zames_pro 2.96.8 → 2.96.10

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.10] - 2026-11-06
+
+### Fixed
+
+- **export:** keep a tool result on one line and mark a clipped one
+- **config:** validate a live store value before writing it
+- **config:** an unknown language is rejected instead of silently defaulted
+- **config:** a password keeps its spaces when set from the command line
+- **transcript:** cap the session label so the file name fits the filesystem
+
+## [2.96.9] - 2026-11-06
+
+### Fixed
+
+- **statusline:** a backgrounded child no longer holds the badge until the timeout
+- **resume:** a junk session record is skipped instead of crashing /sessions
+- **model:** a model id with a newline is flattened to one line
+- **context-limit:** a non-finite retry budget gives up instead of retrying forever
+- **spinner:** a dots-only phrase keeps a label instead of going empty
+
 ## [2.96.8] - 2026-11-06
 
 ### Fixed

package/dist/commands.js

@@ -299,10 +299,17 @@ export function formatExport(entries, meta = {}) {
                 JSON.stringify(e.args ?? {}));
         }
         else if (type === 'tool_result') {
+            // A tool result is TEXT: a newline in it started a bare report line and
+            // broke the one-line list. Flatten it, and MARK a clipped result so the
+            // export does not look like the whole output.
+            const raw = String(e.result ?? '');
+            const flat = raw.split(/\s*\r?\n\s*/).join(' ↵ ');
+            const clipped = clipExportText(flat, 500);
             out.push(' -> ' +
                 String(e.tool ?? '?') +
                 ': ' +
-                clipExportText(String(e.result ?? ''), 500));
+                clipped +
+                (clipped.length < flat.length ? ' …' : ''));
         }
         else if (type === 'assistant_final') {
             out.push('## Answer');

package/dist/config-command.js

@@ -8,6 +8,7 @@
 // The interactive menu (`/config` bare or `menu`) is delegated to openMenu()
 // because it pauses the editor and reads keys itself.
 import { theme } from './theme.js';
+import { isLocale } from './i18n.js';
 import { configGetValue, configValueHint } from './config-commands.js';
 /**
  * Handle a `/config <sub>` text command. Never throws for a bad subcommand or
@@ -65,6 +66,18 @@ export async function handleConfigCommand(input, deps) {
         const field = schema.find((f) => f.path === 'ui.locale');
         if (!field)
             return;
+        // `normalizeLocale` FALLS BACK to the default for anything it does not
+        // understand, so `/config lang xx` silently SAVED English and reported it
+        // as set — the operator's typo was accepted. Reject an unknown value.
+        const normalized = String(val).trim().toLowerCase();
+        if (!isLocale(normalized) &&
+            !['russian', 'русский', 'english', 'английский'].includes(normalized)) {
+            printErr(theme.error(t('cfg.bad_value', {
+                v: 'ui.locale',
+                type: configValueHint(field, t),
+            })));
+            return;
+        }
         const loc = normalizeLocale(val);
         try {
             setValue(field, loc);
@@ -94,7 +107,16 @@ export async function handleConfigCommand(input, deps) {
     }
     if (sub === 'set') {
         const key = parts[2];
-        const raw = parts.slice(3).join(' ');
+        // A password/username is a SECRET: it may legally contain repeated,
+        // leading or trailing spaces, and joining the tokens with ONE space
+        // silently changed it (auto-login then failed with "wrong password").
+        // Take the text after the key VERBATIM for those fields.
+        const isSecret = /(password|username)\/?$/i.test(key || '');
+        const raw = isSecret
+            ? String(input)
+                .replace(/^\s*\/config\s+set\s+\S+\s?/i, '')
+                .replace(/\s+$/, '')
+            : parts.slice(3).join(' ');
         const field = schema.find((f) => f.path === key);
         if (!field) {
             printErr(theme.error(t('cfg.unknown_key', { v: key || '' })));

package/dist/config-live.js

@@ -59,16 +59,37 @@ export function applyBrowserLiveConfig(path, value, browser) {
  *  their config at construction, so a change must be written to the instance
  *  too. */
 export function applyStoreLiveConfig(path, value, stores) {
+    // The browser map VALIDATES its values; these stores were written blindly,
+    // so a negative `maxBackups` (rejected by the schema) or a string could
+    // reach a live store and change retention silently.
+    const isCount = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    const isBool = (v) => typeof v === 'boolean';
     if (path === 'undo.enabled' || path === 'undo.maxBackups') {
         if (!stores.undo)
             return false;
-        stores.undo[path === 'undo.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'undo.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.undo.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.undo.maxBackups = value;
         return true;
     }
     if (path === 'checkpoint.enabled' || path === 'checkpoint.maxBackups') {
         if (!stores.checkpoints)
             return false;
-        stores.checkpoints[path === 'checkpoint.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'checkpoint.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.checkpoints.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.checkpoints.maxBackups = value;
         return true;
     }
     return false;

package/dist/context-limit.js

@@ -9,7 +9,11 @@ export async function recoverFromContextLimit(deps, original) {
         notice(t(keys.giveUp, { provider }));
         return { resend: false, error: original };
     };
-    if (!recover || attempt > maxRetries)
+    // A NON-FINITE budget makes `attempt > maxRetries` false forever (`x > NaN`
+    // is false), so a chat that can never accept another message was
+    // re-compacted on every send with no budget at all. Require a real number.
+    const budget = Number.isFinite(maxRetries) && maxRetries >= 0 ? maxRetries : 0;
+    if (!recover || attempt > budget)
         return giveUp();
     notice(t(keys.compact, { provider }));
     let recovered = false;

package/dist/model-command.js

@@ -12,7 +12,13 @@ export function parseModelIntent(provider, arg, t = translate('en')) {
             message: t('model.unsupported', { provider }),
         };
     }
-    const model = String(arg ?? '').trim();
+    // A model id is a SINGLE token: the operator's text can carry a newline
+    // (a paste, a wrapped line), and it was stored and echoed verbatim — the
+    // newline broke the status line and the `/model set` report into fake
+    // rows. Collapse whitespace; an id is never allowed to contain a break.
+    const model = String(arg ?? '')
+        .replace(/\s+/g, ' ')
+        .trim();
     return model ? { kind: 'set', model } : { kind: 'list' };
 }
 /** The text for an EMPTY model list (a provider that answered with nothing). */

package/dist/resume-command.js

@@ -14,8 +14,13 @@ export function filterSessions(sessions, filter) {
         .toLowerCase();
     if (!q)
         return sessions.slice();
-    return sessions.filter((s) => (s.title || '').toLowerCase().includes(q) ||
-        (s.workdir || '').toLowerCase().includes(q));
+    // Session files are hand-editable and are written by OLDER builds: an array
+    // element can be `null`, and a field can be a number. Reading them blindly
+    // threw a raw TypeError out of `/sessions`.
+    const text = (v) => (typeof v === 'string' ? v : '');
+    return sessions.filter((s) => !!s &&
+        (text(s.title).toLowerCase().includes(q) ||
+            text(s.workdir).toLowerCase().includes(q)));
 }
 /**
  * A chat id only exists on the backend that created it, so opening a session

package/dist/spinner.js

@@ -15,7 +15,10 @@ export function randomThinkingPhrase(locale = DEFAULT_LOCALE) {
 }
 // Strip the trailing ellipsis from the phrase — dots are animated separately.
 export function stripEllipsis(phrase) {
-    return phrase.replace(/[.…]+\s*$/, '');
+    const out = phrase.replace(/[.…]+\s*$/, '');
+    // A phrase that is ONLY dots (an odd translation) must not become an EMPTY
+    // label: the spinner would then animate bare dots with no text at all.
+    return out === '' ? phrase.trim() : out;
 }
 // Dot animation shared by BOTH UIs (the ora spinner and the LineEditor): start
 // from an empty string (0 dots), then grow. The width is padded to the maximum

package/dist/statusline.js

@@ -94,6 +94,15 @@ export function runStatusLineCommand(workdir, command, info, timeoutMs = 4000) {
             clearTimeout(timer);
             finish();
         });
+        // A NEWLINE already ends the FIRST line, and that is all the badge shows.
+        // A backgrounded grandchild keeps the pipe OPEN (`my-status &`), so `end`
+        // never fired and the badge waited out the whole timeout on every tick.
+        child.stdout?.on('data', (c) => {
+            if (String(c).includes(String.fromCharCode(10))) {
+                clearTimeout(timer);
+                finish();
+            }
+        });
         child.on('close', () => {
             clearTimeout(timer);
             finish();

package/dist/transcript.js

@@ -129,10 +129,15 @@ export class Transcript {
             const safeName = String(sessionName)
                 .replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_')
                 .trim() || 'session';
+            // The stamp and the `-`/`.jsonl` suffix take ~40 bytes of the 255-byte
+            // NAME limit: a deeply nested project path produced an over-long file
+            // name, the stream failed with ENAMETOOLONG and the WHOLE run had no
+            // transcript. Cap the label, keeping its head.
+            const cappedName = safeName.slice(0, 120);
             // Rotation BEFORE the create: the new file then has the newest stamp,
             // so the current run's transcript is never a deletion candidate.
             rotateTranscripts(dir);
-            this.file = path.join(dir, `${safeName}-${stamp}.jsonl`);
+            this.file = path.join(dir, `${cappedName}-${stamp}.jsonl`);
             this.stream = fs.createWriteStream(this.file, { flags: 'a' });
             // Write errors (disk full, file deleted, etc.) arrive as an 'error'
             // event; without a listener this is an uncaught exception.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.8",
+  "version": "2.96.10",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {