zames_pro 2.78.0 → 2.78.2

package/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.78.2] - 2026-10-18
+
+### Fixed
+
+- **goal:** clampGoalCondition does not cut a surrogate pair
+- **web:** judge the expanded IPv6 form in the SSRF guard
+- **permissions:** match a command rule against an avv array
+- **scheduler:** OR a restricted day-of-month and day-of-week
+- **qwen:** guest-limit classifier ignores a normal answer
+- **net-capture:** read a top-level accumulated_token_usage pair
+- **tools:** Read does not clip a surrogate pair in half
+- **tool-summary:** do not cut a surrogate pair in the log line
+- **shell:** do not start a background trim on a lone surrogate
+- **sandbox:** match eval at a command position, not as a substring
+- **goal:** parse the spaced and hyphenated NOT MET verdict
+- **hooks:** cap the combined PostToolUse and lifecycle output
+- **fsutil:** write atomic files through a symlink, not over it
+- **mcp:** sanitize the server half of a qualified tool name
+- **statusline:** settle on our own stdout end, not on the pipe closing
+- **provider:** match the handoff workdir by real path, not by string
+- **checkpoint:** retention deletes same-millisecond sibling archives
+- **undo:** a missing backup file no longer wedges the undo history
+- **sessions:** a stale internal id no longer hides the saved session
+- **attach:** keep @file references inside the sandbox root
+
+## [2.78.1] - 2026-10-18
+
+### Fixed
+
+- **permissions:** match a command rule against every plausible command key
+- **hooks:** cap a PreToolUse denial so it cannot flood the tool result
+- **diagnostics:** treat a zero-error watch banner as clean
+- **statusline:** cap the hook output so a chatty command cannot flood the row
+
 ## [2.78.0] - 2026-10-18
 
 ### Added

package/dist/attach-refs.js

@@ -9,6 +9,15 @@ const NL = String.fromCharCode(10);
 // Resolve a pasted string into a path to an EXISTING file. Handles quoted
 // paths (drag&drop from some file managers adds quotes) and paths relative to
 // the working directory. Returns null when nothing matches.
+//
+// Every candidate is checked against the sandbox root (the REAL path, so
+// a symlink escape is refused too). The `..`/cwd candidates exist to help an
+// operator paste a path that LOOKS relative to the project, not to grant
+// access above it: without this guard a reference with a `..` inlined a file
+// outside the sandbox, while every other file tool rejects that path via
+// safePath(). The search continues past an escaping candidate (a regular
+// file inside the project must still resolve), but no candidate outside is
+// ever returned.
 export async function resolveAttachPath(workdir, raw) {
     let s = String(raw || '').trim();
     if (!s)
@@ -34,11 +43,25 @@ export async function resolveAttachPath(workdir, raw) {
         ];
     for (const c of candidates) {
         const st = await fs.stat(c).catch(() => null);
-        if (st && st.isFile())
+        if (!st || !st.isFile())
+            continue;
+        if (await isInside(workdir, c))
             return c;
     }
     return null;
 }
+// True when the REAL path of `target` stays under the REAL workdir root.
+// realpath (not the lexical path) is required here for the same reason as
+// safePath() in src/sandbox.ts: a symlink inside the project can point
+// outside it.
+async function isInside(workdir, target) {
+    const root = await fs.realpath(path.resolve(workdir)).catch(() => null);
+    const real = await fs.realpath(target).catch(() => null);
+    if (!root || !real)
+        return false;
+    const rel = path.relative(root, real);
+    return !rel.startsWith('..') && !path.isAbsolute(rel);
+}
 // Per-file and total caps for `@path` inlining (B5). A reference should SAVE
 // round-trips, not flood the context: a huge file is truncated with a note
 // telling the agent to read the rest itself.

package/dist/checkpoint.js

@@ -176,10 +176,14 @@ export class CheckpointStore {
         const history = await this._readIndex();
         history.push(record);
         const kept = rotateRecords(history, this.maxBackups);
-        // Drop the archives that fell out of the retention window.
-        const keptStamps = new Set(kept.map((r) => r.stamp));
+        // Drop the archives that fell out of the retention window. Keyed by the
+        // RECORD, not by its stamp: the stamp is ms-precision, so two snapshots of
+        // one workdir taken in the same millisecond share it — the pruned record
+        // then looked "kept" thanks to its sibling and its archive stayed on disk
+        // as an orphan forever.
+        const keptSet = new Set(kept);
         for (const r of history) {
-            if (!keptStamps.has(r.stamp))
+            if (!keptSet.has(r))
                 await fs.rm(r.file, { force: true }).catch(() => { });
         }
         writeJsonAtomic(this.indexFile, kept);

package/dist/diagnostics.js

@@ -23,11 +23,17 @@ export function summarizeDiagnostics(raw, maxChars) {
     const text = String(raw || '').trim();
     if (!text)
         return null;
-    // tsc prints nothing on success; eslint prints nothing too. Guard against a
-    // benign banner that some tools emit.
-    if (/^(no errors?\.?|0 problems?.*)$/im.test(text) && text.length < 40) {
+    // tsc prints nothing on success, but with `--watch` it prints a banner
+    // ("Found 0 errors. Watching for file changes.") that is longer than the
+    // old 40-char cutoff — so every edit in watch mode appended a pointless
+    // diagnostics block to the tool result. Treat a ZERO-count banner as clean
+    // however long it is; a non-zero count still falls through to the lines.
+    if (/^(?:found\s+)?0\s+errors?\b/im.test(text))
+        return null;
+    if (/^no errors?\.?$/im.test(text))
+        return null;
+    if (/^0 problems?\b/im.test(text))
         return null;
-    }
     // Keep only error-looking lines when we can recognise them, so a long build
     // log collapses to the actual problems. Fall back to the whole output.
     const lines = text.split(/\r?\n/);

package/dist/fsutil.js

@@ -16,7 +16,18 @@ import path from 'path';
 // multi-user machine. We also chmod the target after rename because a
 // pre-existing file keeps its old mode (rename does not change the inode).
 export function writeFileAtomic(file, data) {
-    const tmp = file + '.tmp-' + process.pid;
+    // Follow a SYMLINK first: a dotfiles setup links ~/.zames/config.json into a
+    // git repo, and a project may link .zamesrc.json. Renaming a temp file over
+    // the link replaces the LINK with a regular file — the real target keeps the
+    // stale content and the next launch reads what the operator never edited.
+    let target = file;
+    try {
+        target = fs.realpathSync(file);
+    }
+    catch {
+        // Missing (first write) or broken link: write to the path itself.
+    }
+    const tmp = target + '.tmp-' + process.pid;
     // fsync the file BEFORE rename: without it a power loss can leave the
     // renamed name pointing at an empty/partial inode (rename itself is atomic,
     // but the data blocks may not have reached the disk yet).
@@ -29,7 +40,7 @@ export function writeFileAtomic(file, data) {
         finally {
             fs.closeSync(fd);
         }
-        fs.renameSync(tmp, file);
+        fs.renameSync(tmp, target);
     }
     catch (e) {
         // A failed write/fsync/rename (full disk, EIO, a directory in the way)

package/dist/goal.js

@@ -13,7 +13,14 @@ export function clampGoalCondition(condition) {
     const g = String(condition ?? '').trim();
     if (g.length <= GOAL_CONDITION_CAP)
         return g;
-    return g.slice(0, GOAL_CONDITION_CAP);
+    // Never cut a surrogate PAIR in half: the condition is injected into the
+    // evaluator prompt, and a lone high surrogate is a broken code point (same
+    // rule as truncateToolResult / capReport / clipLine / oneLine).
+    let cut = GOAL_CONDITION_CAP;
+    const last = g.charCodeAt(cut - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut--;
+    return g.slice(0, cut);
 }
 // The evaluator prompt is AGENT-facing (English), like the system prompt and
 // the compact summary prompt. It runs in the SAME chat as the work so the
@@ -74,7 +81,12 @@ export function parseGoalVerdict(text) {
     // spaces (`**VERDICT:** MET`) — a markdown-model answer did exactly that and
     // the strict `VERDICT:` matcher returned null, so the goal never parsed and
     // the loop auto-continued until the turn budget.
-    const m = /VERDICT\s*[*_`]*\s*:\s*[*_`]*\s*(MET|NOT_MET|IMPOSSIBLE)/i.exec(t);
+    // The value itself may be written the human way (`NOT MET`, `NOT-MET`): a
+    // strict `NOT_MET` matcher returned null for those, and null means "continue"
+    // — the goal loop then auto-continued until the turn budget although the
+    // judge had already said NOT_MET. `MET` is tried LAST so it cannot match the
+    // tail of `NOT MET`.
+    const m = /VERDICT\s*[*_`]*\s*:\s*[*_`]*\s*(IMPOSSIBLE|NOT[_ -]?MET|MET)/i.exec(t);
     if (!m)
         return null;
     const raw = m[1].toUpperCase();

package/dist/hooks.js

@@ -12,6 +12,12 @@ const LIFECYCLE_EVENTS = [
 // tool call must not be held hostage by it.
 const HOOK_TIMEOUT_MS = 10_000;
 const HOOK_MAX_BUFFER = 1024 * 1024;
+// A PreToolUse denial becomes the tool result the model reads, so it is capped
+// like any other tool output.
+const HOOK_DENIAL_CAP = 4000;
+// Combined stdout of a PostToolUse / lifecycle hook. It lands in a tool result
+// or in the chat, so it is a notice, not a log dump.
+const HOOK_OUTPUT_CAP = 8000;
 export function hooksConfigPath(workdir) {
     return path.join(workdir, '.zames', 'hooks.json');
 }
@@ -142,7 +148,15 @@ export async function runPreToolUse(hooks, tool, args, workdir) {
         const r = await runHook(entry, 'PreToolUse', tool, args, workdir);
         if (r.code !== 0) {
             const reason = (r.stderr || r.stdout).trim();
-            return reason || `hook exited with code ${r.code}`;
+            // The denial text becomes a TOOL RESULT the model reads: a hook that
+            // dumps a log must not flood the context with one call.
+            const capped = reason.slice(0, HOOK_DENIAL_CAP);
+            const suffix = reason.length > HOOK_DENIAL_CAP
+                ? '\n… [denial truncated: ' +
+                    (reason.length - HOOK_DENIAL_CAP) +
+                    ' chars omitted]'
+                : '';
+            return capped + suffix || `hook exited with code ${r.code}`;
         }
     }
     return null;
@@ -170,13 +184,28 @@ export async function runLifecycleHooks(hooks, event, workdir, extra = {}) {
 async function runEventHooks(hooks, event, workdir, tool, args, result) {
     const list = hooks?.[event];
     const parts = [];
+    let total = 0;
     for (const entry of list ?? []) {
         if (!matchesHook(entry, tool))
             continue;
         const r = await runHook(entry, event, tool, args, workdir, result);
         const out = r.stdout.trim();
-        if (out)
-            parts.push(out);
+        if (!out)
+            continue;
+        // The combined output goes into a tool result (PostToolUse) or straight
+        // into the chat (SessionStart and the other lifecycle events), so it must
+        // stay a notice: a hook running `npm test` or dumping a log used to append
+        // hundreds of KB and flood the context.
+        if (total >= HOOK_OUTPUT_CAP)
+            break;
+        const piece = out.slice(0, HOOK_OUTPUT_CAP - total);
+        total += piece.length;
+        parts.push(piece);
     }
-    return parts.join(String.fromCharCode(10));
+    const joined = parts.join(String.fromCharCode(10));
+    if (joined.length <= HOOK_OUTPUT_CAP)
+        return joined;
+    return (joined.slice(0, HOOK_OUTPUT_CAP) +
+        String.fromCharCode(10) +
+        '… [hook output truncated]');
 }

package/dist/mcp.js

@@ -275,7 +275,13 @@ function safeJson(v) {
 // servers cannot collide. The prefix uses __ (double underscore) because
 // the model must be able to reproduce it exactly.
 export function qualifyToolName(server, tool) {
-    return server + '__' + tool.replace(/[^A-Za-z0-9_]/g, '_');
+    // BOTH halves must be sanitized: a server name with a space ('my server')
+    // produced 'my server__tool', which the model cannot reproduce in a JSON
+    // tool call. The same rule on both sides also makes two spellings of one
+    // server collide on ONE qualified name, so dedupeToolNames can rename the
+    // duplicate instead of leaving both tools unreachable.
+    const clean = (s) => String(s || '').replace(/[^A-Za-z0-9_]/g, '_');
+    return clean(server) + '__' + clean(tool);
 }
 // Make every tool name unique IN PLACE. agent-loop resolves a call by name and
 // takes the first match, so a duplicate silently shadows the later tool. The

package/dist/net-capture.js

@@ -270,6 +270,12 @@ export function extractTokenUsage(body) {
             : undefined;
         if (resp)
             consider(resp.accumulated_token_usage);
+        // A BATCH update can also arrive with the pair at the TOP level:
+        // {"p":"accumulated_token_usage","v":N} (the same pair DeepSeek nests
+        // inside v: [...]). Reading only the nested form made the context counter
+        // silently stale for that stream shape.
+        if (o.p === 'accumulated_token_usage')
+            consider(o.v);
         // A BATCH update: v is an array of {"p":"accumulated_token_usage","v":N}.
         if (Array.isArray(o.v)) {
             for (const item of o.v) {

package/dist/permissions.js

@@ -63,6 +63,10 @@ function safeRegex(source) {
 // A file path may arrive in any of these keys depending on the tool.
 // We collect them all and match the path regex against ANY of them.
 const PATH_KEYS = ['path', 'file_path', 'notebook_path', 'from', 'to'];
+// The command may be named differently by an MCP tool (its JSON Schema picks
+// the field name) or invented by the model. Checking every plausible key keeps
+// a `command` rule from being bypassed just because the field is called `cmd`.
+const COMMAND_KEYS = ['command', 'cmd', 'shell_command', 'script', 'argv'];
 // Best-effort check whether a string looks like a filesystem path. Used for
 // tools whose arguments are not covered by PATH_KEYS (MCP tools take arbitrary
 // arg names from their JSON Schema), so a `path` rule is not silently
@@ -106,7 +110,18 @@ export function decidePermission(policy, tool, args) {
     if (!policy)
         return { action: 'allow', reason: 'no policy' };
     const a = (args ?? {});
-    const command = typeof a['command'] === 'string' ? a['command'] : '';
+    // A command may be a STRING (`command`, `cmd`, ...) or an ARRAY (`argv`,
+    // the natural shape for execFile-style MCP tools). Accepting only strings
+    // let a `command` deny be bypassed by passing the words as an array.
+    const commands = [];
+    for (const k of COMMAND_KEYS) {
+        const v = a[k];
+        if (typeof v === 'string')
+            commands.push(v);
+        else if (Array.isArray(v)) {
+            commands.push(v.filter((x) => typeof x === 'string').join(' '));
+        }
+    }
     const paths = collectPathCandidates(tool, args);
     for (const r of policy.rules) {
         if (r.tool) {
@@ -116,7 +131,7 @@ export function decidePermission(policy, tool, args) {
         }
         if (r.command) {
             const re = safeRegex(r.command);
-            if (!re || !command || !re.test(command))
+            if (!re || !commands.some((c) => re.test(c)))
                 continue;
         }
         if (r.path) {

package/dist/provider-handoff.js

@@ -52,7 +52,7 @@ export function readProviderHandoff(provider, workdir) {
         }
         if (raw.provider !== provider)
             return null;
-        if ((raw.workdir || '') !== (workdir || ''))
+        if (!sameDir(raw.workdir, workdir))
             return null;
         return raw;
     }
@@ -60,6 +60,30 @@ export function readProviderHandoff(provider, workdir) {
         return null;
     }
 }
+// Two paths that denote the SAME directory must match: the handoff is consumed
+// by the NEXT launch in that directory, and the path there is not guaranteed to
+// be byte-identical — a trailing separator (a `/cd sub/` leaves one) or a
+// symlinked route to the project used to make a lexical `!==` silently drop the
+// carried-over summary. realpath is the comparison; a missing dir falls back to
+// the resolved lexical path so a deleted project still matches its record.
+function sameDir(a, b) {
+    const x = String(a ?? '');
+    const y = String(b ?? '');
+    if (x === y)
+        return true;
+    if (!x || !y)
+        return false;
+    const real = (p) => {
+        const abs = path.resolve(p);
+        try {
+            return fs.realpathSync(abs);
+        }
+        catch {
+            return abs;
+        }
+    };
+    return real(x) === real(y);
+}
 /** Remove the handoff once it has been posted (or is stale). Best-effort. */
 export function clearProviderHandoff() {
     try {

package/dist/qwen-net-capture.js

@@ -256,6 +256,14 @@ export function isGuestLimitText(body) {
     const b = String(body || '');
     if (!b)
         return false;
+    // Same rule as isRateLimitText / isServerBusyText: a normal ANSWER may
+    // MENTION the guest limit (the model explaining Qwen's guest mode, a pasted
+    // notice). Only an error payload or a body with NO answer content can be the
+    // real notice; otherwise ask() would fail fast with "log in" and throw the
+    // answer away.
+    const errNotice = /event:\s*error|"type"\s*:\s*"error"|"error"\s*:/i.test(b);
+    if (!errNotice && hasAnswerContent(b))
+        return false;
     return /guest chat limit|guest.*limit|log in to continue|гостевой лимит/i.test(b);
 }
 export function isServerBusyText(body) {

package/dist/scheduler.js

@@ -41,6 +41,17 @@ export function formatInterval(ms) {
         return ms / 1000 + 's';
     return ms + 'ms';
 }
+// The DAY rule of standard cron: when BOTH day-of-month and day-of-week are
+// restricted they are ORed (`0 9 1 * 1` = the 1st OR any Monday); otherwise
+// they are plain ANDed (an unrestricted field matches every day). ANDing a
+// restricted pair made the job fire only when the two coincided.
+function dayMatches(c, date) {
+    const domOk = c.dom.has(date.getDate());
+    const dowOk = c.dow.has(date.getDay());
+    if (c.domRestricted && c.dowRestricted)
+        return domOk || dowOk;
+    return domOk && dowOk;
+}
 // Parse one cron field ("*", "a-b", "*/n", "a,b", "a-b/n") into a value set.
 function parseCronField(field, min, max) {
     const out = new Set();
@@ -95,19 +106,26 @@ export function parseCron(expr) {
     const dow = new Set();
     for (const d of dowRaw)
         dow.add(d === 7 ? 0 : d);
-    return { minute, hour, dom, month, dow };
+    return {
+        minute,
+        hour,
+        dom,
+        month,
+        dow,
+        domRestricted: parts[2].trim() !== '*',
+        dowRestricted: parts[4].trim() !== '*',
+    };
 }
-// Does the given Date match the cron expression? dom and dow are ANDed (the
-// common, predictable behavior); to schedule "every day" use `*` for one.
+// Does the given Date match the cron expression? The day rule is standard
+// cron: dom/dow are ORed when BOTH are restricted, ANDed otherwise.
 export function cronMatches(expr, date) {
     const c = parseCron(expr);
     if (!c)
         return false;
     return (c.minute.has(date.getMinutes()) &&
         c.hour.has(date.getHours()) &&
-        c.dom.has(date.getDate()) &&
         c.month.has(date.getMonth() + 1) &&
-        c.dow.has(date.getDay()));
+        dayMatches(c, date));
 }
 // Next epoch ms at which the expression fires, strictly after `fromMs`. Scans
 // minute by minute (bounded to ~4 years); a one-time cost when a job is
@@ -125,9 +143,8 @@ export function nextCronTime(expr, fromMs) {
     while (d.getTime() <= limit) {
         if (c.minute.has(d.getMinutes()) &&
             c.hour.has(d.getHours()) &&
-            c.dom.has(d.getDate()) &&
             c.month.has(d.getMonth() + 1) &&
-            c.dow.has(d.getDay())) {
+            dayMatches(c, d)) {
             return d.getTime();
         }
         d.setMinutes(d.getMinutes() + 1);

package/dist/sessions.js

@@ -135,13 +135,17 @@ export function loadLastSession(workdir = '', provider) {
     try {
         const index = JSON.parse(fs.readFileSync(INDEX_FILE, 'utf-8'));
         const byWorkdir = index && index.byWorkdir ? index.byWorkdir : {};
-        const candidates = [byWorkdir[workdir], index.last].filter((x) => Boolean(x));
+        // A denylisted id is useless here: its subagent chat is never saved as a
+        // session, so a stale entry (recorded for a chat merely SEEN) would make the
+        // loop run out of candidates — even though the project's real session is
+        // right there on disk. Filter them out instead of `continue`-ing past them,
+        // then fall back to the newest saved session of this workdir so a stale
+        // index cannot make a saved chat unresumable.
         const internal = readInternal();
+        const candidates = [byWorkdir[workdir], index.last].filter((x) => Boolean(x) && !internal.has(String(x)));
         for (const id of candidates) {
             // The session file may have been deleted — the index is then stale and
             // the session cannot be restored. We try the next candidate.
-            if (internal.has(id))
-                continue;
             const s = readSession(id);
             if (!s)
                 continue;
@@ -151,7 +155,9 @@ export function loadLastSession(workdir = '', provider) {
                 continue;
             return s;
         }
-        return null;
+        const fallback = listSessions().find((s) => (!workdir || s.workdir === workdir) &&
+            (!provider || (s.provider || 'deepseek') === provider));
+        return fallback || null;
     }
     catch {
         return null;

package/dist/shell.js

@@ -12,7 +12,15 @@ export function assertCommandInsideRoot(root, command) {
     // eval re-parses its argument, so a `cd` hidden inside a string is invisible
     // to the static scan; refusing eval together with cd is the honest answer
     // instead of pretending the barrier still holds.
-    if (/\beval\b/.test(cmd) && /\bcd\b/.test(cmd)) {
+    //
+    // The test is on COMMAND POSITIONS, not on raw substrings: a bare
+    // `/eval/`+/cd/ matched ordinary text like `npx tsx --test
+    // test/goal-eval-unparsable.test.ts` (which DOES contain `cd` elsewhere, e.g.
+    // `cd proj && …`), so a legitimate command — even `npm test` — was rejected
+    // with a sandbox error. eval only re-parses when it is RUN, i.e. at the start
+    // of a command or after a separator, optionally via `sh -c eval …`.
+    const evalAtCommand = /(?:^|[;&|(]\s*|\bsh\s+-c\s+['"]?)\s*eval\b/;
+    if (evalAtCommand.test(cmd) && /\bcd\b/.test(cmd)) {
         throw new Error('Sandbox: eval with cd is forbidden');
     }
     // `(` and backticks open a subshell / command substitution where a `cd` is
@@ -118,10 +126,18 @@ const BG_PROCS = new Map();
 const BG_MAX_BUFFER = 1024 * 1024;
 function bgTrim(p) {
     if (p.out.length > BG_MAX_BUFFER) {
+        // Never START the kept window on a low surrogate: the cut slices a JS
+        // string, and an emoji / astral CJK char is TWO UTF-16 units, so a cut
+        // between them left a lone half at the head of the buffer that pollBackground
+        // hands to the model (same rule as truncateToolResult / capReport).
+        let start = p.out.length - BG_MAX_BUFFER;
+        const first = p.out.charCodeAt(start);
+        if (first >= 0xdc00 && first <= 0xdfff)
+            start++;
         p.out =
             '[...earlier output trimmed]' +
                 String.fromCharCode(10) +
-                p.out.slice(p.out.length - BG_MAX_BUFFER);
+                p.out.slice(start);
     }
 }
 /** Start a shell command in the background. Returns a short id. */

package/dist/statusline.js

@@ -26,6 +26,10 @@ export function runStatusLineCommand(workdir, command, info, timeoutMs = 4000) {
             const first = String(out).split(/\r?\n/)[0].trim();
             resolve(first);
         };
+        // Only the FIRST LINE is shown, so there is no reason to keep collecting a
+        // big blob: a chatty command (a JSON dump, `ls -R`) would grow `out`
+        // unboundedly and the status row then repainted megabytes. Stop appending
+        // once a short line is buffered (the rest of that line does not matter).
         const timer = setTimeout(() => {
             try {
                 child.kill();
@@ -33,13 +37,30 @@ export function runStatusLineCommand(workdir, command, info, timeoutMs = 4000) {
             catch { }
             finish();
         }, timeoutMs);
+        // A status line is a short badge: cap what is buffered so a chatty
+        // command cannot grow it (and the rendered row) without bound.
+        const MAX_OUT = 400;
         child.stdout?.on('data', (c) => {
-            out += c.toString();
+            if (out.length >= MAX_OUT)
+                return;
+            // A chunk can be huge (one 64 KB read); clip it to the remaining space
+            // so the buffer never exceeds MAX_OUT. An unbounded `out` made the
+            // status row repaint megabytes on every tick.
+            out += c.toString().slice(0, MAX_OUT - out.length);
         });
         child.on('error', () => {
             clearTimeout(timer);
             finish();
         });
+        // 'end' on OUR stdout fires as soon as the writer closes the pipe. 'close'
+        // waits for the pipes to drain, so a command that backgrounds a daemon (a
+        // watcher, `npm run dev &`) — whose grandchild inherits the pipe — kept the
+        // promise pending until the 4s timeout on EVERY tick even though the line
+        // had already been printed.
+        child.stdout?.on('end', () => {
+            clearTimeout(timer);
+            finish();
+        });
         child.on('close', () => {
             clearTimeout(timer);
             finish();

package/dist/tool-summary.js

@@ -7,7 +7,16 @@
 /** Collapse whitespace and clip to `max` chars (single line). */
 function oneLine(s, max = 80) {
     const t = String(s).replace(/\s+/g, ' ').trim();
-    return t.length > max ? t.slice(0, max - 1) + '…' : t;
+    if (t.length <= max)
+        return t;
+    // Never cut a surrogate PAIR in half: the log line is shown to the operator
+    // (and captured in the transcript), and a lone high surrogate at the end is
+    // a broken code point. Same rule as truncateToolResult / capReport.
+    let cut = max - 1;
+    const last = t.charCodeAt(cut - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut--;
+    return t.slice(0, cut) + '…';
 }
 function str(v) {
     return typeof v === 'string' ? v : '';

package/dist/tools.js

@@ -10,6 +10,17 @@ import { createExtraTools } from './extraTools.js';
 // user-facing. They must be in ENGLISH (like Claude Code / Codex). Only the
 // strings the OPERATOR sees (help, spinner, service messages) are localized —
 // those live in src/i18n.ts (CATALOG) and are picked by the locale setting.
+// Clip a long line without leaving a lone HIGH surrogate: the cut is in
+// UTF-16 units, so an emoji / astral CJK char on the boundary would lose its
+// low half and reach the model as a broken code point (same rule as
+// truncateToolResult / capReport / summarizeDiagnostics / bgTrim).
+function clipLine(l, max) {
+    let cut = max;
+    const last = l.charCodeAt(cut - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut--;
+    return l.slice(0, cut);
+}
 export function createTools(workdir, { undo, todos, readOnly = false, subagents = false, } = {}) {
     const root = path.resolve(workdir);
     const safe = (p) => safePath(root, p);
@@ -109,7 +120,7 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
                 const start = offset ?? 0;
                 const end = limit ? start + limit : lines.length;
                 const slice = lines.slice(start, end);
-                const clip = (l) => l.length > 2000 ? l.slice(0, 2000) + ' …[line truncated]' : l;
+                const clip = (l) => l.length > 2000 ? clipLine(l, 2000) + ' …[line truncated]' : l;
                 if (!numbered)
                     return slice.map(clip).join('\n');
                 const width = String(start + slice.length).length;

package/dist/undo.js

@@ -77,31 +77,56 @@ export class UndoStore {
         const history = await this._readIndex();
         if (!history.length)
             return { ok: false, reason: 'empty' };
-        const record = history.pop();
-        if (!record)
-            return { ok: false, reason: 'empty' };
-        const { originalPath, existed, backupFile } = record;
-        try {
+        // Walk back from the newest record and SKIP a dead one (its .bak vanished,
+        // e.g. ~/.zames/undo was pruned or a crash left a record without the file).
+        // The old code popped the dead record, failed, and never rewrote the index —
+        // so every later /undo hit the same record again and the earlier backups
+        // stayed unreachable.
+        while (history.length) {
+            const record = history.pop();
+            if (!record)
+                break;
+            const { originalPath, existed, backupFile } = record;
+            let data = null;
             if (existed && backupFile) {
-                const data = await fs.readFile(backupFile);
-                await fs.writeFile(originalPath, data);
                 try {
-                    await fs.unlink(backupFile);
+                    data = await fs.readFile(backupFile);
+                }
+                catch (e) {
+                    if (e.code === 'ENOENT')
+                        continue;
+                    return { ok: false, reason: e.message };
                 }
-                catch { }
             }
-            else {
-                try {
-                    await fs.unlink(originalPath);
+            try {
+                if (data) {
+                    await fs.writeFile(originalPath, data);
+                    try {
+                        await fs.unlink(backupFile);
+                    }
+                    catch { }
                 }
-                catch { }
+                else {
+                    // existed === false: the agent CREATED the file, so undoing removes
+                    // it again. ENOENT is the expected case (it is already gone).
+                    try {
+                        await fs.unlink(originalPath);
+                    }
+                    catch { }
+                }
+                await this._writeIndex(history);
+                return { ok: true, record };
+            }
+            catch (e) {
+                // A real failure (permissions, a directory in place of the file): put
+                // the record back so a retry after fixing the cause still works.
+                history.push(record);
+                await this._writeIndex(history);
+                return { ok: false, reason: e.message };
             }
-            await this._writeIndex(history);
-            return { ok: true, record };
-        }
-        catch (e) {
-            return { ok: false, reason: e.message };
         }
+        await this._writeIndex(history);
+        return { ok: false, reason: 'empty' };
     }
     async list(count = 10) {
         const history = await this._readIndex();

package/dist/web.js

@@ -125,6 +125,49 @@ export function parseLegacyIpv4(host) {
     n += nums[nums.length - 1];
     return n >>> 0;
 }
+// Collapse an IPv6 literal to the canonical `a:b:c:d:e:f:g:h` hex form so the
+// prefix checks below see the SAME address whether it was written short
+// (`::1`, `::ffff:7f00:1`) or fully expanded (`0:0:0:0:0:0:0:1`,
+// `0:0:0:0:0:ffff:7f00:1`). A text-prefix match treated the expanded form as
+// PUBLIC, which let the SSRF guard reach loopback. Returns null for a non-IPv6
+// string or a malformed literal.
+function expandIpv6(ip) {
+    const s = ip.toLowerCase();
+    if (!s.includes(':'))
+        return null;
+    // An embedded dotted IPv4 tail (::ffff:127.0.0.1) is folded into two hex
+    // groups first, so the split below has a uniform shape.
+    const dotted = s.match(/^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    let body = s;
+    if (dotted) {
+        const [a, b, c, d] = dotted.slice(2).map(Number);
+        if ([a, b, c, d].some((n) => n > 255))
+            return null;
+        const hi = ((a << 8) | b).toString(16);
+        const lo = ((c << 8) | d).toString(16);
+        body = dotted[1] + hi + ':' + lo;
+    }
+    const halves = body.split('::');
+    if (halves.length > 2)
+        return null;
+    const head = halves[0] ? halves[0].split(':') : [];
+    const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    const groups = [];
+    for (const g of [...head, ...tail]) {
+        if (!/^[0-9a-f]{1,4}$/.test(g))
+            return null;
+        groups.push(g);
+    }
+    const missing = 8 - groups.length - (halves.length === 2 ? 0 : 0);
+    if (halves.length === 2) {
+        if (missing < 0)
+            return null;
+        return [...head, ...Array(missing).fill('0'), ...tail].map((g) => parseInt(g, 16));
+    }
+    if (groups.length !== 8)
+        return null;
+    return groups.map((g) => parseInt(g, 16));
+}
 export function isPrivateIp(ip) {
     const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
     if (v4) {
@@ -158,6 +201,36 @@ export function isPrivateIp(ip) {
         }
     }
     const low = ip.toLowerCase();
+    // Judge the EXPANDED form so `0:0:0:0:0:0:0:1` is treated exactly like
+    // `::1` (a text-prefix match called the expanded literal public).
+    const v6 = expandIpv6(ip);
+    if (v6) {
+        const allZero = v6.every((g) => g === 0);
+        const loopback = v6.slice(0, 7).every((g) => g === 0) && v6[7] === 1;
+        if (allZero || loopback)
+            return true;
+        const g0 = v6[0];
+        // fe80::/10 link-local, fec0::/10 deprecated site-local.
+        if ((g0 & 0xffc0) === 0xfe80 || (g0 & 0xffc0) === 0xfec0)
+            return true;
+        // fc00::/7 unique-local.
+        if ((g0 & 0xfe00) === 0xfc00)
+            return true;
+        // ff00::/8 multicast is not a public unicast destination either.
+        if ((g0 & 0xff00) === 0xff00)
+            return true;
+        // IPv4-mapped ::ffff:a.b.c.d — judge the embedded address.
+        const mappedV4 = v6.slice(0, 5).every((g) => g === 0) && v6[5] === 0xffff;
+        if (mappedV4) {
+            return isPrivateIp((v6[6] >> 8) +
+                '.' +
+                (v6[6] & 0xff) +
+                '.' +
+                (v6[7] >> 8) +
+                '.' +
+                (v6[7] & 0xff));
+        }
+    }
     if (low === '::1' || low === '::')
         return true;
     // IPv6 link-local is fe80::/10, i.e. fe80..febf (the old `startsWith('fe80')`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.78.0",
+  "version": "2.78.2",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {