zames_pro 2.89.0 → 2.90.1

package/dist/completion-check.js

@@ -0,0 +1,77 @@
+// Post-edit "is it really complete?" nudge.
+//
+// Why: the model can generate an INCOMPLETE artifact and declare the task
+// done. A live case: Qwen wrote `snake.html` with a scene, a camera and a
+// board but WITHOUT the game loop, movement/food logic or key handlers, then
+// said DONE — the page rendered black. That is model behaviour, but the loop
+// can help: if code files were WRITTEN/EDITED in this task and the model is
+// about to finish WITHOUT having run a single command (Bash) since the last
+// edit, it never verified that the artifact is complete and runs. Nudge it
+// ONCE to check (not to block), mirroring the structural guards: a plain
+// "please verify" line the model can answer with a tool call or a confirmed
+// respond.
+//
+// Kept PURE and narrow on purpose: no filesystem access, no word matching of
+// the answer — only the STRUCTURE of the run (which tools ran, in what order).
+// Extensions whose result is an executable artifact: a page, a script, a
+// module. Markdown/json/config edits are NOT here — "does it run" makes no
+// sense for them, and nudging on every README edit would be noise.
+const RUNNABLE_EXT = new Set([
+    '.html',
+    '.htm',
+    '.js',
+    '.mjs',
+    '.cjs',
+    '.ts',
+    '.tsx',
+    '.jsx',
+    '.py',
+    '.sh',
+    '.rb',
+    '.go',
+    '.rs',
+    '.java',
+    '.php',
+    '.css',
+]);
+export function isRunnablePath(p) {
+    if (!p)
+        return false;
+    const lower = p.toLowerCase();
+    const dot = lower.lastIndexOf('.');
+    if (dot < 0)
+        return false;
+    return RUNNABLE_EXT.has(lower.slice(dot));
+}
+/**
+ * True when the model is about to finish after WRITING/EDITING a runnable
+ * code file and has run NO Bash since that last edit — i.e. nothing verified
+ * that the artifact is complete and actually runs.
+ *
+ * `steps` is the ordered history of tool calls in this task.
+ */
+export function needsCompletionNudge(steps) {
+    let lastEditIndex = -1;
+    let lastEditRunnable = false;
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i];
+        if (s.mutating && isRunnablePath(s.path)) {
+            lastEditIndex = i;
+            lastEditRunnable = true;
+        }
+    }
+    if (lastEditIndex < 0 || !lastEditRunnable)
+        return false;
+    // A Bash/verification run AFTER the last code edit counts as a check.
+    for (let i = lastEditIndex + 1; i < steps.length; i++) {
+        if (steps[i].tool === 'Bash')
+            return false;
+    }
+    return true;
+}
+export const COMPLETION_NUDGE = 'Before finishing: you wrote/edited a runnable code file in this task, but ' +
+    'you have not run any command since that edit. Check that the file is ' +
+    'COMPLETE and actually runs (e.g. syntax-check it, open/parse it, run its ' +
+    'tests or start it briefly) with one Bash call. If it is already verified ' +
+    'another way, or the task is genuinely done, call respond with the final ' +
+    'message.';

package/dist/config-schema.js

@@ -263,6 +263,14 @@ export const CONFIG_SCHEMA = [
         topKey: 'cfg.top.browser',
         groupKey: 'cfg.group.login',
     },
+    {
+        path: 'browser.passwordStore',
+        type: 'enum',
+        values: ['none', 'keychain', 'config'],
+        labelKey: 'cfg.f.browser_passwordStore',
+        topKey: 'cfg.top.browser',
+        groupKey: 'cfg.group.login',
+    },
     {
         path: 'browser.auth.saveSession',
         type: 'boolean',

package/dist/config.js

@@ -14,6 +14,10 @@ const HOME_CONFIG = path.join(ZAMES_HOME, 'config.json');
 // The PROJECT config path is resolved LAZILY: `/cd` changes process.cwd() at
 // runtime, so freezing it at import time meant a `.zamesrc.json` in the new
 // working directory was never read (and writes went to the OLD directory).
+/** The HOME config file (`~/.zames/config.json`). */
+export function homeConfigPath() {
+    return HOME_CONFIG;
+}
 export function projectConfigPath() {
     return path.join(process.cwd(), '.zamesrc.json');
 }
@@ -121,6 +125,13 @@ export const DEFAULTS = {
         // out of the main context, and the main chat is restored afterwards.
         subagents: true,
         maxSubagents: 3,
+        // N8: providers a task may CONTINUE on after the active one exhausted its
+        // retries. Empty by default (off): a fallback is only used for an
+        // AUTHORIZED provider (auth marker + a confirmed login), never a guest.
+        fallbackProviders: [],
+        // `ask` (the default) asks the operator before switching; `auto` switches
+        // without a prompt.
+        fallbackMode: 'ask',
         deepThinking: false,
         webSearch: true,
         // OFF by default: the telemetry file only serves diagnosis and manual
@@ -133,6 +144,9 @@ export const DEFAULTS = {
             password: '',
             saveSession: true,
         },
+        // N21: where the password lives. `config` keeps the historical field,
+        // `none` never stores it, `keychain` uses the OS store (with a fallback).
+        passwordStore: 'config',
     },
     ui: {
         locale: DEFAULT_LOCALE,

package/dist/dev-commands.js

@@ -0,0 +1,27 @@
+// N2 group (e): the DEV-ONLY self-development commands — /improve, /backlog,
+// /self-review, /self-fix, /self-done, /self-list, /self-diff, /self-apply.
+//
+// They are registry entries with `devOnly: true`, so the guard that used to be
+// a separate pre-check in the main loop is the SAME data the dispatch reads:
+// a regular user gets `msg.dev_only`, dev mode runs the handler. The list here
+// and `DEV_ONLY_COMMANDS` in src/commands.ts are kept in sync by a unit test.
+export function createDevCommands(deps) {
+    return [
+        { name: 'improve', devOnly: true, handler: (c) => deps.improve(c.rest) },
+        { name: 'backlog', devOnly: true, handler: (c) => deps.backlog(c.rest) },
+        {
+            name: 'self-review',
+            devOnly: true,
+            handler: (c) => deps.selfReview(c.rest),
+        },
+        { name: 'self-fix', devOnly: true, handler: (c) => deps.selfFix(c.rest) },
+        { name: 'self-done', devOnly: true, handler: () => deps.selfDone() },
+        { name: 'self-list', devOnly: true, handler: () => deps.selfList() },
+        { name: 'self-diff', devOnly: true, handler: (c) => deps.selfDiff(c.rest) },
+        {
+            name: 'self-apply',
+            devOnly: true,
+            handler: (c) => deps.selfApply(c.rest),
+        },
+    ];
+}

package/dist/dev-watch.js

@@ -0,0 +1,96 @@
+import { readdirSync, statSync } from 'node:fs';
+import path from 'node:path';
+// N4: in dev mode a source file that is NOT hot-reloadable silently keeps
+// running its OLD copy after an edit — the fix "does not work" until zames is
+// restarted. Only `browser.ts` used to be watched. This module computes the
+// FULL set of such files from the source tree, so an edit to index.ts,
+// run-task.ts, a provider browser, browser-login.ts, send-*.ts or the Ink TUI
+// is reported too.
+/**
+ * Names (without extension) of the modules that /reload can hot-swap. Kept
+ * here so the watcher and `index.ts`'s RELOADABLE list cannot drift: the
+ * test asserts every entry is a real module.
+ */
+export const HOT_RELOADABLE = new Set([
+    'mcp',
+    'tools',
+    'extraTools',
+    'agent-loop',
+    'system-prompt',
+    'gitTools',
+    'web',
+    'self-review',
+    'diff',
+    'undo',
+    'checkpoint',
+    'transcript',
+    'spinner',
+    'config',
+    'fsutil',
+    'backlog',
+    'commands',
+    'run-task',
+    'attach-refs',
+]);
+/** A source file in `src/` (recursively) whose basename — without `.ts`/`.tsx` — is not hot-reloadable. */
+export function nonReloadableSources(srcDir, hot = HOT_RELOADABLE) {
+    const out = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            const full = path.join(dir, name);
+            let isDir;
+            try {
+                isDir = statSync(full).isDirectory();
+            }
+            catch {
+                continue;
+            }
+            if (isDir) {
+                walk(full);
+                continue;
+            }
+            const m = /\.(ts|tsx)$/.exec(name);
+            if (!m)
+                continue;
+            const base = name.slice(0, -m[0].length);
+            // `index.ts` IS the entry point (it is not reloaded either), so it is
+            // included like any other non-reloadable module.
+            if (!hot.has(base))
+                out.push(full);
+        }
+    };
+    walk(srcDir);
+    return out.sort();
+}
+/**
+ * Compare the mtimes of the watched files with the previous snapshot and
+ * return the CHANGED ones (first call initializes the snapshot and returns
+ * an empty list).
+ */
+export function diffChanged(files, previous) {
+    const changed = [];
+    for (const f of files) {
+        let mtime;
+        try {
+            mtime = statSync(f).mtimeMs;
+        }
+        catch {
+            continue;
+        }
+        const prev = previous.get(f);
+        if (prev === undefined)
+            previous.set(f, mtime);
+        else if (mtime !== prev) {
+            previous.set(f, mtime);
+            changed.push(f);
+        }
+    }
+    return changed;
+}

package/dist/first-run.js

@@ -0,0 +1,80 @@
+// N19: the FIRST-RUN WIZARD decision, as a pure state machine.
+//
+// A new user is dropped straight into DeepSeek with no explanation: which
+// language, which provider, why DeepSeek needs a real sign-in while Qwen/GLM
+// have guest limits. The wizard is shown ONLY on a truly fresh install (no
+// `~/.zames/config.json`), never in a non-TTY / one-shot / non-interactive
+// login run, and Esc accepts the defaults.
+//
+// Only the STEP LOGIC lives here (unit-tested); the Ink widgets (SelectList,
+// LoginForm) already exist and are rendered by the caller.
+export function initialWizardState() {
+    return { step: 0, locale: null, provider: null, needsLogin: false };
+}
+/**
+ * Should the wizard run at all? A fresh HOME only: an existing config means
+ * the operator already made these choices, and a non-interactive run (a pipe,
+ * `--task`, `ZAMES_NONINTERACTIVE_LOGIN=1`) must never block on a modal.
+ */
+export function shouldRunWizard(opts) {
+    if (opts.configExists)
+        return false;
+    if (!opts.isTTY)
+        return false;
+    if (opts.nonInteractiveLogin)
+        return false;
+    if (opts.oneShot)
+        return false;
+    return true;
+}
+/** The step currently shown. */
+export function currentStep(s) {
+    if (s.step === 0)
+        return { kind: 'language' };
+    if (s.step === 1)
+        return { kind: 'provider' };
+    if (s.step === 2 && s.provider && s.needsLogin) {
+        return { kind: 'login', provider: s.provider };
+    }
+    return { kind: 'done' };
+}
+/** Pick the interface language, then move on. */
+export function chooseLanguage(s, locale) {
+    return { ...s, locale, step: 1 };
+}
+/**
+ * Pick a provider. DeepSeek ALWAYS needs a real sign-in; Qwen and GLM can be
+ * tried as a guest, but the wizard says honestly that the guest tier is a few
+ * turns a day (Qwen) and that GLM gates the first send with a captcha.
+ */
+export function chooseProvider(s, provider) {
+    return {
+        ...s,
+        provider,
+        needsLogin: provider === 'deepseek' || provider === 'glm',
+        step: 2,
+    };
+}
+/** The login step finished (or was skipped): the wizard is over. */
+export function finishWizard(s) {
+    return { ...s, step: 3 };
+}
+/** Esc at any step accepts the current defaults (never blocks the first run). */
+export function acceptDefaults(s) {
+    return {
+        locale: s.locale ?? 'en',
+        provider: s.provider ?? 'deepseek',
+        needsLogin: false,
+        step: 3,
+    };
+}
+/** One-line honest note per provider, shown under the choice. */
+export function providerNote(provider) {
+    if (provider === 'deepseek') {
+        return 'DeepSeek needs a real sign-in (a fresh headless login may ask for a captcha in a visible window).';
+    }
+    if (provider === 'qwen') {
+        return 'Qwen works as a guest for a few messages a day; sign in for long tasks.';
+    }
+    return 'GLM gates the first send with a slider captcha: a visible window (--headed) is the practical mode.';
+}