zames_pro 2.96.3 → 2.96.5

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.5] - 2026-11-06
+
+### Fixed
+
+- **web:** tolerate whitespace around = in a DuckDuckGo result attribute
+- **web:** recognise x-zip and x-msdownload as binary content
+- **web:** drop the page head and keep <pre> code intact when converting HTML
+- **web:** share one in-flight headless context between concurrent fetches
+- **scheduler:** never scan cron forever on a non-finite fromMs
+
+## [2.96.4] - 2026-11-06
+
+### Fixed
+
+- **tui:** keep a tall suggestion popup from overflowing the layout
+- **scheduler:** scan cron in UTC so a DST fall-back hour is not skipped
+- **context:** parse a YAML block list of command arguments
+- **provider-fallback:** probe a guest-capable provider without the guest flag
+- **cli:** accept the --flag=value spelling of a value flag
+
 ## [2.96.3] - 2026-11-06
 
 ### Fixed

package/dist/cli-args.js

@@ -22,6 +22,14 @@ export const SKIP_VALUE_FLAGS = [
 export function createCliArgs(argv) {
     const args = Array.isArray(argv) ? argv : [];
     const getArg = (flag, fallback = null) => {
+        // `--task=fix it` is the common shell spelling: the SEPARATE form below
+        // never matched it, so the value was dropped from the task text and the
+        // operator's prompt vanished. Check the `=` form first.
+        const eq = flag + '=';
+        const joined = args.find((a) => a.startsWith(eq));
+        if (joined !== undefined && joined.length > eq.length) {
+            return joined.slice(eq.length);
+        }
         const i = args.indexOf(flag);
         // Truthiness, not `!== undefined`: an EMPTY value (`--task ''`) must
         // fall back too - an empty task is not a task. A following FLAG is not

package/dist/context.js

@@ -332,11 +332,15 @@ function parseFrontmatter(raw) {
     const userInvokable = typeof out['user-invokable'] === 'string'
         ? out['user-invokable'].toLowerCase() !== 'false'
         : undefined;
+    // A YAML BLOCK LIST (`arguments:` + `  - env`) folds into one string with
+    // the list markers, so splitting on whitespace produced `['-', 'env']`: every
+    // declared name was 'missing' and the command was refused. Strip the markers
+    // first; the inline form (`arguments: env mode`) still works.
     const argumentsList = typeof out['arguments'] === 'string'
         ? out['arguments']
             .split(/[,\s]+/)
             .map((s) => s.trim())
-            .filter(Boolean)
+            .filter((s) => s && s !== '-')
         : undefined;
     return {
         name: out.name,

package/dist/provider-fallback.js

@@ -26,7 +26,10 @@ export async function pickFallbackProvider(active, candidates, probeLogin, hasMa
             continue;
         // A live GUEST session is not a fallback (it dies in a few turns), but the
         // provider is still authorizable — signing in makes it a candidate.
-        if (c.guestAllowed && c.guestSession !== false) {
+        // `guestSession` is OPTIONAL: an older caller that predates the field
+        // leaves it undefined, and reading that as "a guest" silently refused to
+        // fall back to a signed-in provider with a live session.
+        if (c.guestAllowed && c.guestSession === true) {
             authorizable.push(c.id);
             continue;
         }

package/dist/scheduler.js

@@ -10,6 +10,9 @@ export function parseInterval(text) {
     const n = Number(m[1]);
     if (!Number.isFinite(n) || n <= 0)
         return null;
+    // `n * mult` can overflow to Infinity for a huge digit string; the range
+    // check below then compares Infinity > MAX_TIMER_MS and rejects it, but only
+    // AFTER the multiplication — keep the guard explicit for both.
     const unit = (m[2] || 's').toLowerCase();
     const mult = unit.startsWith('h')
         ? 3_600_000
@@ -157,18 +160,30 @@ export function nextCronTime(expr, fromMs) {
     const c = parseCron(expr);
     if (!c)
         return null;
-    const d = new Date(fromMs);
-    d.setSeconds(0, 0);
-    d.setMinutes(d.getMinutes() + 1);
+    // The scan steps in UTC MILLISECONDS, not local minutes: on the autumn DST
+    // FALL-BACK an hour repeats, and `setMinutes(getMinutes()+1)` visits every
+    // wall-clock minute TWICE (then jumps over the second occurrence), so a
+    // 02:45 job created after the first 02:45 fired the NEXT DAY. A fixed
+    // 60-second step visits every real minute exactly once; the field checks
+    // still use the LOCAL getters, so the wall-clock match is unchanged.
+    // A non-finite/huge `fromMs` (a clock past 8.64e15, a hand-edited job) made
+    // `limit` Infinity and the scan walked one minute at a time FOREVER.
+    if (!Number.isFinite(fromMs) || Math.abs(fromMs) > 8.64e15)
+        return null;
+    const step = 60_000;
+    let t = Math.floor(fromMs / step) * step + step;
     const limit = fromMs + 4 * 366 * 24 * 60 * 60 * 1000;
-    while (d.getTime() <= limit) {
+    if (!Number.isFinite(limit))
+        return null;
+    while (t <= limit) {
+        const d = new Date(t);
         if (c.minute.has(d.getMinutes()) &&
             c.hour.has(d.getHours()) &&
             c.month.has(d.getMonth() + 1) &&
             dayMatches(c, d)) {
-            return d.getTime();
+            return t;
         }
-        d.setMinutes(d.getMinutes() + 1);
+        t += step;
     }
     return null;
 }

package/dist/tui/layout.js

@@ -20,8 +20,15 @@ export function fullScreenLayout(input) {
     // width — and the pure helper stays consistent with what it renders.
     const cols = Math.max(1, Math.floor(input.cols) || 80);
     const box = inputBoxRows(input.prompt, input.buf, input.cursor, cols, input.borderCols ?? 2);
-    const suggestRows = Math.max(0, Math.floor(input.suggestRows) || 0);
-    const panelRows = HEADER_ROWS + STATUS_ROWS + box + suggestRows + HINT_ROWS;
+    const wanted = Math.max(0, Math.floor(input.suggestRows) || 0);
+    // The layout must FIT the terminal: with a tall popup (a project with many
+    // custom commands) the reserved rows exceeded `termRows`, `logHeight` was
+    // clamped to 1 and the panel still overflowed — the input rows were pushed
+    // below the screen. The popup gives way first (it is a hint list), the log
+    // keeps at least one row.
+    const fixed = HEADER_ROWS + STATUS_ROWS + box + HINT_ROWS;
+    const suggestRows = Math.max(0, Math.min(wanted, termRows - fixed - 1));
+    const panelRows = fixed + suggestRows;
     const logHeight = Math.max(1, termRows - panelRows);
     // The caret counts the SAME viewport the reservation uses.
     // The suggestion popup is drawn ABOVE the box and the box does NOT move, so

package/dist/web.js

@@ -37,6 +37,7 @@ export function htmlToText(html) {
     // document to the next.
     pendingHighSurrogate = null;
     // Remove blocks we don't need
+    const parkedPre = [];
     let s = html
         // A tag that never CLOSES (a truncated body, or HTML the regex cannot
         // pair) used to leak its raw JS/CSS into the text: also drop everything
@@ -47,6 +48,10 @@ export function htmlToText(html) {
         .replace(/<style\b[\s\S]*$/i, '')
         .replace(/<noscript[\s\S]*?<\/noscript>/gi, '')
         .replace(/<noscript\b[\s\S]*$/i, '')
+        // The <head> (title, meta) is page CHROME, not content: left in place the
+        // title glued itself to the first paragraph (`My pageBody`).
+        .replace(/<head[\s\S]*?<\/head>/gi, '')
+        .replace(/<title[\s\S]*?<\/title>/gi, '')
         .replace(/<svg[\s\S]*?<\/svg>/gi, '')
         .replace(/<svg\b[\s\S]*$/i, '')
         .replace(/<!--[\s\S]*?-->/g, '');
@@ -60,11 +65,18 @@ export function htmlToText(html) {
     // `<td>42</td>` became `Name42` — two independent values fused into one, and
     // the model reported a number that never appeared on the page.
     s = s
+        // A `<pre>` block is CODE: a bare `<` inside it (`if (a < b)`) is text, not
+        // the start of a tag, so the generic strip below would eat the rest of the
+        // line. Park the block, then restore it after the tag removal.
+        .replace(/<pre\b[^>]*>([\s\S]*?)<\/pre>/gi, (_m, code) => '\u0000PRE' + (parkedPre.push(code) - 1) + 'PRE\u0000')
         .replace(/<\/(h[1-6]|p|div|li|tr|section|article)>/gi, '\n')
         .replace(/<\/(td|th)>/gi, ' ')
         .replace(/<br\s*\/?>/gi, '\n')
         .replace(/<li[^>]*>/gi, '- ')
         .replace(/<[^>]+>/g, '');
+    // A parked `<pre>` block comes back AFTER the tag strip, with only its own
+    // tags removed and its text kept verbatim.
+    s = s.replace(/\u0000PRE(\d+)PRE\u0000/g, (_m, i) => (parkedPre[Number(i)] ?? '').replace(/<[^>]+>/g, ''));
     // HTML entities — the basic ones
     s = s
         .replace(/&nbsp;/g, ' ')
@@ -406,7 +418,7 @@ export function isBinaryContentType(contentType) {
     if (/\+(json|xml)$/.test(ct))
         return false;
     if (/^(image|audio|video|font|model)\//.test(ct) ||
-        /^application\/(pdf|zip|gzip|x-gzip|x-tar|octet-stream|msword|vnd\.|x-7z|x-rar|x-bzip|x-protobuf|wasm)/.test(ct)) {
+        /^application\/(pdf|zip|gzip|x-gzip|x-tar|octet-stream|msword|vnd\.|x-7z|x-rar|x-bzip|x-zip|x-msdownload|x-protobuf|wasm|epub\+zip)/.test(ct)) {
         return true;
     }
     return false;
@@ -503,13 +515,32 @@ async function getHeadless() {
 // tested without launching a real browser.
 export function createReusable(factory, dispose) {
     let cached = null;
+    // The FACTORY is async: checking `cached === null` and then awaiting it let
+    // two concurrent get() calls BOTH run the factory (two Chromium contexts,
+    // the first leaked). The in-flight promise is cached, so every caller waits
+    // for the SAME value.
+    let inflight = null;
     return {
         async get() {
-            if (cached === null)
-                cached = await factory();
-            return cached;
+            if (cached !== null)
+                return cached;
+            if (!inflight) {
+                inflight = factory().then((v) => {
+                    cached = v;
+                    inflight = null;
+                    return v;
+                }, (e) => {
+                    inflight = null;
+                    throw e;
+                });
+            }
+            return inflight;
         },
         async reset() {
+            if (inflight) {
+                // A failed factory must not leave a poisoned promise behind.
+                await inflight.catch(() => { });
+            }
             if (cached === null)
                 return;
             const v = cached;
@@ -673,9 +704,11 @@ export function parseDuckDuckGoResults(body, limit) {
     // through a proxy does), so each quote style is accepted rather than only
     // `class="…"`. Rejecting them made a valid page parse to zero results and
     // WebSearch answer "the output format may have changed".
-    const anchorRe = /<a[^>]*class=(?:"([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a>/gi;
+    // HTML allows whitespace around the `=` of an attribute (`class = "x"`);
+    // requiring it to touch both sides made such a page parse to ZERO results.
+    const anchorRe = /<a[^>]*class\s*=\s*(?:"([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a>/gi;
     const hrefOf = (tag) => {
-        const m = tag.match(/href=(?:"([^"]*)"|'([^']*)')/i);
+        const m = tag.match(/href\s*=\s*(?:"([^"]*)"|'([^']*)')/i);
         return m ? (m[1] ?? m[2] ?? '') : '';
     };
     let cur = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.3",
+  "version": "2.96.5",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {