zames_pro 2.82.49 → 2.82.50

package/dist/index.js

@@ -47,6 +47,13 @@ import { askOperatorConfirm, } from './run-task.js';
 import { closeWeb } from './web.js';
 import { assertCommandInsideRoot, runShell, killAllBackground, } from './shell.js';
 import { saveSession, loadLastSession, readSession, listSessions, sessionsDir, loadHistory, saveHistory, isInternalChat, } from './sessions.js';
+import { parseModelIntent, emptyModelListMessage } from './model-command.js';
+import { parseResumeId, filterSessions, resumeProviderRefusal, } from './resume-command.js';
+import { formatLimits, limitsEmptyMessage } from './limits-command.js';
+import { renderContextReport } from './context-command.js';
+import { renderQueueView } from './queue-command.js';
+import { parseProviderIntent, providerUsageMessage, } from './provider-command.js';
+import { formatStatus } from './status-command.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const NL = String.fromCharCode(10);
 // The last final assistant message, for the /copy command. Module-level
@@ -1735,19 +1742,18 @@ async function main() {
             if (ed.busy) {
                 const q = mod.commands.parseQueueCommand(text);
                 if (q) {
-                    if (q.sub === 'clear') {
-                        const n = pendingQueue.length;
+                    const view = renderQueueView(q.sub, pendingQueue.length, pendingQueue);
+                    if (view.kind === 'cleared') {
                         pendingQueue.length = 0;
-                        ed.printAbove(theme.system(t('msg.queue_cleared') + ' (' + n + ')'));
+                        ed.printAbove(theme.system(t('msg.queue_cleared') + ' (' + view.n + ')'));
                     }
-                    else if (!pendingQueue.length) {
+                    else if (view.kind === 'empty') {
                         ed.printAbove(theme.dim(t('msg.queue_empty')));
                     }
-                    else {
+                    else if (view.kind === 'list') {
                         ed.printAbove(theme.system(t('msg.queue_title')));
-                        for (const line of mod.commands.formatQueueList(pendingQueue)) {
+                        for (const line of view.lines)
                             ed.printAbove(theme.assistant(line));
-                        }
                         ed.printAbove(theme.dim(t('msg.queue_cleared_hint')));
                     }
                     return;
@@ -2616,8 +2622,8 @@ async function main() {
             continue;
         }
         if (lower === '/provider' || lower.startsWith('/provider ')) {
-            const arg = trimmed.slice('/provider'.length).trim().toLowerCase();
-            if (!arg || arg === 'status') {
+            const intent = parseProviderIntent(trimmed.slice('/provider'.length), config.provider);
+            if (intent.kind === 'status') {
                 const model = providerModelOf(config.provider) || '(default)';
                 console.log(theme.system(t('provider.status', {
                     v: config.provider,
@@ -2626,7 +2632,7 @@ async function main() {
                 })));
                 continue;
             }
-            if (arg === 'login') {
+            if (intent.kind === 'login') {
                 try {
                     await browser.waitForLogin();
                     console.log(theme.system(t('provider.login_done')));
@@ -2636,9 +2642,10 @@ async function main() {
                 }
                 continue;
             }
-            if (isProviderId(arg)) {
+            if (intent.kind === 'switch') {
+                const arg = intent.provider;
                 const from = config.provider;
-                if (arg === from) {
+                if (intent.same) {
                     console.log(theme.system(t('provider.switched', { v: arg })));
                     continue;
                 }
@@ -2780,7 +2787,7 @@ async function main() {
                 }
                 continue;
             }
-            console.error(theme.warn(t('provider.usage', { providers: PROVIDER_IDS.join('|') })));
+            console.error(theme.warn(providerUsageMessage(t)));
             continue;
         }
         if (lower === '/model' || lower.startsWith('/model ')) {
@@ -2788,10 +2795,9 @@ async function main() {
             // `/model` is available to ANY provider that exposes a model picker
             // (Qwen, GLM). DeepSeek has none, so the command is hidden from the
             // hints there and only explains itself when typed by hand.
-            if (!providerHasModelPicker(config.provider)) {
-                console.log(theme.system(t('model.unsupported', {
-                    provider: providerLabel(config.provider),
-                })));
+            const intent = parseModelIntent(config.provider, arg, t);
+            if (intent.kind === 'unsupported') {
+                console.log(theme.system(intent.message));
                 continue;
             }
             const section = providerConfigSection(config.provider);
@@ -2800,10 +2806,10 @@ async function main() {
                 continue;
             const curModel = String(sectionObj.model || '');
             const qb = browser;
-            if (!arg) {
+            if (intent.kind === 'list') {
                 const models = qb.listModels ? await qb.listModels() : [];
                 if (!models.length) {
-                    console.log(theme.system(t('model.list', { v: '(none)' })));
+                    console.log(theme.system(emptyModelListMessage(t)));
                     continue;
                 }
                 // In the TUI, open a proper SELECT LIST instead of dumping text.
@@ -2862,10 +2868,10 @@ async function main() {
                 console.log(theme.system(t('model.list', { v: lines })));
                 continue;
             }
-            sectionObj.model = arg;
+            sectionObj.model = intent.model;
             if (typeof qb.model === 'string')
-                qb.model = arg;
-            applyModelContextLimit(arg);
+                qb.model = intent.model;
+            applyModelContextLimit(intent.model);
             if (editor) {
                 editor.setContextLimit(effectiveContextLimit());
                 editor.refreshStatus();
@@ -2874,7 +2880,10 @@ async function main() {
                 writeConfigValue('home', section + '.model', arg);
             }
             catch { }
-            console.log(theme.system(t('model.set', { provider: providerLabel(config.provider), v: arg })));
+            console.log(theme.system(t('model.set', {
+                provider: providerLabel(config.provider),
+                v: intent.model,
+            })));
             continue;
         }
         if (lower === '/chat') {
@@ -2898,9 +2907,7 @@ async function main() {
                 .toLowerCase();
             // /sessions <query> filters by title or workdir (substring). Sorted by
             // recency already (listSessions).
-            const all = listSessions().filter((s) => !filter ||
-                (s.title || '').toLowerCase().includes(filter) ||
-                (s.workdir || '').toLowerCase().includes(filter));
+            const all = filterSessions(listSessions(), filter);
             console.log(theme.system(t('sessions.dir', { v: sessionsDir() })));
             if (!all.length) {
                 console.log(theme.system(t('sessions.none')));
@@ -2961,11 +2968,19 @@ async function main() {
             continue;
         }
         if (lower.startsWith('/resume-id ')) {
-            const id = trimmed.slice('/resume-id'.length).trim();
+            const id = parseResumeId(trimmed.slice('/resume-id'.length));
             if (!id) {
                 console.error(theme.error(t('sessions.resume_id_usage')));
                 continue;
             }
+            // A chat id only exists on the backend that created it, so opening a
+            // session saved by ANOTHER provider fails deep inside the browser with a
+            // confusing error. Refuse up front and name the right /provider command.
+            const refusal = resumeProviderRefusal(readSession(id), config.provider, t);
+            if (refusal) {
+                console.error(theme.error(refusal));
+                continue;
+            }
             if (editor)
                 editor.lock(t('msg.input_locked'));
             try {
@@ -3121,24 +3136,23 @@ async function main() {
         }
         if (lower === '/queue' || lower.startsWith('/queue ')) {
             const q = mod.commands.parseQueueCommand(trimmed);
-            if (!q) {
+            const view = renderQueueView(q ? q.sub : null, pendingQueue.length, pendingQueue);
+            if (view.kind === 'usage') {
                 console.error(theme.error(t('msg.queue_usage')));
                 continue;
             }
-            if (q.sub === 'clear') {
-                const n = pendingQueue.length;
+            if (view.kind === 'cleared') {
                 pendingQueue.length = 0;
-                console.log(theme.system(t('msg.queue_cleared') + ' (' + n + ')'));
+                console.log(theme.system(t('msg.queue_cleared') + ' (' + view.n + ')'));
                 continue;
             }
-            if (!pendingQueue.length) {
+            if (view.kind === 'empty') {
                 console.log(theme.dim(t('msg.queue_empty')));
                 continue;
             }
             console.log(theme.system(t('msg.queue_title')));
-            for (const line of mod.commands.formatQueueList(pendingQueue)) {
+            for (const line of view.lines)
                 console.log(theme.assistant(line));
-            }
             console.log(theme.dim(t('msg.queue_cleared_hint')));
             continue;
         }
@@ -3388,51 +3402,32 @@ async function main() {
             continue;
         }
         if (lower === '/status') {
-            const yes = t('common.yes');
-            const no = t('common.no');
-            console.log(theme.system(t('status.workdir', { v: currentWorkdir })));
-            console.log(theme.system(t('status.review_mode', {
-                v: reviewMode ? reviewMode.snapName : t('status.review_none'),
-            })));
-            if (reviewMode) {
-                console.log(theme.system(t('status.orig_dir', { v: reviewMode.originalWorkdir })));
-            }
-            console.log(theme.system(t('status.chat', { v: currentChatId || t('common.none') })));
-            console.log(theme.system(t('status.fresh_next', { v: freshChatNext ? yes : no })));
-            console.log(theme.system(t('status.prompt_next', { v: sendSystemPromptNext ? yes : no })));
-            console.log(theme.system(t('status.last_chat', {
-                v: loadLastChat(currentWorkdir) || t('common.none'),
-            })));
-            console.log(theme.system(t('status.sessions', { v: sessionsDir() })));
-            console.log(theme.system(t('status.dev', {
-                v: devMode ? t('common.on') : t('common.off'),
-            })));
-            console.log(theme.system(t('status.max_iter', { v: currentMaxIter() })));
-            console.log(theme.system(t('status.headless', { v: headless ? yes : no })));
-            console.log(theme.system(t('status.debug', { v: debug ? yes : no })));
             const statusToggles = browser.getToggleStatesSync();
-            console.log(theme.system(t('status.toggles', {
-                think: statusToggles.deepThinking ? yes : no,
-                search: statusToggles.webSearch ? yes : no,
-            })));
-            console.log(theme.system(t('status.undo', {
-                v: config.undo.enabled ? t('common.on') : t('common.off'),
-            })));
-            console.log(theme.system(t('status.checkpoint', {
-                v: config.checkpoint.enabled ? t('common.on') : t('common.off'),
-            })));
-            console.log(theme.system(t('status.transcript', {
-                v: transcript.file || t('common.off'),
-            })));
-            console.log(theme.system(t('status.goal', { v: sessionGoal || t('common.none') })));
-            console.log(theme.system(t('status.locale', { v: localeDisplayName(currentLocale) })));
-            console.log(theme.system(t('status.mcp', {
-                v: mcpPool ? String(mcpPool.status().toolCount) : t('common.none'),
-            })));
-            const tokens = browser.getLastTokenUsage();
-            console.log(theme.system(t('status.tokens', {
-                v: tokens === null ? t('common.unknown') : String(tokens),
-            })));
+            const statusLines = formatStatus({
+                workdir: currentWorkdir,
+                reviewMode: reviewMode ? reviewMode.snapName : null,
+                origDir: reviewMode ? reviewMode.originalWorkdir : null,
+                chatId: currentChatId,
+                freshNext: freshChatNext,
+                promptNext: sendSystemPromptNext,
+                lastChat: loadLastChat(currentWorkdir),
+                sessionsDir: sessionsDir(),
+                devMode,
+                maxIterations: currentMaxIter(),
+                headless,
+                debug,
+                deepThinking: statusToggles.deepThinking,
+                webSearch: statusToggles.webSearch,
+                undo: config.undo.enabled,
+                checkpoint: config.checkpoint.enabled,
+                transcriptFile: transcript.file,
+                goal: sessionGoal,
+                localeName: localeDisplayName(currentLocale),
+                mcpToolCount: mcpPool ? mcpPool.status().toolCount : null,
+                tokenUsage: browser.getLastTokenUsage(),
+            }, t);
+            for (const line of statusLines)
+                console.log(theme.system(line));
             continue;
         }
         if (lower === '/config' || lower.startsWith('/config ')) {
@@ -3456,7 +3451,12 @@ async function main() {
                     locale: currentLocale,
                     context: ctx,
                 }).length;
-                console.log(theme.system(mod.commands.formatContextSources(ctx.agents, ctx.memory, ctx.skills, ctx.commands, { systemPromptChars: sysLen }, t)));
+                console.log(theme.system(renderContextReport({
+                    agents: ctx.agents,
+                    memory: ctx.memory,
+                    skills: ctx.skills,
+                    commands: ctx.commands,
+                }, { systemPromptChars: sysLen }, t)));
             }
             catch (e) {
                 console.error(theme.error(e.message));
@@ -3563,29 +3563,18 @@ async function main() {
             const logsDir = config.transcript.dir;
             const events = readSendEvents(logsDir, config.provider);
             if (!events.length) {
-                console.log(theme.system(t('limits.none', { path: sendLogPath(logsDir, config.provider) })));
+                console.log(theme.system(limitsEmptyMessage(sendLogPath(logsDir, config.provider), t)));
             }
             else {
                 const st = summarizeSends(events);
-                console.log(theme.system(t('limits.title', { provider: providerLabel(config.provider) })));
-                for (const [label, n] of [
-                    ['10m', st.last10m],
-                    ['30m', st.last30m],
-                    ['60m', st.last60m],
-                ]) {
-                    console.log('  ' + t('limits.window', { label, n: String(n) }));
+                for (const line of formatLimits(st, {
+                    providerLabel: providerLabel(config.provider),
+                    intervalMs: browser.sendIntervalMs(),
+                    adaptive: providerAdaptiveThrottle(config.provider),
+                }, t)) {
+                    // The title is printed bare; the counters are indented under it.
+                    console.log(line.kind === 'title' ? theme.system(line.text) : '  ' + line.text);
                 }
-                console.log('  ' +
-                    t('limits.rate', {
-                        n: String(st.rateLimits),
-                        sec: String(Math.round(st.avgBlockMs / 1000)),
-                    }));
-                const adaptive = providerAdaptiveThrottle(config.provider);
-                console.log('  ' +
-                    t('limits.interval', {
-                        sec: String(Math.round(browser.sendIntervalMs() / 1000)),
-                        adaptive: adaptive ? t('limits.adaptive_on') : '',
-                    }));
             }
             continue;
         }

package/dist/input/layout.js

@@ -37,7 +37,12 @@ export function countPasteLines(raw) {
         .join(NL)
         .split(CR)
         .join(NL);
-    const trimmed = normalized.replace(/\n+$/, '');
+    // Only the SINGLE last newline is a terminator (it does not open a new
+    // line); any newline before it ends a real - possibly BLANK - line. The
+    // old /\n+$/ stripped ALL trailing newlines, so a paste of "a\n\n\n"
+    // counted as ONE line: it was inserted verbatim instead of collapsing into
+    // a `[Pasted lines#N]` marker and flooded the input line.
+    const trimmed = normalized.endsWith(NL) ? normalized.slice(0, -1) : normalized;
     if (trimmed === '')
         return 1;
     return trimmed.split(NL).length;
@@ -197,15 +202,23 @@ export function wrapToWidth(s, maxCols) {
         // separator, so `'aaa bbb'` at width 7 became `'aaabbb'` and an indented
         // warning lost its indent.
         const words = raw.split(/ +/).filter((w) => w !== '');
-        const indent = raw.slice(0, raw.length - raw.trimStart().length);
+        // An INDENT deeper than the whole width can never be reproduced within
+        // the margin: keeping it on the first line glued `width` MORE columns to
+        // it (a pasted stack-trace line pushed the terminal into horizontal
+        // scroll). It is clipped so every produced line fits.
+        let indent = raw.slice(0, raw.length - raw.trimStart().length);
+        if (visLen(indent) > width)
+            indent = truncateToWidth(indent, width - 1);
+        const avail = Math.max(1, width - visLen(indent));
         let line = indent;
         let lineW = visLen(indent);
         let first = true;
         for (let i = 0; i < words.length; i++) {
             const word = words[i];
             const w = visLen(word);
-            // Hard-split a word longer than a whole line.
-            if (w > width) {
+            // Hard-split a word that does not fit the REMAINING columns on this
+            // line (the indent, plus any earlier word, consumes part of it).
+            if (w > avail) {
                 if (!first) {
                     out.push(line);
                     line = '';
@@ -213,12 +226,14 @@ export function wrapToWidth(s, maxCols) {
                 }
                 let piece = '';
                 let pieceW = 0;
+                let room = width - lineW;
                 for (const ch of word) {
                     const cw = charWidth(ch.codePointAt(0));
-                    if (pieceW + cw > width) {
+                    if (pieceW + cw > room) {
                         out.push(line + piece);
                         line = '';
                         lineW = 0;
+                        room = width;
                         piece = '';
                         pieceW = 0;
                     }
@@ -382,11 +397,21 @@ export const CONTEXT_YELLOW_PCT = 50;
 export const CONTEXT_RED_PCT = 80;
 // The color role for a context fill level, as a stable string so it can be
 // unit-tested without a terminal: 'ok' | 'warn' | 'high'. Null tokens -> null.
+// A usable context window: a finite POSITIVE number. The denominator comes
+// from config (`ui.contextLimit` / a provider section), so a 0 / NaN /
+// negative / Infinity value reaches these functions; dividing by it rendered
+// `Infinity%` / `NaN%` (or a fake 0.0% and even 'high') on a real token
+// count. An unusable window falls back to the default one.
+function usableLimit(limit) {
+    return typeof limit === 'number' && Number.isFinite(limit) && limit > 0
+        ? limit
+        : CONTEXT_LIMIT;
+}
 export function tokenStatusLevel(tokens, limit = CONTEXT_LIMIT) {
     if (typeof tokens !== 'number' || !Number.isFinite(tokens) || tokens < 0) {
         return null;
     }
-    const pct = (tokens / limit) * 100;
+    const pct = (tokens / usableLimit(limit)) * 100;
     if (pct >= CONTEXT_RED_PCT)
         return 'high';
     if (pct >= CONTEXT_YELLOW_PCT)
@@ -399,7 +424,7 @@ export function formatTokenStatus(tokens, limit = CONTEXT_LIMIT) {
     }
     const n = Math.round(tokens);
     const compact = formatCompactTokens(n);
-    const pct = Math.max(0, (n / limit) * 100);
+    const pct = Math.max(0, (n / usableLimit(limit)) * 100);
     const pctStr = pct >= 10 ? String(Math.round(pct)) : pct.toFixed(1);
     // "ctx:" marks this as the USED context size, so the operator does not have
     // to guess what "302k · 30%" means.

package/dist/limits-command.js

@@ -0,0 +1,42 @@
+import { translate } from './i18n.js';
+/**
+ * The lines of `/limits` for an aggregate. `intervalMs` is the ACTIVE browser's
+ * send interval and `adaptive` whether the pause is derived adaptively.
+ */
+export function formatLimits(stats, opts, t = translate('en')) {
+    const out = [];
+    out.push({
+        kind: 'title',
+        text: t('limits.title', { provider: opts.providerLabel }),
+    });
+    const windows = [
+        ['10m', stats.last10m],
+        ['30m', stats.last30m],
+        ['60m', stats.last60m],
+    ];
+    for (const [label, n] of windows) {
+        out.push({
+            kind: 'window',
+            text: t('limits.window', { label, n: String(n) }),
+        });
+    }
+    out.push({
+        kind: 'rate',
+        text: t('limits.rate', {
+            n: String(stats.rateLimits),
+            sec: String(Math.round(stats.avgBlockMs / 1000)),
+        }),
+    });
+    out.push({
+        kind: 'interval',
+        text: t('limits.interval', {
+            sec: String(Math.round(opts.intervalMs / 1000)),
+            adaptive: opts.adaptive ? t('limits.adaptive_on') : '',
+        }),
+    });
+    return out;
+}
+/** The text for an EMPTY telemetry file (nothing recorded yet). */
+export function limitsEmptyMessage(path, t = translate('en')) {
+    return t('limits.none', { path });
+}

package/dist/mcp.js

@@ -44,7 +44,14 @@ export function hardenPlaywrightArgs(command, args) {
     const hay = (String(command || '') + ' ' + args.join(' ')).toLowerCase();
     if (!hay.includes('playwright') || !hay.includes('mcp'))
         return args;
-    if (args.some((a) => 
+    // The profile flag may sit in the COMMAND itself: a config like
+    // `{command: "npx --user-data-dir=/tmp/x", args: ["@playwright/mcp"]}` is
+    // legitimate, and checking only `args` appended `--isolated` next to the
+    // profile — the server then has BOTH an on-disk profile and an in-memory
+    // one and picks unpredictably (the live agent's profile is the very thing
+    // this guard exists to protect).
+    const all = [String(command || ''), ...args];
+    if (all.some((a) => 
     // A PREFIX match treated `--isolated=false` as the isolated flag, so
     // the hardener added nothing and the MCP browser opened the agent's
     // live profile anyway. Only a flag EXPLICITLY ON, or a value-taking
@@ -53,10 +60,16 @@ export function hardenPlaywrightArgs(command, args) {
         /^--isolated=(?!false$)/.test(a) ||
         a === '--user-data-dir' ||
         a.startsWith('--user-data-dir=') ||
+        a.endsWith('--user-data-dir') ||
+        a.includes('--user-data-dir=') ||
         a === '--extension' ||
         a.startsWith('--extension=') ||
+        a.endsWith('--extension') ||
+        a.includes('--extension=') ||
         a === '--cdp-endpoint' ||
-        a.startsWith('--cdp-endpoint='))) {
+        a.startsWith('--cdp-endpoint=') ||
+        a.endsWith('--cdp-endpoint') ||
+        a.includes('--cdp-endpoint='))) {
         return args;
     }
     return [...args, '--isolated'];

package/dist/model-command.js

@@ -0,0 +1,21 @@
+import { providerHasModelPicker } from './providers.js';
+import { translate } from './i18n.js';
+/**
+ * Decide what /model should do from the command argument and the provider.
+ * The argument is the text after "/model" (trimmed here again); an empty
+ * argument means "list".
+ */
+export function parseModelIntent(provider, arg, t = translate('en')) {
+    if (!providerHasModelPicker(provider)) {
+        return {
+            kind: 'unsupported',
+            message: t('model.unsupported', { provider }),
+        };
+    }
+    const model = String(arg ?? '').trim();
+    return model ? { kind: 'set', model } : { kind: 'list' };
+}
+/** The text for an EMPTY model list (a provider that answered with nothing). */
+export function emptyModelListMessage(t = translate('en')) {
+    return t('model.list', { v: '(none)' });
+}

package/dist/path-token.js

@@ -107,35 +107,62 @@ export function extractAtFileRefs(text) {
             continue;
         }
         const prev = i > 0 ? chars[i - 1] : '';
-        // A comma separates list items: `@a.ts,@b.ts` is TWO references. The
-        // comma itself is not a boundary (it is stripped as prose punctuation),
-        // so without this the second `@` never started a new scan and its file was
-        // never inlined.
-        if (prev && !isRefBoundary(prev) && prev !== ',') {
+        // The at-sign must START a reference: at the very beginning, after
+        // whitespace/a bracket/a quote, or right after a LIST SEPARATOR (a comma
+        // or a semicolon). A second at-sign WITHOUT a separator (`@a.ts@b.ts`) is
+        // an email/decorator shape and is skipped — the glued path cannot be
+        // inlined anyway.
+        if (prev && !isRefBoundary(prev) && prev !== ',' && prev !== ';') {
             i++;
             continue;
         }
         let j = i + 1;
         let tok = '';
+        // The token is rejected WHOLE when it contains an at-sign that is NOT a
+        // list separator — `@Component` / `user@host` are a decorator and an
+        // email. Trimming the prefix at that at-sign would otherwise inline a
+        // bogus path.
+        let hadInnerAt = false;
+        // A token that contains an at-sign (`@Component`, `user@host`) is a
+        // decorator / an email, NOT a file reference. The scan used to stop at
+        // that at-sign and hand the PREFIX (`Component` … no) or, worse, the part
+        // BEFORE it to the inliner. Now the whole token is rejected instead.
+        const isRef = (t) => t.length > 0 && !t.includes('@');
         while (j < n && !isRefEnd(chars[j])) {
             // A COMMA directly followed by another `@` starts the NEXT reference:
             // `@a.ts,@b.ts` is a list, and scanning to whitespace made the whole
             // `a.ts,@b.ts` one path, so neither file was inlined.
             if (chars[j] === ',' && chars[j + 1] === '@')
                 break;
+            // A SEMICOLON or a second at-sign also separates list items. Scanning
+            // to whitespace made `a.ts;@b.ts` ONE path whose extension consumed the
+            // separator, so `looksLikeToken` failed and BOTH files were dropped.
+            if ((chars[j] === ';' || chars[j] === '@') && chars[j + 1] === '@')
+                break;
+            // An at-sign followed by an ordinary char is part of the token (an
+            // email/decorator) — remember it so the token is rejected below.
+            if (chars[j] === '@')
+                hadInnerAt = true;
             tok += chars[j];
             j++;
         }
         const cleaned = stripRefPunct(tok);
-        if (cleaned && looksLikeToken(cleaned) && !seen.has(cleaned)) {
+        if (!hadInnerAt &&
+            isRef(cleaned) &&
+            looksLikeToken(cleaned) &&
+            !seen.has(cleaned)) {
             seen.add(cleaned);
             out.push(cleaned);
         }
         // The break above leaves `j` ON the comma; step past it so the next `@`
         // is seen as the start of a reference. When the scan ended on a
         // terminator instead, continue AFTER it.
-        if (chars[j] === ',' && chars[j + 1] === '@')
-            i = j + 1;
+        // The scan stopped ON a separator that split the token (`,`, `;` or a
+        // second at-sign): resume AT it so the next part is scanned as its own
+        // reference. Continuing past it dropped the second file of a list.
+        const sep = j < n ? chars[j] : '';
+        if (j > i + 1 && (sep === ',' || sep === ';' || sep === '@'))
+            i = j;
         else
             i = j > i + 1 ? j : i + 1;
     }

package/dist/permissions.js

@@ -156,14 +156,43 @@ export function decidePermission(policy, tool, args) {
     // the natural shape for execFile-style MCP tools). Accepting only strings
     // let a `command` deny be bypassed by passing the words as an array.
     const commands = [];
-    for (const k of COMMAND_KEYS) {
-        const v = a[k];
+    // Collect a value as a command string: a string is one command, an ARRAY
+    // (argv) is joined into one line so a rule can match the words in order.
+    const addCommand = (v) => {
         if (typeof v === 'string')
             commands.push(v);
         else if (Array.isArray(v)) {
-            commands.push(v.filter((x) => typeof x === 'string').join(' '));
+            const parts = v.filter((x) => typeof x === 'string');
+            if (parts.length)
+                commands.push(parts.join(' '));
         }
+    };
+    for (const k of COMMAND_KEYS) {
+        if (k in a)
+            addCommand(a[k]);
     }
+    // MCP tools (and a model that nests its payload) send the command one or
+    // more levels down — `{args: {command}}`, `{input: {params: {cmd}}}`.
+    // Checking only the TOP level let a `command` deny rule be bypassed by
+    // wrapping the same words in an object, so nested objects and arrays are
+    // scanned too (depth-bounded like the path scan).
+    const walkCommands = (v, depth) => {
+        if (depth > 4 || v === null || v === undefined)
+            return;
+        if (Array.isArray(v)) {
+            for (const x of v)
+                walkCommands(x, depth + 1);
+            return;
+        }
+        if (typeof v !== 'object')
+            return;
+        for (const [key, val] of Object.entries(v)) {
+            if (COMMAND_KEYS.includes(key))
+                addCommand(val);
+            walkCommands(val, depth + 1);
+        }
+    };
+    walkCommands(a, 0);
     const paths = collectPathCandidates(tool, args);
     for (const r of policy.rules) {
         // An UNPARSABLE regex in any field of the rule makes the rule fail