zames_pro 2.82.74 → 2.82.76

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.76] - 2026-10-24
+
+### Fixed
+
+- **login:** askPassword Backspace deletes a whole code point
+
+## [2.82.75] - 2026-10-24
+
+### Fixed
+
+- **xml:** keep an escaped quote inside an invoke attribute value
+
 ## [2.82.74] - 2026-10-24
 
 ### Fixed

package/dist/browser-pure.js

@@ -68,9 +68,16 @@ export function askPassword(question) {
                     return;
                 }
                 // Backspace (0x7f or 0x08): remove the last char and one star.
+                // Delete a WHOLE code point: an emoji is two UTF-16 units, and
+                // removing one left a LONE surrogate in the password — a broken code
+                // point that never matches the real one.
                 if (code === 127 || code === 8) {
                     if (value.length > 0) {
-                        value = value.slice(0, -1);
+                        const prev = value.charCodeAt(value.length - 1);
+                        const low = prev >= 0xdc00 && prev <= 0xdfff;
+                        const hi = value.length >= 2 ? value.charCodeAt(value.length - 2) : 0;
+                        const pair = low && hi >= 0xd800 && hi <= 0xdbff;
+                        value = value.slice(0, pair ? -2 : -1);
                         process.stdout.write('\b \b');
                     }
                     continue;

package/dist/xml-toolcall.js

@@ -30,17 +30,30 @@ function readAttr(attrs, name) {
 function readAllAttrs(attrs) {
     const Q = String.fromCharCode(34);
     const out = {};
-    const re = new RegExp('([A-Za-z_][A-Za-z0-9_]*)[ ]*=[ ]*[' + Q + ']([^' + Q + ']*)[' + Q + ']', 'g');
+    // The VALUE may contain an ESCAPED quote (`todos="[{\"content\":\"x\"}]"`):
+    // `[^"]*` stopped at the first one and truncated the argument. Accept a
+    // backslash-escaped quote inside the value, then unescape it.
+    const re = new RegExp('([A-Za-z_][A-Za-z0-9_]*)[ ]*=[ ]*[' +
+        Q +
+        ']((?:[^' +
+        Q +
+        '\\\\]|\\\\.)*)[' +
+        Q +
+        ']', 'g');
     let m;
     while ((m = re.exec(attrs)) !== null) {
         const key = m[1];
         if (key === 'name')
             continue;
         if (!(key in out))
-            out[key] = unescapeXml(m[2]);
+            out[key] = unescapeXml(decodeAttrEscapes(m[2]));
     }
     return out;
 }
+/** Decode the backslash escapes inside an attribute VALUE. */
+function decodeAttrEscapes(s) {
+    return String(s).replace(/\\(.)/g, '$1');
+}
 // The model sometimes produces a "hybrid" call: the tool name is an attribute
 // AND the arguments are inline JSON in the SAME opening tag, without any
 // <parameter> children. A real case from the transcript:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.74",
+  "version": "2.82.76",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {