zames_pro 2.82.38 → 2.82.41

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.41] - 2026-10-22
+
+### Fixed
+
+- **telemetry:** accept a stringified blockMs in the average
+
+## [2.82.40] - 2026-10-22
+
+### Fixed
+
+- **transcript:** cap a single logged payload
+
+## [2.82.39] - 2026-10-22
+
+### Fixed
+
+- **config:** do not mask a whitespace-only password
+
 ## [2.82.38] - 2026-10-22
 
 ### Fixed

package/dist/config-commands.js

@@ -26,8 +26,11 @@ export function configListValue(field, value, t) {
 export function configGetValue(path, value, t) {
     if (value === undefined)
         return t('cfg.menu.default');
-    if (/password/i.test(path) && String(value).length > 0)
+    // Mask a real secret, but NOT a whitespace-only one: it cannot log in, and
+    // hiding it makes `/config get` look like a password is configured.
+    if (/password/i.test(path) && String(value).trim().length > 0) {
         return '********';
+    }
     return JSON.stringify(value);
 }
 /**

package/dist/send-telemetry.js

@@ -45,12 +45,12 @@ export function summarizeSends(events, now = Date.now()) {
         const t = Date.parse(e.at);
         return Number.isFinite(t) && now - t <= ms;
     }).length;
+    // `blockMs` may arrive as a NUMBER (the writer) or a string (an older
+    // build, a hand-edited file): a numeric string is accepted so the average
+    // is not silently 0 for a file that records the block.
     const blocks = events
-        .filter((e) => e.outcome === 'rate_limit' &&
-        typeof e.blockMs === 'number' &&
-        Number.isFinite(e.blockMs) &&
-        e.blockMs >= 0)
-        .map((e) => e.blockMs);
+        .map((e) => Number(e.blockMs))
+        .filter((n) => Number.isFinite(n) && n >= 0);
     const avgBlockMs = blocks.length
         ? Math.round(blocks.reduce((a, b) => a + b, 0) / blocks.length)
         : 0;

package/dist/transcript.js

@@ -34,6 +34,8 @@ export function rotateTranscripts(dir, keep = MAX_TRANSCRIPT_FILES) {
 function transcriptErrorLine(e) {
     return `transcript: failed to create file: ${e.message}`;
 }
+/** Hard cap on one transcript line (a single `log` payload). */
+export const TRANSCRIPT_LINE_CAP = 100_000;
 export class Transcript {
     enabled;
     file;
@@ -84,7 +86,19 @@ export class Transcript {
             type,
             ...data,
         };
-        const line = JSON.stringify(entry) + String.fromCharCode(10);
+        let line = JSON.stringify(entry) + String.fromCharCode(10);
+        // One `log` call may carry a tool result, a page dump or a fetched
+        // document; an uncapped line makes the transcript grow by megabytes per
+        // event, and /cost + /export then load it all into memory. Keep the
+        // transcript a LOG: cap each line with a marker (never splitting a
+        // surrogate pair).
+        if (line.length > TRANSCRIPT_LINE_CAP) {
+            let cut = TRANSCRIPT_LINE_CAP - 2;
+            const last = line.charCodeAt(cut - 1);
+            if (last >= 0xd800 && last <= 0xdbff)
+                cut--;
+            line = line.slice(0, cut) + '…' + String.fromCharCode(10);
+        }
         // The mirror runs even when the file is disabled (jsonl mode).
         if (this.onLine) {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.38",
+  "version": "2.82.41",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {