zames_pro 2.78.0 → 2.78.1

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.78.1] - 2026-10-18
+
+### Fixed
+
+- **permissions:** match a command rule against every plausible command key
+- **hooks:** cap a PreToolUse denial so it cannot flood the tool result
+- **diagnostics:** treat a zero-error watch banner as clean
+- **statusline:** cap the hook output so a chatty command cannot flood the row
+
 ## [2.78.0] - 2026-10-18
 
 ### Added

package/dist/diagnostics.js

@@ -23,11 +23,17 @@ export function summarizeDiagnostics(raw, maxChars) {
     const text = String(raw || '').trim();
     if (!text)
         return null;
-    // tsc prints nothing on success; eslint prints nothing too. Guard against a
-    // benign banner that some tools emit.
-    if (/^(no errors?\.?|0 problems?.*)$/im.test(text) && text.length < 40) {
+    // tsc prints nothing on success, but with `--watch` it prints a banner
+    // ("Found 0 errors. Watching for file changes.") that is longer than the
+    // old 40-char cutoff — so every edit in watch mode appended a pointless
+    // diagnostics block to the tool result. Treat a ZERO-count banner as clean
+    // however long it is; a non-zero count still falls through to the lines.
+    if (/^(?:found\s+)?0\s+errors?\b/im.test(text))
+        return null;
+    if (/^no errors?\.?$/im.test(text))
+        return null;
+    if (/^0 problems?\b/im.test(text))
         return null;
-    }
     // Keep only error-looking lines when we can recognise them, so a long build
     // log collapses to the actual problems. Fall back to the whole output.
     const lines = text.split(/\r?\n/);

package/dist/hooks.js

@@ -12,6 +12,9 @@ const LIFECYCLE_EVENTS = [
 // tool call must not be held hostage by it.
 const HOOK_TIMEOUT_MS = 10_000;
 const HOOK_MAX_BUFFER = 1024 * 1024;
+// A PreToolUse denial becomes the tool result the model reads, so it is capped
+// like any other tool output.
+const HOOK_DENIAL_CAP = 4000;
 export function hooksConfigPath(workdir) {
     return path.join(workdir, '.zames', 'hooks.json');
 }
@@ -142,7 +145,15 @@ export async function runPreToolUse(hooks, tool, args, workdir) {
         const r = await runHook(entry, 'PreToolUse', tool, args, workdir);
         if (r.code !== 0) {
             const reason = (r.stderr || r.stdout).trim();
-            return reason || `hook exited with code ${r.code}`;
+            // The denial text becomes a TOOL RESULT the model reads: a hook that
+            // dumps a log must not flood the context with one call.
+            const capped = reason.slice(0, HOOK_DENIAL_CAP);
+            const suffix = reason.length > HOOK_DENIAL_CAP
+                ? '\n… [denial truncated: ' +
+                    (reason.length - HOOK_DENIAL_CAP) +
+                    ' chars omitted]'
+                : '';
+            return capped + suffix || `hook exited with code ${r.code}`;
         }
     }
     return null;

package/dist/permissions.js

@@ -63,6 +63,10 @@ function safeRegex(source) {
 // A file path may arrive in any of these keys depending on the tool.
 // We collect them all and match the path regex against ANY of them.
 const PATH_KEYS = ['path', 'file_path', 'notebook_path', 'from', 'to'];
+// The command may be named differently by an MCP tool (its JSON Schema picks
+// the field name) or invented by the model. Checking every plausible key keeps
+// a `command` rule from being bypassed just because the field is called `cmd`.
+const COMMAND_KEYS = ['command', 'cmd', 'shell_command', 'script', 'argv'];
 // Best-effort check whether a string looks like a filesystem path. Used for
 // tools whose arguments are not covered by PATH_KEYS (MCP tools take arbitrary
 // arg names from their JSON Schema), so a `path` rule is not silently
@@ -106,7 +110,7 @@ export function decidePermission(policy, tool, args) {
     if (!policy)
         return { action: 'allow', reason: 'no policy' };
     const a = (args ?? {});
-    const command = typeof a['command'] === 'string' ? a['command'] : '';
+    const commands = COMMAND_KEYS.filter((k) => typeof a[k] === 'string').map((k) => a[k]);
     const paths = collectPathCandidates(tool, args);
     for (const r of policy.rules) {
         if (r.tool) {
@@ -116,7 +120,7 @@ export function decidePermission(policy, tool, args) {
         }
         if (r.command) {
             const re = safeRegex(r.command);
-            if (!re || !command || !re.test(command))
+            if (!re || !commands.some((c) => re.test(c)))
                 continue;
         }
         if (r.path) {

package/dist/statusline.js

@@ -26,6 +26,10 @@ export function runStatusLineCommand(workdir, command, info, timeoutMs = 4000) {
             const first = String(out).split(/\r?\n/)[0].trim();
             resolve(first);
         };
+        // Only the FIRST LINE is shown, so there is no reason to keep collecting a
+        // big blob: a chatty command (a JSON dump, `ls -R`) would grow `out`
+        // unboundedly and the status row then repainted megabytes. Stop appending
+        // once a short line is buffered (the rest of that line does not matter).
         const timer = setTimeout(() => {
             try {
                 child.kill();
@@ -33,8 +37,16 @@ export function runStatusLineCommand(workdir, command, info, timeoutMs = 4000) {
             catch { }
             finish();
         }, timeoutMs);
+        // A status line is a short badge: cap what is buffered so a chatty
+        // command cannot grow it (and the rendered row) without bound.
+        const MAX_OUT = 400;
         child.stdout?.on('data', (c) => {
-            out += c.toString();
+            if (out.length >= MAX_OUT)
+                return;
+            // A chunk can be huge (one 64 KB read); clip it to the remaining space
+            // so the buffer never exceeds MAX_OUT. An unbounded `out` made the
+            // status row repaint megabytes on every tick.
+            out += c.toString().slice(0, MAX_OUT - out.length);
         });
         child.on('error', () => {
             clearTimeout(timer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.78.0",
+  "version": "2.78.1",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {