zames_pro 2.96.9 → 2.96.10

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.10] - 2026-11-06
+
+### Fixed
+
+- **export:** keep a tool result on one line and mark a clipped one
+- **config:** validate a live store value before writing it
+- **config:** an unknown language is rejected instead of silently defaulted
+- **config:** a password keeps its spaces when set from the command line
+- **transcript:** cap the session label so the file name fits the filesystem
+
 ## [2.96.9] - 2026-11-06
 
 ### Fixed

package/dist/commands.js

@@ -299,10 +299,17 @@ export function formatExport(entries, meta = {}) {
                 JSON.stringify(e.args ?? {}));
         }
         else if (type === 'tool_result') {
+            // A tool result is TEXT: a newline in it started a bare report line and
+            // broke the one-line list. Flatten it, and MARK a clipped result so the
+            // export does not look like the whole output.
+            const raw = String(e.result ?? '');
+            const flat = raw.split(/\s*\r?\n\s*/).join(' ↵ ');
+            const clipped = clipExportText(flat, 500);
             out.push(' -> ' +
                 String(e.tool ?? '?') +
                 ': ' +
-                clipExportText(String(e.result ?? ''), 500));
+                clipped +
+                (clipped.length < flat.length ? ' …' : ''));
         }
         else if (type === 'assistant_final') {
             out.push('## Answer');

package/dist/config-command.js

@@ -8,6 +8,7 @@
 // The interactive menu (`/config` bare or `menu`) is delegated to openMenu()
 // because it pauses the editor and reads keys itself.
 import { theme } from './theme.js';
+import { isLocale } from './i18n.js';
 import { configGetValue, configValueHint } from './config-commands.js';
 /**
  * Handle a `/config <sub>` text command. Never throws for a bad subcommand or
@@ -65,6 +66,18 @@ export async function handleConfigCommand(input, deps) {
         const field = schema.find((f) => f.path === 'ui.locale');
         if (!field)
             return;
+        // `normalizeLocale` FALLS BACK to the default for anything it does not
+        // understand, so `/config lang xx` silently SAVED English and reported it
+        // as set — the operator's typo was accepted. Reject an unknown value.
+        const normalized = String(val).trim().toLowerCase();
+        if (!isLocale(normalized) &&
+            !['russian', 'русский', 'english', 'английский'].includes(normalized)) {
+            printErr(theme.error(t('cfg.bad_value', {
+                v: 'ui.locale',
+                type: configValueHint(field, t),
+            })));
+            return;
+        }
         const loc = normalizeLocale(val);
         try {
             setValue(field, loc);
@@ -94,7 +107,16 @@ export async function handleConfigCommand(input, deps) {
     }
     if (sub === 'set') {
         const key = parts[2];
-        const raw = parts.slice(3).join(' ');
+        // A password/username is a SECRET: it may legally contain repeated,
+        // leading or trailing spaces, and joining the tokens with ONE space
+        // silently changed it (auto-login then failed with "wrong password").
+        // Take the text after the key VERBATIM for those fields.
+        const isSecret = /(password|username)\/?$/i.test(key || '');
+        const raw = isSecret
+            ? String(input)
+                .replace(/^\s*\/config\s+set\s+\S+\s?/i, '')
+                .replace(/\s+$/, '')
+            : parts.slice(3).join(' ');
         const field = schema.find((f) => f.path === key);
         if (!field) {
             printErr(theme.error(t('cfg.unknown_key', { v: key || '' })));

package/dist/config-live.js

@@ -59,16 +59,37 @@ export function applyBrowserLiveConfig(path, value, browser) {
  *  their config at construction, so a change must be written to the instance
  *  too. */
 export function applyStoreLiveConfig(path, value, stores) {
+    // The browser map VALIDATES its values; these stores were written blindly,
+    // so a negative `maxBackups` (rejected by the schema) or a string could
+    // reach a live store and change retention silently.
+    const isCount = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    const isBool = (v) => typeof v === 'boolean';
     if (path === 'undo.enabled' || path === 'undo.maxBackups') {
         if (!stores.undo)
             return false;
-        stores.undo[path === 'undo.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'undo.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.undo.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.undo.maxBackups = value;
         return true;
     }
     if (path === 'checkpoint.enabled' || path === 'checkpoint.maxBackups') {
         if (!stores.checkpoints)
             return false;
-        stores.checkpoints[path === 'checkpoint.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'checkpoint.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.checkpoints.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.checkpoints.maxBackups = value;
         return true;
     }
     return false;

package/dist/transcript.js

@@ -129,10 +129,15 @@ export class Transcript {
             const safeName = String(sessionName)
                 .replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_')
                 .trim() || 'session';
+            // The stamp and the `-`/`.jsonl` suffix take ~40 bytes of the 255-byte
+            // NAME limit: a deeply nested project path produced an over-long file
+            // name, the stream failed with ENAMETOOLONG and the WHOLE run had no
+            // transcript. Cap the label, keeping its head.
+            const cappedName = safeName.slice(0, 120);
             // Rotation BEFORE the create: the new file then has the newest stamp,
             // so the current run's transcript is never a deletion candidate.
             rotateTranscripts(dir);
-            this.file = path.join(dir, `${safeName}-${stamp}.jsonl`);
+            this.file = path.join(dir, `${cappedName}-${stamp}.jsonl`);
             this.stream = fs.createWriteStream(this.file, { flags: 'a' });
             // Write errors (disk full, file deleted, etc.) arrive as an 'error'
             // event; without a listener this is an uncaught exception.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.9",
+  "version": "2.96.10",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {