zames_pro 2.78.2 → 2.78.3

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.78.3] - 2026-10-18
+
+### Fixed
+
+- **answer-parse:** a report narrating completed steps is not unfinished work
+- **net-capture:** a short complete answer is not a finished-without-answer turn
+- **git:** keep the empty-output sentinel out of the git context
+- **tools:** make Read offset/limit 1-based like every line-numbered tool
+- **shell:** scan a glued cd target (cd../.. escaped the sandbox)
+- **web:** drop an unclosed script/style body in htmlToText
+- **diagnostics:** recognize a coloured/timestamped clean banner
+- **permissions:** fail closed on a rule with an invalid regex
+- **transcript:** sanitize the session name in the file name
+- **backlog:** strip a CR from a note title
+- **shell:** escalate to SIGKILL when a killed job traps SIGTERM
+- **input:** Tab on an empty buffer inserted a guessed command
+
 ## [2.78.2] - 2026-10-18
 
 ### Fixed

package/dist/answer-parse.js

@@ -111,6 +111,64 @@ export function looksLikeUnfinishedWork(text) {
     if (/\b(done|finished|completed|готово|выполнено|завершено)\b/i.test(t)) {
         return false;
     }
+    // A report that NARRATES a completed step ("Tests pass. Now I will run
+    // the build.", "I have updated the README.", "Fixed the bug.") recounts
+    // work that is ALREADY done. The future-tense "now …" that follows must not
+    // turn such a report back into unfinished work: the loop re-asked the model
+    // up to 3 times on a complete answer. A bare promise ("Let me run the
+    // tests") has NO completed-step clause and is still caught below.
+    // The prefix and the verb are matched SEPARATELY (not as one combined
+    // regex): with a Cyrillic alternation glued to a `\b`-prefixed group, V8
+    // silently fails to find the match. A short English/Russian verb list is
+    // checked with plain `includes` on the lowercased text.
+    const lower = t.toLowerCase();
+    const completedWords = [
+        'passed',
+        'succeeded',
+        'failed',
+        'updated',
+        'fixed',
+        'added',
+        'removed',
+        'applied',
+        'committed',
+        'pushed',
+        'installed',
+        'verified',
+        'changed',
+        'modified',
+        'implemented',
+        'reviewed',
+        'created',
+        'built',
+        'pass.',
+        'pass,',
+        'pass ',
+        'have ',
+        'has ',
+        'проходят',
+        'прошёл',
+        'прошел',
+        'успешн',
+        'готов',
+    ];
+    const completedRu = [
+        'исправил',
+        'добавил',
+        'обновил',
+        'создал',
+        'удалил',
+        'применил',
+        'запустил',
+        'проверил',
+        'изменил',
+        'сделал',
+        'выполнил',
+    ];
+    if (completedWords.some((w) => lower.includes(w)) ||
+        completedRu.some((w) => lower.includes(w))) {
+        return false;
+    }
     // `update`/`summarize`/`explain` are REPORT verbs (`I will update you on the
     // results: …`) — they do not promise a tool call. A colon anywhere in the
     // gap also means the sentence is explaining a fact, not about to act.

package/dist/backlog.js

@@ -30,7 +30,10 @@ export function parseBacklogNote(note) {
             break;
         }
     }
-    const bodyLines = body.split(NL);
+    // A note typed on Windows (or pasted from one) carries CRLF line endings;
+    // the title would keep the trailing `\r` and the heading would get a stray
+    // carriage return.
+    const bodyLines = body.split(NL).map((l) => l.replace(/\r$/, ''));
     const title = bodyLines[0];
     const rest = bodyLines.slice(1).join(NL).trim();
     return { priority, title, note: rest || undefined };

package/dist/diagnostics.js

@@ -28,11 +28,17 @@ export function summarizeDiagnostics(raw, maxChars) {
     // old 40-char cutoff — so every edit in watch mode appended a pointless
     // diagnostics block to the tool result. Treat a ZERO-count banner as clean
     // however long it is; a non-zero count still falls through to the lines.
-    if (/^(?:found\s+)?0\s+errors?\b/im.test(text))
+    // Strip ANSI colour codes and a leading `[12:00:00]`-style timestamp before
+    // the clean checks: a watch-mode banner is usually coloured and/or
+    // prefixed, and the anchored regexes missed it — every edit then
+    // appended a pointless diagnostics block.
+    const plain = text.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '');
+    const cleanCheck = plain.replace(/^\[[^\]]*\]\s*/, '');
+    if (/^(?:found\s+)?0\s+errors?\b/im.test(cleanCheck))
         return null;
-    if (/^no errors?\.?$/im.test(text))
+    if (/^no errors?(?: found)?\.?$/im.test(cleanCheck))
         return null;
-    if (/^0 problems?\b/im.test(text))
+    if (/^0 problems?\b/im.test(cleanCheck))
         return null;
     // Keep only error-looking lines when we can recognise them, so a long build
     // log collapses to the actual problems. Fall back to the whole output.

package/dist/gitTools.js

@@ -1,5 +1,9 @@
 import { execFile } from 'child_process';
 const BS = String.fromCharCode(92);
+// What runGitArgs answers for an EMPTY successful run. Callers that parse the
+// output must not mistake it for real content (a clean tree is not "one
+// modified file whose name is this string").
+export const NO_OUTPUT_SENTINEL = '(command produced no output)';
 // Run git with an argument ARRAY (no shell). ALL git invocations go through
 // this: an argument from the model can never be seen by a shell, so $(...),
 // backticks and a leading `-` (option injection) cannot turn a read-only call
@@ -22,7 +26,7 @@ export function runGitArgs(args, cwd, timeout = 15_000) {
             const errStr = (stderr || '').toString();
             if (!err) {
                 const combined = (out + errStr).trim();
-                resolve(combined || '(command produced no output)');
+                resolve(combined || NO_OUTPUT_SENTINEL);
                 return;
             }
             const parts = [];
@@ -49,7 +53,11 @@ export async function getGitContext(workdir) {
     const remoteR = await runGitArgs(['remote'], workdir, 5000);
     const aheadR = await runGitArgs(['rev-list', '--left-right', '--count', '@{upstream}...HEAD'], workdir, 5000);
     const branch = branchR.trim() || '(detached HEAD)';
-    const statusLines = statusR
+    // The shared runner answers an EMPTY successful run with a sentinel. Storing
+    // it verbatim told the model the tree had a modified "file" that is really
+    // an internal string — every task started with a false dirty-tree premise.
+    const statusText = statusR.trim() === NO_OUTPUT_SENTINEL ? '' : statusR;
+    const statusLines = statusText
         .split(String.fromCharCode(10))
         .map((l) => l.trimEnd())
         .filter(Boolean);
@@ -84,7 +92,7 @@ export function formatGitContext(ctx) {
     else {
         s += '\n- Remote: (none)';
     }
-    if (ctx.changedFiles > 0) {
+    if (ctx.changedFiles > 0 && ctx.statusPreview.trim() !== NO_OUTPUT_SENTINEL) {
         s += `\n- Uncommitted changes: ${ctx.changedFiles} file(s)
 `;
         // Choose a fence longer than any backtick run in the preview: a filename
@@ -234,8 +242,7 @@ export function createGitTools(workdir) {
                 // We stage everything only if the index is empty (as the description promises).
                 const staged = await runGitArgs(['diff', '--cached', '--name-only'], workdir, 10_000);
                 const stagedTrimmed = staged.trim();
-                const hasStaged = stagedTrimmed !== '' &&
-                    stagedTrimmed !== '(command produced no output)';
+                const hasStaged = stagedTrimmed !== '' && stagedTrimmed !== NO_OUTPUT_SENTINEL;
                 const addResult = hasStaged
                     ? '(index is not empty — add -A skipped)'
                     : await runGitArgs(['add', '-A'], workdir, 20_000);

package/dist/input/suggest.js

@@ -100,10 +100,23 @@ export function completeSlashCommand(buf, sugg, selected) {
     if (sugg.length === 1)
         return sugg[0].name + ' ';
     let prefix = sugg[0].name;
+    const typed = buf.toLowerCase();
     for (const c of sugg) {
-        while (!c.name.toLowerCase().startsWith(prefix.toLowerCase())) {
+        while (prefix.length > typed.length &&
+            !c.name.toLowerCase().startsWith(prefix.toLowerCase())) {
             prefix = prefix.slice(0, -1);
         }
     }
+    // Stop shrinking at the TYPED text: with an empty buffer the list matches
+    // everything, and the shared prefix used to shrink down to a bare "/" (or a
+    // common first letter like "/h") — Tab then inserted something the operator
+    // never typed. A completion must EXTEND what is already there.
+    // With an EMPTY buffer everything matches and the shared prefix collapses
+    // to a bare "/" (or a common first letter like "/h"): Tab must not guess a
+    // command the operator has not started typing.
+    if (typed.length < 2)
+        return null;
+    if (!prefix.toLowerCase().startsWith(typed))
+        return null;
     return prefix.length > buf.length ? prefix : null;
 }

package/dist/net-capture.js

@@ -169,9 +169,12 @@ export function extractAnswer(body) {
 // isFinishedWithoutAnswer === false): the finish loop kept polling for a
 // complete answer and `ask()` gave up only at the askDeadlineMs watchdog — the
 // operator watched a spinner for ~4 minutes with no tool call.
-// A real answer (a tool-call JSON, prose, a `respond` call) is far longer, so
-// anything below this is treated as a truncated/empty turn and retried.
-const MIN_FINISHED_ANSWER_CHARS = 4;
+// A real answer is anything non-empty. The one case that must NOT count is a
+// truncated RESPONSE head (an empty string or a bare `{`), which the measure
+// below excludes explicitly.
+const MIN_REAL_ANSWER_CHARS = 1;
+/** A bare truncated head (whitespace or braces only) is not a real answer. */
+const TRUNCATED_HEAD_RE = /^[\s{[]*$/;
 // How many chars of RESPONSE text the body carries, or -1 when there is NO
 // RESPONSE fragment at all. The fragment is SSE/JSON-encoded, so the content
 // may contain `\"` escapes AND raw `"` inside the JSON (the capture is the RAW
@@ -184,7 +187,25 @@ function responseContentLength(body) {
     const b = String(body || '');
     if (!/"type":"RESPONSE"/.test(b))
         return -1;
-    return extractFromSse(b).length;
+    // `extractFromSse` reads only `data:` lines, so a plain-JSON body (or one
+    // captured without the SSE framing) measured as 0 even when it carried a
+    // real SHORT answer. Count the content strings from the raw body and decode
+    // them, so an escaped quote does not inflate the count.
+    let len = 0;
+    const re = /"type":"RESPONSE"[^}]*?"content":"((?:[^"\\]|\\.)*)"/g;
+    let m;
+    while ((m = re.exec(b)) !== null) {
+        let text = m[1];
+        try {
+            text = JSON.parse('"' + m[1] + '"');
+        }
+        catch { }
+        // A bare truncated head (empty, or a lone `{`/`[`) is not an answer; any
+        // other non-empty text — however short — is.
+        if (!TRUNCATED_HEAD_RE.test(text))
+            len += text.length;
+    }
+    return len;
 }
 // True when the SSE body shows a turn that ENDED (`quasi_status: FINISHED`)
 // but produced NO real answer text — the reasoning (THINK fragment) was
@@ -209,7 +230,7 @@ export function isFinishedWithoutAnswer(body) {
         return false;
     // A RESPONSE fragment with real content means the model DID answer.
     const len = responseContentLength(b);
-    if (len >= MIN_FINISHED_ANSWER_CHARS)
+    if (len >= MIN_REAL_ANSWER_CHARS)
         return false;
     // No RESPONSE fragment at all (len === -1) or only a truncated head:
     // treat the absence of a real answer as "no answer produced".
@@ -234,7 +255,7 @@ export function isFinishedWithAnswer(body) {
     // A truncated RESPONSE head (a lone `{`) is NOT a complete answer: the
     // finish loop would return it as the model's text and the tool-call parser
     // would fail on it. Require real content (see MIN_FINISHED_ANSWER_CHARS).
-    return responseContentLength(b) >= MIN_FINISHED_ANSWER_CHARS;
+    return responseContentLength(b) >= MIN_REAL_ANSWER_CHARS;
 }
 // The CONTEXT size (in tokens) DeepSeek reports for the current answer.
 //

package/dist/permissions.js

@@ -124,6 +124,13 @@ export function decidePermission(policy, tool, args) {
     }
     const paths = collectPathCandidates(tool, args);
     for (const r of policy.rules) {
+        // An UNPARSABLE regex in any field of the rule makes the rule fail
+        // CLOSED: skipping it silently (the old behavior) turned a deny rule with
+        // a typo (`^(Bash$`) into "allow everything it was meant to block".
+        const bad = [r.tool, r.command, r.path].find((src) => src !== undefined && safeRegex(src) === null);
+        if (bad !== undefined) {
+            return { action: 'deny', reason: 'rule has an invalid regex: ' + bad };
+        }
         if (r.tool) {
             const re = safeRegex(r.tool);
             if (!re || !re.test(tool))

package/dist/shell.js

@@ -25,7 +25,12 @@ export function assertCommandInsideRoot(root, command) {
     }
     // `(` and backticks open a subshell / command substitution where a `cd` is
     // still executed; include them in the prefix so the scan sees it.
-    const cdRe = /(?:^|[;&|(\s`])(?:cd|pushd)\s+([^;&|)]+)/gi;
+    //
+    // `\s*` (not `\s+`): a shell accepts `cd` GLUED to its target — `cd..`,
+    // `cd$HOME`, `cd../..` — and runs it as a real directory change. Requiring
+    // whitespace skipped those forms, so a glued `cd../..` walked out of the
+    // root with the guard never firing.
+    const cdRe = /(?:^|[;&|(\s`])(?:cd|pushd)\s*([^;&|)]+)/gi;
     let m;
     while ((m = cdRe.exec(cmd))) {
         const raw = m[1].trim().replace(/^["']|["']$/g, '');
@@ -217,6 +222,22 @@ export function killBackground(id) {
         return `Failed to kill ${id}: ${e.message}`;
     }
     BG_PROCS.delete(id);
+    // SIGTERM is only a REQUEST. A shell that traps it (a wrapper script, a
+    // daemon that cleans up on TERM) ignores the signal, and the old code then
+    // forgot the id and reported "Killed" while the process kept running as an
+    // orphan. Give it a moment, then SIGKILL the group (the shell's own trap
+    // cannot block that). Detached from the caller so killBackground stays sync.
+    const pid = p.child.pid;
+    if (process.platform !== 'win32' && pid) {
+        const t = setTimeout(() => {
+            try {
+                process.kill(-pid, 'SIGKILL');
+            }
+            catch { }
+        }, 1500);
+        if (typeof t.unref === 'function')
+            t.unref();
+    }
     return `Killed background process ${id}.`;
 }
 /** Kill every background process — called on exit so no orphan survives. */

package/dist/tools.js

@@ -71,7 +71,8 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
     const baseTools = [
         {
             name: 'Read',
-            description: 'Read a file. Optional: offset and limit (lines). ' +
+            description: 'Read a file. Optional: offset and limit (lines, BOTH 1-BASED: ' +
+                'offset=5 starts at line 5, limit=10 reads ten lines). ' +
                 'numbered=true adds cat -n style line numbers (1-based) for reference ' +
                 'only — do NOT copy the numbers into Edit old_string. ' +
                 'Lines longer than 2000 chars are truncated. ' +
@@ -117,8 +118,15 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
                 if (content === '')
                     return '(file is empty)';
                 const lines = content.split('\n');
-                const start = offset ?? 0;
-                const end = limit ? start + limit : lines.length;
+                // `offset`/`limit` are 1-BASED, like sed / `git blame -L` and the
+                // `numbered=true` output this tool prints. Treating them as 0-based
+                // array slices silently shifted every window by one line and made
+                // `offset: 1` skip the first line. A non-positive or non-numeric
+                // offset means "from the start".
+                const off = Math.max(1, Math.floor(Number(offset) || 1));
+                const start = off - 1;
+                const lim = Math.floor(Number(limit));
+                const end = Number.isFinite(lim) && lim > 0 ? start + lim : lines.length;
                 const slice = lines.slice(start, end);
                 const clip = (l) => l.length > 2000 ? clipLine(l, 2000) + ' …[line truncated]' : l;
                 if (!numbered)

package/dist/transcript.js

@@ -1,5 +1,8 @@
 import fs from 'fs';
 import path from 'path';
+function transcriptErrorLine(e) {
+    return `transcript: failed to create file: ${e.message}`;
+}
 export class Transcript {
     enabled;
     file;
@@ -17,7 +20,14 @@ export class Transcript {
         try {
             fs.mkdirSync(dir, { recursive: true });
             const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-            this.file = path.join(dir, `${sessionName}-${stamp}.jsonl`);
+            // `sessionName` is the LABEL of the working directory (dirLabel), so a
+            // name like `a/b` or `C:\x` would nest a subdirectory or break the
+            // path outright: the stream then failed with ENOENT and no transcript
+            // at all was written. Keep the name a plain file-name fragment.
+            const safeName = String(sessionName)
+                .replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_')
+                .trim() || 'session';
+            this.file = path.join(dir, `${safeName}-${stamp}.jsonl`);
             this.stream = fs.createWriteStream(this.file, { flags: 'a' });
             // Write errors (disk full, file deleted, etc.) arrive as an 'error'
             // event; without a listener this is an uncaught exception.
@@ -27,10 +37,12 @@ export class Transcript {
             });
         }
         catch (e) {
-            console.error(`transcript: failed to create file: ${e.message}`);
+            console.error(transcriptErrorLine(e));
             this.enabled = false;
         }
     }
+    /** Number of writes that hit backpressure (write() === false). */
+    backpressure = 0;
     log(type, data = {}) {
         const entry = {
             ts: new Date().toISOString(),
@@ -60,8 +72,6 @@ export class Transcript {
         }
         catch { }
     }
-    /** Number of writes that hit backpressure (write() === false). */
-    backpressure = 0;
     // Flush the stream and resolve once the data reached the file. The callers
     // run on process.exit paths (one-shot --task, browser error, clean exit), and
     // end() without awaiting the callback lets the process die before the buffer
@@ -89,6 +99,6 @@ export class Transcript {
             return null;
         return ('transcript: ' +
             this.backpressure +
-            ' write(s) hit backpressure (slow disk?) — events may be delayed');
+            ' write(s) hit backpressure (slow disk?)― events may be delayed');
     }
 }

package/dist/web.js

@@ -38,10 +38,17 @@ export function htmlToText(html) {
     pendingHighSurrogate = null;
     // Remove blocks we don't need
     let s = html
+        // A tag that never CLOSES (a truncated body, or HTML the regex cannot
+        // pair) used to leak its raw JS/CSS into the text: also drop everything
+        // from an unclosed opening tag to the end of the document.
         .replace(/<script[\s\S]*?<\/script>/gi, '')
+        .replace(/<script\b[\s\S]*$/i, '')
         .replace(/<style[\s\S]*?<\/style>/gi, '')
+        .replace(/<style\b[\s\S]*$/i, '')
         .replace(/<noscript[\s\S]*?<\/noscript>/gi, '')
+        .replace(/<noscript\b[\s\S]*$/i, '')
         .replace(/<svg[\s\S]*?<\/svg>/gi, '')
+        .replace(/<svg\b[\s\S]*$/i, '')
         .replace(/<!--[\s\S]*?-->/g, '');
     // Links: <a href="URL">text</a> → text (URL)
     s = s.replace(/<a\b[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, text) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.78.2",
+  "version": "2.78.3",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {