zames_pro 2.53.1 → 2.55.0

package/README.md

@@ -90,6 +90,9 @@ The prompt is a small line editor with persistent history:
   delete the word before the cursor, `Ctrl+←`/`Ctrl+→` — move by words.
 - `\` + `Enter`, `Ctrl+J`, `Ctrl+Enter` or `Shift+Enter` — insert a newline.
 - `/` + `Tab` — slash-command hints and completion.
+- `!command` — run a shell command directly, bypassing the model (like
+  Claude Code's bash mode). The same sandbox guard as the `Bash` tool applies,
+  so a direct command cannot leave the project either.
 
 Set `NO_COLOR=1` to disable colors (a calm default palette is used otherwise).
 
@@ -160,8 +163,6 @@ Codex CLI:
 - /export [file] — write the session transcript to a Markdown file
   (zames-export-<stamp>.md by default).
 - /doctor — diagnose node, git, config, browser, clipboard and MCP.
-- /permissions — show the confirmation settings (Write/Edit/Bash + the
-  alwaysConfirm regex list).
 - /add-dir <path> — validate an extra directory (the sandbox is fixed at
   startup; relaunch with --dir to write there).
 - /resume <n> (after /chats) and /resume-id <id> — open a chat and PRINT its
@@ -207,7 +208,8 @@ workflows from your repository and from `~/.zames`.
   will explore the project and write an AGENTS.md based on the real build/test
   commands and conventions (use `/init --force` to overwrite an existing file).
 - **MEMORY.md** — durable notes that persist between sessions. The agent
-  appends useful facts here; you can edit it by hand.
+  appends useful facts here; you can edit it by hand, or add one from the
+  prompt with `/remember <text>`.
 - **Skills** — a folder with a `SKILL.md` file (YAML frontmatter: `name`,
   `description`, optional `allowed-tools`, `user-invokable`) plus any helper
   files. Discovered under `.zames/skills/`, `.claude/skills/`,
@@ -223,6 +225,7 @@ Skills and custom commands show up in the «/» completion list and in `/help`.
 ```
 /skills                       list discovered skills
 /memory                       show AGENTS.md / MEMORY.md in effect
+/remember <text>              append a durable note to MEMORY.md
 /init [--force]               analyze the project and create AGENTS.md
 ```
 
@@ -286,7 +289,6 @@ Examples:
 
 ```
 /config set maxIterations 20
-/config set confirmation.bash false
 /config set browser.deepThinking true   # DeepSeek Deep thinking (slow; reasoning is hidden)
 /config set browser.webSearch false     # DeepSeek Smart web search
 /config lang en

package/dist/commands.js

@@ -2,7 +2,7 @@ import path from 'path';
 import { isImageName } from './attachments.js';
 import { translate } from './i18n.js';
 // Helpers for the extra slash commands (/diff, /cost, /export, /doctor,
-// /permissions, /review, /add-dir). Pure functions, unit-tested without a
+// /review, /add-dir). Pure functions, unit-tested without a
 // live agent/browser. index.ts only renders their output.
 const NL = String.fromCharCode(10);
 const CR = String.fromCharCode(13);
@@ -234,22 +234,6 @@ export function renderDoctor(d, t = translate('en')) {
     }
     return t('doctor.title') + NL + rows.join(NL);
 }
-export function renderPermissions(p, t = translate('en')) {
-    const onoff = (b) => (b ? t('perm.ask') : t('perm.allow'));
-    const lines = [];
-    lines.push(t('perm.title'));
-    lines.push(t('perm.write', { v: onoff(p.write) }));
-    lines.push(t('perm.edit', { v: onoff(p.edit) }));
-    lines.push(t('perm.bash', { v: onoff(p.bash) }));
-    if (p.alwaysConfirm.length) {
-        lines.push(t('perm.always'));
-        for (const re of p.alwaysConfirm)
-            lines.push(' ' + re);
-    }
-    lines.push('');
-    lines.push(t('perm.change_hint'));
-    return lines.join(NL);
-}
 // ---------- /add-dir ----------
 export function resolveExtraDir(input, workdir, t = translate('en')) {
     const raw = String(input ?? '').trim();
@@ -488,9 +472,10 @@ export function hasQueuedJob(queue, jobId) {
 // True when the queued message is a slash-command. It must NOT be merged into
 // a task: the main loop has to execute it (e.g. /compact, /new).
 export function isSlashCommand(text) {
-    return String(text ?? '')
-        .trim()
-        .startsWith('/');
+    const s = String(text ?? '').trim();
+    // `!command` is also an operator command (run the shell directly) — it
+    // must NOT be batched into a task sent to the model.
+    return s.startsWith('/') || s.startsWith('!');
 }
 export function parseLiveToggle(text) {
     const m = /^\/(thinking|web|websearch|search)(?:\s+(\S+))?\s*$/i.exec(String(text ?? '').trim());

package/dist/config.js

@@ -24,21 +24,6 @@ export const DEFAULTS = {
     headless: true,
     debug: false,
     browserChannel: null,
-    confirmation: {
-        write: true,
-        edit: true,
-        bash: true,
-        alwaysConfirm: [
-            'rm\s+-rf',
-            'rmdir\s+/s',
-            'del\s+/[sqf]',
-            'format\s+[a-z]:',
-            'shutdown',
-            'reg\s+delete',
-            'remove-item.*-recurse',
-            'git\s+push\s+--force',
-        ],
-    },
     undo: {
         enabled: true,
         maxBackups: 200,
@@ -169,24 +154,6 @@ export const CONFIG_SCHEMA = [
         labelKey: 'cfg.f.hotReload',
         groupKey: 'cfg.group.agent',
     },
-    {
-        path: 'confirmation.write',
-        type: 'boolean',
-        labelKey: 'cfg.f.confirmation_write',
-        groupKey: 'cfg.group.confirmation',
-    },
-    {
-        path: 'confirmation.edit',
-        type: 'boolean',
-        labelKey: 'cfg.f.confirmation_edit',
-        groupKey: 'cfg.group.confirmation',
-    },
-    {
-        path: 'confirmation.bash',
-        type: 'boolean',
-        labelKey: 'cfg.f.confirmation_bash',
-        groupKey: 'cfg.group.confirmation',
-    },
     {
         path: 'undo.enabled',
         type: 'boolean',

package/dist/i18n.js

@@ -135,6 +135,10 @@ export const CATALOG = {
         ru: 'Esc, Ctrl+C              прервать текущую генерацию',
         en: 'Esc, Ctrl+C               abort current generation',
     },
+    'help.key.bang': {
+        ru: '!команда                  выполнить shell-команду напрямую (мимо модели)',
+        en: '!command                  run a shell command directly (bypass the model)',
+    },
     'help.commands': { ru: 'Обычные команды:', en: 'Commands:' },
     'help.cmd.new': {
         ru: '/new, /clear             новый чат (сброс контекста)',
@@ -205,10 +209,6 @@ export const CATALOG = {
         ru: '/doctor диагностика установки и конфига',
         en: '/doctor diagnose install and config',
     },
-    'help.cmd.permissions': {
-        ru: '/permissions настройки подтверждений',
-        en: '/permissions confirmation settings',
-    },
     'help.cmd.add_dir': {
         ru: '/add-dir <path> проверить директорию',
         en: '/add-dir <path> validate a directory',
@@ -393,6 +393,14 @@ export const CATALOG = {
         en: 'Instructions (AGENTS.md):',
     },
     'memory.memory': { ru: 'Память (MEMORY.md):', en: 'Memory (MEMORY.md):' },
+    'remember.usage': {
+        ru: 'Использование: /remember <текст заметки>',
+        en: 'Usage: /remember <note text>',
+    },
+    'remember.saved': {
+        ru: '🧠 Заметка добавлена в {v}',
+        en: '🧠 Note appended to {v}',
+    },
     'init.exists': {
         ru: 'AGENTS.md уже существует: {v}',
         en: 'AGENTS.md already exists: {v}',
@@ -424,6 +432,10 @@ export const CATALOG = {
         ru: '/memory                  показать MEMORY.md и AGENTS.md',
         en: '/memory                  show MEMORY.md and AGENTS.md',
     },
+    'help.cmd.remember': {
+        ru: '/remember <текст>        дописать заметку в MEMORY.md',
+        en: '/remember <text>         append a note to MEMORY.md',
+    },
     'help.cmd.init': {
         ru: '/init [--force]          изучить проект и создать AGENTS.md',
         en: '/init [--force]          analyze the project and create AGENTS.md',
@@ -607,6 +619,14 @@ export const CATALOG = {
         en: 'Unknown command: {v}. Type /help.',
     },
     'msg.bye': { ru: 'Выход.', en: 'Bye.' },
+    'shell.empty': {
+        ru: 'После ! нужна команда, например !git status.',
+        en: 'A command is required after !, e.g. !git status.',
+    },
+    'shell.running': {
+        ru: 'выполняю shell-команду...',
+        en: 'running shell command...',
+    },
     'msg.exit_summary': {
         ru: 'Транскрипт: {transcript} · чат: {chat}',
         en: 'Transcript: {transcript} · chat: {chat}',
@@ -722,24 +742,6 @@ export const CATALOG = {
         ru: 'UA ещё не закэширован (первый запуск перезапустится один раз)',
         en: 'no cached UA yet (first start relaunches once)',
     },
-    // ---------- /permissions ----------
-    'perm.title': {
-        ru: 'Права инструментов (настройки подтверждений):',
-        en: 'Tool permissions (confirmation settings):',
-    },
-    'perm.write': { ru: ' Write: {v}', en: ' Write: {v}' },
-    'perm.edit': { ru: ' Edit: {v}', en: ' Edit: {v}' },
-    'perm.bash': { ru: ' Bash: {v}', en: ' Bash: {v}' },
-    'perm.ask': { ru: 'спрашивать', en: 'ask' },
-    'perm.allow': { ru: 'разрешить', en: 'allow' },
-    'perm.always': {
-        ru: ' Всегда подтверждать (regex):',
-        en: ' Always confirm (regex):',
-    },
-    'perm.change_hint': {
-        ru: 'Изменить: /config set confirmation.write false (и .edit / .bash)',
-        en: 'Change with: /config set confirmation.write false (and .edit / .bash)',
-    },
     // ---------- /add-dir ----------
     'adddir.usage': {
         ru: 'Использование: /add-dir <path>',
@@ -1213,7 +1215,6 @@ export const CATALOG = {
     // ---------- config menu ----------
     'cfg.group.ui': { ru: 'Интерфейс', en: 'Interface' },
     'cfg.group.agent': { ru: 'Агент', en: 'Agent' },
-    'cfg.group.confirmation': { ru: 'Подтверждения', en: 'Confirmations' },
     'cfg.group.undo': { ru: 'Откат (undo)', en: 'Undo' },
     'cfg.group.transcript': { ru: 'Транскрипт', en: 'Transcript' },
     'cfg.group.browser': { ru: 'Браузер / DeepSeek', en: 'Browser / DeepSeek' },
@@ -1242,18 +1243,6 @@ export const CATALOG = {
         ru: 'Авто-перечитывание модулей перед задачей',
         en: 'Auto-reload logic modules before each task',
     },
-    'cfg.f.confirmation_write': {
-        ru: 'Спрашивать перед Write',
-        en: 'Ask before Write',
-    },
-    'cfg.f.confirmation_edit': {
-        ru: 'Спрашивать перед Edit',
-        en: 'Ask before Edit',
-    },
-    'cfg.f.confirmation_bash': {
-        ru: 'Спрашивать перед Bash',
-        en: 'Ask before Bash',
-    },
     'cfg.f.undo_enabled': {
         ru: 'Включить бэкапы для отката',
         en: 'Enable undo backups',
@@ -1493,8 +1482,8 @@ export const CATALOG = {
         en: 'Config write scope: {v} ({file})',
     },
     'cfg.scope_usage': {
-        ru: 'Использование: /config scope <project|home>. project = .zamesrc.json (в git), home = ~/.zames/. Для личных настроек (confirmations) выбери home, чтобы не коммитить их.',
-        en: 'Usage: /config scope <project|home>. project = .zamesrc.json (committed), home = ~/.zames/. Use home for personal settings (confirmations) so they are not committed.',
+        ru: 'Использование: /config scope <project|home>. project = .zamesrc.json (в git), home = ~/.zames/. Для личных настроек выбери home, чтобы не коммитить их.',
+        en: 'Usage: /config scope <project|home>. project = .zamesrc.json (committed), home = ~/.zames/. Use home for personal settings so they are not committed.',
     },
     'cfg.scope_set': {
         ru: 'Запись конфига: {v} ({file})',

package/dist/index.js

@@ -18,11 +18,12 @@ import { translate, normalizeLocale, localeDisplayName, isLocale, } from './i18n
 import { Transcript } from './transcript.js';
 import { UndoStore } from './undo.js';
 import { selfReview, selfDiff, selfApply, selfList } from './self-review.js';
-import { formatDiff, diffGitArgs, parseTranscript, summarizeTranscript, renderCost, formatExport, defaultExportPath, renderDoctor, renderPermissions, resolveExtraDir, buildReviewPrompt, formatDuration, formatRelativeTime, trimRestoredMessages, RESTORED_HISTORY_LIMIT, mergeMessages, hasQueuedJob, isSlashCommand, parseQueueCommand, parseLiveToggle, parseGoalCommand, isLiveConfigCommand, withGoal, formatQueueList, ctrlCEscalation, } from './commands.js';
+import { formatDiff, diffGitArgs, parseTranscript, summarizeTranscript, renderCost, formatExport, defaultExportPath, renderDoctor, resolveExtraDir, buildReviewPrompt, formatDuration, formatRelativeTime, trimRestoredMessages, RESTORED_HISTORY_LIMIT, mergeMessages, hasQueuedJob, isSlashCommand, parseQueueCommand, parseLiveToggle, parseGoalCommand, isLiveConfigCommand, withGoal, formatQueueList, ctrlCEscalation, } from './commands.js';
 import { performCompact } from './compact.js';
 import { Scheduler, parseInterval, formatInterval, formatJobLine, parseCron, } from './scheduler.js';
 import { renderMarkdown, setAnswerWidth } from './markdown.js';
 import { closeWeb } from './web.js';
+import { assertCommandInsideRoot, runShell } from './shell.js';
 import { saveSession, loadLastSession, readSession, listSessions, sessionsDir, loadHistory, saveHistory, } from './sessions.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const NL = String.fromCharCode(10);
@@ -167,7 +168,6 @@ const RELOADABLE = [
     'self-review',
     'diff',
     'undo',
-    'confirm',
     'transcript',
     'spinner',
     'config',
@@ -309,6 +309,7 @@ ${theme.bold(t('help.while_working'))}
   ${t('help.key.backslash')}
   ${t('help.key.attach')}
   ${t('help.key.esc')}
+  ${t('help.key.bang')}
 
 ${theme.bold(t('help.commands'))}
   ${t('help.cmd.new')}
@@ -329,7 +330,6 @@ ${theme.bold(t('help.commands'))}
   ${t('help.cmd.cost')}
   ${t('help.cmd.export')}
   ${t('help.cmd.doctor')}
-  ${t('help.cmd.permissions')}
   ${t('help.cmd.add_dir')}
   ${t('help.cmd.review')}
   ${t('help.cmd.goal')}
@@ -343,6 +343,11 @@ ${theme.bold(t('help.commands'))}
   ${t('help.cmd.tasks')}
   ${t('help.cmd.config')}
   ${t('help.cmd.lang')}
+  ${t('help.cmd.skills')}
+  ${t('help.cmd.memory')}
+  ${t('help.cmd.remember')}
+  ${t('help.cmd.init')}
+  ${t('help.cmd.mcp')}
   ${t('help.cmd.debug_dom')}
   ${t('help.cmd.help')}
   ${t('help.cmd.exit')}
@@ -396,7 +401,6 @@ const SLASH_COMMANDS = [
     { name: '/cost', key: 'help.cmd.cost' },
     { name: '/export', key: 'help.cmd.export' },
     { name: '/doctor', key: 'help.cmd.doctor' },
-    { name: '/permissions', key: 'help.cmd.permissions' },
     { name: '/add-dir', key: 'help.cmd.add_dir' },
     { name: '/review', key: 'help.cmd.review' },
     { name: '/goal', key: 'help.cmd.goal' },
@@ -411,6 +415,7 @@ const SLASH_COMMANDS = [
     { name: '/config', key: 'help.cmd.config' },
     { name: '/skills', key: 'help.cmd.skills' },
     { name: '/memory', key: 'help.cmd.memory' },
+    { name: '/remember', key: 'help.cmd.remember' },
     { name: '/init', key: 'help.cmd.init' },
     { name: '/mcp', key: 'help.cmd.mcp' },
     { name: '/debug-dom', key: 'help.cmd.debug_dom' },
@@ -2153,6 +2158,36 @@ async function main() {
         const lower = trimmed.toLowerCase();
         if (['/exit', '/quit', 'exit', 'quit'].includes(lower))
             break;
+        // `!command` — run a shell command directly, without asking the model
+        // (like Claude Code's bash mode). The same sandbox guard as the Bash tool
+        // applies, so a direct command cannot leave the project either.
+        if (trimmed.startsWith('!')) {
+            const cmd = trimmed.slice(1).trim();
+            if (!cmd) {
+                console.error(theme.warn(t('shell.empty')));
+                continue;
+            }
+            try {
+                assertCommandInsideRoot(currentWorkdir, cmd);
+            }
+            catch (e) {
+                console.error(theme.error(e.message));
+                continue;
+            }
+            transcript.log('shell_command', { command: cmd });
+            if (editor)
+                editor.lock(t('shell.running'));
+            try {
+                const out = await runShell(currentWorkdir, cmd);
+                console.log(theme.system(out));
+                transcript.log('shell_result', { command: cmd, result: out });
+            }
+            finally {
+                if (editor)
+                    editor.unlock();
+            }
+            continue;
+        }
         if (lower === '/help' ||
             lower === 'help' ||
             lower.startsWith('/help ') ||
@@ -2771,6 +2806,34 @@ async function main() {
             show(t('memory.memory'), ctx.memory);
             continue;
         }
+        // `/remember <text>` — append a durable note to the project MEMORY.md.
+        // Claude Code has the same idea (# shortcut): a fact worth keeping across
+        // sessions is written to disk instead of living only in this chat. We
+        // write to the workdir's own MEMORY.md (the deepest file the loader reads)
+        // and create it when missing.
+        if (lower === '/remember' || lower.startsWith('/remember ')) {
+            const note = trimmed.slice('/remember'.length).trim();
+            if (!note) {
+                console.error(theme.warn(t('remember.usage')));
+                continue;
+            }
+            const memFile = path.join(currentWorkdir, 'MEMORY.md');
+            const stamp = new Date().toISOString().slice(0, 10);
+            let body;
+            try {
+                body = await fs.readFile(memFile, 'utf-8');
+            }
+            catch {
+                body = '# MEMORY\n\nDurable notes accumulated across sessions.\n';
+            }
+            if (body.length && !body.endsWith(NL))
+                body += NL;
+            body += NL + '- (' + stamp + ') ' + note + NL;
+            await fs.writeFile(memFile, body, 'utf-8');
+            transcript.log('remember', { note, file: memFile });
+            console.log(theme.assistant(t('remember.saved', { v: memFile })));
+            continue;
+        }
         if (lower === '/init' || lower.startsWith('/init ')) {
             const force = lower.includes('--force');
             const target = path.join(currentWorkdir, 'AGENTS.md');
@@ -3037,15 +3100,6 @@ async function main() {
             }, t)));
             continue;
         }
-        if (lower === '/permissions' || lower === '/allowed-tools') {
-            console.log(theme.system(renderPermissions({
-                write: config.confirmation.write,
-                edit: config.confirmation.edit,
-                bash: config.confirmation.bash,
-                alwaysConfirm: config.confirmation.alwaysConfirm,
-            }, t)));
-            continue;
-        }
         if (lower === '/add-dir' || lower.startsWith('/add-dir ')) {
             const arg = trimmed.slice('/add-dir'.length).trim();
             const res = resolveExtraDir(arg, currentWorkdir, t);

package/dist/input.js

@@ -1298,6 +1298,11 @@ export class LineEditor {
         // dots) and keep it running until toolResult()/assistant()/stop(). Esc now
         // really aborts the tool (the Bash child process is killed via the
         // AbortSignal), so the "Esc — стоп" hint is shown.
+        //
+        // The tool status is NOT a send phase: clear the lifecycle prefix first,
+        // otherwise the previous answer's "✓ done" sticks and the status reads
+        // "✓ done: running Bash" on one line.
+        this._sendState = '';
         this._startAnimated(translate(this.locale)('spinner.running_tool', { name }));
     }
     toolResult(result) {

package/dist/self-review.js

@@ -61,6 +61,45 @@ async function copyDirJsFiles(from, to) {
     }
     return copied;
 }
+// Root files and folders a review often needs but that are NOT part of the
+// editable src/ set (scripts, lint/ts configs). They are copied into a
+// read-only `_context/` subfolder so the reviewer can READ them while the
+// .ts-only diff/apply logic stays untouched (a stray edit here would never be
+// applied back and would only confuse the report).
+const CONTEXT_FILES = [
+    'package.json',
+    'eslint.config.js',
+    '.prettierrc',
+    'tsconfig.json',
+    'tsconfig.build.json',
+];
+async function copyContextFiles(srcDir, snapDir) {
+    const repoRoot = path.resolve(srcDir, '..');
+    const ctxDir = path.join(snapDir, '_context');
+    for (const rel of CONTEXT_FILES) {
+        const data = await fs
+            .readFile(path.join(repoRoot, rel), 'utf-8')
+            .catch(() => null);
+        if (data === null)
+            continue;
+        await ensureDir(ctxDir);
+        await fs.writeFile(path.join(ctxDir, rel), data, 'utf-8');
+    }
+    const scripts = await fs
+        .readdir(path.join(repoRoot, 'scripts'))
+        .catch(() => []);
+    if (scripts.length) {
+        await ensureDir(path.join(ctxDir, 'scripts'));
+        for (const f of scripts) {
+            const data = await fs
+                .readFile(path.join(repoRoot, 'scripts', f), 'utf-8')
+                .catch(() => null);
+            if (data === null)
+                continue;
+            await fs.writeFile(path.join(ctxDir, 'scripts', f), data, 'utf-8');
+        }
+    }
+}
 // ---------- /self-review ----------
 export async function selfReview({ browser, focus, transcript, locale, }) {
     const t = translator(locale);
@@ -74,12 +113,9 @@ export async function selfReview({ browser, focus, transcript, locale, }) {
         console.error(theme.error('\n✖ ' + t('self.no_src', { dir: SRC_DIR })));
         throw new Error(t('self.no_src_err'));
     }
-    // Copy package.json for context — so the agent sees the dependencies
-    try {
-        const pkg = await fs.readFile(path.resolve(SRC_DIR, '..', 'package.json'), 'utf-8');
-        await fs.writeFile(path.join(snapDir, 'package.json'), pkg, 'utf-8');
-    }
-    catch { }
+    // Copy root configs/scripts into a read-only _context/ subfolder so the
+    // reviewer can read them (the editable set stays .ts-only).
+    await copyContextFiles(SRC_DIR, snapDir);
     console.log(theme.system('\n' + t('self.snapshot', { dir: snapDir })));
     console.log(theme.system(t('self.files', { n: copied.length, list: copied.join(', ') })));
     console.log(theme.system(t('self.starting') + '\n'));
@@ -248,6 +284,8 @@ function buildReviewPrompt({ focus, snapDir, }) {
     return `You are a senior JavaScript/Node.js engineer. You are reviewing your own source code — a Playwright-based coding agent that talks to the DeepSeek web chat as an LLM backend.
 
 All source files are in your working directory: ${snapDir}
+Root configs and scripts (package.json, tsconfig, eslint, scripts/) are copied
+into the read-only _context/ subfolder there — read them when relevant.
 ${focusLine}
 ## Your job
 

package/dist/shell.js

@@ -0,0 +1,72 @@
+import { exec } from 'child_process';
+import path from 'path';
+// Shared shell runner for the Bash tool and the operator's `!command` escape.
+// Kept in its own module so both call sites use the SAME sandbox guard and the
+// SAME abort wiring; a second, ad-hoc runner would drift from the real one.
+// Sandbox (option A): don't let a shell command go above the project root.
+// This is a protective barrier, not full OS isolation.
+export function assertCommandInsideRoot(root, command) {
+    const cmd = String(command || '');
+    const cdRe = /(?:^|[;&|]|\s)(?:cd|pushd)\s+([^;&|]+)/gi;
+    let m;
+    while ((m = cdRe.exec(cmd))) {
+        const raw = m[1].trim();
+        if (!raw || raw === '-')
+            continue;
+        const target = path.resolve(root, raw);
+        const rel = path.relative(root, target);
+        if (rel.startsWith('..') || path.isAbsolute(rel)) {
+            throw new Error('Sandbox: leaving ' + root + ' is forbidden (cd ' + raw + ')');
+        }
+    }
+}
+export function runShell(workdir, command, timeout = 30_000, signal) {
+    return new Promise((resolve) => {
+        const options = {
+            cwd: workdir,
+            timeout,
+            maxBuffer: 1024 * 1024 * 8,
+            windowsHide: true,
+            env: { ...process.env },
+            // Abort the child process when the operator pressed Esc/Ctrl+C.
+            // Without it a long `npm test` kept running even after the stop.
+            signal,
+        };
+        if (process.platform === 'win32') {
+            options.shell = process.env.ComSpec || 'C:\\Windows\\System32\\cmd.exe';
+        }
+        else {
+            options.shell = '/bin/sh';
+        }
+        exec(command, options, (err, stdout, stderr) => {
+            const out = (stdout || '').toString();
+            const errStr = (stderr || '').toString();
+            if (!err) {
+                const combined = (out + errStr).trim();
+                resolve(combined || '(command produced no output)');
+                return;
+            }
+            const parts = [];
+            if (err.killed) {
+                parts.push('\u23f1 Timeout after ' + timeout + 'ms \u2014 process killed.');
+            }
+            else if (err.code === 'ABORT_ERR') {
+                parts.push('(aborted by the operator)');
+            }
+            else if (err.code !== undefined && err.code !== null) {
+                parts.push('Exit code: ' + err.code);
+            }
+            else if (err.signal) {
+                parts.push('Killed by signal: ' + err.signal);
+            }
+            else {
+                parts.push('Error: ' + err.message);
+            }
+            if (out.trim())
+                parts.push('stdout:\n' + out.trim());
+            if (errStr.trim())
+                parts.push('stderr:\n' + errStr.trim());
+            resolve(parts.join('\n'));
+        });
+    });
+}

package/dist/tools.js

@@ -1,6 +1,6 @@
 import fs from 'fs/promises';
 import path from 'path';
-import { exec } from 'child_process';
+import { assertCommandInsideRoot, runShell } from './shell.js';
 import { createGitTools } from './gitTools.js';
 import { createWebTools } from './web.js';
 import { createExtraTools } from './extraTools.js';
@@ -20,71 +20,6 @@ export function createTools(workdir, { undo, todos } = {}) {
         }
         return resolved;
     };
-    // Sandbox (option A): don't let the command go above root.
-    // This is a protective barrier, not full OS isolation.
-    const assertCommandInsideRoot = (command) => {
-        const cmd = String(command || '');
-        const cdRe = /(?:^|[;&|]|\s)(?:cd|pushd)\s+([^;&|]+)/gi;
-        let m;
-        while ((m = cdRe.exec(cmd))) {
-            const raw = m[1].trim();
-            if (!raw || raw === '-')
-                continue;
-            const target = path.resolve(root, raw);
-            const rel = path.relative(root, target);
-            if (rel.startsWith('..') || path.isAbsolute(rel)) {
-                throw new Error('Sandbox: leaving ' + root + ' is forbidden (cd ' + raw + ')');
-            }
-        }
-    };
-    const runShell = (command, timeout = 30_000, signal) => new Promise((resolve) => {
-        const options = {
-            cwd: workdir,
-            timeout,
-            maxBuffer: 1024 * 1024 * 8,
-            windowsHide: true,
-            env: { ...process.env },
-            // Abort the child process when the operator pressed Esc/Ctrl+C.
-            // Without it a long `npm test` kept running even after the stop.
-            signal,
-        };
-        if (process.platform === 'win32') {
-            options.shell = process.env.ComSpec || 'C:\\Windows\\System32\\cmd.exe';
-        }
-        else {
-            options.shell = '/bin/sh';
-        }
-        exec(command, options, (err, stdout, stderr) => {
-            const out = (stdout || '').toString();
-            const errStr = (stderr || '').toString();
-            if (!err) {
-                const combined = (out + errStr).trim();
-                resolve(combined || '(command produced no output)');
-                return;
-            }
-            const parts = [];
-            if (err.killed) {
-                parts.push(`⏱ Timeout after ${timeout}ms — process killed.`);
-            }
-            else if (err.code === 'ABORT_ERR') {
-                parts.push('(aborted by the operator)');
-            }
-            else if (err.code !== undefined && err.code !== null) {
-                parts.push(`Exit code: ${err.code}`);
-            }
-            else if (err.signal) {
-                parts.push(`Killed by signal: ${err.signal}`);
-            }
-            else {
-                parts.push(`Error: ${err.message}`);
-            }
-            if (out.trim())
-                parts.push(`stdout:\n${out.trim()}`);
-            if (errStr.trim())
-                parts.push(`stderr:\n${errStr.trim()}`);
-            resolve(parts.join('\n'));
-        });
-    });
     // Extracts text from content/content_base64. base64 is needed because the
     // channel that delivers the model's answer may corrupt characters ($,
     // backslashes, newlines). base64 consists only of [A-Za-z0-9+/=] and is not
@@ -202,8 +137,8 @@ export function createTools(workdir, { undo, todos } = {}) {
                 'For git use the Git* tools. For the web use WebFetch / WebSearch.',
             parameters: { command: 'string', timeout: 'number?' },
             fn: async ({ command, timeout }, ctx) => {
-                assertCommandInsideRoot(req(command, 'command'));
-                return runShell(req(command, 'command'), timeout, ctx?.signal);
+                assertCommandInsideRoot(root, req(command, 'command'));
+                return runShell(workdir, req(command, 'command'), timeout, ctx?.signal);
             },
         },
         {
@@ -245,11 +180,11 @@ export function createTools(workdir, { undo, todos } = {}) {
                 if (process.platform === 'win32') {
                     const escaped = pat.replace(/"/g, '\\"');
                     const scope = searchPath ? '"' + target + '\\*' : '*';
-                    return runShell(`findstr /s /n /r /c:"${escaped}" ` + scope);
+                    return runShell(workdir, `findstr /s /n /r /c:"${escaped}" ` + scope);
                 }
                 const flags = mode === 'files_only' ? '-rlE' : mode === 'count' ? '-rcE' : '-rnE';
                 const includeArg = inc ? ' --include=' + JSON.stringify(inc) : '';
-                return runShell(`grep ${flags}${includeArg} ${JSON.stringify(pat)} ` +
+                return runShell(workdir, `grep ${flags}${includeArg} ${JSON.stringify(pat)} ` +
                     `${JSON.stringify(target)} || true`);
             },
         },

package/dist/web.js

@@ -1,4 +1,6 @@
 import { chromium } from 'playwright';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
 const DEFAULT_TIMEOUT = 20_000;
 const MAX_TEXT = 12_000;
 // Removes scripts, styles, and turns HTML into readable text.
@@ -42,6 +44,102 @@ function htmlToText(html) {
         .join('\n');
     return s;
 }
+// ---------- SSRF guard ----------
+//
+// WebFetch takes an arbitrary URL from the model. Without a guard it could be
+// talked into reading cloud metadata (169.254.169.254), internal admin panels
+// or localhost services. We resolve the hostname and refuse private / loopback
+// / link-local addresses. Best-effort: a DNS rebind between the check and the
+// fetch is out of scope for a CLI tool, but the common cases are covered.
+export function isPrivateIp(ip) {
+    const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const [a, b] = v4.slice(1).map(Number);
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local + cloud metadata
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        return false;
+    }
+    const low = ip.toLowerCase();
+    if (low === '::1' || low === '::')
+        return true;
+    if (low.startsWith('fe80') || low.startsWith('fc') || low.startsWith('fd')) {
+        return true;
+    }
+    const mapped = low.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mapped)
+        return isPrivateIp(mapped[1]);
+    return false;
+}
+export function isPrivateHostname(host) {
+    const h = host.toLowerCase().replace(/\.$/, '');
+    if (!h)
+        return true;
+    if (h === 'localhost' || h.endsWith('.localhost'))
+        return true;
+    if (h === 'metadata.google.internal')
+        return true;
+    return false;
+}
+async function assertPublicUrl(rawUrl) {
+    const u = new URL(rawUrl);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        throw new Error(`unsupported protocol: ${u.protocol}`);
+    }
+    const host = u.hostname;
+    if (isPrivateHostname(host)) {
+        throw new Error(`blocked private host: ${host}`);
+    }
+    if (isIP(host)) {
+        if (isPrivateIp(host))
+            throw new Error(`blocked private address: ${host}`);
+        return;
+    }
+    try {
+        const addrs = await lookup(host, { all: true });
+        for (const a of addrs) {
+            if (isPrivateIp(a.address)) {
+                throw new Error(`blocked private address for ${host}: ${a.address}`);
+            }
+        }
+    }
+    catch (e) {
+        // Re-throw our own block, but let a DNS failure fall through so fetch()
+        // surfaces the real network error instead of a misleading one.
+        if (e.message.startsWith('blocked'))
+            throw e;
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// fetch with retries for transient network errors and 5xx responses.
+async function httpFetchWithRetry(url, opts = {}, retries = 2) {
+    let lastErr;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const r = await httpFetch(url, opts);
+            if (r.status >= 500 && attempt < retries) {
+                await sleep(300 * 2 ** attempt);
+                continue;
+            }
+            return r;
+        }
+        catch (e) {
+            lastErr = e;
+            if (attempt < retries) {
+                await sleep(300 * 2 ** attempt);
+                continue;
+            }
+        }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+}
 // fetch with redirects and a timeout
 async function httpFetch(url, { timeout = DEFAULT_TIMEOUT, headers = {}, } = {}) {
     const ctrl = new AbortController();
@@ -126,12 +224,13 @@ export function createWebTools() {
                 }
                 const limit = Math.min(Number(maxChars) || MAX_TEXT, 60_000);
                 try {
+                    await assertPublicUrl(String(url));
                     if (render) {
                         const r = await renderWithHeadless(String(url));
                         const text = htmlToText(r.html);
                         return formatResult(r.status, r.url, text, limit);
                     }
-                    const r = await httpFetch(String(url));
+                    const r = await httpFetchWithRetry(String(url));
                     // If it's JSON/plain text — return as is
                     if (/application\/json|text\/plain|text\/markdown/i.test(r.contentType)) {
                         const trimmed = r.body.slice(0, limit);
@@ -168,7 +267,7 @@ export function createWebTools() {
                     return 'Error: query is empty.';
                 const limit = Math.min(Math.max(Number(maxResults) || 8, 1), 20);
                 try {
-                    const r = await httpFetch(`https://html.duckduckgo.com/html/?q=${q}`, {
+                    const r = await httpFetchWithRetry(`https://html.duckduckgo.com/html/?q=${q}`, {
                         timeout: 25_000,
                         headers: {
                             Accept: 'text/html,application/xhtml+xml',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.53.1",
+  "version": "2.55.0",
   "description": "Terminal coding agent over chat.deepseek.com via Playwright",
   "type": "module",
   "bin": {
@@ -40,6 +40,7 @@
   "engines": {
     "node": ">=20"
   },
+  "packageManager": "npm@11.19.0",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
     "chalk": "^5.3.0",

package/dist/confirm.js

@@ -1,105 +0,0 @@
-import * as readlinePromises from 'readline/promises';
-import { theme } from './theme.js';
-import { unifiedDiff, colorDiff } from './diff.js';
-import { translate, DEFAULT_LOCALE } from './i18n.js';
-export class ConfirmManager {
-    settings;
-    alwaysConfirm;
-    allowedForSession;
-    locale;
-    constructor({ config, locale = DEFAULT_LOCALE, } = {}) {
-        const c = config || {};
-        this.locale = locale;
-        this.settings = {
-            write: c.write !== false,
-            edit: c.edit !== false,
-            bash: c.bash !== false,
-        };
-        // An invalid operator-supplied regex must NEVER crash the run. Fall back to
-        // a literal substring match (case-insensitive) for that pattern.
-        this.alwaysConfirm = (c.alwaysConfirm || []).map((p) => {
-            try {
-                return new RegExp(p, 'i');
-            }
-            catch {
-                return new RegExp(escapeRegExp(p), 'i');
-            }
-        });
-        this.allowedForSession = new Set();
-    }
-    _matchesAlwaysConfirm(command) {
-        return this.alwaysConfirm.some((re) => re.test(command));
-    }
-    shouldAsk(kind, target = null) {
-        if (kind === 'bash' && target && this._matchesAlwaysConfirm(target)) {
-            return true;
-        }
-        if (!this.settings[kind])
-            return false;
-        if (this.allowedForSession.has(kind))
-            return false;
-        return true;
-    }
-    // Hot-update the language (from /config lang). The manager holds the locale
-    // so its prompt follows the interface language without a restart.
-    setLocale(locale) {
-        this.locale = locale;
-    }
-    async ask({ kind, target, preview = null, message, }) {
-        if (!this.shouldAsk(kind, target ?? null))
-            return true;
-        if (preview) {
-            console.log(preview);
-        }
-        const t = translate(this.locale);
-        const label = message || t('confirm.ask_label') + ' ' + kind + '?';
-        const question = theme.warn(`${label} `) +
-            theme.system('[') +
-            theme.assistant('y') +
-            theme.system(' = ' + t('common.yes') + ', ') +
-            theme.error('n') +
-            theme.system(' = ' + t('common.no') + ', ') +
-            theme.user('a') +
-            theme.system(' = ' + t('confirm.hint') + '] ');
-        const answer = await this._prompt(question);
-        if (answer === 'a') {
-            if (kind !== 'bash' || !this._matchesAlwaysConfirm(target ?? '')) {
-                this.allowedForSession.add(kind);
-            }
-            return true;
-        }
-        return answer === 'y';
-    }
-    async _prompt(question) {
-        process.stdin.resume();
-        if (process.stdin.isTTY && process.stdin.setRawMode) {
-            process.stdin.setRawMode(false);
-        }
-        const rl = readlinePromises.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        try {
-            const ans = await rl.question(question);
-            const v = (ans || '').trim().toLowerCase();
-            if (v === 'a' || v === 'always' || v === 'в')
-                return 'a';
-            if (v === 'y' || v === 'yes' || v === 'д' || v === 'да')
-                return 'y';
-            return 'n';
-        }
-        finally {
-            rl.close();
-        }
-    }
-}
-// Escape a string so it can be used as a literal regex (used when an
-// operator-supplied alwaysConfirm pattern is invalid and we fall back to a
-// substring match).
-function escapeRegExp(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, (m) => '\\' + m);
-}
-export function formatDiffPreview(oldText, newText, { label } = {}) {
-    const diff = unifiedDiff(oldText, newText, { label });
-    return colorDiff(diff);
-}