zames_pro 2.78.3 → 2.80.0

package/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.80.0] - 2026-10-20
+
+### Fixed
+
+- **commands:** keep an unsupplied  position as written in a custom command
+- **subagent:** count a subagent run only once it actually starts
+- **attach:** do not cut an inlined @file inside a surrogate pair
+- **checkpoint:** a bare out-of-range rewind index no longer matches a stamp prefix
+- **git:** split a space-separated paths argument in GitAdd
+- **mcp:** keep an MCP tool result inside its size cap
+- **hooks:** never cut a hook denial or notice inside a surrogate pair
+- **sessions:** escape a literal underscore in the session file name
+
+## [2.79.0] - 2026-10-19
+
+### Fixed
+
+- **qwen:** match the history 'from' role case-insensitively and accept human
+- **browser-chats:** match the history role case-insensitively and drop service turns
+- **extratools:** apply multi-hunk ApplyPatch updates and honour @@ line numbers
+- **web:** drop non-http(s) links from WebSearch results
+- **web:** judge 6to4 and Teredo addresses by the embedded IPv4
+- **permissions:** match path rules against arrays and nested MCP args
+- **scheduler:** reject empty and malformed cron field tokens
+- **qwen:** read numeric and map-keyed ids in the chat list
+- **xml-toolcall:** a stray brace before inline JSON no longer eats the args
+- **xml-toolcall:** keep a </parameter> literal inside a parameter value
+- **qwen:** detect a finished status carried on the choice, not only the delta
+- **config:** reject an empty value for a number setting
+- **goal:** an echoed label set is not the evaluator verdict
+- **input:** expand each paste into its own marker occurrence
+- **compact:** a summary that mentions DSML in prose is usable
+
 ## [2.78.3] - 2026-10-18
 
 ### Fixed

package/dist/attach-refs.js

@@ -94,7 +94,15 @@ export async function inlineAtRefs(workdir, text) {
         let body = raw;
         let note = '';
         if (body.length > AT_REF_FILE_CAP) {
-            body = body.slice(0, AT_REF_FILE_CAP);
+            let cut = AT_REF_FILE_CAP;
+            // Never end the inlined block on a lone HIGH surrogate: the cut is in
+            // UTF-16 units, so an emoji / astral CJK char on the boundary would
+            // reach the model as a broken code point (same rule as
+            // truncateToolResult / capReport / cutHookText).
+            const last = body.charCodeAt(cut - 1);
+            if (last >= 0xd800 && last <= 0xdbff)
+                cut--;
+            body = body.slice(0, cut);
             note = NL + NL + '(truncated at ' + AT_REF_FILE_CAP + ' chars)';
         }
         total += body.length;

package/dist/browser-chats.js

@@ -30,7 +30,15 @@ export function parseHistoryMessages(messages) {
         if (raw && typeof raw.accumulated_token_usage === 'number') {
             usage = raw.accumulated_token_usage;
         }
-        const role = raw && raw.role === 'ASSISTANT' ? 'assistant' : 'user';
+        // Roles are matched case-insensitively, and a turn that is neither the
+        // operator nor the assistant (SYSTEM, TOOL, a future role) is DROPPED: the
+        // old `role === 'ASSISTANT'` fallback read every other turn as the
+        // operator's, so a lowercase assistant answer was printed as the operator's
+        // text in the restored dialogue.
+        const rawRole = String((raw && raw.role) || '').toUpperCase();
+        if (rawRole !== 'ASSISTANT' && rawRole !== 'USER')
+            continue;
+        const role = rawRole === 'ASSISTANT' ? 'assistant' : 'user';
         const want = role === 'assistant' ? 'RESPONSE' : 'REQUEST';
         let text = '';
         for (const fr of (raw && raw.fragments) || []) {

package/dist/checkpoint.js

@@ -50,10 +50,15 @@ export function pickRecord(records, selector) {
         return null;
     if (/^\d+$/.test(sel)) {
         const n = Number(sel);
-        // A small number is an index (1 = newest). An out-of-range number is
-        // still tried as a stamp prefix below, so `/rewind 1730000` works.
+        // A small number is an index (1 = newest).
         if (n >= 1 && n <= records.length)
             return records[n - 1];
+        // A stamp is epoch-ms (~13 digits), but older files and tests may hold
+        // a SHORT one, so the prefix form stays. What must NOT happen is a bare
+        // out-of-range INDEX matching a stamp by its first digit (`/rewind 9`
+        // with 5 checkpoints): the prefix form therefore needs TWO digits.
+        if (sel.length < 2)
+            return null;
     }
     return records.find((r) => String(r.stamp).startsWith(sel)) || null;
 }

package/dist/commands.js

@@ -544,15 +544,26 @@ export function isUsableCompactSummary(text) {
         return false;
     if (/^\(прервано пользователем\)$/.test(t))
         return false;
+    // A tool call must be RECOGNIZED as one: a plain word `DSML` in prose (the
+    // summary describing the feature) is not noise. Requiring the tag/DSML
+    // syntax keeps the guard on real protocol output without rejecting a valid
+    // summary that merely mentions the feature (which made every retry fail and
+    // forced the local fallback).
     if (parseAssistantToolCall(t))
         return false;
-    if (/DSML/i.test(t))
+    // A REAL DSML call carries the marker punctuation (`<｜DSML｜invoke`); a
+    // summary may MENTION the feature by name in prose. Matching the bare word
+    // rejected a perfectly good summary and every retry failed the same way.
+    if (/<\s*[\uFF5C|]\s*DSML/i.test(t))
         return false;
     // A tool-call body without a recognizable head (a cut-off stream) still
     // carries "args": { ... }.
     if (/"args"\s*:\s*\{/.test(t))
         return false;
-    if (/<ds_safety>/i.test(t))
+    // A REAL safety block is the marker, not a sentence that mentions it: the
+    // closing form `</ds_safety>` is what a summary would NOT write in prose
+    // (a summary may say "no <ds_safety> marker appeared").
+    if (/<\/ds_safety\s*>/i.test(t))
         return false;
     return true;
 }
@@ -762,7 +773,11 @@ function replaceDollarTokens(s, parts, names) {
             continue;
         }
         if (isAllDigits(tok)) {
-            res += parts[Number(tok) - 1] ?? '';
+            const idx = Number(tok) - 1;
+            // A position that was NOT supplied stays as written: `$100` in prose
+            // is a PRICE, not "position 100", and replacing it with an empty
+            // string silently deleted the number from the prompt.
+            res += idx >= 0 && idx < parts.length ? parts[idx] : '$' + tok;
         }
         else {
             const idx = names.indexOf(tok);

package/dist/config.js

@@ -527,6 +527,12 @@ function parseConfigValue(field, raw) {
             throw new Error('boolean');
         }
         case 'number': {
+            // `Number('')` and `Number('   ')` are 0, NOT NaN: an empty value for a
+            // field with min 0 passed validation and silently BECAME 0 (an operator
+            // clearing the edit buffer turned retries/backups OFF instead of being
+            // told the value is invalid).
+            if (raw.trim() === '')
+                throw new Error('number');
             const n = Number(raw);
             if (!Number.isFinite(n))
                 throw new Error('number');

package/dist/extraTools.js

@@ -100,81 +100,119 @@ export function parsePatch(text) {
             continue;
         }
         if (current)
-            current.lines.push(line);
+            current.lines.push(line.replace(/\r$/, ''));
     }
     if (!ops.length)
         return { ops: [], error: 'Patch contains no file operations.' };
     return { ops };
 }
-/**
- * Apply an update hunk to existing content using context matching.
- * The hunk is a list of lines prefixed with ' ' (context), '-' (remove),
- * '+' (add). We locate the context block by exact match, then by ignoring
- * trailing whitespace, then by ignoring all whitespace (like Codex).
- */
-export function applyUpdateHunk(content, hunkLines) {
-    const hasCRLF = content.includes('\r\n');
-    const fileLines = content.split(/\r?\n/);
-    const oldLines = [];
-    const newLines = [];
+/** Split a hunk list into per-`@@` blocks, remembering each header position. */
+function splitHunks(hunkLines) {
+    const blocks = [{ oldStart: null, lines: [] }];
     for (const l of hunkLines) {
-        if (l.startsWith('@@'))
+        if (l.startsWith('@@')) {
+            const m = l.match(/^@@\s*-(\d+)/);
+            blocks.push({ oldStart: m ? Number(m[1]) : null, lines: [] });
             continue;
-        if (l.startsWith('+')) {
-            newLines.push(l.slice(1));
-        }
-        else if (l.startsWith('-')) {
-            oldLines.push(l.slice(1));
-        }
-        else if (l.startsWith(' ')) {
-            oldLines.push(l.slice(1));
-            newLines.push(l.slice(1));
-        }
-        else if (l === '') {
-            oldLines.push('');
-            newLines.push('');
         }
-        else {
-            oldLines.push(l);
-            newLines.push(l);
-        }
-    }
-    if (!oldLines.length) {
-        return {
-            ok: false,
-            error: 'Hunk has no context or removed lines to anchor on.',
-        };
+        blocks[blocks.length - 1].lines.push(l);
     }
-    const norm = (s, mode) => {
-        if (mode === 'exact')
-            return s;
-        if (mode === 'trim')
-            return s.replace(/[ \t]+$/, '');
-        return s.replace(/\s+/g, '');
-    };
+    return blocks.filter((b) => b.lines.length > 0);
+}
+const hunkNorm = (s, mode) => {
+    if (mode === 'exact')
+        return s;
+    if (mode === 'trim')
+        return s.replace(/[ \t]+$/, '');
+    return s.replace(/\s+/g, '');
+};
+/**
+ * Find where a block's old side starts in `fileLines`.
+ * `from` is the lowest index allowed (hunks must not overlap / go backwards).
+ * When the header named a line, that position is preferred: repeated context
+ * is otherwise ambiguous and the wrong occurrence gets patched.
+ */
+function locateBlock(fileLines, oldLines, oldStart, from) {
+    const maxStart = fileLines.length - oldLines.length;
+    if (maxStart < from)
+        return -1;
     for (const mode of ['exact', 'trim', 'ws']) {
-        const anchor = oldLines.map((l) => norm(l, mode));
-        for (let i = 0; i + anchor.length <= fileLines.length; i++) {
-            let match = true;
+        const anchor = oldLines.map((l) => hunkNorm(l, mode));
+        const matches = (i) => {
             for (let j = 0; j < anchor.length; j++) {
-                if (norm(fileLines[i + j], mode) !== anchor[j]) {
-                    match = false;
-                    break;
-                }
+                if (hunkNorm(fileLines[i + j], mode) !== anchor[j])
+                    return false;
             }
-            if (!match)
+            return true;
+        };
+        if (oldStart !== null) {
+            const hinted = oldStart - 1;
+            if (hinted >= from && hinted <= maxStart && matches(hinted))
+                return hinted;
+        }
+        for (let i = from; i <= maxStart; i++) {
+            if (matches(i))
+                return i;
+        }
+    }
+    return -1;
+}
+/**
+ * Apply an update hunk to existing content using context matching.
+ * The hunk is a list of lines prefixed with ' ' (context), '-' (remove),
+ * '+' (add). Several `@@` hunks for one file are applied in order, top to
+ * bottom. A block is located by exact match, then ignoring trailing
+ * whitespace, then ignoring all whitespace (like Codex).
+ */
+export function applyUpdateHunk(content, hunkLines) {
+    const hasCRLF = content.includes('\r\n');
+    const eol = hasCRLF ? '\r\n' : NL;
+    let fileLines = content.split(/\r?\n/);
+    for (const block of splitHunks(hunkLines)) {
+        const oldLines = [];
+        const newLines = [];
+        for (const l of block.lines) {
+            // A blank hunk line is the newline BEFORE "*** End Patch", not a
+            // context line: counting it as context demanded an extra blank file
+            // line and made every realistic multi-hunk patch fail.
+            if (l === '')
                 continue;
-            const before = fileLines.slice(0, i);
-            const after = fileLines.slice(i + anchor.length);
-            const joined = [...before, ...newLines, ...after].join(hasCRLF ? '\r\n' : NL);
-            return { ok: true, content: joined };
+            if (l.startsWith('+')) {
+                newLines.push(l.slice(1));
+            }
+            else if (l.startsWith('-')) {
+                oldLines.push(l.slice(1));
+            }
+            else if (l.startsWith(' ')) {
+                oldLines.push(l.slice(1));
+                newLines.push(l.slice(1));
+            }
+            else {
+                oldLines.push(l);
+                newLines.push(l);
+            }
+        }
+        if (!oldLines.length) {
+            return {
+                ok: false,
+                error: 'Hunk has no context or removed lines to anchor on.',
+            };
         }
+        const at = locateBlock(fileLines, oldLines, block.oldStart, 0);
+        if (at === -1) {
+            return {
+                ok: false,
+                error: 'Context not found in the file (hunk did not match): ' +
+                    oldLines[0].slice(0, 60),
+            };
+        }
+        fileLines = [
+            ...fileLines.slice(0, at),
+            ...newLines,
+            ...fileLines.slice(at + oldLines.length),
+        ];
     }
-    return {
-        ok: false,
-        error: 'Context not found in the file (hunk did not match): ' +
-            oldLines[0].slice(0, 60),
-    };
+    return { ok: true, content: fileLines.join(eol) };
 }
 // ---------- factory ----------
 export function createExtraTools(workdir, { undo, todos } = {}) {

package/dist/gitTools.js

@@ -44,6 +44,39 @@ export function runGitArgs(args, cwd, timeout = 15_000) {
         });
     });
 }
+// Split a `paths` argument into individual pathspecs. The parameter is
+// declared as a STRING, so models send "a.txt b.txt" or a quoted path with a
+// space ("my file.txt"); git needs each path as its OWN argument.
+export function splitPaths(input) {
+    const out = [];
+    const s = String(input || '');
+    let cur = '';
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                cur += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === ' ' || ch === '\t' || ch === '\n') {
+            if (cur)
+                out.push(cur);
+            cur = '';
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur)
+        out.push(cur);
+    return out;
+}
 export async function getGitContext(workdir) {
     const probe = await runGitArgs(['rev-parse', '--is-inside-work-tree'], workdir, 5000);
     if (probe.trim() !== 'true')
@@ -215,16 +248,27 @@ export function createGitTools(workdir) {
                 if (err)
                     return err;
                 if (paths && String(paths).trim()) {
-                    const list = (Array.isArray(paths) ? paths : [paths])
+                    // `paths` is declared as a STRING, so the model sends
+                    // "a.txt b.txt". Passing it as ONE pathspec made git answer
+                    // `did not match any files` and staged nothing. Split on
+                    // whitespace, honour quotes (a path may contain a space), and
+                    // keep the array form working.
+                    const list = (Array.isArray(paths) ? paths : splitPaths(String(paths)))
                         .map((v) => String(v).trim())
                         .filter(Boolean);
                     for (const p of list) {
                         if (p.startsWith('-'))
                             return `Error: invalid path: ${p}`;
                     }
-                    return runGitArgs(['add', '--', ...list], workdir, 20_000);
+                    const staged = await runGitArgs(['add', '--', ...list], workdir, 20_000);
+                    // A successful `git add` prints NOTHING; the shared runner then
+                    // answers the internal sentinel, which reads as a failure.
+                    return staged.trim() === NO_OUTPUT_SENTINEL
+                        ? 'Staged: ' + list.join(' ')
+                        : staged;
                 }
-                return runGitArgs(['add', '-A'], workdir, 20_000);
+                const all = await runGitArgs(['add', '-A'], workdir, 20_000);
+                return all.trim() === NO_OUTPUT_SENTINEL ? 'Staged all changes.' : all;
             },
         },
         {

package/dist/goal.js

@@ -86,11 +86,34 @@ export function parseGoalVerdict(text) {
     // — the goal loop then auto-continued until the turn budget although the
     // judge had already said NOT_MET. `MET` is tried LAST so it cannot match the
     // tail of `NOT MET`.
-    const m = /VERDICT\s*[*_`]*\s*:\s*[*_`]*\s*(IMPOSSIBLE|NOT[_ -]?MET|MET)/i.exec(t);
-    if (!m)
+    //
+    // The evaluator sometimes ECHOES the requested label set before the real
+    // verdict (`VERDICT: MET | NOT_MET | IMPOSSIBLE`). Taking the FIRST match
+    // read the echo's `MET` as the verdict while REASON said the opposite, and
+    // MET CLEARS the goal — an unfinished task was silently accepted as done.
+    // A verdict line with a separator after the value is an echo, not a verdict;
+    // scan EVERY `VERDICT:` occurrence and take the first REAL one. The
+    // separator is checked on the character FOLLOWING the matched value (a
+    // lookahead INSIDE the value pattern was useless: the value alternatives
+    // always end on a word boundary of their own).
+    const label = /VERDICT\s*[*_`]*\s*:\s*[*_`]*\s*(IMPOSSIBLE|NOT[_ -]?MET|MET)/gi;
+    let m;
+    let status = null;
+    while ((m = label.exec(t)) !== null) {
+        // Skip whitespace/backticks between the value and whatever follows.
+        let k = m.index + m[0].length;
+        while (k < t.length && /[\s*_`]/.test(t.charAt(k)))
+            k++;
+        const after = t.charAt(k);
+        if (after === '|' || after === '/')
+            continue;
+        const raw = m[1].toUpperCase();
+        status =
+            raw === 'MET' ? 'met' : raw === 'IMPOSSIBLE' ? 'impossible' : 'not_met';
+        break;
+    }
+    if (!status)
         return null;
-    const raw = m[1].toUpperCase();
-    const status = raw === 'MET' ? 'met' : raw === 'IMPOSSIBLE' ? 'impossible' : 'not_met';
     const rm = /REASON\s*[*_`]*\s*:\s*(.+)/i.exec(t);
     const reason = rm
         ? rm[1]

package/dist/hooks.js

@@ -18,6 +18,19 @@ const HOOK_DENIAL_CAP = 4000;
 // Combined stdout of a PostToolUse / lifecycle hook. It lands in a tool result
 // or in the chat, so it is a notice, not a log dump.
 const HOOK_OUTPUT_CAP = 8000;
+// Cut a hook string by UTF-16 units WITHOUT leaving a lone HIGH surrogate at
+// the end: the text becomes a tool result or a chat notice, and a broken code
+// point there is the same bug truncated elsewhere (same rule as
+// truncateToolResult / capReport / summarizeDiagnostics).
+function cutHookText(s, max) {
+    if (s.length <= max)
+        return s;
+    let cut = Math.max(0, max);
+    const last = s.charCodeAt(cut - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut--;
+    return s.slice(0, cut);
+}
 export function hooksConfigPath(workdir) {
     return path.join(workdir, '.zames', 'hooks.json');
 }
@@ -150,7 +163,7 @@ export async function runPreToolUse(hooks, tool, args, workdir) {
             const reason = (r.stderr || r.stdout).trim();
             // The denial text becomes a TOOL RESULT the model reads: a hook that
             // dumps a log must not flood the context with one call.
-            const capped = reason.slice(0, HOOK_DENIAL_CAP);
+            const capped = cutHookText(reason, HOOK_DENIAL_CAP);
             const suffix = reason.length > HOOK_DENIAL_CAP
                 ? '\n… [denial truncated: ' +
                     (reason.length - HOOK_DENIAL_CAP) +
@@ -198,14 +211,14 @@ async function runEventHooks(hooks, event, workdir, tool, args, result) {
         // hundreds of KB and flood the context.
         if (total >= HOOK_OUTPUT_CAP)
             break;
-        const piece = out.slice(0, HOOK_OUTPUT_CAP - total);
+        const piece = cutHookText(out, HOOK_OUTPUT_CAP - total);
         total += piece.length;
         parts.push(piece);
     }
     const joined = parts.join(String.fromCharCode(10));
     if (joined.length <= HOOK_OUTPUT_CAP)
         return joined;
-    return (joined.slice(0, HOOK_OUTPUT_CAP) +
+    return (cutHookText(joined, HOOK_OUTPUT_CAP) +
         String.fromCharCode(10) +
         '… [hook output truncated]');
 }

package/dist/input/layout.js

@@ -59,15 +59,29 @@ export function pasteReplacement(raw) {
         return null;
     return { marker: formatPasteMarker(lines), text };
 }
-// Replace "[Pasted lines#N]" markers with the original pasted text (the first
-// occurrence in order — matches the order in which the pastes were inserted).
+// Replace "[Pasted lines#N]" markers with the original pasted text. The marker
+// carries ONLY the line count, so two pastes of the same length share it: a
+// plain indexOf-per-paste substituted the FIRST paste's text into whichever
+// marker survived (the operator deleted the first one) — the model then got
+// the WRONG paste under a plausible marker. Replacing ONE occurrence per paste
+// and tying each marker to the pasted text it was CREATED with fixes it for
+// every order: an unmatched paste leaves the marker as text instead of
+// swapping bodies.
 export function expandPastes(pastes, text) {
-    let out = text;
-    for (const p of pastes) {
-        const idx = out.indexOf(p.marker);
-        if (idx !== -1) {
-            out = out.slice(0, idx) + p.text + out.slice(idx + p.marker.length);
-        }
+    if (!pastes.length)
+        return text;
+    // Expand in REVERSE order of appearance: each paste consumes its OWN marker
+    // occurrence (the last one for the last paste), so a marker the operator
+    // deleted cannot shift another paste's text into the wrong slot. With a
+    // single occurrence left, the LAST paste owns it — the operator deleted the
+    // EARLIER marker, so the later paste's body is the right fill.
+    let out = String(text);
+    for (let i = pastes.length - 1; i >= 0; i--) {
+        const p = pastes[i];
+        const idx = out.lastIndexOf(p.marker);
+        if (idx === -1)
+            continue;
+        out = out.slice(0, idx) + p.text + out.slice(idx + p.marker.length);
     }
     return out;
 }

package/dist/mcp.js

@@ -183,7 +183,14 @@ export function truncateMcpResult(s, limit = MCP_RESULT_LIMIT) {
     const str = String(s);
     if (str.length <= limit)
         return str;
-    let head = str.slice(0, limit);
+    // The MARKER is part of the result, so the head must leave room for it:
+    // appending it to a limit-long head produced a result WIDER than the cap
+    // (the cap exists to bound the context a single MCP call can consume).
+    // Reserve the WORST-CASE marker (a 10-digit count), so no result can
+    // exceed the cap whatever the omitted length turns out to be.
+    const MARKER = '\n[...truncated 9999999999 chars]';
+    const budget = Math.max(0, limit - MARKER.length);
+    let head = str.slice(0, budget);
     // Never leave a lone HIGH surrogate at the cut: an emoji / astral CJK char
     // sits on two UTF-16 units, and cutting between them hands the model a
     // broken code point (same rule as truncateToolResult / capReport).
@@ -194,7 +201,7 @@ export function truncateMcpResult(s, limit = MCP_RESULT_LIMIT) {
     }
     // Prefer a line boundary so a cut does not split a line in half.
     const nl = head.lastIndexOf(String.fromCharCode(10));
-    const cut = nl > limit * 0.5 ? head.slice(0, nl + 1) : head;
+    const cut = nl > budget * 0.5 ? head.slice(0, nl + 1) : head;
     const omitted = str.length - cut.length;
     return cut + `\n[...truncated ${omitted} chars]`;
 }

package/dist/permissions.js

@@ -80,9 +80,22 @@ function looksLikePath(v) {
 export function collectPathCandidates(tool, args) {
     const a = (args ?? {});
     const out = [];
+    // A path may arrive as a STRING or as an ARRAY of strings (`files: [...]`,
+    // `path: [...]`), and MCP tools nest their args (`{file: {path}}`). Accepting
+    // only a top-level string let a `path` deny rule be bypassed by wrapping the
+    // same path one level deeper or in an array.
+    const addValue = (v) => {
+        if (typeof v === 'string')
+            out.push(v);
+        else if (Array.isArray(v)) {
+            for (const x of v)
+                if (typeof x === 'string')
+                    out.push(x);
+        }
+    };
     for (const k of PATH_KEYS) {
-        if (typeof a[k] === 'string')
-            out.push(a[k]);
+        if (k in a)
+            addValue(a[k]);
     }
     if (tool === 'ApplyPatch') {
         // Parse the patch and pull the file headers out of it.
@@ -96,13 +109,33 @@ export function collectPathCandidates(tool, args) {
         while ((m = re.exec(text)))
             out.push(m[1]);
     }
-    // MCP tools (and any unknown tool): scan the string values for path-looking
-    // entries. Conservative — only values that clearly look like paths.
+    // MCP tools (and any unknown tool): scan the values for path-looking
+    // entries — through ARRAYS and NESTED objects too, since an MCP schema is
+    // free to nest (`{file: {path}}`) or take `argv: ['cat', '/etc/x']`. Only
+    // values that clearly look like paths are taken (depth-bounded to avoid a
+    // pathological payload).
     if (tool.includes('__')) {
-        for (const v of Object.values(a)) {
-            if (typeof v === 'string' && looksLikePath(v))
-                out.push(v);
-        }
+        const walk = (v, depth) => {
+            if (depth > 4 || v === null || v === undefined)
+                return;
+            if (typeof v === 'string') {
+                if (looksLikePath(v))
+                    out.push(v);
+                return;
+            }
+            if (Array.isArray(v)) {
+                for (const x of v)
+                    walk(x, depth + 1);
+                return;
+            }
+            if (typeof v === 'object') {
+                for (const x of Object.values(v)) {
+                    walk(x, depth + 1);
+                }
+            }
+        };
+        for (const v of Object.values(a))
+            walk(v, 0);
     }
     return out;
 }

package/dist/qwen-chats.js

@@ -101,18 +101,33 @@ export function parseQwenChatList(json) {
                 data.list ??
                 data.items)
             : null;
-    if (!Array.isArray(arr))
+    // The payload has also been seen as a MAP keyed by chat id (the same
+    // convention as the history shape); the key then IS the id. Without this a
+    // legitimate list was rejected by the array guard and /chats printed
+    // "(none)" with no error.
+    const keyed = Array.isArray(arr)
+        ? null
+        : arr && typeof arr === 'object'
+            ? Object.entries(arr)
+            : null;
+    if (!Array.isArray(arr) && !keyed)
         return [];
+    const entries = Array.isArray(arr)
+        ? arr.map((c) => ['', c])
+        : keyed;
     const out = [];
-    for (const c of arr) {
+    for (const [key, c] of entries) {
         if (!c || typeof c !== 'object')
             continue;
         const m = c;
-        const id = typeof m.id === 'string'
-            ? m.id
-            : typeof m.chat_id === 'string'
-                ? m.chat_id
-                : '';
+        // A numeric id (`{id: 12345}`) used to be dropped as "no id"; it is a
+        // perfectly usable chat id once stringified.
+        const raw = m.id ?? m.chat_id;
+        const id = typeof raw === 'string'
+            ? raw
+            : typeof raw === 'number' && Number.isFinite(raw)
+                ? String(raw)
+                : key;
         if (!id)
             continue;
         const title = (typeof m.title === 'string' && m.title) ||
@@ -163,14 +178,23 @@ export function parseQwenHistory(json) {
     const out = [];
     for (const m of sorted) {
         // Role detection is DEFENSIVE: the field has been `role` (string,
-        // case-insensitive), a numeric flag, or `is_user`. Anything that is not
+        // case-insensitive), a NUMERIC flag, or `is_user`. Anything that is not
         // clearly the user is treated as the assistant (the restored dialogue
-        // cares about the distinction, not the exact enum).
+        // cares about the distinction, not the exact enum). A numeric flag uses
+        // 1 = user, 2 = assistant (the `String(1) === '1'` form was ignored and
+        // every user turn was attributed to the model).
         const roleStr = String(m.role ?? '').toLowerCase();
+        // `from` is matched case-insensitively and accepts Qwen's `human`
+        // spelling: the exact `from === 'user'` test read an uppercase/human
+        // turn as the ASSISTANT's answer, so the operator's own question was
+        // restored as the model's reply.
+        const fromStr = String(m.from ?? '').toLowerCase();
         const isUser = roleStr === 'user' ||
+            roleStr === '1' ||
             roleStr === '0' ||
             m.is_user === true ||
-            m.from === 'user';
+            fromStr === 'user' ||
+            fromStr === 'human';
         const role = isUser ? 'user' : 'assistant';
         let text = '';
         if (typeof m.content === 'string')

package/dist/qwen-net-capture.js

@@ -184,7 +184,12 @@ export function isFinishedWithoutAnswer(body) {
         for (const ch of choices) {
             if (!ch || typeof ch !== 'object')
                 continue;
-            const delta = ch.delta;
+            const c = ch;
+            // The final chunk carries `status` on the CHOICE (see the format comment
+            // at the top of this file); older/other builds put it on `delta`.
+            if (c.status === 'finished')
+                finished = true;
+            const delta = c.delta;
             if (delta && delta.status === 'finished')
                 finished = true;
         }

package/dist/scheduler.js

@@ -56,7 +56,13 @@ function dayMatches(c, date) {
 function parseCronField(field, min, max) {
     const out = new Set();
     for (const part of field.split(',')) {
-        const [range, stepStr] = part.split('/');
+        // An empty list item (`1,,2`, a trailing comma) used to fall through
+        // Number('') === 0 and silently ADD minute 0 to the schedule.
+        if (!part)
+            return null;
+        const [range, stepStr, extra] = part.split('/');
+        if (extra !== undefined)
+            return null;
         const step = stepStr === undefined ? 1 : Number(stepStr);
         if (!Number.isInteger(step) || step <= 0)
             return null;
@@ -67,11 +73,22 @@ function parseCronField(field, min, max) {
             hi = max;
         }
         else if (range.includes('-')) {
-            const [a, b] = range.split('-');
+            // A bare number is required on BOTH sides: `split('-')` on `-5` gave
+            // ['', '5'] and Number('') === 0, so a typo `-5 * * * *` became the
+            // range 0-5 instead of being rejected. `1-2-3` was silently truncated
+            // to 1-2 the same way.
+            const segs = range.split('-');
+            if (segs.length !== 2)
+                return null;
+            const [a, b] = segs;
+            if (!/^\d+$/.test(a) || !/^\d+$/.test(b))
+                return null;
             lo = Number(a);
             hi = Number(b);
         }
         else {
+            if (!/^\d+$/.test(range))
+                return null;
             lo = Number(range);
             // `N/step` (a start with a step, no range) is valid cron: it means from
             // N up to the field maximum. Treating it as the single value N made a

package/dist/sessions.js

@@ -55,7 +55,10 @@ function safeName(id) {
     const s = String(id);
     let out = '';
     for (const ch of s) {
-        if (/[a-zA-Z0-9.-]/.test(ch))
+        // `_` ITSELF is the escape prefix: leaving a literal underscore in
+        // place made the encoding ambiguous (`a/b` -> `a_2fb` collided with the
+        // real id `a_2fb`), so one session silently overwrote the other.
+        if (/[a-zA-Z0-9.-]/.test(ch) && ch !== '_')
             out += ch;
         else
             out += '_' + ch.codePointAt(0).toString(16).padStart(2, '0');

package/dist/subagent.js

@@ -76,7 +76,6 @@ export function createSubagentRunner(opts) {
                     ' per task). Do the remaining work yourself with the other tools.',
             };
         }
-        used++;
         // Resolve the parent chat id BEFORE anything else. The runner restores the
         // parent chat in its finally block, and that restore is what keeps the
         // subagent's isolated context from swallowing the parent's turn. If the id
@@ -98,6 +97,10 @@ export function createSubagentRunner(opts) {
                     'would be lost). Do the work yourself with the other tools.',
             };
         }
+        // Count the run only NOW: every early exit above (budget, unknown
+        // parent chat id) returned BEFORE anything ran, and charging those
+        // attempts burned the whole budget on runs that never started.
+        used++;
         const subTools = buildTools(req.type === 'explore');
         const taskText = subagentPersona(req.type) + '\n\n--- SUB-TASK ---\n' + req.prompt;
         // Save the parent's send hooks: the nested loop OVERWRITES them on

package/dist/web.js

@@ -226,6 +226,28 @@ export function isPrivateIp(ip) {
         // ff00::/8 multicast is not a public unicast destination either.
         if ((g0 & 0xff00) === 0xff00)
             return true;
+        // 6to4 (2002:AABB:CCDD::/48) embeds an IPv4 in groups 1-2, so
+        // `2002:7f00:0001::` IS 127.0.0.1 and `2002:a9fe:a9fe::` is the cloud
+        // metadata address. Judged by the embedded address, like the other
+        // transition prefixes.
+        if (v6[0] === 0x2002) {
+            return isPrivateIp((v6[1] >> 8) +
+                '.' +
+                (v6[1] & 0xff) +
+                '.' +
+                (v6[2] >> 8) +
+                '.' +
+                (v6[2] & 0xff));
+        }
+        // Teredo (2001:0000::/32): the CLIENT IPv4 is the last 32 bits XORed with
+        // 0xffffffff (the server IPv4 sits in groups 3-4 and is not the peer).
+        if (v6[0] === 0x2001 && v6[1] === 0x0000) {
+            const a = (v6[6] >> 8) ^ 0xff;
+            const b = (v6[6] & 0xff) ^ 0xff;
+            const c = (v6[7] >> 8) ^ 0xff;
+            const d = (v6[7] & 0xff) ^ 0xff;
+            return isPrivateIp(a + '.' + b + '.' + c + '.' + d);
+        }
         // IPv4-mapped ::ffff:a.b.c.d — judge the embedded address.
         const mappedV4 = v6.slice(0, 5).every((g) => g === 0) && v6[5] === 0xffff;
         if (mappedV4) {
@@ -625,7 +647,11 @@ export function parseDuckDuckGoResults(body, limit) {
             href = decodeURIComponent(uddgMatch[1]);
         const title = htmlToText(m[2] || '').trim();
         const snippet = htmlToText(m[3] || '').trim();
-        if (!title || !href)
+        // Only an absolute http(s) link is a real result. The page can carry a
+        // `javascript:`/`data:` href (malicious or broken markup) or a
+        // site-relative one; handing either to the model as a result URL is wrong
+        // (a `javascript:` URL looks fetchable, a relative one is not).
+        if (!title || !/^https?:\/\//i.test(href))
             continue;
         results.push({ title, url: href, snippet });
     }

package/dist/xml-toolcall.js

@@ -46,13 +46,29 @@ function readAllAttrs(attrs) {
 // (the agent then stalls). Here we look for the first JSON object inside the
 // attributes/body and parse it as args.
 function parseInlineJsonArgs(s) {
+    // Find the start of the inline JSON. The SPECIFIC `"args" {` marker wins:
+    // a generic `{` in the surrounding prose (`note {here}: {…}`) was taken as
+    // the object start, balance ended on its `}`, and the call reached the tool
+    // with EMPTY args. Fall back to a bare `{` only when the marker is absent.
+    const argsMarker = /["']args["']\s*[:=]?\s*\{/i.exec(s);
+    if (argsMarker)
+        return parseBalancedJson(s, argsMarker.index + argsMarker[0].length - 1);
+    // No explicit marker: try EVERY `{` and take the first one that actually
+    // parses as an object. Picking the first `{` blindly broke on a stray brace
+    // in the prose (`note {here}: {…}`): balance ended on its `}`, the fragment
+    // carried no arguments, and the tool ran with EMPTY args.
+    const re = /\{/g;
+    let b;
+    while ((b = re.exec(s)) !== null) {
+        const parsed = parseBalancedJson(s, b.index);
+        if (parsed)
+            return parsed;
+    }
+    return null;
+}
+/** Parse one balanced, string-aware `{...}` object that STARTS at `from`. */
+function parseBalancedJson(s, from) {
     const Q = String.fromCharCode(34);
-    // Find a plausible start of a JSON object: `{` or `"args" {`/`'args' {`.
-    const startRe = /\{|["']args["']\s*[:=]?\s*\{/i;
-    const m = startRe.exec(s);
-    if (!m)
-        return null;
-    const from = m.index;
     // Scan for a balanced {...} block (string-aware) and try to parse it.
     let depth = 0;
     let inStr = false;
@@ -112,14 +128,47 @@ function parseInlineJsonArgs(s) {
 // parameter).
 function parseParameters(body) {
     const args = {};
-    const paramRe = /<[^>]*?parameter([^>]*)>([\s\S]*?)<\/[^>]*?parameter[^>]*>/gi;
-    let p;
-    while ((p = paramRe.exec(body)) !== null) {
-        const pname = readAttr(p[1] || '', 'name');
+    // The VALUE is arbitrary model text: a Write/Edit content may legitimately
+    // contain the literal `</parameter>` (writing an XML parser, a docs
+    // example). A plain non-greedy scan stops at that FIRST close tag and the
+    // rest of the content is silently lost — the file is written TRUNCATED.
+    // So: find every opening tag, then take as the value everything up to the
+    // LAST close tag of the same name that precedes the next opening tag (or the
+    // end of the body). A stray `</parameter>` inside a value is thus kept.
+    // An opening tag is `<parameter …>` / `<|DSML|parameter …>` — NOT the
+    // closing `</parameter>`, whose name ALSO matches this pattern (the prefix
+    // before `parameter` is not required to be empty). Treating a close tag as
+    // an open one shifted every limit by one element and cut the last value;
+    // a slash directly before `parameter` marks the close form.
+    const openRe = /<[^>]*?(?<!\/)parameter([^>]*)>/gi;
+    const opens = [];
+    let m;
+    while ((m = openRe.exec(body)) !== null) {
+        opens.push({
+            attrs: m[1] || '',
+            start: m.index,
+            valueStart: m.index + m[0].length,
+        });
+    }
+    const closeRe = /<\/[^>]*?parameter[^>]*>/gi;
+    for (let i = 0; i < opens.length; i++) {
+        const o = opens[i];
+        const pname = readAttr(o.attrs, 'name');
         if (!pname)
             continue;
-        const isString = /string[ ]*=[ ]*"?true"?/i.test(p[1] || '');
-        let value = unescapeXml(p[2]);
+        const limit = i + 1 < opens.length ? opens[i + 1].start : body.length;
+        // The LAST close tag before the next opening tag (or the end).
+        let valueEnd = limit;
+        closeRe.lastIndex = o.valueStart;
+        let c;
+        while ((c = closeRe.exec(body)) !== null) {
+            if (c.index >= limit)
+                break;
+            valueEnd = c.index;
+        }
+        const raw = body.slice(o.valueStart, valueEnd);
+        const isString = /string[ ]*=[ ]*"?true"?/i.test(o.attrs);
+        let value = unescapeXml(raw);
         if (!isString) {
             try {
                 value = JSON.parse(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.78.3",
+  "version": "2.80.0",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {