zames_pro 2.95.6 → 2.96.0

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.0] - 2026-11-05
+
+### Added
+
+- **loop:** dev-only /loop improvement cycles with a release policy
+
+### Fixed
+
+- **extraTools:** apply an insertion-only ApplyPatch hunk from its @@ header
+- **dev:** keep the unparsed-call dump directory bounded
+
 ## [2.95.6] - 2026-11-05
 
 ### Added

package/dist/agent-loop.js

@@ -1392,9 +1392,38 @@ export function _setParserBindings(m) {
     parseToolCall = m.parseToolCall;
     responseLooksLikeToolCall = m.responseLooksLikeToolCall;
 }
-let unparsedDumps = 0;
-const UNPARSED_DUMP_MAX = 20;
+// The dev dump is a POST-MORTEM aid, not an archive. `npm run dev` turns it
+// on, and a /loop run is ONE process: the old per-process counter (stop after
+// 20, never delete) left every earlier file in place, so the project
+// `.zames/unparsed` grew without bound (93 files against a cap of 20). The
+// net-log dump already rotates for the same reason, so this directory keeps
+// the newest UNPARSED_DUMP_KEEP dumps.
+const UNPARSED_DUMP_KEEP = 20;
 const UNPARSED_DUMP_BYTES = 64 * 1024;
+/** Our names start with an ISO stamp, so a plain sort is chronological. */
+const UNPARSED_DUMP_RE = /^\d{4}-\d{2}-\d{2}T[\d-]+Z-/;
+/**
+ * Keeps only the newest `keep` dumps in `dir`. A foreign `.txt` is neither
+ * deleted nor allowed to eat a slot of the keep window. Exported for the test:
+ * this rotation is the only thing bounding the directory.
+ */
+export async function rotateUnparsedDumps(dir, keep = UNPARSED_DUMP_KEEP) {
+    const fs = await import('node:fs/promises');
+    const p = await import('node:path');
+    const names = (await fs.readdir(dir).catch(() => [])).filter((n) => n.endsWith('.txt') && UNPARSED_DUMP_RE.test(n));
+    if (names.length <= keep)
+        return 0;
+    names.sort();
+    const stale = names.slice(0, names.length - keep);
+    let removed = 0;
+    for (const n of stale) {
+        await fs
+            .rm(p.join(dir, n), { force: true })
+            .then(() => removed++)
+            .catch(() => { });
+    }
+    return removed;
+}
 /** Dev mode: save an unrecognized (but call-looking) answer for analysis. */
 /**
  * True when the raw answer is a bare `{"tool":"BashOutput","args":{"id":...}}`
@@ -1421,8 +1450,6 @@ export function isEmptyPollCall(raw) {
     return !!a && typeof a.id === 'string';
 }
 export async function dumpUnparsedCall(raw, meta) {
-    if (unparsedDumps >= UNPARSED_DUMP_MAX)
-        return '';
     const text = String(raw || '');
     if (!text.trim())
         return '';
@@ -1431,7 +1458,6 @@ export async function dumpUnparsedCall(raw, meta) {
     const dir = p.join(meta.workdir || process.cwd(), '.zames', 'unparsed');
     try {
         await fs.mkdir(dir, { recursive: true });
-        unparsedDumps++;
         const stamp = new Date().toISOString().replace(/[:.]/g, '-');
         const name = stamp + '-' + String(meta.where || 'x').replace(/[^a-z0-9_-]+/gi, '_');
         const file = p.join(dir, name + '.txt');
@@ -1455,6 +1481,8 @@ export async function dumpUnparsedCall(raw, meta) {
             NL +
             NL;
         await fs.writeFile(file, head + text.slice(0, UNPARSED_DUMP_BYTES), 'utf-8');
+        // Rotate AFTER the write, so the dump just produced survives.
+        await rotateUnparsedDumps(dir);
         return file;
     }
     catch {

package/dist/commands.js

@@ -1096,6 +1096,13 @@ export function buildImprovePrompt(item) {
 export const DEV_ONLY_COMMANDS = [
     '/improve',
     '/backlog',
+    // The /loop improvement cycles (src/loop-prompts.ts): they edit QUEUE.md,
+    // read the dev dumps and push to master — a regular user has none of that.
+    '/bughunt',
+    '/textaudit',
+    '/coverage',
+    '/dumps',
+    '/smoke',
     '/self-review',
     '/self-fix',
     '/self-done',
@@ -1168,6 +1175,14 @@ export const SLASH_COMMANDS = [
     { name: '/review', key: 'help.cmd.review' },
     { name: '/improve', key: 'help.cmd.improve' },
     { name: '/backlog', key: 'help.cmd.backlog' },
+    // The DEV-ONLY improvement cycles (src/loop-prompts.ts). printHelp filters
+    // them out for a regular user (isDevOnlyCommand); the «/» list drops them
+    // in buildSlashCommands, so a release build never advertises them.
+    { name: '/bughunt', key: 'help.cmd.bughunt' },
+    { name: '/textaudit', key: 'help.cmd.textaudit' },
+    { name: '/coverage', key: 'help.cmd.coverage' },
+    { name: '/dumps', key: 'help.cmd.dumps' },
+    { name: '/smoke', key: 'help.cmd.smoke' },
     { name: '/goal', key: 'help.cmd.goal' },
     { name: '/loop', key: 'help.cmd.loop' },
     { name: '/cron', key: 'help.cmd.cron' },

package/dist/dev-commands.js

@@ -1,14 +1,26 @@
 // N2 group (e): the DEV-ONLY self-development commands — /improve, /backlog,
-// /self-review, /self-fix, /self-done, /self-list, /self-diff, /self-apply.
+// /self-review, /self-fix, /self-done, /self-list, /self-diff, /self-apply,
+// plus the `/loop` improvement CYCLES (/bughunt, /textaudit, /coverage,
+// /dumps, /smoke).
 //
 // They are registry entries with `devOnly: true`, so the guard that used to be
 // a separate pre-check in the main loop is the SAME data the dispatch reads:
 // a regular user gets `msg.dev_only`, dev mode runs the handler. The list here
 // and `DEV_ONLY_COMMANDS` in src/commands.ts are kept in sync by a unit test.
+import { LOOP_CYCLES } from './loop-prompts.js';
 export function createDevCommands(deps) {
     return [
         { name: 'improve', devOnly: true, handler: (c) => deps.improve(c.rest) },
         { name: 'backlog', devOnly: true, handler: (c) => deps.backlog(c.rest) },
+        // `backlog` has BOTH a dev command (record a note) and a cycle (implement
+        // an item): the command keeps its name, the cycle is reachable as
+        // `/backlog` only when no explicit entry exists, so the registry list is
+        // deduplicated by name below.
+        ...LOOP_CYCLES.filter((id) => id !== 'backlog').map((id) => ({
+            name: id,
+            devOnly: true,
+            handler: (c) => deps.cycle(id, c.rest),
+        })),
         {
             name: 'self-review',
             devOnly: true,

package/dist/extraTools.js

@@ -198,10 +198,26 @@ export function applyUpdateHunk(content, hunkLines) {
             }
         }
         if (!oldLines.length) {
-            return {
-                ok: false,
-                error: 'Hunk has no context or removed lines to anchor on.',
-            };
+            // An INSERTION-ONLY hunk (`@@ -N,0 +N,M @@` + `+line`s) has nothing to
+            // match, so it was rejected outright — yet appending a line is a normal
+            // unified-diff form and the model uses it. Position it from the header's
+            // old-side start (a `-N,0` hunk inserts AFTER line N, hence the index N);
+            // without a usable header there is no anchor and we still refuse.
+            const hinted = block.oldStart !== null ? block.oldStart : -1;
+            if (hinted < 0) {
+                return {
+                    ok: false,
+                    error: 'Insertion-only hunk needs a @@ -N,0 +N,M @@ header to know where to insert.',
+                };
+            }
+            const atInsert = Math.min(Math.max(hinted, searchFrom), fileLines.length);
+            fileLines = [
+                ...fileLines.slice(0, atInsert),
+                ...newLines,
+                ...fileLines.slice(atInsert),
+            ];
+            searchFrom = atInsert + newLines.length;
+            continue;
         }
         const at = locateBlock(fileLines, oldLines, block.oldStart, searchFrom);
         if (at === -1) {

package/dist/i18n/common.js

@@ -169,6 +169,10 @@ export const commonMessages = {
         ru: 'Команда {v} доступна только в dev-режиме (--dev или hotReload).',
         en: 'The {v} command is only available in dev mode (--dev or hotReload).',
     },
+    'cycle.unknown': {
+        ru: 'Неизвестный цикл {v}: ожидается /bughunt, /textaudit, /coverage, /dumps, /backlog или /smoke.',
+        en: 'Unknown cycle {v}: expected /bughunt, /textaudit, /coverage, /dumps, /backlog or /smoke.',
+    },
     'msg.bye': { ru: 'Выход.', en: 'Bye.' },
     'shell.empty': {
         ru: 'После ! нужна команда, например !git status.',

package/dist/i18n/help.js

@@ -320,6 +320,30 @@ export const helpMessages = {
         ru: 'стартовать в режиме плана (только чтение)',
         en: 'start in plan mode (read-only)',
     },
+    'help.sec.cycles': {
+        ru: 'Циклы улучшения (/loop, только dev)',
+        en: 'Improvement cycles (/loop, dev only)',
+    },
+    'help.cmd.bughunt': {
+        ru: '/bughunt [интервал] dev-only: /loop с охотой за багами по docs/BUGHUNT.md',
+        en: '/bughunt [interval] dev-only: /loop the bug hunt from docs/BUGHUNT.md',
+    },
+    'help.cmd.textaudit': {
+        ru: '/textaudit [интервал] dev-only: /loop с аудитом текстов по docs/TEXT-AUDIT.md',
+        en: '/textaudit [interval] dev-only: /loop the text audit from docs/TEXT-AUDIT.md',
+    },
+    'help.cmd.coverage': {
+        ru: '/coverage [интервал] dev-only: /loop с заполнением пробелов покрытия тестами',
+        en: '/coverage [interval] dev-only: /loop filling test-coverage gaps',
+    },
+    'help.cmd.dumps': {
+        ru: '/dumps [интервал] dev-only: /loop с разбором дампов непойманных tool-вызовов',
+        en: '/dumps [interval] dev-only: /loop triaging the unparsed-call dumps',
+    },
+    'help.cmd.smoke': {
+        ru: '/smoke [интервал] dev-only: /loop с живым smoke-прогоном провайдера',
+        en: '/smoke [interval] dev-only: /loop a live provider smoke run',
+    },
     'help.cmd.loop': {
         ru: '/loop <интервал> <задача> повторять задачу (s/m/h; без единицы — секунды; первый запуск сразу; минимум 15с)',
         en: '/loop <interval> <task> repeat a task (s/m/h; no unit means seconds; the first run is immediate; minimum 15s)',

package/dist/index.js

@@ -17,6 +17,7 @@ import { createSessionCommands } from './session-commands.js';
 import { createTreeCommands } from './tree-commands.js';
 import { createSchedulerCommands } from './scheduler-commands.js';
 import { createDevCommands } from './dev-commands.js';
+import { buildCycleLoopLine } from './loop-prompts.js';
 import { shouldRunWizard, chooseLanguage, chooseProvider, providerNote, } from './first-run.js';
 import { DeepSeekBrowser, headlessUACacheReady } from './browser.js';
 import { QwenBrowser } from './qwen-browser.js';
@@ -481,6 +482,18 @@ function printHelp() {
             t('help.self.diff') +
             '\n  ' +
             t('help.self.apply') +
+            '\n\n' +
+            theme.bold(t('help.sec.cycles')) +
+            '\n  ' +
+            t('help.cmd.bughunt') +
+            '\n  ' +
+            t('help.cmd.textaudit') +
+            '\n  ' +
+            t('help.cmd.coverage') +
+            '\n  ' +
+            t('help.cmd.dumps') +
+            '\n  ' +
+            t('help.cmd.smoke') +
             '\n\n'
         : '  ' +
             t('help.cmd.debug_dom') +
@@ -3138,6 +3151,21 @@ async function main() {
             sendSystemPromptNext = false;
         }
     };
+    /**
+     * A dev-only /loop improvement cycle (`/bughunt 10m`, `/coverage`): build
+     * the ONE `/loop <interval> <task>` line and arm the scheduler through the
+     * SAME path `/loop` uses, so the interval/job bookkeeping has one owner.
+     */
+    const cycleCommand = (id, rest) => {
+        const arg = rest.trim();
+        const interval = arg.split(/\s+/)[0] || '';
+        const line = buildCycleLoopLine(id, interval);
+        if (!line) {
+            console.error(theme.error(t('cycle.unknown', { v: '/' + id })));
+            return;
+        }
+        loopCommand(line.slice('/loop '.length));
+    };
     /** /goal: set/show/clear the condition. Returns whether it was SET. */
     const goalCommand = async (line) => {
         const sub = await handleGoal(line);
@@ -3603,6 +3631,7 @@ async function main() {
                 selfList: () => selfListCommand(''),
                 selfDiff: (name) => selfDiffCommand(name),
                 selfApply: (name) => selfApplyCommand(name),
+                cycle: (id, rest) => cycleCommand(id, rest),
             });
             if (await dispatchCommand(devCommands, trimmed, {
                 print: (line) => console.log(line),

package/dist/loop-prompts.js

@@ -0,0 +1,61 @@
+// The DEV-ONLY `/loop` cycles of zames_pro itself: bughunt, textaudit,
+// coverage, dumps, backlog, smoke. Each command expands into ONE `/loop`
+// line, so the interval lives in the scheduler (a fired tick is queued and
+// skipped while the same job is still queued) and the operator never re-pastes
+// a long prompt.
+//
+// WHY dev-only: these cycles edit BACKLOG.md/QUEUE.md, read the dev dumps and
+// push to `master` — a regular npm user has none of that, and `/bughunt` on an
+// arbitrary project would hunt bugs in THEIR code with OUR protocol. The list
+// here and `DEV_ONLY_COMMANDS` in src/commands.ts are kept in sync by a test.
+export const LOOP_CYCLES = [
+    'bughunt',
+    'textaudit',
+    'coverage',
+    'dumps',
+    'backlog',
+    'smoke',
+];
+/** Default period of a cycle: 5m. The floor is MIN_LOOP_MS (15s). */
+export const DEFAULT_LOOP_INTERVAL = '5m';
+const RULES = 'run the gates (typecheck, test, lint, format:check, build), append a step entry to QUEUE.md with the finding + gates + commit SHA, update the journal list, commit (see the subject rule below) and push to master (git push origin master), then check the release policy: git describe --tags --abbrev=0, git log <tag>..HEAD --pretty=format:%s and src/release-policy.ts decideRelease() — if it reports a READY patch/minor, run `npm run release <bump>`, push the branch AND the tag (git push && git push origin vX.Y.Z), and record the new version in QUEUE.md; a major or a BREAKING change is NEVER released by the loop, only reported. Do NOT bump the version by hand.';
+const BODIES = {
+    bughunt: 'Bug hunt, one step. Read docs/BUGHUNT.md and follow it exactly: pick the next NOT-yet-covered module from its scope table (skip the ones under "Покрытые области" in QUEUE.md unless their code changed after the covering date), find ONE real reproducible defect, write the FAILING test first (RED), fix the root cause (GREEN), ' +
+        RULES +
+        ' If the module is clean, add it to "Покрытые области", write a `чисто` entry with what you verified, and commit nothing. Stop the loop with /jobs clear when every module in the scope table is covered and no covered module has changed since its covering date.',
+    textaudit: 'Text audit, one step. Read docs/TEXT-AUDIT.md and follow it exactly: pick the next NOT-yet-covered file from its scope table (skip the ones listed under "Covered areas" in QUEUE.md), audit it against the code as the source of truth, fix ONE defect family in the source file(s) plus both languages, regenerate the generated files (npm run build:readme && npm run build:llms), ' +
+        RULES +
+        ' If the file is clean, add it to "Covered areas", write a `чисто` entry with what you verified, and commit nothing. Stop the loop with /jobs clear when every file in the scope table is covered.',
+    coverage: 'Coverage step, one step: run `npm run coverage:gate`, find the module or branch whose line coverage is lowest or has NO test file at all (list `src/*.ts` without a matching `test/*.test.ts`), pick ONE of them, and write pure unit tests that pin the CURRENT behaviour — do not change the source unless a test uncovers a real bug (then switch to a fix: commit and cite docs/BUGHUNT.md). ' +
+        RULES +
+        ' Stop the loop with /jobs clear when every source module has a test file and no gate module is below its floor.',
+    dumps: 'Unparsed-dump step, one step: list `.zames/unparsed/*.txt` (dev dumps of answers that looked like a tool call but were NOT parsed) and `~/.zames/net-log` if ZAMES_NET_DEBUG was on; take the NEWEST dump not yet analysed in QUEUE.md, classify WHY parseToolCall (src/answer-parse.ts) and the XML/DSML path (src/xml-toolcall.ts) missed it, then either extend the parser with a failing test FIRST (test/answer-parse*.test.ts or test/xml-toolcall*.test.ts) or record in QUEUE.md that the answer is genuinely unparseable (a reasoning paragraph, not a call) and why. ' +
+        RULES +
+        ' Do NOT delete a dump you have not classified. Stop the loop with /jobs clear when every dump in the directory is classified.',
+    backlog: 'Backlog step, one item: read BACKLOG.md, take the highest-priority item that is NOT archived in a <details> block and is small enough for one step, implement it (a failing test first when the item is testable), ' +
+        RULES +
+        " Move the finished item under the archived <details> block with the /backlog helpers. Skip an item that needs the operator's decision and note WHY in QUEUE.md. Stop the loop with /jobs clear when BACKLOG.md has no open item left.",
+    smoke: "Live smoke step, one step: run the matching smoke script (`npm run self-smoke` for deepseek, `npm run qwen-smoke`, `npm run glm-smoke -- --headed`); it launches an ISOLATED zames instance (throwaway HOME) and must NEVER touch the operator's ~/.zames/profile or another agent's browser. If a scenario FAILS, read its output, reproduce the failing unit-level behaviour with a focused test if possible, fix the root cause (src/browser*.ts / src/qwen-*.ts / src/glm-*.ts / src/*-net-capture.ts), rerun the smoke and " +
+        RULES +
+        ' If every scenario PASSES, write a `чисто` entry with the exit code and commit nothing. Stop the loop with /jobs clear after 3 consecutive PASS runs with no new failure.',
+};
+/** True when `id` is one of the cycles. */
+export function isLoopCycle(id) {
+    return LOOP_CYCLES.includes(String(id ?? '').toLowerCase());
+}
+/**
+ * Build the ONE line a cycle sends to `/loop`. `interval` is the FIRST token
+ * (the scheduler parses it), so a bare `/bughunt 10m` retunes the period.
+ * Returns null for an unknown cycle.
+ */
+export function buildCycleLoopLine(id, interval = DEFAULT_LOOP_INTERVAL) {
+    const cycle = String(id ?? '').toLowerCase();
+    if (!isLoopCycle(cycle))
+        return null;
+    // Collapse whitespace: a newline would split the interval off the command.
+    const every = String(interval ?? '')
+        .trim()
+        .replace(/\s+/g, '');
+    const period = every || DEFAULT_LOOP_INTERVAL;
+    return '/loop ' + period + ' ' + BODIES[cycle];
+}

package/dist/release-policy.js

@@ -0,0 +1,100 @@
+// WHEN a /loop improvement cycle may cut a release. PURE and unit-tested: the
+// decision is made from the commits since the last tag, and it is the one rule
+// that keeps an unattended run from either spamming npm with a patch per fix
+// or sitting on a pile of unreleased work forever.
+//
+// The policy is deliberately COARSE. DEVELOPING.md says several fixes land as
+// ONE patch release (a 142-patch 2.82.x branch made the CHANGELOG and npm
+// unreadable), so a lone fix is NOT enough: at least MIN_COMMITS user-visible
+// changes must have accumulated. A feature or a breaking change is the
+// operator's own signal and releases alone.
+//
+// docs/chore/test/ci/build commits do not count (they never appear in a
+// user-facing changelog), but they also must not BLOCK a release: they are
+// simply ignored.
+import { parseConventionalCommit, groupCommits, } from './changelog.js';
+/** User-visible commits (feat/fix/perf/refactor/revert/remove) that release together. */
+export const MIN_COMMITS = 5;
+/**
+ * Decide whether the commits in `subjects` (git log --pretty=format:%s since
+ * the last tag) justify a release, and which bump it is.
+ *
+ * - a `!` marker -> major (alone);
+ * - any `feat:` -> minor (alone);
+ * - otherwise at least MIN_COMMITS visible commits -> patch;
+ * - anything less -> `bump: null` (wait; the next step adds to the pile).
+ */
+export function decideRelease(subjects, opts = {}) {
+    const min = opts.minCommits ?? MIN_COMMITS;
+    const parsed = (subjects || [])
+        .map((s) => parseConventionalCommit(String(s ?? '')))
+        .filter((c) => c !== null);
+    // A chore(release) commit is the release itself; it must not be counted as
+    // work and must not trigger a second release.
+    const work = parsed.filter((c) => !(c.type === 'chore' && c.scope === 'release'));
+    const breaking = work.filter((c) => c.breaking);
+    if (breaking.length) {
+        return {
+            bump: 'major',
+            counted: work.length,
+            kinds: kindsOf(work),
+            blocked: breakingNote(breaking),
+        };
+    }
+    const feats = work.filter((c) => c.type === 'feat');
+    if (feats.length) {
+        return { bump: 'minor', counted: work.length, kinds: kindsOf(work) };
+    }
+    // The changelog groups are the source of truth for "user-visible": a type
+    // that renders NO line (docs/test/chore/ci/build) is not work worth a
+    // release on its own.
+    const groups = groupCommits(work);
+    const visible = groups.Added.length +
+        groups.Fixed.length +
+        groups.Changed.length +
+        groups.Removed.length;
+    if (visible < min) {
+        return { bump: null, counted: visible, kinds: kindsOf(work) };
+    }
+    return { bump: 'patch', counted: visible, kinds: kindsOf(work) };
+}
+function kindsOf(list) {
+    const seen = [];
+    for (const c of list)
+        if (!seen.includes(c.type))
+            seen.push(c.type);
+    return seen;
+}
+function breakingNote(list) {
+    const first = list[0];
+    return ('a BREAKING change (' +
+        (first.scope ? first.scope + '): ' : '') +
+        first.description +
+        ') must be released by the operator, not by an unattended /loop');
+}
+/**
+ * A `/loop` must NEVER publish. `npm run release` only commits and tags, but
+ * the tag is what triggers the npm publish workflow — so a cycle that tagged
+ * would publish on its own.
+ */
+export const LOOP_RELEASE_BLOCKED = 'an unattended /loop must not tag: a tag push publishes to npm. ' +
+    'Report the ready bump and let the operator run `npm run release <bump>`.';
+/**
+ * The one line a cycle prints (and writes into QUEUE.md) when the pile is big
+ * enough for a release.
+ */
+export function releaseHint(d, version) {
+    if (d.blocked)
+        return 'release blocked: ' + d.blocked;
+    if (!d.bump) {
+        const left = Math.max(0, MIN_COMMITS - d.counted);
+        return ('release: not yet (' +
+            d.counted +
+            '/' +
+            MIN_COMMITS +
+            ' user-visible commits; ' +
+            left +
+            ' more)');
+    }
+    return 'release READY: npm run release ' + d.bump + ' (from ' + version + ')';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.95.6",
+  "version": "2.96.0",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {