zames_pro 2.90.1 → 2.90.3

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.90.3] - 2026-10-28
+
+### Fixed
+
+- **ui:** keep a tool detail on a negative clip budget instead of a lone ellipsis
+
+## [2.90.2] - 2026-10-28
+
+### Fixed
+
+- **web:** treat the IPv4-translated ::ffff:0:a.b.c.d literal as private
+
 ## [2.90.1] - 2026-10-28
 
 ### Fixed
@@ -437,7 +449,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- **mcp:** a schema property named __proto__ becomes a real parameter
+- **mcp:** a schema property named **proto** becomes a real parameter
 
 ## [2.82.123] - 2026-10-24
 
@@ -1486,7 +1498,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- **commands:** keep an unsupplied  position as written in a custom command
+- **commands:** keep an unsupplied position as written in a custom command
 - **subagent:** count a subagent run only once it actually starts
 - **attach:** do not cut an inlined @file inside a surrogate pair
 - **checkpoint:** a bare out-of-range rewind index no longer matches a stamp prefix
@@ -1606,7 +1618,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **changelog:** keep drafted group headings on their own line
 - **tui:** decode modified and release wheel reports correctly
 - **shell:** normalize an invalid Bash timeout instead of crashing the tool
-- **cost:** keep per-tool stats safe for __proto__/constructor tool names
+- **cost:** keep per-tool stats safe for **proto**/constructor tool names
 - **tui:** mark blocked/aborted tool calls as errors in the result icon
 - **mcp:** do not split a surrogate pair when truncating an MCP result
 - **context:** discover skills at the documented 3 levels deep

package/dist/input/layout.js

@@ -314,7 +314,14 @@ export function wrapToWidth(s, maxCols) {
     return out.join(NL);
 }
 export function truncateToWidth(s, maxCols) {
-    const width = Math.max(1, Math.floor(maxCols));
+    // The callers derive the budget from the row width MINUS the tool name
+    // (`contentWidth() - name.length - 6`), so a long name (an MCP tool id) on a
+    // narrow pane produced a NEGATIVE budget and the whole detail collapsed to a
+    // lone `…` — the operator saw no argument at all. A budget below 1 (the
+    // ellipsis itself) is lifted to 2, so the head keeps ONE character next to
+    // the marker instead of disappearing entirely.
+    const requested = Number.isFinite(maxCols) ? Math.floor(maxCols) : 1;
+    const width = requested < 1 ? 2 : requested;
     const text = String(s ?? '');
     if (visLen(text) <= width)
         return text;

package/dist/web.js

@@ -263,6 +263,20 @@ export function isPrivateIp(ip) {
                 '.' +
                 (v6[7] & 0xff));
         }
+        // IPv4-TRANSLATED ::ffff:0:a.b.c.d (RFC 2765): the embedded IPv4 sits in
+        // the LAST two groups with one extra zero group between `ffff` and it.
+        // Only the mapped form above was judged, so `::ffff:0:7f00:1` (= 127.0.0.1)
+        // stayed "public" and WebFetch could reach localhost/metadata through it.
+        const translatedV4 = v6.slice(0, 4).every((g) => g === 0) && v6[4] === 0xffff && v6[5] === 0;
+        if (translatedV4) {
+            return isPrivateIp((v6[6] >> 8) +
+                '.' +
+                (v6[6] & 0xff) +
+                '.' +
+                (v6[7] >> 8) +
+                '.' +
+                (v6[7] & 0xff));
+        }
     }
     if (low === '::1' || low === '::')
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.90.1",
+  "version": "2.90.3",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {