zames_pro 2.96.0 → 2.96.2

package/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **info:** keep a /chat and /pwd value on one line
+- **status:** flatten a status/doctor value and drop a broken count
+- **limits:** never render a negative or NaN counter in /limits
+- **restore-history:** keep a plain answer that opens with 'thinking for'
+- **commands:** keep a project file/skill/command name on one /context row
+
+## [2.96.2] - 2026-11-06
+
+### Fixed
+
+- **info:** keep a /chat and /pwd value on one line
+- **status:** flatten a status/doctor value and drop a broken count
+- **limits:** never render a negative or NaN counter in /limits
+- **restore-history:** keep a plain answer that opens with 'thinking for'
+- **commands:** keep a project file/skill/command name on one /context row
+
+## [2.96.1] - 2026-11-06
+
+### Fixed
+
+- **release-policy:** one pair of parens in the BREAKING note
+- **changelog:** a group heading must start a line, not sit inside a bullet
+- **backlog:** ignore a fenced section header when appending
+- **dev-watch:** follow index.ts's hot-reloadable list (restore-history, input/layout)
+- **shell:** block a recursive rm of ./ and ../ (trailing slash)
+
 ## [2.96.0] - 2026-11-05
 
 ### Added

package/dist/backlog.js

@@ -191,8 +191,25 @@ export function appendBacklogItem(text, item) {
     }
     const lines = src.split(NL);
     const headerRe = new RegExp('^##[ ]+' + prio + '(?![0-9])');
+    // A fenced code block is MARKDOWN, not structure: a note that documents the
+    // file format contains `## P1` inside ```…```, and treating it as a section
+    // header inserted the new item INTO that fence (parseBacklogItems skips
+    // fenced headings, so the item then became invisible to /improve). Track the
+    // fence exactly like the parser does.
+    let fence = '';
     let at = -1;
     for (let i = 0; i < lines.length; i++) {
+        const fm = /^\s*(`{3,}|~{3,})/.exec(lines[i]);
+        if (fm) {
+            const mark = fm[1][0];
+            if (!fence)
+                fence = mark;
+            else if (mark === fence)
+                fence = '';
+            continue;
+        }
+        if (fence)
+            continue;
         if (headerRe.test(lines[i])) {
             // Insert right after the header and any blank lines that follow it, so
             // the newest note sits at the top of its priority block.

package/dist/changelog.js

@@ -91,31 +91,29 @@ export function syncUnreleased(changelog, body) {
     const rest = changelog.slice(afterAnchor);
     const next = rest.search(/\n## \[/);
     const tail = next < 0 ? '' : rest.slice(next);
-    const cleanBody = String(body || '')
+    // A `## ` that does not START a line is FREE TEXT inside a bullet (a commit
+    // description that documents a markdown heading, `ignore a ## P<n> header`).
+    // Matching it ANYWHERE treated that text as a group heading: the bullet was
+    // split and a FAKE `### P<n>` section appeared in the file. Every group
+    // heading is therefore recognized on WHOLE LINES only.
+    const lines = String(body || '')
         .replace(/^## \[Unreleased\]\s*/m, '')
-        // A drafted group heading must START a line of its own. When the draft
-        // carries several groups (`## Added` … `## Fixed`) without a blank line
-        // between them, the next group used to stay glued to the last bullet
-        // (`- a### Fixed`) — it was not a heading at all, so the item vanished
-        // from the rendered changelog. The lookahead is what keeps a CONTINUATION
-        // line of a multi-line bullet in place: gluing on `\n` as well joined the
-        // indent line to the next bullet and truncated the note.
-        // The draft's groups are still `## ` at this point (they become `### `
-        // below), and the FIRST group is already preceded by the blank line of
-        // the draft — so a group always starts a line, and this rule only has to
-        // punch in the missing blank line after a bullet.
-        .replace(/([^\n])(?=## )/g, '$1' + nl + nl)
-        .trim()
-        // The draft renders groups as `## Added` (top-level), but INSIDE the file
-        // a version's groups are `### Added` (a subsection of the version heading).
-        // `## [` (the next version) is left alone. The FIRST group follows the
-        // version heading directly (no bullet before it), so the blank-line rule
-        // above never fired for it — `## [Unreleased]` came out as a bare `#`
-        // followed by `# Added`. The heading owns a blank line, always.
+        .split(nl);
+    const out = [];
+    for (const line of lines) {
+        // A heading glued to the previous bullet (`- one## Added`) does not render
+        // as a heading at all: break it onto its own line, keeping the bullet.
+        const glued = /^(?!#)(\S.*[^\s`])(## .*)$/.exec(line);
+        if (glued)
+            out.push(glued[1], '', glued[2]);
+        else
+            out.push(line);
+    }
+    const cleanBody = out
+        .join(nl)
         .replace(/^## (?!\[)/gm, '### ')
-        // One blank line between the version heading and its first group, not
-        // the three the rules above can stack up.
-        .replace(/^\n+(?=### )/gm, '');
+        .replace(/^\n+(?=### )/, '')
+        .trim();
     const section = cleanBody ? nl + nl + cleanBody + nl : nl;
     return changelog.slice(0, afterAnchor) + section + tail;
 }

package/dist/commands.js

@@ -64,11 +64,16 @@ export function formatDiffStat(statText, opts = {}, t = translate('en')) {
 /** One renderable line per loaded context source (file + char count). */
 export function formatContextSources(agents, memory, skills, commands, opts = {}, t = translate('en')) {
     const lines = [];
+    // Paths, skill and command names come from the operator's PROJECT: a
+    // newline in one of them started a NEW row of the report (a crafted
+    // `/cmd\nFAKE` printed a bare `FAKE` line), so every value is flattened to
+    // one line first — the same rule as renderDoctor/formatJobLine.
+    const oneLine = (v) => String(v ?? '').replace(/\s+/g, ' ');
     lines.push(t('context.title'));
     if (typeof opts.systemPromptChars === 'number') {
         lines.push(t('context.system_prompt', { n: String(opts.systemPromptChars) }));
     }
-    const fileLine = (p, content) => '  ' + p + '  (' + content.length + ' chars)';
+    const fileLine = (p, content) => '  ' + oneLine(p) + '  (' + content.length + ' chars)';
     lines.push(t('context.agents'));
     if (agents.length)
         for (const a of agents)
@@ -84,13 +89,13 @@ export function formatContextSources(agents, memory, skills, commands, opts = {}
     lines.push(t('context.skills'));
     if (skills.length)
         for (const s of skills)
-            lines.push('  ' + s.name + (s.path ? '  ' + s.path : ''));
+            lines.push('  ' + oneLine(s.name) + (s.path ? '  ' + oneLine(s.path) : ''));
     else
         lines.push('  ' + t('context.none'));
     lines.push(t('context.commands'));
     if (commands.length)
         for (const c of commands)
-            lines.push('  /' + c.name);
+            lines.push('  /' + oneLine(c.name));
     else
         lines.push('  ' + t('context.none'));
     return lines.join(NL);

package/dist/dev-watch.js

@@ -28,6 +28,12 @@ export const HOT_RELOADABLE = new Set([
     'config',
     'fsutil',
     'backlog',
+    // index.ts reloads these too; leaving them out of THIS list made the dev
+    // watcher report a false "restart zames" warning on every edit to them.
+    'restore-history',
+    // A NESTED module: only its basename is known here, which is what the
+    // watcher compares (src/input/layout.ts).
+    'layout',
     'commands',
     'run-task',
     'attach-refs',

package/dist/info-commands.js

@@ -10,6 +10,11 @@ import { theme } from './theme.js';
  */
 export function createInfoCommands(deps) {
     const { t } = deps;
+    // A chat id comes from the page URL and the working directory from the
+    // process cwd: a newline in either would start a LINE of its own in the
+    // terminal, so a value is flattened before it is printed (the same rule
+    // `/status` and `/doctor` already follow).
+    const oneLine = (v) => String(v ?? '').replace(/\s+/g, ' ');
     const printLines = (lines, print) => {
         for (const line of lines)
             print(theme.system(line));
@@ -24,17 +29,19 @@ export function createInfoCommands(deps) {
             handler: async (ctx) => {
                 const id = deps.currentChatId();
                 if (id) {
-                    ctx.print(theme.system(t('chats.current_id', { v: id })));
-                    ctx.print(theme.system(`URL: ${deps.chatUrl(id)}`));
+                    ctx.print(theme.system(t('chats.current_id', { v: oneLine(id) })));
+                    ctx.print(theme.system(`URL: ${oneLine(deps.chatUrl(id))}`));
                     return;
                 }
                 const live = await deps.resolveChatId();
-                ctx.print(theme.system(live ? t('chats.current_id', { v: live }) : t('chats.not_created')));
+                ctx.print(theme.system(live
+                    ? t('chats.current_id', { v: oneLine(live) })
+                    : t('chats.not_created')));
             },
         },
         {
             name: 'pwd',
-            handler: (ctx) => ctx.print(theme.system(deps.workdir())),
+            handler: (ctx) => ctx.print(theme.system(oneLine(deps.workdir()))),
         },
         {
             name: 'transcript',

package/dist/limits-command.js

@@ -5,9 +5,17 @@ import { translate } from './i18n.js';
  */
 export function formatLimits(stats, opts, t = translate('en')) {
     const out = [];
+    // A counter is a count and a pause is a duration: a negative/NaN/Infinity
+    // value (a hand-edited telemetry line, a broken provider counter) must not
+    // render as `-3s` / `NaNs`, which reads like a real measurement.
+    const num = (v) => typeof v === 'number' && Number.isFinite(v) ? String(Math.max(0, v)) : '0';
     out.push({
         kind: 'title',
-        text: t('limits.title', { provider: opts.providerLabel }),
+        // The provider label comes from the config: a newline in it would start a
+        // row of its own.
+        text: t('limits.title', {
+            provider: String(opts.providerLabel ?? '').replace(/\s+/g, ' '),
+        }),
     });
     const windows = [
         ['10m', stats.last10m],
@@ -17,20 +25,20 @@ export function formatLimits(stats, opts, t = translate('en')) {
     for (const [label, n] of windows) {
         out.push({
             kind: 'window',
-            text: t('limits.window', { label, n: String(n) }),
+            text: t('limits.window', { label, n: num(n) }),
         });
     }
     out.push({
         kind: 'rate',
         text: t('limits.rate', {
-            n: String(stats.rateLimits),
-            sec: String(Math.round(stats.avgBlockMs / 1000)),
+            n: num(stats.rateLimits),
+            sec: String(Math.round(Number(num(stats.avgBlockMs)) / 1000)),
         }),
     });
     out.push({
         kind: 'interval',
         text: t('limits.interval', {
-            sec: String(Math.round(opts.intervalMs / 1000)),
+            sec: String(Math.round(Number(num(opts.intervalMs)) / 1000)),
             adaptive: opts.adaptive ? t('limits.adaptive_on') : '',
         }),
     });

package/dist/release-policy.js

@@ -67,9 +67,13 @@ function kindsOf(list) {
 }
 function breakingNote(list) {
     const first = list[0];
+    // One pair of parentheses around the WHOLE label: the scope used to close
+    // its own paren (`(cli): x)`) and leave a stray `)` in the operator report.
+    const label = first.scope
+        ? first.scope + ': ' + first.description
+        : first.description;
     return ('a BREAKING change (' +
-        (first.scope ? first.scope + '): ' : '') +
-        first.description +
+        label +
         ') must be released by the operator, not by an unattended /loop');
 }
 /**

package/dist/restore-history.js

@@ -260,7 +260,16 @@ export function stripThinkBlocks(text) {
     // "OK2"); the reasoning BODY was already removed with its subtree.
     // A single newline: with the blank-line form the `[\s\S]*?` below ate
     // the whole answer and the restored turn vanished.
-    t = t.replace(/^\s*(?:thought|thinking|think)\s+for\s+[^\n]*\n?/i, '');
+    // The header is `Thought for <duration>`: the FIRST word is the past tense
+    // (`Thought`) or the bare `Think`, and the duration must look like a TIME
+    // (`1 second`, `12s`, `2 minutes`). Matching any `think for <anything>`
+    // dropped a plain answer that OPENS with the same words.
+    t = t.replace(/^\s*(?:thought|thinking|think)\s+for\s+\d+(?:\.\d+)?\s*(?:seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h)(?![a-z])\b[^\n]*\n?/i, '');
+    // The DOM may hand the header WITHOUT its newline (`Thought for 1
+    // secondOK2`), so a header followed directly by the answer text is dropped
+    // too. The duration must be a real TIME word, never just `for <word>`: a
+    // plain answer opening with the same words keeps its line.
+    t = t.replace(/^\s*(?:thought|thinking|think)\s+for\s+\d+(?:\.\d+)?\s*(?:seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h)(?=[A-Z\u0410-\u042f])/i, '');
     // The DOM may hand the header WITHOUT its newline ("Thought for 1
     // secondOK2"): drop the header up to the first non-space run only when a
     // line break or the end of the text follows it.

package/dist/shell.js

@@ -88,13 +88,20 @@ export function assertCommandInsideRoot(root, command) {
             const raw = w.replace(/["']/g, '');
             if (!raw)
                 continue;
-            if (raw === '/' ||
-                raw === '.' ||
-                raw === '..' ||
-                raw === '~' ||
-                raw.startsWith('~/') ||
-                raw.startsWith('/') ||
-                raw.startsWith('..')) {
+            // A shell NORMALIZES a trailing separator before running the command:
+            // `rm -rf ./` and `rm -rf ../` delete the project root and its parent,
+            // but the raw word is neither `.` nor `..`, so the checks below let it
+            // through. Compare without the trailing slashes (a bare `//` is the
+            // root on POSIX and must stay one).
+            const norm = raw.replace(/\/+$/, '');
+            const bare = norm === '' ? raw.charAt(0) : norm;
+            if (bare === '/' ||
+                bare === '.' ||
+                bare === '..' ||
+                bare === '~' ||
+                bare.startsWith('~/') ||
+                bare.startsWith('/') ||
+                bare.startsWith('..')) {
                 throw new Error('Sandbox: recursive rm of an absolute/outside path is forbidden (' +
                     raw +
                     ')');

package/dist/status-command.js

@@ -6,18 +6,29 @@ export function formatStatus(s, t = translate('en')) {
     const none = t('common.none');
     const onoff = (b) => (b ? t('common.on') : t('common.off'));
     const lines = [];
-    lines.push(t('status.workdir', { v: s.workdir }));
-    lines.push(t('status.review_mode', { v: s.reviewMode || no }));
+    // Every value printed here comes from the ENVIRONMENT (a working directory,
+    // a chat id) or from the config: a newline in one of them starts a status
+    // row of its own, so each value is flattened to one line — the same rule
+    // renderDoctor already applies to its cells.
+    const oneLine = (v) => String(v ?? '').replace(/\s+/g, ' ');
+    // A count must be a real number: `String(NaN)` used to print `NaN` in a row
+    // that reads like a measurement.
+    const count = (n) => typeof n === 'number' && Number.isFinite(n) && n >= 0 ? String(n) : '0';
+    const val = (v, fallback) => v ? oneLine(v) : fallback;
+    lines.push(t('status.workdir', { v: oneLine(s.workdir) }));
+    lines.push(t('status.review_mode', {
+        v: s.reviewMode ? oneLine(s.reviewMode) : no,
+    }));
     if (s.reviewMode && s.origDir) {
-        lines.push(t('status.orig_dir', { v: s.origDir }));
+        lines.push(t('status.orig_dir', { v: oneLine(s.origDir) }));
     }
-    lines.push(t('status.chat', { v: s.chatId || none }));
+    lines.push(t('status.chat', { v: val(s.chatId, none) }));
     lines.push(t('status.fresh_next', { v: s.freshNext ? yes : no }));
     lines.push(t('status.prompt_next', { v: s.promptNext ? yes : no }));
-    lines.push(t('status.last_chat', { v: s.lastChat || none }));
-    lines.push(t('status.sessions', { v: s.sessionsDir }));
+    lines.push(t('status.last_chat', { v: val(s.lastChat, none) }));
+    lines.push(t('status.sessions', { v: oneLine(s.sessionsDir) }));
     lines.push(t('status.dev', { v: s.devMode ? t('common.on') : t('common.off') }));
-    lines.push(t('status.max_iter', { v: s.maxIterations }));
+    lines.push(t('status.max_iter', { v: count(s.maxIterations) }));
     lines.push(t('status.headless', { v: s.headless ? yes : no }));
     lines.push(t('status.debug', { v: s.debug ? yes : no }));
     lines.push(t('status.toggles', {
@@ -26,27 +37,28 @@ export function formatStatus(s, t = translate('en')) {
     }));
     lines.push(t('status.undo', { v: onoff(s.undo) }));
     lines.push(t('status.checkpoint', { v: onoff(s.checkpoint) }));
-    lines.push(t('status.transcript', { v: s.transcriptFile || t('common.off') }));
-    // The GOAL is operator text (`/goal <free text>`) and a newline in it would
-    // start a new terminal line, faking another status row (`FAKE: hacked`) —
-    // one status entry must stay on one line.
-    const oneLine = (v) => String(v ?? '').replace(/\s+/g, ' ');
+    lines.push(t('status.transcript', {
+        v: s.transcriptFile ? oneLine(s.transcriptFile) : t('common.off'),
+    }));
+    // The GOAL is operator text (`/goal <free text>`): one status entry must
+    // stay on one line.
     lines.push(t('status.goal', { v: s.goal ? oneLine(s.goal) : none }));
-    lines.push(t('status.locale', { v: s.localeName }));
+    lines.push(t('status.locale', { v: oneLine(s.localeName) }));
     // A NEGATIVE tool count is nonsense (a broken MCP server status, a
-    // hand-edited value): "MCP tools: -2" reads like a real measurement, the
-    // same rule the token counter below already follows.
-    // `none` ("(none)") would claim that the tools themselves are absent;
-    // with no MCP pool configured the COUNT is simply unknown.
-    const mcpCount = s.mcpToolCount === null || s.mcpToolCount < 0
+    // hand-edited value): "MCP tools: -2" reads like a real measurement.
+    const mcpCount = s.mcpToolCount === null ||
+        !Number.isFinite(s.mcpToolCount) ||
+        s.mcpToolCount < 0
         ? t('common.unknown')
-        : s.mcpToolCount;
+        : String(s.mcpToolCount);
     lines.push(t('status.mcp', { v: mcpCount }));
     // A NEGATIVE count is nonsense (a broken provider counter): show "unknown"
     // rather than a number that reads like a real measurement.
-    const tokens = s.tokenUsage === null || s.tokenUsage < 0 ? null : s.tokenUsage;
+    const tokens = s.tokenUsage === null || !Number.isFinite(s.tokenUsage) || s.tokenUsage < 0
+        ? null
+        : s.tokenUsage;
     lines.push(t('status.tokens', {
-        v: tokens === null ? t('common.unknown') : tokens,
+        v: tokens === null ? t('common.unknown') : String(tokens),
     }));
     return lines;
 }
@@ -57,26 +69,31 @@ export function formatStatus(s, t = translate('en')) {
  */
 export function doctorProbeSummary(p) {
     const rows = [];
+    // A branch name, a missing capability id and a server/tool COUNT come from
+    // the repository and from a broken MCP probe: a newline started a row of its
+    // own and `NaN`/`-3` read like real measurements.
+    const oneLine = (v) => String(v ?? '').replace(/\s+/g, ' ');
+    const count = (n) => typeof n === 'number' && Number.isFinite(n) && n >= 0 ? n : 0;
     rows.push({
         status: p.gitOk ? 'ok' : 'warn',
-        label: p.gitOk ? 'git: ' + (p.gitBranch || 'detached') : 'git: absent',
+        label: p.gitOk
+            ? 'git: ' + oneLine(p.gitBranch || 'detached')
+            : 'git: absent',
     });
     rows.push({
         status: p.authSaved ? 'ok' : 'warn',
         label: p.authSaved ? 'auth: saved' : 'auth: not saved',
     });
+    const servers = count(p.mcpServers);
+    const tools = count(p.mcpTools);
     rows.push({
-        status: p.mcpTools > 0 ? 'ok' : 'warn',
-        label: 'mcp: ' +
-            String(p.mcpServers) +
-            ' servers / ' +
-            String(p.mcpTools) +
-            ' tools',
+        status: tools > 0 ? 'ok' : 'warn',
+        label: 'mcp: ' + String(servers) + ' servers / ' + String(tools) + ' tools',
     });
     if (p.uiMissingCritical && p.uiMissingCritical.length) {
         rows.push({
             status: 'warn',
-            label: 'ui: missing ' + p.uiMissingCritical.join(', '),
+            label: 'ui: missing ' + oneLine(p.uiMissingCritical.join(', ')),
         });
     }
     return rows;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.0",
+  "version": "2.96.2",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {