zames_pro 2.96.9 → 2.96.11

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.96.11] - 2026-11-06
+
+### Fixed
+
+- **prompt:** delete a whole code point in the forward-Delete branch
+- **completion-check:** treat extension-less build files as runnable artifacts
+- **login:** classify a guest page with a captcha as a challenge
+- **compact:** keep the message count in an empty-fallback reason
+- **restore-history:** decode every JSON escape in one pass so a doubled backslash keeps the next escape
+
+## [2.96.10] - 2026-11-06
+
+### Fixed
+
+- **export:** keep a tool result on one line and mark a clipped one
+- **config:** validate a live store value before writing it
+- **config:** an unknown language is rejected instead of silently defaulted
+- **config:** a password keeps its spaces when set from the command line
+- **transcript:** cap the session label so the file name fits the filesystem
+
 ## [2.96.9] - 2026-11-06
 
 ### Fixed

package/dist/browser-login.js

@@ -175,10 +175,13 @@ export function classifyLoginProbe(input) {
     const role = String(input.role || '').toLowerCase();
     if (role === 'user' || role === 'admin')
         return 'in';
-    if (role === 'guest')
-        return input.signInVisible ? 'out' : 'in';
+    // A captcha is the site asking for a HUMAN: a guest page that renders one is
+    // NOT a usable session (the visible-window flow exists for exactly this), so
+    // it must be classified before the guest shortcut below.
     if (input.captcha)
         return 'challenge';
+    if (role === 'guest')
+        return input.signInVisible ? 'out' : 'in';
     if (input.hasToken === true)
         return 'in';
     if (input.hasToken === false)

package/dist/commands.js

@@ -299,10 +299,17 @@ export function formatExport(entries, meta = {}) {
                 JSON.stringify(e.args ?? {}));
         }
         else if (type === 'tool_result') {
+            // A tool result is TEXT: a newline in it started a bare report line and
+            // broke the one-line list. Flatten it, and MARK a clipped result so the
+            // export does not look like the whole output.
+            const raw = String(e.result ?? '');
+            const flat = raw.split(/\s*\r?\n\s*/).join(' ↵ ');
+            const clipped = clipExportText(flat, 500);
             out.push(' -> ' +
                 String(e.tool ?? '?') +
                 ': ' +
-                clipExportText(String(e.result ?? ''), 500));
+                clipped +
+                (clipped.length < flat.length ? ' …' : ''));
         }
         else if (type === 'assistant_final') {
             out.push('## Answer');

package/dist/compact.js

@@ -143,7 +143,9 @@ export async function performCompact(opts) {
                 // The reason must be ACTIONABLE: a model error, a BLOCKED history
                 // fetch (auth/HTTP) and a TOO-SHORT history end here, and a bare
                 // "unknown" hides which one it was.
-                const err = summaryErr
+                // A model error is reported verbatim: it already names the cause.
+                const unusableReply = !!summaryErr && /^\s*[\[\{]/.test(summaryErr);
+                const err = summaryErr && !unusableReply
                     ? summaryErr
                     : histErr
                         ? t('compact.summary_failed', { v: histErr })
@@ -152,8 +154,10 @@ export async function performCompact(opts) {
                                 ' (' +
                                 historyLen +
                                 ')'
-                            : t('compact.summary_failed', { v: 'history too short' });
-                ' (' + historyLen + ')';
+                            : t('compact.summary_failed', { v: 'history too short' }) +
+                                ' (' +
+                                historyLen +
+                                ')';
                 log(t('compact.summary_failed', { v: err }));
                 return {
                     ok: false,

package/dist/completion-check.js

@@ -34,12 +34,27 @@ const RUNNABLE_EXT = new Set([
     '.php',
     '.css',
 ]);
+// Extension-LESS build artifacts: they are executable "does it run" targets
+// just like a script, and they were the one family the guard silently skipped
+// (a written Makefile/Dockerfile and an answer DONE with no Bash call in
+// between is exactly the live failure this module exists for).
+const RUNNABLE_NAMES = new Set([
+    'makefile',
+    'gnumakefile',
+    'dockerfile',
+    'containerfile',
+    'build.ninja',
+    'justfile',
+]);
 export function isRunnablePath(p) {
     if (!p)
         return false;
     const lower = p.toLowerCase();
+    const base = lower.slice(lower.lastIndexOf('/') + 1);
+    if (RUNNABLE_NAMES.has(base))
+        return true;
     const dot = lower.lastIndexOf('.');
-    if (dot < 0)
+    if (dot < 0 || dot < lower.lastIndexOf('/'))
         return false;
     return RUNNABLE_EXT.has(lower.slice(dot));
 }

package/dist/config-command.js

@@ -8,6 +8,7 @@
 // The interactive menu (`/config` bare or `menu`) is delegated to openMenu()
 // because it pauses the editor and reads keys itself.
 import { theme } from './theme.js';
+import { isLocale } from './i18n.js';
 import { configGetValue, configValueHint } from './config-commands.js';
 /**
  * Handle a `/config <sub>` text command. Never throws for a bad subcommand or
@@ -65,6 +66,18 @@ export async function handleConfigCommand(input, deps) {
         const field = schema.find((f) => f.path === 'ui.locale');
         if (!field)
             return;
+        // `normalizeLocale` FALLS BACK to the default for anything it does not
+        // understand, so `/config lang xx` silently SAVED English and reported it
+        // as set — the operator's typo was accepted. Reject an unknown value.
+        const normalized = String(val).trim().toLowerCase();
+        if (!isLocale(normalized) &&
+            !['russian', 'русский', 'english', 'английский'].includes(normalized)) {
+            printErr(theme.error(t('cfg.bad_value', {
+                v: 'ui.locale',
+                type: configValueHint(field, t),
+            })));
+            return;
+        }
         const loc = normalizeLocale(val);
         try {
             setValue(field, loc);
@@ -94,7 +107,16 @@ export async function handleConfigCommand(input, deps) {
     }
     if (sub === 'set') {
         const key = parts[2];
-        const raw = parts.slice(3).join(' ');
+        // A password/username is a SECRET: it may legally contain repeated,
+        // leading or trailing spaces, and joining the tokens with ONE space
+        // silently changed it (auto-login then failed with "wrong password").
+        // Take the text after the key VERBATIM for those fields.
+        const isSecret = /(password|username)\/?$/i.test(key || '');
+        const raw = isSecret
+            ? String(input)
+                .replace(/^\s*\/config\s+set\s+\S+\s?/i, '')
+                .replace(/\s+$/, '')
+            : parts.slice(3).join(' ');
         const field = schema.find((f) => f.path === key);
         if (!field) {
             printErr(theme.error(t('cfg.unknown_key', { v: key || '' })));

package/dist/config-live.js

@@ -59,16 +59,37 @@ export function applyBrowserLiveConfig(path, value, browser) {
  *  their config at construction, so a change must be written to the instance
  *  too. */
 export function applyStoreLiveConfig(path, value, stores) {
+    // The browser map VALIDATES its values; these stores were written blindly,
+    // so a negative `maxBackups` (rejected by the schema) or a string could
+    // reach a live store and change retention silently.
+    const isCount = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    const isBool = (v) => typeof v === 'boolean';
     if (path === 'undo.enabled' || path === 'undo.maxBackups') {
         if (!stores.undo)
             return false;
-        stores.undo[path === 'undo.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'undo.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.undo.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.undo.maxBackups = value;
         return true;
     }
     if (path === 'checkpoint.enabled' || path === 'checkpoint.maxBackups') {
         if (!stores.checkpoints)
             return false;
-        stores.checkpoints[path === 'checkpoint.enabled' ? 'enabled' : 'maxBackups'] = value;
+        if (path === 'checkpoint.enabled') {
+            if (!isBool(value))
+                return false;
+            stores.checkpoints.enabled = value;
+            return true;
+        }
+        if (!isCount(value))
+            return false;
+        stores.checkpoints.maxBackups = value;
         return true;
     }
     return false;

package/dist/prompt.js

@@ -200,9 +200,23 @@ export async function promptOnce(question) {
                         continue;
                     }
                     if (rest.startsWith('[3~')) {
-                        // Delete.
+                        // Delete removes a CODE POINT, not one UTF-16 unit: in front of an
+                        // emoji a unit-sized cut left the LOW surrogate in the line — a
+                        // broken code point the caller received as its answer (same rule
+                        // as the Backspace branch above). A unit cut is only safe OFF a
+                        // surrogate: inside a PAIR it must move to the pair's start first.
                         if (cursor < line.length) {
-                            line = line.slice(0, cursor) + line.slice(cursor + 1);
+                            const at = line.charCodeAt(cursor);
+                            if (at >= 0xdc00 && at <= 0xdfff)
+                                cursor--;
+                            const next = line.charCodeAt(cursor);
+                            const follow = cursor + 1 < line.length ? line.charCodeAt(cursor + 1) : 0;
+                            const pair = next >= 0xd800 &&
+                                next <= 0xdbff &&
+                                follow >= 0xdc00 &&
+                                follow <= 0xdfff;
+                            const cut = cursor + (pair ? 2 : 1);
+                            line = line.slice(0, cursor) + line.slice(cut);
                             redraw();
                         }
                         s = s.slice(3);

package/dist/restore-history.js

@@ -56,12 +56,32 @@ export function parseAssistantToolCall(text) {
 export function unescapeJsonString(s) {
     // A `\uD800`-style escape that is NOT followed by a low surrogate (a
     // truncated or hand-written payload) would become a LONE surrogate - a
-    // broken code point the restored dialogue prints as `?`. Decode a valid PAIR
-    // as one code point and drop an unpaired half.
+    // broken code point the restored dialogue prints as `?`. Decode a valid
+    // PAIR as one code point and drop an unpaired half.
+    //
+    // ONE pass for EVERY escape family: `\\` is consumed before the simple
+    // escapes (`\n`, `\t`, ...) look at the second half of a DOUBLED
+    // backslash. JSON stores a literal backslash before `n` (`C:\\notes`,
+    // a printed `\n`) as `\\\\n`; decoding `\n` first turned that pair
+    // into a real LINE BREAK and lost the backslash, reflowing the restored
+    // answer.
     let pendingHigh = '';
-    return String(s || '')
-        .replace(/\\u([0-9a-fA-F]{4})/g, (_x, h) => {
-        const cp = parseInt(h, 16);
+    return String(s || '').replace(/\\(?:u([0-9a-fA-F]{4})|([nrt"\\]))/g, (_m, hex, ch) => {
+        if (!hex) {
+            if (ch === 'n')
+                return NL;
+            if (ch === 'r')
+                return String.fromCharCode(13);
+            if (ch === 't')
+                return String.fromCharCode(9);
+            if (ch === '"')
+                return '"';
+            pendingHigh = '';
+            return '\\';
+        }
+        const cp = parseInt(hex, 16);
+        // A valid PAIR is one code point; an UNPAIRED half is dropped (it
+        // would print as `?`).
         if (cp >= 0xd800 && cp <= 0xdbff) {
             pendingHigh = String.fromCharCode(cp);
             return '';
@@ -73,12 +93,7 @@ export function unescapeJsonString(s) {
         }
         pendingHigh = '';
         return String.fromCharCode(cp);
-    })
-        .replace(/\\n/g, NL)
-        .replace(/\\r/g, String.fromCharCode(13))
-        .replace(/\\t/g, String.fromCharCode(9))
-        .replace(/\\"/g, '"')
-        .replace(/\\\\/g, '\\');
+    });
 }
 /**
  * Normalize one restored message for display:

package/dist/transcript.js

@@ -129,10 +129,15 @@ export class Transcript {
             const safeName = String(sessionName)
                 .replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_')
                 .trim() || 'session';
+            // The stamp and the `-`/`.jsonl` suffix take ~40 bytes of the 255-byte
+            // NAME limit: a deeply nested project path produced an over-long file
+            // name, the stream failed with ENAMETOOLONG and the WHOLE run had no
+            // transcript. Cap the label, keeping its head.
+            const cappedName = safeName.slice(0, 120);
             // Rotation BEFORE the create: the new file then has the newest stamp,
             // so the current run's transcript is never a deletion candidate.
             rotateTranscripts(dir);
-            this.file = path.join(dir, `${safeName}-${stamp}.jsonl`);
+            this.file = path.join(dir, `${cappedName}-${stamp}.jsonl`);
             this.stream = fs.createWriteStream(this.file, { flags: 'a' });
             // Write errors (disk full, file deleted, etc.) arrive as an 'error'
             // event; without a listener this is an uncaught exception.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.96.9",
+  "version": "2.96.11",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {