zames_pro 2.96.4 → 2.96.6

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.6] - 2026-11-06
+
+### Fixed
+
+- **input:** drop a dangling ZWJ when a truncation cuts an emoji sequence
+- **input:** count a ZWJ emoji sequence as one glyph in the layout
+- **tui:** ZAMES_NO_BG=0 no longer disables the themed background
+- **markdown:** an unknown code-fence language falls back to plain text
+- **web:** decode an escaped HTML entity only once
+
+## [2.96.5] - 2026-11-06
+
+### Fixed
+
+- **web:** tolerate whitespace around = in a DuckDuckGo result attribute
+- **web:** recognise x-zip and x-msdownload as binary content
+- **web:** drop the page head and keep <pre> code intact when converting HTML
+- **web:** share one in-flight headless context between concurrent fetches
+- **scheduler:** never scan cron forever on a non-finite fromMs
+
 ## [2.96.4] - 2026-11-06
 
 ### Fixed

package/dist/input/layout.js

@@ -167,6 +167,15 @@ export function visRows(s, cols) {
 // zero-width joiner/space/variation selectors count as 0.
 export function visLen(s) {
     s = String(s);
+    // An emoji SEQUENCE renders as ONE glyph but occupies several code
+    // points: ZWJ-joined, a skin-tone modifier, a keycap. Counting each
+    // point separately measured a family as 6 columns instead of 2, so the
+    // layout reserved extra rows and the cursor column drifted. The sequence
+    // is replaced by ONE placeholder cell before measuring.
+    s = s.replace(/(?:\p{Extended_Pictographic}|\p{Emoji_Modifier}|\u200d|\ufe0f)+/gu, 
+    // The placeholder is a WIDE glyph (2 columns), the width an emoji renders
+    // at: a single `X` would under-count it.
+    '😀');
     let n = 0;
     let i = 0;
     while (i < s.length) {
@@ -399,6 +408,11 @@ export function truncateToWidth(s, maxCols) {
         used += w;
         i += ch.length;
     }
+    // A cut inside a ZWJ emoji sequence leaves a DANGLING joiner: the terminal
+    // glues the following `…` to the emoji, so the marker becomes invisible and
+    // the visible line is wider than requested. Drop the dangling tail (the
+    // whole incomplete grapheme) before closing the style.
+    out = out.replace(/\u200d+$/, '');
     // The visible text was cut BEFORE any trailing RESET, so the ellipsis and
     // everything printed after it on the row would inherit the last colour.
     // Close any style the kept prefix opened (the text may still be plain, in

package/dist/markdown.js

@@ -98,11 +98,31 @@ export function renderMarkdown(text) {
             // opt-out is NO_COLOR, handled above.
             color: true,
             theme: mdTheme(p),
-            highlighter: (code, lang) => highlight(code, {
-                language: lang || 'plaintext',
-                ignoreIllegals: true,
-                theme: hlTheme(p),
-            }),
+            // An UNKNOWN language tag throws inside cli-highlight, and the throw
+            // escaped the whole render: ONE ```` ```kotlin-ish ```` fence turned the
+            // entire answer into raw markdown (no wrap, no theme, no code box). Fall
+            // back to plaintext for this block only.
+            highlighter: (code, lang) => {
+                try {
+                    return highlight(code, {
+                        language: lang || 'plaintext',
+                        ignoreIllegals: true,
+                        theme: hlTheme(p),
+                    });
+                }
+                catch {
+                    try {
+                        return highlight(code, {
+                            language: 'plaintext',
+                            ignoreIllegals: true,
+                            theme: hlTheme(p),
+                        });
+                    }
+                    catch {
+                        return String(code);
+                    }
+                }
+            },
             codeBox: true,
             tableBorder: 'unicode',
             listIndent: 2,

package/dist/scheduler.js

@@ -10,6 +10,9 @@ export function parseInterval(text) {
     const n = Number(m[1]);
     if (!Number.isFinite(n) || n <= 0)
         return null;
+    // `n * mult` can overflow to Infinity for a huge digit string; the range
+    // check below then compares Infinity > MAX_TIMER_MS and rejects it, but only
+    // AFTER the multiplication — keep the guard explicit for both.
     const unit = (m[2] || 's').toLowerCase();
     const mult = unit.startsWith('h')
         ? 3_600_000
@@ -163,9 +166,15 @@ export function nextCronTime(expr, fromMs) {
     // 02:45 job created after the first 02:45 fired the NEXT DAY. A fixed
     // 60-second step visits every real minute exactly once; the field checks
     // still use the LOCAL getters, so the wall-clock match is unchanged.
+    // A non-finite/huge `fromMs` (a clock past 8.64e15, a hand-edited job) made
+    // `limit` Infinity and the scan walked one minute at a time FOREVER.
+    if (!Number.isFinite(fromMs) || Math.abs(fromMs) > 8.64e15)
+        return null;
     const step = 60_000;
     let t = Math.floor(fromMs / step) * step + step;
     const limit = fromMs + 4 * 366 * 24 * 60 * 60 * 1000;
+    if (!Number.isFinite(limit))
+        return null;
     while (t <= limit) {
         const d = new Date(t);
         if (c.minute.has(d.getMinutes()) &&

package/dist/tui/background.js

@@ -23,7 +23,13 @@ function hexToOsc(hex) {
  * testable without a terminal.
  */
 export function backgroundOsc(name) {
-    if (process.env.NO_COLOR || process.env.ZAMES_NO_BG)
+    // NO_COLOR is "present means off" (no-color.org). ZAMES_NO_BG is our OWN
+    // switch: a shell profile writing `ZAMES_NO_BG=0` clearly means KEEP it, so
+    // only a truthy value opts out.
+    const noBg = String(process.env.ZAMES_NO_BG ?? '').toLowerCase();
+    if (process.env.NO_COLOR)
+        return '';
+    if (noBg && noBg !== '0' && noBg !== 'false' && noBg !== 'no')
         return '';
     const id = isThemeName(name) ? name : DEFAULT_THEME;
     return '\x1b]11;rgb:' + hexToOsc(ALL_PALETTES[id].bg) + '\x07';

package/dist/web.js

@@ -37,6 +37,7 @@ export function htmlToText(html) {
     // document to the next.
     pendingHighSurrogate = null;
     // Remove blocks we don't need
+    const parkedPre = [];
     let s = html
         // A tag that never CLOSES (a truncated body, or HTML the regex cannot
         // pair) used to leak its raw JS/CSS into the text: also drop everything
@@ -47,6 +48,10 @@ export function htmlToText(html) {
         .replace(/<style\b[\s\S]*$/i, '')
         .replace(/<noscript[\s\S]*?<\/noscript>/gi, '')
         .replace(/<noscript\b[\s\S]*$/i, '')
+        // The <head> (title, meta) is page CHROME, not content: left in place the
+        // title glued itself to the first paragraph (`My pageBody`).
+        .replace(/<head[\s\S]*?<\/head>/gi, '')
+        .replace(/<title[\s\S]*?<\/title>/gi, '')
         .replace(/<svg[\s\S]*?<\/svg>/gi, '')
         .replace(/<svg\b[\s\S]*$/i, '')
         .replace(/<!--[\s\S]*?-->/g, '');
@@ -60,15 +65,25 @@ export function htmlToText(html) {
     // `<td>42</td>` became `Name42` — two independent values fused into one, and
     // the model reported a number that never appeared on the page.
     s = s
+        // A `<pre>` block is CODE: a bare `<` inside it (`if (a < b)`) is text, not
+        // the start of a tag, so the generic strip below would eat the rest of the
+        // line. Park the block, then restore it after the tag removal.
+        .replace(/<pre\b[^>]*>([\s\S]*?)<\/pre>/gi, (_m, code) => '\u0000PRE' + (parkedPre.push(code) - 1) + 'PRE\u0000')
         .replace(/<\/(h[1-6]|p|div|li|tr|section|article)>/gi, '\n')
         .replace(/<\/(td|th)>/gi, ' ')
         .replace(/<br\s*\/?>/gi, '\n')
         .replace(/<li[^>]*>/gi, '- ')
         .replace(/<[^>]+>/g, '');
-    // HTML entities — the basic ones
+    // A parked `<pre>` block comes back AFTER the tag strip, with only its own
+    // tags removed and its text kept verbatim.
+    s = s.replace(/\u0000PRE(\d+)PRE\u0000/g, (_m, i) => (parkedPre[Number(i)] ?? '').replace(/<[^>]+>/g, ''));
+    // HTML entities — the basic ones. `&amp;` is decoded LAST, otherwise an
+    // escaped entity (`&amp;#38;` — the literal text `&#38;`) is decoded TWICE
+    // and the page's text is changed.
+    const AMP = String.fromCharCode(0) + 'amp' + String.fromCharCode(0);
+    s = s.replace(/&amp;/g, AMP);
     s = s
         .replace(/&nbsp;/g, ' ')
-        .replace(/&amp;/g, '&')
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
         .replace(/&quot;/g, '"')
@@ -77,7 +92,9 @@ export function htmlToText(html) {
         .replace(/&ndash;/g, '–')
         .replace(/&hellip;/g, '…')
         .replace(/&#(\d+);/g, (_, n) => decodeEntityCode(Number(n)))
-        .replace(/&#x([0-9a-f]+);/gi, (_, n) => decodeEntityCode(parseInt(n, 16)));
+        .replace(/&#x([0-9a-f]+);/gi, (_, n) => decodeEntityCode(parseInt(n, 16)))
+        .split(AMP)
+        .join('&');
     // Collapse blank lines
     s = s
         .split('\n')
@@ -406,7 +423,7 @@ export function isBinaryContentType(contentType) {
     if (/\+(json|xml)$/.test(ct))
         return false;
     if (/^(image|audio|video|font|model)\//.test(ct) ||
-        /^application\/(pdf|zip|gzip|x-gzip|x-tar|octet-stream|msword|vnd\.|x-7z|x-rar|x-bzip|x-protobuf|wasm)/.test(ct)) {
+        /^application\/(pdf|zip|gzip|x-gzip|x-tar|octet-stream|msword|vnd\.|x-7z|x-rar|x-bzip|x-zip|x-msdownload|x-protobuf|wasm|epub\+zip)/.test(ct)) {
         return true;
     }
     return false;
@@ -503,13 +520,32 @@ async function getHeadless() {
 // tested without launching a real browser.
 export function createReusable(factory, dispose) {
     let cached = null;
+    // The FACTORY is async: checking `cached === null` and then awaiting it let
+    // two concurrent get() calls BOTH run the factory (two Chromium contexts,
+    // the first leaked). The in-flight promise is cached, so every caller waits
+    // for the SAME value.
+    let inflight = null;
     return {
         async get() {
-            if (cached === null)
-                cached = await factory();
-            return cached;
+            if (cached !== null)
+                return cached;
+            if (!inflight) {
+                inflight = factory().then((v) => {
+                    cached = v;
+                    inflight = null;
+                    return v;
+                }, (e) => {
+                    inflight = null;
+                    throw e;
+                });
+            }
+            return inflight;
         },
         async reset() {
+            if (inflight) {
+                // A failed factory must not leave a poisoned promise behind.
+                await inflight.catch(() => { });
+            }
             if (cached === null)
                 return;
             const v = cached;
@@ -673,9 +709,11 @@ export function parseDuckDuckGoResults(body, limit) {
     // through a proxy does), so each quote style is accepted rather than only
     // `class="…"`. Rejecting them made a valid page parse to zero results and
     // WebSearch answer "the output format may have changed".
-    const anchorRe = /<a[^>]*class=(?:"([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a>/gi;
+    // HTML allows whitespace around the `=` of an attribute (`class = "x"`);
+    // requiring it to touch both sides made such a page parse to ZERO results.
+    const anchorRe = /<a[^>]*class\s*=\s*(?:"([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a>/gi;
     const hrefOf = (tag) => {
-        const m = tag.match(/href=(?:"([^"]*)"|'([^']*)')/i);
+        const m = tag.match(/href\s*=\s*(?:"([^"]*)"|'([^']*)')/i);
         return m ? (m[1] ?? m[2] ?? '') : '';
     };
     let cur = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.4",
+  "version": "2.96.6",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {