zames_pro 2.82.37 → 2.82.40

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.40] - 2026-10-22
+
+### Fixed
+
+- **transcript:** cap a single logged payload
+
+## [2.82.39] - 2026-10-22
+
+### Fixed
+
+- **config:** do not mask a whitespace-only password
+
+## [2.82.38] - 2026-10-22
+
+### Fixed
+
+- **config:** dispatch /config subcommands after the command name
+
 ## [2.82.37] - 2026-10-22
 
 ### Fixed

package/dist/config-command.js

@@ -17,10 +17,17 @@ import { configGetValue, configValueHint } from './config-commands.js';
 export async function handleConfigCommand(input, deps) {
     const { t, print, printErr, getValue, setValue, resetField, showList, openMenu, currentLocale, normalizeLocale, localeDisplayName, homeConfigPath, projectConfigPath, } = deps;
     const schema = deps.schema;
-    const parts = input.trim().split(/\s+/);
+    // Accept BOTH spellings: the main loop passes the whole typed line
+    // (`/config get ui.locale`), while tests and other callers pass the text
+    // after the command (`get ui.locale`). Reading parts[1] blindly made the
+    // second form treat `get` as the subcommand.
+    const all = input.trim().split(/\s+/).filter(Boolean);
+    const parts = /^\/config(\s|$)/i.test(input.trim())
+        ? all
+        : ['/config', ...all];
     const sub = (parts[1] || '').toLowerCase();
     // With no subcommand - the menu (or a text list in non-TTY).
-    if (!sub || sub === 'menu' || sub === 'ui') {
+    if (!sub || sub === 'menu') {
         await openMenu();
         return;
     }

package/dist/config-commands.js

@@ -26,8 +26,11 @@ export function configListValue(field, value, t) {
 export function configGetValue(path, value, t) {
     if (value === undefined)
         return t('cfg.menu.default');
-    if (/password/i.test(path) && String(value).length > 0)
+    // Mask a real secret, but NOT a whitespace-only one: it cannot log in, and
+    // hiding it makes `/config get` look like a password is configured.
+    if (/password/i.test(path) && String(value).trim().length > 0) {
         return '********';
+    }
     return JSON.stringify(value);
 }
 /**

package/dist/transcript.js

@@ -34,6 +34,8 @@ export function rotateTranscripts(dir, keep = MAX_TRANSCRIPT_FILES) {
 function transcriptErrorLine(e) {
     return `transcript: failed to create file: ${e.message}`;
 }
+/** Hard cap on one transcript line (a single `log` payload). */
+export const TRANSCRIPT_LINE_CAP = 100_000;
 export class Transcript {
     enabled;
     file;
@@ -84,7 +86,19 @@ export class Transcript {
             type,
             ...data,
         };
-        const line = JSON.stringify(entry) + String.fromCharCode(10);
+        let line = JSON.stringify(entry) + String.fromCharCode(10);
+        // One `log` call may carry a tool result, a page dump or a fetched
+        // document; an uncapped line makes the transcript grow by megabytes per
+        // event, and /cost + /export then load it all into memory. Keep the
+        // transcript a LOG: cap each line with a marker (never splitting a
+        // surrogate pair).
+        if (line.length > TRANSCRIPT_LINE_CAP) {
+            let cut = TRANSCRIPT_LINE_CAP - 2;
+            const last = line.charCodeAt(cut - 1);
+            if (last >= 0xd800 && last <= 0xdbff)
+                cut--;
+            line = line.slice(0, cut) + '…' + String.fromCharCode(10);
+        }
         // The mirror runs even when the file is disabled (jsonl mode).
         if (this.onLine) {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.37",
+  "version": "2.82.40",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {