zames_pro 2.82.122 → 2.82.124

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.124] - 2026-10-24
+
+### Fixed
+
+- **mcp:** a schema property named __proto__ becomes a real parameter
+
+## [2.82.123] - 2026-10-24
+
+### Fixed
+
+- **mcp:** a duplicate tool rename does not steal a later tool name
+
 ## [2.82.122] - 2026-10-24
 
 ### Fixed

package/dist/mcp.js

@@ -158,7 +158,11 @@ export async function loadConfigFiles(files) {
 // We also keep the full schema in the tool description, so the model sees
 // descriptions/enums/required fields that the flat map cannot convey.
 export function jsonSchemaToParams(schema) {
-    const out = {};
+    // Property NAMES come from the server and are arbitrary text: assigning to a
+    // plain object, a name like `__proto__` mutates the object's PROTOTYPE and
+    // the parameter silently disappears from the prompt (the same class as the
+    // tool-count maps in /cost). Null-prototype map: every key is an own key.
+    const out = Object.create(null);
     if (!schema || typeof schema !== 'object')
         return out;
     const s = schema;
@@ -337,6 +341,11 @@ export function qualifyToolName(server, tool) {
 // qualifier is not injective (see the call site), hence this guard. Pure;
 // exported for tests.
 export function dedupeToolNames(tools) {
+    // The rename must avoid EVERY name in the list, not only the ones already
+    // visited: a later tool that already owns `<name>_2` (a server's own `x_2`
+    // tool) was renamed itself, and the model's call to `x_2` then reached the
+    // RENAMED DUPLICATE — the wrong tool.
+    const all = new Set(tools.map((t) => t.name));
     const seen = new Set();
     for (const t of tools) {
         if (!seen.has(t.name)) {
@@ -345,12 +354,16 @@ export function dedupeToolNames(tools) {
         }
         let n = 2;
         let candidate = `${t.name}_${n}`;
-        while (seen.has(candidate)) {
+        while (seen.has(candidate) || all.has(candidate)) {
             n++;
             candidate = `${t.name}_${n}`;
         }
+        // The duplicate leaves the pool of ORIGINAL names: its old name belongs to
+        // the first tool of that name.
+        all.delete(t.name);
         t.name = candidate;
         seen.add(candidate);
+        all.add(candidate);
     }
 }
 // Connect to ONE server and return a ready connection (or an error).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.122",
+  "version": "2.82.124",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {