfigMenu.js

@@ -12,6 +12,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // callbacks (the SAME ones the legacy menu takes), so the logic is shared.
 import { useMemo, useState } from 'react';
 import { Box, Text, useInput, useApp, useWindowSize } from 'ink';
+import { translate } from '../i18n.js';
 import { Checkbox, Select, UI, HintBar } from './widgets.js';
 /** Strip ANSI to measure a line's visible width. */
 function stripAnsi(s) {
@@ -37,8 +38,11 @@ function displayValue(field, value, t) {
     return String(value);
 }
 export function ConfigMenuApp(opts) {
-    const { fields, t, get, set, reset, getDefault } = opts;
+    const { fields, t, get, set, reset, getDefault, locale = 'en' } = opts;
     const { exit } = useApp();
+    // The hint bar is operator text: it follows the SAME locale the labels use
+    // (a hardcoded Russian bar showed up in an English UI).
+    const hint = translate(locale);
     const { columns, rows } = useWindowSize();
     const [cursor, setCursor] = useState(0);
     const [filterQuery, setFilterQuery] = useState('');
@@ -327,11 +331,11 @@ export function ConfigMenuApp(opts) {
         items.push(_jsx(Text, { color: UI.dim, children: '  ' + t('cfg.menu.no_match') }, "none"));
     }
     return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: UI.border, paddingX: 1, children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsx(Text, { bold: true, color: UI.title, children: t('cfg.menu.title') }), _jsx(Text, { color: UI.dim, children: (visible.length ? cursor + 1 : 0) + '/' + visible.length })] }), _jsx(Text, { color: "#3a3f4b", children: '─'.repeat(Math.max(10, (columns || 80) - 6)) }), items, _jsx(Text, { color: "#3a3f4b", children: '─'.repeat(Math.max(10, (columns || 80) - 6)) }), editing ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: UI.text, children: t('cfg.menu.edit_hint') }), _jsx(Text, { color: UI.accent, children: '❯ ' + editBuf })] })) : filterMode ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: UI.text, children: t('cfg.menu.filter_hint') }), _jsx(Text, { color: UI.accent, children: '❯ ' + filterQuery })] })) : message ? (_jsx(Text, { color: UI.ok, children: message })) : filterQuery ? (_jsx(Text, { color: UI.dim, children: t('cfg.menu.filter_active', { q: filterQuery }) })) : null, _jsx(HintBar, { hints: [
-                    ['↑/↓', 'выбор'],
-                    ['←/→', 'изменить'],
-                    ['Enter', 'правка'],
-                    ['/', 'поиск'],
-                    ['d', 'сброс'],
-                    ['q', 'выход'],
+                    ['↑/↓', hint('tui.hint.select')],
+                    ['←/→', hint('tui.hint.change')],
+                    ['Enter', hint('tui.hint.edit')],
+                    ['/', hint('tui.hint.search')],
+                    ['d', hint('tui.hint.reset')],
+                    ['q', hint('tui.hint.quit')],
                 ] })] }));
 }

package/dist/tui/ConfirmDialog.js

@@ -5,14 +5,16 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
 import { Box, Text, useInput, useApp } from 'ink';
 import { UI, HintBar } from './widgets.js';
+import { translate } from '../i18n.js';
 function Button({ label, focused, danger, }) {
     const color = danger ? UI.err : UI.on;
     return (_jsxs(Text, { children: [focused ? _jsx(Text, { color: color, children: '▸ ' }) : _jsx(Text, { children: '  ' }), _jsx(Text, { color: focused ? color : UI.dim, bold: focused, children: label })] }));
 }
-export function ConfirmDialog({ title, message, yesLabel, noLabel, onAnswer, }) {
+export function ConfirmDialog({ title, message, yesLabel, noLabel, onAnswer, locale = 'en', }) {
     // Focus starts on "no" — a stray Enter must not confirm a destructive action.
     const [yes, setYes] = useState(false);
     const { exit } = useApp();
+    const t = translate(locale);
     const answer = (ok) => {
         onAnswer(ok);
         exit();
@@ -35,8 +37,8 @@ export function ConfirmDialog({ title, message, yesLabel, noLabel, onAnswer, })
         }
     });
     return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: UI.warn, paddingX: 2, paddingY: 0, children: [_jsx(Text, { color: UI.warn, bold: true, children: '⚠ ' + title }), message ? _jsx(Text, { color: UI.text, children: message }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Button, { label: yesLabel, focused: yes, danger: true }), _jsx(Text, { children: '    ' }), _jsx(Button, { label: noLabel, focused: !yes })] }), _jsx(HintBar, { hints: [
-                    ['←/→', 'выбор'],
-                    ['Enter', 'ok'],
+                    ['←/→', t('tui.hint.select')],
+                    ['Enter', t('tui.hint.ok')],
                     ['y/n', ''],
                 ] })] }));
 }

package/dist/tui/SelectList.js

@@ -5,9 +5,11 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useMemo, useState } from 'react';
 import { Box, Text, useInput, useApp, useWindowSize } from 'ink';
 import { UI, HintBar } from './widgets.js';
-export function SelectList({ title, items, initial, onSelect, }) {
+import { translate } from '../i18n.js';
+export function SelectList({ title, items, initial, locale = 'en', onSelect, }) {
     const { exit } = useApp();
     const { rows, columns } = useWindowSize();
+    const t = translate(locale);
     const start = Math.max(0, items.findIndex((it) => it.value === initial));
     const [cursor, setCursor] = useState(start);
     const maxRows = Math.max(3, (rows || 24) - 7);
@@ -47,8 +49,8 @@ export function SelectList({ title, items, initial, onSelect, }) {
                 const sel = idx === cursor;
                 return (_jsxs(Text, { children: [_jsx(Text, { color: UI.accent, children: sel ? '❯ ' : '  ' }), _jsx(Text, { color: sel ? UI.accent : undefined, bold: sel, children: it.label }), it.detail ? _jsx(Text, { color: UI.dim, children: '  ' + it.detail }) : null] }, it.value));
             }), _jsx(HintBar, { hints: [
-                    ['↑/↓', 'выбор'],
-                    ['Enter', 'ok'],
-                    ['Esc', 'отмена'],
+                    ['↑/↓', t('tui.hint.select')],
+                    ['Enter', t('tui.hint.ok')],
+                    ['Esc', t('tui.hint.cancel')],
                 ] })] }));
 }

package/dist/tui/useMouseWheel.js

@@ -48,7 +48,16 @@ export function parseWheel(chunk) {
     let m;
     while ((m = re.exec(chunk)) !== null) {
         const cb = Number(m[1]);
+        // SGR reports a RELEASE as the same button number with a lowercase `m`.
+        // Only press events are wheels: a terminal that sends 1000/1002/1003
+        // release reports (xterm does for button events) would otherwise count
+        // every notch TWICE — once for the press and once for its release.
+        if (m[0].endsWith('m'))
+            continue;
         // Button code 64 = wheel up (scroll back), 65 = wheel down (scroll fwd).
+        // Modifier bits (4=shift, 8=alt, 16=ctrl) must be masked OFF first: the
+        // mask below used to keep bit 0, so Ctrl/Alt-wheel (Cb 80/72/... — odd or
+        // even) fell through and that notch was lost.
         const button = cb & 0b11000011;
         if (button === 64)
             delta += 1;

package/dist/web.js

@@ -5,7 +5,37 @@ const DEFAULT_TIMEOUT = 20_000;
 const MAX_TEXT = 12_000;
 // Removes scripts, styles, and turns HTML into readable text. Exported for
 // tests — the entity/whitespace/collapse branches are pure and worth pinning.
+// Decode ONE numeric HTML entity to its character. A hostile/broken page can
+// carry `�` (beyond Unicode), a surrogate (`�`) or a huge
+// hex value; String.fromCodePoint THROWS RangeError on those, and the throw
+// escaped htmlToText into the WebFetch handler — the whole page came back as
+// "Error fetching <url>: Invalid code point 999999999". An undecodable
+// reference is kept VERBATIM instead.
+//
+// A surrogate PAIR written as two references (`&#55357;&#56832;`) is ONE
+// astral character (an emoji): decoding each half alone left two lone
+// surrogates in the text. A lone high surrogate is remembered and JOINED with
+// the low surrogate that immediately follows it (the replacer runs in order).
+let pendingHighSurrogate = null;
+function decodeEntityCode(cp) {
+    if (!Number.isInteger(cp) || cp < 0 || cp > 0x10ffff)
+        return '';
+    if (cp >= 0xd800 && cp <= 0xdbff) {
+        pendingHighSurrogate = String.fromCharCode(cp);
+        return '';
+    }
+    if (cp >= 0xdc00 && cp <= 0xdfff) {
+        const high = pendingHighSurrogate;
+        pendingHighSurrogate = null;
+        return high ? high + String.fromCharCode(cp) : String.fromCharCode(cp);
+    }
+    pendingHighSurrogate = null;
+    return String.fromCodePoint(cp);
+}
 export function htmlToText(html) {
+    // Reset the cross-reference surrogate state: it must never leak from one
+    // document to the next.
+    pendingHighSurrogate = null;
     // Remove blocks we don't need
     let s = html
         .replace(/<script[\s\S]*?<\/script>/gi, '')
@@ -35,8 +65,8 @@ export function htmlToText(html) {
         .replace(/&mdash;/g, '—')
         .replace(/&ndash;/g, '–')
         .replace(/&hellip;/g, '…')
-        .replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-        .replace(/&#x([0-9a-f]+);/gi, (_, n) => String.fromCodePoint(parseInt(n, 16)));
+        .replace(/&#(\d+);/g, (_, n) => decodeEntityCode(Number(n)))
+        .replace(/&#x([0-9a-f]+);/gi, (_, n) => decodeEntityCode(parseInt(n, 16)));
     // Collapse blank lines
     s = s
         .split('\n')
@@ -52,6 +82,49 @@ export function htmlToText(html) {
 // or localhost services. We resolve the hostname and refuse private / loopback
 // / link-local addresses. Best-effort: a DNS rebind between the check and the
 // fetch is out of scope for a CLI tool, but the common cases are covered.
+// Parse an inet_aton-style IPv4 literal (the form WHATWG URL and the OS also
+// accept) into a uint32, or null when it is not one. Rules: 1-4 parts; each
+// part may be hex (0x…), octal (leading 0) or decimal; the LAST part fills all
+// remaining bytes, so `127.1` == 127.0.0.1 and `2130706433` == 127.0.0.1.
+export function parseLegacyIpv4(host) {
+    const h = String(host || '').trim();
+    if (!h)
+        return null;
+    const parts = h.split('.');
+    if (parts.length < 1 || parts.length > 4)
+        return null;
+    const nums = [];
+    for (const p of parts) {
+        if (p === '')
+            return null;
+        let v;
+        if (/^0[xX][0-9a-fA-F]+$/.test(p))
+            v = parseInt(p.slice(2), 16);
+        else if (/^0[0-7]+$/.test(p))
+            v = parseInt(p.slice(1), 8);
+        else if (/^\d+$/.test(p))
+            v = parseInt(p, 10);
+        else
+            return null;
+        if (!Number.isFinite(v) || v < 0)
+            return null;
+        nums.push(v);
+    }
+    // Every part except the last must fit one byte; the last fills the rest.
+    for (let i = 0; i < nums.length - 1; i++) {
+        if (nums[i] > 0xff)
+            return null;
+    }
+    const lastMax = Math.pow(256, 5 - nums.length) - 1;
+    if (nums[nums.length - 1] > lastMax)
+        return null;
+    let n = 0;
+    for (let i = 0; i < nums.length - 1; i++) {
+        n += nums[i] * Math.pow(256, 3 - i);
+    }
+    n += nums[nums.length - 1];
+    return n >>> 0;
+}
 export function isPrivateIp(ip) {
     const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
     if (v4) {
@@ -68,6 +141,22 @@ export function isPrivateIp(ip) {
             return true; // CGNAT
         return false;
     }
+    // A NON-canonical IPv4 literal is still a number: WHATWG URL and inet_aton
+    // accept 1-4 parts with decimal/octal/hex digits (`2130706433`,
+    // `0x7f.1`, `0177.0.0.1`, `127.1` all mean 127.0.0.1). Recognising only the
+    // dotted-quad form let those through the SSRF guard (a classic bypass).
+    if (/^[0-9a-fx.]+$/i.test(ip) && !ip.includes(':')) {
+        const n = parseLegacyIpv4(ip);
+        if (n !== null) {
+            return isPrivateIp(((n >>> 24) & 0xff) +
+                '.' +
+                ((n >>> 16) & 0xff) +
+                '.' +
+                ((n >>> 8) & 0xff) +
+                '.' +
+                (n & 0xff));
+        }
+    }
     const low = ip.toLowerCase();
     if (low === '::1' || low === '::')
         return true;
@@ -123,7 +212,10 @@ export async function assertPublicUrl(rawUrl) {
     if (u.protocol !== 'http:' && u.protocol !== 'https:') {
         throw new Error(`unsupported protocol: ${u.protocol}`);
     }
-    const host = u.hostname;
+    // The URL API keeps the BRACKETS of an IPv6 literal (`[::ffff:7f00:1]`),
+    // and net.isIP() rejects a bracketed host — so the address fell through to
+    // the DNS lookup branch and the literal was never checked as an address.
+    const host = u.hostname.replace(/^\[(.*)\]$/, '$1');
     if (isPrivateHostname(host)) {
         throw new Error(`blocked private host: ${host}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.76.0",
+  "version": "2.77.0",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {